{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,5]],"date-time":"2026-08-05T21:00:22Z","timestamp":1785963622791,"version":"3.56.0"},"reference-count":39,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T00:00:00Z","timestamp":1793491200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2026,6,26]],"date-time":"2026-06-26T00:00:00Z","timestamp":1782432000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100003086","name":"Eusko Jaurlaritza","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100003086","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Computers & Security"],"published-print":{"date-parts":[[2026,11]]},"DOI":"10.1016\/j.cose.2026.105043","type":"journal-article","created":{"date-parts":[[2026,6,25]],"date-time":"2026-06-25T23:49:15Z","timestamp":1782431355000},"page":"105043","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":0,"special_numbering":"C","title":["STUN comprehension-optional attributes as a covert channel: Design, implementation, and detection"],"prefix":"10.1016","volume":"170","author":[{"ORCID":"https:\/\/orcid.org\/0009-0008-6778-7625","authenticated-orcid":false,"given":"Gorka","family":"Gorrochategui","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7366-9579","authenticated-orcid":false,"given":"Unai","family":"Zulaika","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8160-9130","authenticated-orcid":false,"given":"Pablo","family":"Garaizar","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"issue":"4","key":"10.1016\/j.cose.2026.105043_b1","first-page":"5","article-title":"DeltaShaper: Enabling unobservable censorship-resistant TCP tunneling over videoconferencing streams","volume":"2017","author":"Barradas","year":"2017","journal-title":"Proc. Priv. Enhancing Technol. (PoPETS)"},{"key":"10.1016\/j.cose.2026.105043_b2","unstructured":"Barradas, D., Santos, N., Rodrigues, L., 2018. Effective detection of multimedia protocol tunneling using machine learning. In: Proc. 27th USENIX Security Symposium."},{"key":"10.1016\/j.cose.2026.105043_b3","series-title":"Proc. ACM SIGSAC Conference on Computer and Communications Security","article-title":"Poking a hole in the wall: Efficient censorship-resistant internet communications by parasitizing on webrtc","author":"Barradas","year":"2020"},{"issue":"165","key":"10.1016\/j.cose.2026.105043_b4","article-title":"ITC-Net-blend-60: A comprehensive dataset for robust network traffic classification in diverse environments","volume":"17","author":"Bayat","year":"2024","journal-title":"BMC Res. Notes"},{"key":"10.1016\/j.cose.2026.105043_b5","unstructured":"Bocovich, C., Breault, A., Fifield, D., Serene, Wang, X., 2024. Snowflake, a censorship circumvention system using temporary WebRTC proxies. In: Proc. 33rd USENIX Security Symposium."},{"key":"10.1016\/j.cose.2026.105043_b6","unstructured":"Crosser, A., 2025. Ghost Calls: Abusing Web Conferencing for Covert Command & Control. In: Proc. Black Hat USA 2025. Las Vegas, NV, [Online]. Available: https:\/\/www.praetorian.com\/blog\/ghost-calls-abusing-web-conferencing-for-covert-command-control-part-1-of-2\/."},{"key":"10.1016\/j.cose.2026.105043_b7","series-title":"Proc. ACM ASIA CCS","article-title":"Stegozoa: Enhancing WebRTC covert channels with video steganography for internet censorship circumvention","author":"Figueira","year":"2022"},{"key":"10.1016\/j.cose.2026.105043_b8","series-title":"Proc. 14th ACM Conf. Computer and Communications Security","first-page":"307","article-title":"Detecting covert timing channels: an entropy-based approach","author":"Gianvecchio","year":"2007"},{"key":"10.1016\/j.cose.2026.105043_b9","series-title":"OpenVPN on grandstream IP phones guide","author":"Grandstream Networks","year":"2023"},{"key":"10.1016\/j.cose.2026.105043_b10","series-title":"IR.92 IMS