{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,23]],"date-time":"2026-10-23T08:24:22Z","timestamp":1792743862336,"version":"4.5.0"},"reference-count":126,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2007,1,1]],"date-time":"2007-01-01T00:00:00Z","timestamp":1167609600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2007,1,1]],"date-time":"2007-01-01T00:00:00Z","timestamp":1167609600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2007,1,1]],"date-time":"2007-01-01T00:00:00Z","timestamp":1167609600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Commun. Surv. Tutorials"],"published-print":{"date-parts":[[2007]]},"DOI":"10.1109\/comst.2007.4317620","type":"journal-article","created":{"date-parts":[[2007,9,24]],"date-time":"2007-09-24T15:01:55Z","timestamp":1190646115000},"page":"44-57","source":"Crossref","is-referenced-by-count":451,"title":["A survey of covert channels and countermeasures in computer network protocols"],"prefix":"10.1109","volume":"9","author":[{"given":"Sebastian","family":"Zander","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Grenville","family":"Armitage","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Philip","family":"Branch","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"crossref","first-page":"421","DOI":"10.1007\/11908739_30","article-title":"Traceroute Based IP Channel for Sending Hidden Short Messages","author":"trabelsi","year":"2006","journal-title":"Proc Advances in Information and Computer Security (IWSEC)"},{"key":"ref38","author":"graf","year":"2003","journal-title":"Messaging over IPv6 Destination Options"},{"key":"ref33","doi-asserted-by":"crossref","DOI":"10.1007\/978-3-540-30114-1_12","article-title":"Syntax and Semantics-Preserving Application-Layer Protocol Steganography","author":"lucena","year":"2004","journal-title":"Proc 6th Information Hiding Wksp"},{"key":"ref32","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1007\/3-540-61996-8_29","article-title":"Hiding Data in the OSI Network Model","author":"handel","year":"1996","journal-title":"Proc 1st Int'l Wksp Information Hiding"},{"key":"ref31","doi-asserted-by":"crossref","first-page":"355","DOI":"10.1007\/3-540-49380-8_25","article-title":"On Public-Key Steganography in the Presence of an Active Warden","author":"craver","year":"1998","journal-title":"Proc 2nd Int'l Wksp Information Hiding"},{"key":"ref30","first-page":"51","article-title":"The Prisoners' Problem and the Subliminal Channel","author":"simmons","year":"1983","journal-title":"Proc Advances in Cryptology (CRYPTO)"},{"key":"ref37","first-page":"147","article-title":"Covert Channels in IPv6","author":"lucena","year":"2005","journal-title":"Proc Privacy Enhancing Technologies (PET)"},{"key":"ref36","first-page":"91","article-title":"Covert Channels in LAN Protocols","author":"wolf","year":"1989","journal-title":"Proc Wksp Local Area Network Security (LANSEC)"},{"key":"ref35","author":"hintz","year":"2003","journal-title":"Covert Channels in TCP and IP Headers"},{"key":"ref34","article-title":"Practical Internet Steganography: Data Hiding in IP","author":"kundur","year":"2003","journal-title":"Proc Texas Wksp Security of Information Systems"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1999.766906"},{"key":"ref27","year":"1985","journal-title":"Trusted Computer System Evaluation Criteria"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/SP.1982.10007"},{"key":"ref20","article-title":"Prefixpreserving IP Address Anonymization: Measurement-based Security Evaluation and a New Cryptography-based Scheme","author":"xu","year":"2002","journal-title":"Proc 10th IEEE Int'l Conf Network Protocols"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2005.32"},{"key":"ref21","article-title":"Mapping Internet Sensors with Probe Response Attacks","author":"bethencourt","year":"2005","journal-title":"Proc Usenix Security Symp"},{"key":"ref24","doi-asserted-by":"crossref","first-page":"170","DOI":"10.1007\/11875567_13","article-title":"New VoIP Traffic Security Scheme with Digital Watermarking","author":"mazurczyk","year":"2006","journal-title":"Proc Int'l Conf Computer Safety Reliability and Security (SafeComp)"},{"key":"ref23","author":"mazurczyk","year":"2005","journal-title":"New Security and Control Protocol for VoIP Based on Steganography and Digital Watermarking"},{"key":"ref101","doi-asserted-by":"publisher","DOI":"10.1109\/INFCOM.2000.832535"},{"key":"ref26","first-page":"38","article-title":"Using Covert Channel to Resist DoS Attacks in WLAN","author":"qu","year":"2005","journal-title":"Proc Int'l Conf Wireless Networks"},{"key":"ref100","doi-asserted-by":"publisher","DOI":"10.1109\/CMPASS.1994.318449"},{"key":"ref25","first-page":"451","article-title":"IPTraceback Solutions Based on Time to Live Covert Channel","author":"jones","year":"2004","journal-title":"Proc IEEE Int'l Conf Networks (ICON)"},{"key":"ref50","first-page":"194","article-title":"Covert Messaging Through TCP Timestamps","author":"giffin","year":"2002","journal-title":"Proc Privacy Enhancing Technologies Workshop (PET)"},{"key":"ref51","first-page":"178","article-title":"IP Covert Timing Channels: Design and Detection","author":"cabuk","year":"2004","journal-title":"Proc 11th ACM Conf Computer and Communications Security (CCS)"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TIT.2008.929965"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1007\/11560326_34"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.17487\/rfc2401"},{"key":"ref56","article-title":"Communication Using Phantoms: