{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T09:10:42Z","timestamp":1789031442228,"version":"build-2803163510"},"reference-count":55,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T00:00:00Z","timestamp":1783555200000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2024YFF1401300"],"award-info":[{"award-number":["2024YFF1401300"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2026,11]]},"DOI":"10.1016\/j.cose.2026.105035","type":"journal-article","created":{"date-parts":[[2026,6,26]],"date-time":"2026-06-26T06:35:22Z","timestamp":1782455722000},"page":"105035","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["TranCTC: Transformer-based IPv6 covert timing channel detection with heterogeneous features fusion"],"prefix":"10.1016","volume":"170","author":[{"ORCID":"https:\/\/orcid.org\/0009-0007-1772-4821","authenticated-orcid":false,"given":"Yuguo","family":"Wang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9296-0142","authenticated-orcid":false,"given":"Chen","family":"Yang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Gaopeng","family":"Gou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-3344-9058","authenticated-orcid":false,"given":"Zheyuan","family":"Gu","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xinlei","family":"Ju","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhen","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Gang","family":"Xiong","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-9801-0091","authenticated-orcid":false,"given":"Mi","family":"Zhou","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.cose.2026.105035_b1","doi-asserted-by":"crossref","first-page":"177","DOI":"10.1109\/ACCESS.2020.3046234","article-title":"SnapCatch: Automatic detection of covert timing channels using image processing and machine learning","volume":"9","author":"Al-Eidi","year":"2021","journal-title":"IEEE Access"},{"issue":"2","key":"10.1016\/j.cose.2026.105035_b2","doi-asserted-by":"crossref","first-page":"1655","DOI":"10.1007\/s10586-023-04035-5","article-title":"A deep learning approach for detecting covert timing channel attacks using sequential data","volume":"27","author":"Al-Eidi","year":"2024","journal-title":"Clust. Comput."},{"key":"10.1016\/j.cose.2026.105035_b3","series-title":"RFC 5681: TCP congestion control","author":"Allman","year":"2009"},{"key":"10.1016\/j.cose.2026.105035_b4","series-title":"A deep learning based approach to detect covert channels attacks and anomaly in new generation internet protocol IPv6","author":"AlSenaid","year":"2020"},{"key":"10.1016\/j.cose.2026.105035_b5","doi-asserted-by":"crossref","first-page":"284","DOI":"10.1016\/j.cose.2014.03.007","article-title":"A comparative analysis of detection metrics for covert timing channels","volume":"45","author":"Archibald","year":"2014","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105035_b6","series-title":"Proceedings of the 2023 Applied Networking Research Workshop","first-page":"27","article-title":"Evaluating the benefits: Quantifying the effects of TCP options, QUIC, and CDNs on throughput","author":"Bauer","year":"2023"},{"key":"10.1016\/j.cose.2026.105035_b7","series-title":"Information, Communication and Computing Technology","first-page":"98","article-title":"Network steganography using extension headers in IPv6","author":"Bedi","year":"2020"},{"key":"10.1016\/j.cose.2026.105035_b8","series-title":"2015 International Conference on Computing Communication Control and Automation","first-page":"275","article-title":"Secure data communication using protocol steganography in IPv6","author":"Bobade","year":"2015"},{"key":"10.1016\/j.cose.2026.105035_b9","article-title":"Network covert channels: Design, analysis, detection, and elimination","author":"Cabuk","year":"2006","journal-title":"ETD Collect. Purdue Univ."