Profile for Voice and SMS, Version 22.0","author":"GSMA","year":"2025"},{"key":"10.1016\/j.cose.2026.105043_b11","series-title":"WebRTC 1.0: Real-time communication between browsers","author":"Jennings","year":"2021"},{"key":"10.1016\/j.cose.2026.105043_b12","series-title":"Interactive connectivity establishment (ICE): A protocol for network address translator (NAT) traversal","author":"Keranen","year":"2018"},{"key":"10.1016\/j.cose.2026.105043_b13","series-title":"Proc. European Interdisciplinary Cybersecurity Conference","article-title":"How to make an intrusion detection system aware of steganographic transmission","author":"Koziak","year":"2021"},{"key":"10.1016\/j.cose.2026.105043_b14","series-title":"Proceedings of the 13th Workshop on Privacy in the Electronic Society (WPES)","first-page":"163","article-title":"Facet: Streaming over Videoconferencing for Censorship Circumvention","author":"Li","year":"2014"},{"key":"10.1016\/j.cose.2026.105043_b15","series-title":"Traversal using relays around NAT (TURN): Relay extensions to STUN","author":"Mahy","year":"2010"},{"key":"10.1016\/j.cose.2026.105043_b16","series-title":"Guidelines for protecting user privacy in WIDE traffic archive","author":"MAWI Working Group","year":"1999"},{"key":"10.1016\/j.cose.2026.105043_b17","series-title":"MAWI Working Group Traffic Archive","author":"MAWI Working Group","year":"2026"},{"issue":"2","key":"10.1016\/j.cose.2026.105043_b18","doi-asserted-by":"crossref","DOI":"10.1145\/2543581.2543587","article-title":"VoIP steganography and its detection: A survey","volume":"46","author":"Mazurczyk","year":"2013","journal-title":"ACM Comput. Surv."},{"key":"10.1016\/j.cose.2026.105043_b19","series-title":"Global E-Security","first-page":"65","article-title":"Covert channels in SIP for VoIP signalling","volume":"vol. 12","author":"Mazurczyk","year":"2008"},{"key":"10.1016\/j.cose.2026.105043_b20","series-title":"Multimedia Communications, Services and Security","first-page":"182","article-title":"Creating covert channel using SIP","volume":"vol. 429","author":"Mehi\u0107","year":"2014"},{"key":"10.1016\/j.cose.2026.105043_b21","series-title":"CVE-2023-2374: Ubiquiti EdgeRouter X web management interface command injection","author":"NIST","year":"2023"},{"key":"10.1016\/j.cose.2026.105043_b22","series-title":"CVE-2023-43959: Yealink SIP-T19P_E2 authenticated remote code execution","author":"NIST","year":"2023"},{"key":"10.1016\/j.cose.2026.105043_b23","series-title":"CVE-2026-2329: Grandstream GXP1600 series unauthenticated stack buffer overflow in\/cgi-bin\/api.values.get","author":"NIST","year":"2026"},{"key":"10.1016\/j.cose.2026.105043_b24","series-title":"Payload keywords: entropy","author":"Open Information Security Foundation","year":"2025"},{"key":"10.1016\/j.cose.2026.105043_b25","series-title":"Session traversal utilities for NAT (STUN)","author":"Petit-Huguenin","year":"2020"},{"key":"10.1016\/j.cose.2026.105043_b26","series-title":"Session traversal utilities for NAT (STUN)","author":"Rosenberg","year":"2008"},{"key":"10.1016\/j.cose.2026.105043_b27","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1016\/j.future.2020.04.032","article-title":"Voip network covert channels to enhance privacy and information sharing","volume":"111","author":"Saenger","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"10.1016\/j.cose.2026.105043_b28","series-title":"Proc. 35th IFIP International Conference on ICT Systems Security and Privacy Protection","first-page":"17","article-title":"Evaluation of statistical tests for detecting storage-based covert channels","author":"Sattolo","year":"2020"},{"key":"10.1016\/j.cose.2026.105043_b29","doi-asserted-by":"crossref","first-page":"17","DOI":"10.1016\/j.cose.2018.08.006","article-title":"Exploiting IP telephony with silence suppression for hidden data transfers","volume":"79","author":"Schmidt","year":"2018","journal-title":"Comput. Secur."