Review on covert channel detection methods of TCP/IP header

Abstract

A covert channel is any methodology of communication that’s acquainted illicitly transfer data, so breaking the security policy of a system. A network covert channel is a covert statement by hiding covert messages in to explicit network packets. Any shared resource will be probably used as a covert channel. In recent years with the growth of various hiding methods, network covert channel has become a new kind of intimidation for network security. A covert channel is an unplanned design within authentic communication whose axiom is to leak information as a part of undeveloped protocols. In fact, most detection systems can detect hidden data in the payload, but struggle to survive with data hidden in the IP and TCP packet headers. The huge number of protocols in internet seems ideal as a high-bandwidth vehicle for covert communication. Due to unwanted and malevolent nature of covert channel applications and as it poses a serious security threat to network, it is recommended to detect covert channels efficiently. This paper presents a criticism of TCP/IP covert channel design and their detection scheme and presents a proposed method based on Naive-Bayesian classifier to detect covert channels in TCP ISN and IP ID fields of TCP/IP packet.