},{"key":"10.1016\/j.cose.2026.105035_b10","series-title":"Proceedings of the 11th ACM Conference on Computer and Communications Security","first-page":"178","article-title":"IP covert timing channels: design and detection","author":"Cabuk","year":"2004"},{"issue":"4","key":"10.1016\/j.cose.2026.105035_b11","doi-asserted-by":"crossref","DOI":"10.1145\/1513601.1513604","article-title":"IP covert channel detection","volume":"12","author":"Cabuk","year":"2009","journal-title":"ACM Trans. Inf. Syst. Secur."},{"key":"10.1016\/j.cose.2026.105035_b12","series-title":"The CAIDA UCSD anonymized internet traces","author":"CAIDA, University of California San Diego","year":"2018"},{"key":"10.1016\/j.cose.2026.105035_b13","doi-asserted-by":"crossref","DOI":"10.1016\/j.asoc.2019.105546","article-title":"Using hierarchical statistical analysis and deep neural networks to detect covert timing channels","volume":"82","author":"Darwish","year":"2019","journal-title":"Appl. Soft Comput."},{"key":"10.1016\/j.cose.2026.105035_b14","series-title":"IP Version 6 Addressing Architecture","author":"Deering","year":"2006"},{"key":"10.1016\/j.cose.2026.105035_b15","series-title":"Proceedings of the 2012 Internet Measurement Conference","first-page":"537","article-title":"Measuring the deployment of IPv6: topology, routing and performance","author":"Dhamdhere","year":"2012"},{"key":"10.1016\/j.cose.2026.105035_b16","series-title":"Computer Security \u2013 ESORICS 2023","first-page":"277","article-title":"A new model for testing IPv6 fragment handling","author":"Di Paolo","year":"2024"},{"key":"10.1016\/j.cose.2026.105035_b17","series-title":"2013 27th International Conference on Advanced Information Networking and Applications Workshops","first-page":"1094","article-title":"Design and implementation of the NORNET CORE research testbed for multi-homed systems","author":"Dreibholz","year":"2013"},{"key":"10.1016\/j.cose.2026.105035_b18","doi-asserted-by":"crossref","first-page":"110661","DOI":"10.1109\/ACCESS.2022.3215132","article-title":"Detecting and locating storage-based covert channels in internet protocol version 6","volume":"10","author":"Dua","year":"2022","journal-title":"IEEE Access"},{"key":"10.1016\/j.cose.2026.105035_b19","doi-asserted-by":"crossref","first-page":"38391","DOI":"10.1109\/ACCESS.2022.3164392","article-title":"Covert channel detection: Machine learning approaches","volume":"10","author":"Elsadig","year":"2022","journal-title":"IEEE Access"},{"key":"10.1016\/j.cose.2026.105035_b20","series-title":"Form 10-K: Annual report for the fiscal year ended december 31, 2006","author":"Equinix","year":"2007"},{"key":"10.1016\/j.cose.2026.105035_b21","series-title":"Segment Routing over IPv6 (SRv6) Network Programming","author":"Filsfils","year":"2021"},{"key":"10.1016\/j.cose.2026.105035_b22","series-title":"Proceedings of the 14th ACM Conference on Computer and Communications Security","first-page":"307","article-title":"Detecting covert timing channels: an entropy-based approach","author":"Gianvecchio","year":"2007"},{"key":"10.1016\/j.cose.2026.105035_b23","series-title":"Recent Advances in Intrusion Detection","first-page":"211","article-title":"Model-based covert timing channels: Automated modeling and evasion","author":"Gianvecchio","year":"2008"},{"key":"10.1016\/j.cose.2026.105035_b24","doi-asserted-by":"crossref","unstructured":"Golkar, Forough, Dreibholz, Thomas, Kvalbein, Amund, 2014. Measuring and comparing Internet path stability in IPv4 and IPv6. In: 2014 International Conference and Workshop on the Network of the Future. NOF, pp. 1\u20135.","DOI":"10.1109\/NOF.2014.7119767"},{"key":"10.1016\/j.cose.2026.105035_b25","doi-asserted-by":"crossref","unstructured":"Haghighat, Mohammad Hashem, Foroushani, Zohreh Abtahi, Li, Jun, 2019. SAWANT: Smart Window Based Anomaly Detection Using Netflow Traffic. In: 2019 IEEE 19th International Conference on Communication Technology. ICCT, pp. 1396\u20131402.","DOI":"10.1109\/ICCT46805.2019.8947103"},{"key":"10.1016\/j.cose.2026.105035_b26","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2020.101952","article-title":"Covert timing channel detection method based on time interval and payload length analysis","volume":"97","author":"Han","year":"2020","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105035_b27","series-title":"2017 Network Traffic Measurement and Analysis Conference","first-page":"1","article-title":"Threats and surprises behind IPv6 extension headers","author":"Hendriks","year":"2017"},{"issue":"2","key":"10.1016\/j.cose.2026.105035_b28","first-page":"224","article-title":"Transform sequential data to image for detecting covert timing channel","volume":"26","author":"Huang","year":"2024","journal-title":"Int. J. Netw. Secur."