{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,22]],"date-time":"2025-12-22T18:34:21Z","timestamp":1766428461498,"version":"3.44.0"},"publisher-location":"Cham","reference-count":26,"publisher":"Springer Nature Switzerland","isbn-type":[{"type":"print","value":"9783032006370"},{"type":"electronic","value":"9783032006356"}],"license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025]]},"DOI":"10.1007\/978-3-032-00635-6_19","type":"book-chapter","created":{"date-parts":[[2025,8,8]],"date-time":"2025-08-08T13:36:04Z","timestamp":1754660164000},"page":"327-345","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Entropy-Aware Secret Data Embedding for\u00a0Network Storage Channels"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4252-5545","authenticated-orcid":false,"given":"Pawe\u0142","family":"Rajba","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0303-6140","authenticated-orcid":false,"given":"J\u00f6rg","family":"Keller","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8509-4127","authenticated-orcid":false,"given":"Wojciech","family":"Mazurczyk","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2025,8,9]]},"reference":[{"key":"19_CR1","doi-asserted-by":"publisher","DOI":"10.1016\/j.sigpro.2025.109888","volume":"231","author":"LT Badar","year":"2025","unstructured":"Badar, L.T., Carminati, B., Ferrari, E.: A comprehensive survey on stegomalware detection in digital media, research challenges and future directions. Signal Process. 231, 109888 (2025)","journal-title":"Signal Process."},{"key":"19_CR2","doi-asserted-by":"crossref","unstructured":"Bang, J., Kim, J.N., Lee, S.: Entropy sharing in ransomware: bypassing entropy-based detection of cryptographic operations. Sensors 24(5) (2024)","DOI":"10.3390\/s24051446"},{"issue":"4","key":"19_CR3","doi-asserted-by":"publisher","first-page":"2367","DOI":"10.3390\/e17042367","volume":"17","author":"P Berezi\u0144ski","year":"2015","unstructured":"Berezi\u0144ski, P., Jasiul, B., Szpyrka, M.: An entropy-based network anomaly detection method. Entropy 17(4), 2367\u20132408 (2015)","journal-title":"Entropy"},{"key":"19_CR4","doi-asserted-by":"publisher","first-page":"5371","DOI":"10.1109\/ACCESS.2020.3048319","volume":"9","author":"L Caviglione","year":"2021","unstructured":"Caviglione, L., et al.: Tight arms race: overview of current malware threats and trends in their detection. IEEE Access 9, 5371\u20135396 (2021)","journal-title":"IEEE Access"},{"issue":"5","key":"19_CR5","doi-asserted-by":"publisher","first-page":"101","DOI":"10.1109\/MSEC.2022.3178205","volume":"20","author":"L Caviglione","year":"2022","unstructured":"Caviglione, L., Mazurczyk, W.: Never mind the malware, here\u2019s the stegomalware. IEEE Sec. Priv. 20(5), 101\u2013106 (2022)","journal-title":"IEEE Sec. Priv."},{"key":"19_CR6","unstructured":"Cover, T.M., Thomas, J.A.: Elements of Information Theory. Wiley-Interscience, 2nd edn. (2006)"},{"key":"19_CR7","doi-asserted-by":"crossref","unstructured":"Darwish, O., Al-Fuqaha, A., Anan, M.: Hierarchical entropy analysis for covert timing channel detection. In: IWCMC, pp. 153\u2013159 (2015)","DOI":"10.1109\/IWCMC.2015.7289074"},{"key":"19_CR8","doi-asserted-by":"crossref","unstructured":"Gianvecchio, S., Wang, H.: Detecting covert timing channels: an entropy-based approach. In: Conference on Communications and Network Security, CCS 2007, pp. 307\u2013316 (2007)","DOI":"10.1145\/1315245.1315284"},{"issue":"9","key":"19_CR9","doi-asserted-by":"publisher","first-page":"1098","DOI":"10.1109\/JRPROC.1952.273898","volume":"40","author":"DA Huffman","year":"1952","unstructured":"Huffman, D.A.: A method for the construction of minimum-redundancy codes. Proc. IRE 40(9), 1098\u20131101 (1952)","journal-title":"Proc. IRE"},{"key":"19_CR10","doi-asserted-by":"crossref","unstructured":"Liu, T., Wang, Z., Wang, H., Lu, K.: An entropy-based method for attack detection in large scale network. Int.l J. Comput. Comm. 7(3), 509\u2013517 (2012)","DOI":"10.15837\/ijccc.2012.3.1391"},{"issue":"2","key":"19_CR11","doi-asserted-by":"publisher","first-page":"40","DOI":"10.1109\/MSP.2007.48","volume":"5","author":"R Lyda","year":"2007","unstructured":"Lyda, R., Hamrock, J.: Using entropy analysis to find encrypted and packed malware. IEEE Sec. Priv. 5(2), 40\u201345 (2007)","journal-title":"IEEE Sec. Priv."},{"key":"19_CR12","first-page":"412","volume":"3","author":"J Mali","year":"2013","unstructured":"Mali, J., Sonawane, V., Awale, R.: Image steganography using block-level entropy thresholding. IJERA 3, 412\u2013415 (2013)","journal-title":"IJERA"},{"key":"19_CR13","unstructured":"Mawi, W.G.T.A.: Packet traces from WIDE backbone. https:\/\/mawi.wide.ad.jp\/mawi\/ (2025), Accessed 10-May-2025"},{"key":"19_CR14","doi-asserted-by":"crossref","unstructured":"Mazurczyk, W., Wendzel, S., Chourib, M., Keller, J.: Countering adaptive network covert communication with dynamic wardens. Future Gener. Comput. Syst. 94(C), 712\u2013725 (2019)","DOI":"10.1016\/j.future.2018.12.047"},{"key":"19_CR15","doi-asserted-by":"crossref","unstructured":"Mazurczyk, W., Wendzel, S., Zander, S., Houmansadr, A., Szczypiorski, K.: Information hiding in communication networks: fundamentals, mechanisms, and applications. IEEE Ser. Inf. and Comm. Netw. Security, Wiley, Hoboken, NJ (2016)","DOI":"10.1002\/9781119081715"},{"key":"19_CR16","first-page":"1","volume":"109","author":"H Menendez Benito","year":"2016","unstructured":"Menendez Benito, H., Crawford, T.: The arms race: adversarial search defeats entropy used to detect malware. Expert Syst. Appl. 109, 1\u201315 (2016)","journal-title":"Expert Syst. Appl."