},{"key":"10.1016\/j.cose.2026.105043_b30","series-title":"Multiple critical vulnerabilities in snom IP phones","author":"SEC Consult Vulnerability Lab","year":"2015"},{"key":"10.1016\/j.cose.2026.105043_b31","series-title":"STUN service discovery results","author":"Shodan Search Engine","year":"2026"},{"key":"10.1016\/j.cose.2026.105043_b32","series-title":"Configuring VPN on snom deskphones","author":"Snom Technology","year":"2024"},{"key":"10.1016\/j.cose.2026.105043_b33","series-title":"Proc. 32nd Annual Computer Security Applications Conference","first-page":"558","article-title":"Spicy: A unified deep packet inspection framework for safely dissecting all your data","author":"Sommer","year":"2016"},{"key":"10.1016\/j.cose.2026.105043_b34","series-title":"Challenging tribal knowledge: Large scale measurement campaign on decentralized NAT traversal","author":"Trautwein","year":"2025"},{"key":"10.1016\/j.cose.2026.105043_b35","series-title":"Proc. 12th Int. Conf. on Trust, Privacy and Security in Digital Business","first-page":"48","article-title":"Hidden in plain sight: SDP-based covert channel for botnet communication","volume":"vol. 9264","author":"Tsiatsikas","year":"2015"},{"issue":"11","key":"10.1016\/j.cose.2026.105043_b36","first-page":"1456","article-title":"Unified description for network information hiding methods","volume":"22","author":"Wendzel","year":"2016","journal-title":"J. Univers. Comput. Sci."},{"issue":"3","key":"10.1016\/j.cose.2026.105043_b37","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/2684195","article-title":"Pattern-based survey and categorization of network covert channel techniques","volume":"47","author":"Wendzel","year":"2015","journal-title":"ACM Comput. Surv."},{"issue":"3","key":"10.1016\/j.cose.2026.105043_b38","doi-asserted-by":"crossref","first-page":"44","DOI":"10.1109\/COMST.2007.4317620","article-title":"A survey of covert channels and countermeasures in computer network protocols","volume":"9","author":"Zander","year":"2007","journal-title":"IEEE Commun. Surv. Tutor."},{"issue":"6","key":"10.1016\/j.cose.2026.105043_b39","doi-asserted-by":"crossref","first-page":"1865","DOI":"10.1007\/s10207-023-00723-w","article-title":"DNS exfiltration detection in the presence of adversarial attacks and modified exfiltrator behaviour","volume":"22","author":"\u017di\u017ea","year":"2023","journal-title":"Int. J. Inf. Secur."}],"container-title":["Computers & Security"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826002191?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S0167404826002191?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,8,5]],"date-time":"2026-08-05T19:53:06Z","timestamp":1785959586000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S0167404826002191"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,11]]},"references-count":39,"alternative-id":["S0167404826002191"],"URL":"https:\/\/doi.org\/10.1016\/j.cose.2026.105043","relation":{"is-supplemented-by":[{"id-type":"uri","id":"https:\/\/drive.google.com\/drive\/folders\/1-7KzZx5vwhh1PdXE2BltSTTNrJs4wt-L","asserted-by":"subject"}]},"ISSN":["0167-4048"],"issn-type":[{"value":"0167-4048","type":"print"}],"subject":[],"published":{"date-parts":[[2026,11]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"STUN comprehension-optional attributes as a covert channel: Design, implementation, and detection","name":"articletitle","label":"Article Title"},{"value":"Computers & Security","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2026.105043","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2026 The Authors. Published by Elsevier Ltd.","name":"copyright","label":"Copyright"}],"article-number":"105043"}}