},{"key":"10.1016\/j.cose.2026.105035_b29","series-title":"Data Mining: Practical Machine Learning Tools and Techniques","author":"Ian","year":"2005"},{"key":"10.1016\/j.cose.2026.105035_b30","series-title":"Passive and Active Measurement: 26th International Conference, PAM 2025, Virtual Event, March 10\u201312, 2025, Proceedings","first-page":"3","article-title":"The razor\u2019s edge: IPv6 extension headers survivability","author":"Iurman","year":"2025"},{"key":"10.1016\/j.cose.2026.105035_b31","doi-asserted-by":"crossref","DOI":"10.1016\/j.comnet.2019.106947","article-title":"Tracking the deployment of IPv6: Topology, routing and performance","volume":"165","author":"Jia","year":"2019","journal-title":"Comput. Netw."},{"key":"10.1016\/j.cose.2026.105035_b32","series-title":"Discretization techniques: A recent survey","author":"Kotsiantis","year":"2006"},{"key":"10.1016\/j.cose.2026.105035_b33","series-title":"A Uniform Format for IPv6 Extension Headers","author":"Krishnan","year":"2012"},{"issue":"10","key":"10.1016\/j.cose.2026.105035_b34","doi-asserted-by":"crossref","first-page":"613","DOI":"10.1145\/362375.362389","article-title":"A note on the confinement problem","volume":"16","author":"Lampson","year":"1973","journal-title":"Commun. ACM"},{"issue":"5","key":"10.1016\/j.cose.2026.105035_b35","doi-asserted-by":"crossref","first-page":"4085","DOI":"10.1109\/TDSC.2022.3207573","article-title":"Generic and sensitive anomaly detection of network covert timing channels","volume":"20","author":"Li","year":"2023","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"key":"10.1016\/j.cose.2026.105035_b36","first-page":"1","article-title":"A case study of IPv6 network performance: Packet delay, loss, and reordering","volume":"2017","author":"Li","year":"2017","journal-title":"Math. Probl. Eng."},{"issue":"2","key":"10.1016\/j.cose.2026.105035_b37","doi-asserted-by":"crossref","first-page":"473","DOI":"10.1109\/JSAC.2025.3528808","article-title":"AutoSRv6: Configuration synthesis for segment routing over IPv6","volume":"43","author":"Liang","year":"2025","journal-title":"IEEE J. Sel. Areas Commun."},{"key":"10.1016\/j.cose.2026.105035_b38","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2024.104200","article-title":"Covert timing channel detection based on isolated binary trees","volume":"150","author":"Lin","year":"2025","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105035_b39","series-title":"Privacy Enhancing Technologies","first-page":"147","article-title":"Covert channels in IPv6","author":"Lucena","year":"2006"},{"issue":"253","key":"10.1016\/j.cose.2026.105035_b40","doi-asserted-by":"crossref","first-page":"68","DOI":"10.1080\/01621459.1951.10500769","article-title":"The Kolmogorov-Smirnov test for goodness of fit","volume":"46","author":"Massey","year":"1951","journal-title":"J. Amer. Statist. Assoc."},{"key":"10.1016\/j.cose.2026.105035_b41","doi-asserted-by":"crossref","first-page":"36","DOI":"10.1016\/j.cose.2018.09.006","article-title":"Detection of malicious and low throughput data exfiltration over the DNS protocol","volume":"80","author":"Nadler","year":"2019","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105035_b42","series-title":"Privacy Extensions for Stateless Address Autoconfiguration in IPv6","author":"Narten","year":"2007"},{"key":"10.1016\/j.cose.2026.105035_b43","series-title":"IPv6 Stateless Address