DOI: 10.3217/jucs-025-11-1396

Authors: Steffen Wendzel, Florian Link, Daniela Eller, Wojciech Mazurczyk

Abstract: Network covert channels enable stealthy communications for malware and data exfiltration. For this reason, developing effective countermeasures for these threats is important for the protection of individuals and organizations. However, due to the large number of available covert channel techniques, it is considered impractical to develop countermeasures for all existing covert channels. In recent years, researchers started to develop countermeasures that (instead of only countering one particular hiding technique) can be applied to a whole family of similar hiding techniques. These families are referred to as hiding patterns. Considering above, the main contribution of this paper is to introduce the concept of countermeasure variation. Countermeasure variation is a slight modification of a given countermeasure that was designed to detect covert channels of one specific hiding pattern so that the countermeasure can also detect covert channels that are representing other hiding patterns. We exemplify countermeasure variation using the compressibility score, the ε-similarity and the regularity metric originally presented by Cabuk et al. All three methods are used to detect covert channels that utilize the Inter-packet Times pattern and we show that countermeasure variation allows the application of these countermeasures to detect covert channels of the Size Modulation pattern, too.

HTML

XML

PDF

DOI: 10.3217/jucs-024-05-0556

Authors: Ralf Keidel, Steffen Wendzel, Sebastian Zillien, Eric Conner, Georg Haas

Abstract: With the increasing number of steganography-capable malware and the increasing trend of stealthy data exfiltrations, network covert channels are becoming a crucial security threat - also for critical infrastructures (CIs): network covert channels enable the stealthy remote-control of malware nested in a CI and allow to exfiltrate sensitive data, such as sensor values, firmware or configuration parameters. We present WoDiCoF, a distributed testbed, accessible for the international research community to perform a unified evaluation of detection algorithms for network covert channels. In comparison to existing works, our testbed is designed for upcoming big- data scenarios, in which huge traffic recordings must be analyzed for covert channels. It is the first testbed to allow the testing of parallel detection algorithms. To evaluateWoDiCoF, we took a detection algorithm published in ACM CCS/TISSEC, verified several of the original results and enhanced the understanding of its performance by considering previously unconsidered parameters. By parallelizing the algorithm, we could moreover achieve a speed-up of 2.89 with three nodes.

HTML

XML

PDF

DOI: 10.3217/jucs-022-11-1456

Authors: Steffen Wendzel, Wojciech Mazurczyk, Sebastian Zander

Abstract: Until now hiding methods in network steganography have been described in arbitrary ways, making them difficult to compare. For instance, some publications describe classical channel characteristics, such as robustness and bandwidth, while others describe the embedding of hidden information. We introduce the first unified description of hiding methods in network steganography. Our description method is based on a comprehensive analysis of the existing publications in the domain. When our description method is applied by the research community, future publications will be easier to categorize, compare and extend. Our method can also serve as a basis to evaluate the novelty of hiding methods proposed in the future.

HTML

XML

PDF

DOI: 10.3217/jucs-021-12-1684

Authors: Steffen Wendzel, Carolin Palmer

Abstract: The research discipline of network steganography deals with the hiding of information within network transmissions, e.g. to transfer illicit information in networks with Internet censorship. The last decades of research on network steganography led to more than hundred techniques for hiding data in network transmissions. However, previous research has shown that most of these hiding techniques are either based on the same idea or introduce limited novelty, enabling the application of existing countermeasures. In this paper, we provide a link between the field of creativity and network steganographic research. We propose a framework and a metric to help evaluating the creativity bound to a given hiding technique. This way, we support two sides of the scientific peer review process as both authors and reviewers can use our framework to analyze the novelty and applicability of hiding techniques. At the same time, we contribute to a uniform terminology in network steganography.

HTML

XML

PDF

DOI: 10.3217/jucs-018-20-2748

Authors: Lutz Prechelt

Abstract: In September 1997, J.UCS published an article titled "Why we Need an Explicit Forum for Negative Results" [Prechelt, 1997]. It argued that when a plausible approach for solving a computer science or software engineering problem had failed to work out, it was silly for the scientific system not to publish the attempt iff a useful insight had been gained along the way nevertheless. Due to the strong bias of essentially all Computer Science publication venues towards "successful" research results, it was thus required to call for such negative results explicitly in order to avoid that those results would either be misleadingly disguised as successes or disappear in some closet. The article declared that J.UCS had thus agreed to create the "Forum for Negative Results (FNR)" as a permanent special section of J.UCS.

HTML

XML

PDF

DOI: 10.3217/jucs-015-08-1642

Authors: Matti Tedre

Abstract: Computing as a discipline is often characterized as a combination of three major traditions: theoretical, scientific, and engineering tradition. Although the three traditions are all considered equally necessary for modern computing, the engineering tradition is often considered to be useful but to lack intellectual depth. This article discusses the basic intellectual background of the engineering tradition of computing. The article depicts the engineering aims manifest in the academic field of computing, compares the engineering tradition with the other traditions of computing as a discipline, and presents some epistemological, ontological, and methodological views concerning the engineering tradition of computing. The article aims at giving the reader an overview of the engineering tradition in computing and of some open questions about the intellectual foundations and contributions of the engineering tradition in computing.

HTML

XML

PDF

DOI: 10.3217/jucs-003-09-1074

Authors: Lutz Prechelt

Abstract: Current Computer Science (CS) research is primarily focused on solving engineering problems. Often though, promising attempts for solving a particular problem fail for non-avoidable reasons. This is what I call a negative result: something that should have worked does not. Due to the current CS publication climate such negative results today are usually camouflaged as positive results by non-evaluating or mis-evaluating the research or by redefining the problem to fit the solution. Such publication behavior hampers progress in CS by suppressing some valuable insights, producing spurious understanding, and misleading further research efforts. Specific examples given below illustrate and back up these claims. This paper is the announcement of a (partial) remedy: a permanent publication forum explicitly for negative CS research results, called the Forum for Negative Results, FNR. FNR will be a regular part of J.UCS.

HTML

XML

PDF