},{"issue":"5","key":"19_CR17","doi-asserted-by":"publisher","first-page":"1112","DOI":"10.3758\/s13423-014-0585-6","volume":"21","author":"S Piantadosi","year":"2014","unstructured":"Piantadosi, S.: Zipf\u2019s word frequency law in natural language: a critical review and future directions. Psychon. Bull. Rev. 21(5), 1112\u20131130 (2014)","journal-title":"Psychon. Bull. Rev."},{"issue":"3","key":"19_CR18","doi-asserted-by":"publisher","first-page":"379","DOI":"10.1002\/j.1538-7305.1948.tb01338.x","volume":"27","author":"CE Shannon","year":"1948","unstructured":"Shannon, C.E.: A mathematical theory of communication. Bell Syst. Tech. J. 27(3), 379\u2013423 (1948)","journal-title":"Bell Syst. Tech. J."},{"issue":"15","key":"19_CR19","doi-asserted-by":"publisher","first-page":"3485","DOI":"10.1016\/j.comnet.2011.07.008","volume":"55","author":"B Tellenbach","year":"2011","unstructured":"Tellenbach, B., Burkhart, M., Schatzmann, D., Gugelmann, D., Sornette, D.: Accurate network anomaly classification with generalized entropy metrics. Comput. Netw. 55(15), 3485\u20133502 (2011)","journal-title":"Comput. Netw."},{"issue":"6","key":"19_CR20","doi-asserted-by":"publisher","first-page":"1217","DOI":"10.1016\/j.comnet.2010.11.007","volume":"55","author":"RJ Walls","year":"2011","unstructured":"Walls, R.J., Kothari, K., Wright, M.: Liquid: A detection-resistant covert timing channel based on ipd shaping. Comput. Netw. 55(6), 1217\u20131228 (2011)","journal-title":"Comput. Netw."},{"key":"19_CR21","doi-asserted-by":"crossref","unstructured":"Wendzel, S., et al.: A generic taxonomy for steganography methods. ACM Comput. Surv. (2025)","DOI":"10.1145\/3729165"},{"key":"19_CR22","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"122","DOI":"10.1007\/978-3-642-24712-5_10","volume-title":"Communications and Multimedia Security","author":"S Wendzel","year":"2011","unstructured":"Wendzel, S., Keller, J.: Low-attention forwarding for mobile network covert channels. In: De Decker, B., Lapon, J., Naessens, V., Uhl, A. (eds.) CMS 2011. LNCS, vol. 7025, pp. 122\u2013133. Springer, Heidelberg (2011). https:\/\/doi.org\/10.1007\/978-3-642-24712-5_10"},{"key":"19_CR23","doi-asserted-by":"crossref","unstructured":"Wendzel, S., Zander, S., Fechner, B., Herdin, C.: Pattern-based survey and categorization of network covert channel techniques. ACM Com. Sur. 47(3) (Apr 2015)","DOI":"10.1145\/2684195"},{"key":"19_CR24","unstructured":"de\u00a0Witt, C.S., Sokota, S., Kolter, J.Z., Foerster, J.N., Strohmeier, M.: Perfectly secure steganography using minimum entropy coupling. In: 11th International Conference on Learning Representations, ICLR 2023. OpenReview.net (2023)"},{"issue":"3","key":"19_CR25","doi-asserted-by":"publisher","first-page":"44","DOI":"10.1109\/COMST.2007.4317620","volume":"9","author":"S Zander","year":"2007","unstructured":"Zander, S., Armitage, G., Branch, P.: A survey of covert channels and countermeasures in computer network protocols. IEEE Com. Sur. & Tut. 9(3), 44\u201357 (2007)","journal-title":"IEEE Com. Sur. & Tut."},{"key":"19_CR26","unstructured":"Zipf, G.K.: The Psychobiology of Language. Houghton-Mifflin, New York (1935)"}],"container-title":["Lecture Notes in Computer Science","Availability, Reliability and Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-00635-6_19","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,9,8]],"date-time":"2025-09-08T19:39:39Z","timestamp":1757360379000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-00635-6_19"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"ISBN":["9783032006370","9783032006356"],"references-count":26,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-00635-6_19","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2025]]},"assertion":[{"value":"9 August 2025","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ARES","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"International Conference on Availability, Reliability and Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Ghent","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Belgium","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"11 August 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"14 August 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"20","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"ares-12025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/2025.ares-conference.eu","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}