Autoconfiguration","author":"Narten","year":"2007"},{"key":"10.1016\/j.cose.2026.105035_b44","series-title":"Proc. Netw. Distrib. Syst. Secur. Symp","first-page":"1","article-title":"Information based heavy hitters for real-time DNS data exfiltration detection","author":"Ozery","year":"2024"},{"key":"10.1016\/j.cose.2026.105035_b45","series-title":"IEEE INFOCOM 2009","first-page":"2204","article-title":"TCP\/IP timing channels: Theory to implementation","author":"Sellke","year":"2009"},{"key":"10.1016\/j.cose.2026.105035_b46","series-title":"Security Architecture for the Internet Protocol","author":"Seo","year":"2005"},{"key":"10.1016\/j.cose.2026.105035_b47","series-title":"Proceedings of the 15th Conference on USENIX Security Symposium - Volume 15","article-title":"Keyboards and covert channels","author":"Shah","year":"2006"},{"key":"10.1016\/j.cose.2026.105035_b48","doi-asserted-by":"crossref","first-page":"339","DOI":"10.3390\/fi16090339","article-title":"Optimizing network performance: A comparative analysis of EIGRP, OSPF, and BGP in IPv6-based load-sharing and link-failover systems","volume":"16","author":"Shahid","year":"2024","journal-title":"Futur. Internet"},{"issue":"2","key":"10.1016\/j.cose.2026.105035_b49","doi-asserted-by":"crossref","first-page":"274","DOI":"10.1109\/TDSC.2015.2423680","article-title":"A support vector machine-based framework for detection of covert timing channels","volume":"13","author":"Shrestha","year":"2016","journal-title":"IEEE Trans. Dependable Secur. Comput."},{"issue":"2","key":"10.1016\/j.cose.2026.105035_b50","doi-asserted-by":"crossref","first-page":"139","DOI":"10.1016\/S0166-5316(01)00048-7","article-title":"An integrated model for the latency and steady-state throughput of TCP connections","volume":"46","author":"Sikdar","year":"2001","journal-title":"Perform. Eval."},{"key":"10.1016\/j.cose.2026.105035_b51","series-title":"Delay performance analysis with short packets in intelligent machine network","author":"Xu","year":"2025"},{"issue":"1","key":"10.1016\/j.cose.2026.105035_b52","doi-asserted-by":"crossref","first-page":"258","DOI":"10.1109\/TCCN.2024.3421309","article-title":"A self-attention mechanism-based model to detect IPv6 multi-field covert channels","volume":"11","author":"Zhang","year":"2025","journal-title":"IEEE Trans. Cogn. Commun. Netw."},{"key":"10.1016\/j.cose.2026.105035_b53","doi-asserted-by":"crossref","first-page":"212","DOI":"10.1016\/j.comcom.2021.10.040","article-title":"ZM-CTC: Covert timing channel construction method based on zigzag matrix","volume":"182","author":"Zheng","year":"2022","journal-title":"Comput. Commun."},{"key":"10.1016\/j.cose.2026.105035_b54","article-title":"A generalized detection framework for covert timing channels based on perceptual hashing","volume":"35","author":"Zhuang","year":"2024","journal-title":"Trans. Emerg. Telecommun. Technol."},{"issue":"6","key":"10.1016\/j.cose.2026.105035_b55","doi-asserted-by":"crossref","first-page":"5156","DOI":"10.1109\/TDSC.2023.3241451","article-title":"Weaknesses of popular and recent covert channel detection methods and a remedy","volume":"20","author":"Zillien","year":"2023","journal-title":"IEEE Trans. Dependable Secur. Comput."}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826002117?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826002117?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T08:43:26Z","timestamp":1789029806000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404826002117"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,11]]},"references-count":55,"alternative-id":["S0167404826002117"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2026.105035","relation":{},"ISSN":["0167-4048"],"issn-type":[{"value":"0167-4048","type":"print"}],"subject":[],"published":{"date-parts":[[2026,11]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"TranCTC: Transformer-based IPv6 covert timing channel detection with heterogeneous features fusion","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2026.105035","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"105035"}}