Covert Channels in the Internet","author":"servetto","year":"2001","journal-title":"Proc IEEE Int'l Symp Information Theory (ISIT)"},{"key":"ref55","author":"e?er","year":"2005","journal-title":"Kapazit\ufffdtsmessung eines verdeckten Zeitkanals \ufffdber HTTP"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.17487\/rfc0777"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/1180405.1180410"},{"key":"ref52","author":"berk","year":"2005","journal-title":"Detection of covert channel encoding in network packet delays"},{"key":"ref40","article-title":"Practical Data Hiding in TCP\/IP","author":"ahsan","year":"2002","journal-title":"Proc ACM Wksp Multimedia Security"},{"key":"ref4","article-title":"Eliminating Steganography in Internet Traffic with Active Wardens","author":"fisk","year":"2002","journal-title":"Proc 5th int'L Wksp Information Hiding"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1987.233153"},{"key":"ref6","doi-asserted-by":"crossref","DOI":"10.1117\/12.670123","article-title":"Data Exfiltration and Covert Channels","author":"giani","year":"2006","journal-title":"Proc SPIE Sensors and Command Control Commun and Intelligence (C3I) Technologies for Homeland Security and Homeland Defense V"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.17487\/rfc0791"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/5.771065"},{"key":"ref49","author":"perkins","year":"2005","journal-title":"Hiding out in Plaintext Covert Messaging with Bitwise Summations"},{"key":"ref7","author":"gligor","year":"1993","journal-title":"A guide to understanding covert channel analysis of trusted systems"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/49.668970"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.17487\/rfc0768"},{"key":"ref45","author":"abad","year":"2001","journal-title":"IP Checksum Covert Channels and Selected Hash Collision"},{"key":"ref48","article-title":"Covert Channels in the IP Time To Live Field","author":"zander","year":"2006","journal-title":"Proc Australian Telecommunication Networks and Applications Conf (ATNAC)"},{"key":"ref47","first-page":"189","article-title":"A Typical Noisy Covert Channel in the IP Protocol","author":"qu","year":"2004","journal-title":"Proc 25th Annu IEEE Int Carnahan Conf Security Technology"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.17487\/rfc0793"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1007\/11533962_11"},{"key":"ref44","doi-asserted-by":"crossref","DOI":"10.1007\/11558859_19","article-title":"Embedding Covert Channels into TCP\/IP","author":"murdoch","year":"2005","journal-title":"Proc 7th Information Hiding Wksp"},{"key":"ref43","article-title":"The Implementation of Passive Covert Channels in the Linux Kernel","author":"rutkowska","year":"2004","journal-title":"Proc Chaos Communication Congress"},{"key":"ref126","first-page":"110","article-title":"Web Tap: Detecting Covert Web Traffic","author":"borders","year":"2004","journal-title":"Proc 11th ACM Conf Computer and Communications Security (CCS)"},{"key":"ref125","doi-asserted-by":"publisher","DOI":"10.1109\/ICSMC.2003.1244631"},{"key":"ref124","first-page":"828","article-title":"Covert Channel Detection in the ICMP Payload Using Support Vector Machine","author":"sohn","year":"2003","journal-title":"Proc 18th Int'l Symp Computer and Information Sciences (ISCIS)"},{"key":"ref73","first-page":"50","article-title":"Cooking Channels","author":"castro","year":"2006","journal-title":"Hakin9 Magazine"},{"key":"ref72","article-title":"Deception on the Network: Thinking Differently About Covert Channels","author":"van horenbeeck","year":"2006","journal-title":"Proc 7th Australian Info Warfare and Security Conf"},{"key":"ref71","author":"kwecka","year":"2006","journal-title":"Application Layer Covert Channel Analysis and Detection"},{"key":"ref70","author":"dyatlov","year":"2003","journal-title":"Exploitation of Data Streams Authorized by a Network Access Control System for Arbitrary Data Transfers Tunneling and Covert Channels over the HTTP Protocol"},{"key":"ref76","author":"kaminsky","year":"2004","journal-title":"IP-over-DNS Using Ozyman"},{"key":"ref77","author":"gil","year":"2005","journal-title":"IP-over-DNS using NSTX"},{"key":"ref74","year":"2005","journal-title":"DNS Covert Channels and Bouncing Techniques"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.17487\/rfc2308"},{"key":"ref78","author":"group","year":"1996","journal-title":"RTP a transport protocol for real-time applications"},{"key":"ref79","first-page":"1079","article-title":"The Research on Information Hiding Based on Command Sequence of FTP Protocol","author":"zou","year":"2005","journal-title":"Proc 9th Int'l Conf Knowledge-Based Intelligent Info and Engineering Systems"},{"key":"ref60","first-page":"31","article-title":"HICCUPS: Hidden Communication System for Corrupted Networks","author":"szczypiorski","year":"2003","journal-title":"Proc 10th Int'l Multi- Conf Advanced Computer Systems"},{"key":"ref62","first-page":"1168","article-title":"A Covert Channel in MAC Protocols based on Splitting Algorithms","author":"li","year":"2005","journal-title":"Proc Wireless Commun and Networking Conf (WCNC)"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1007\/10719724_29"},{"key":"ref63","author":"marone","year":"2003","journal-title":"Adaptation and Performance of Covert Channels in Dynamic Source Routing"},{"key":"ref64","first-page":"88","article-title":"A Network Layer Covert Channel in Adhoc Wireless Networks","author":"li","year":"2004","journal-title":"Proc IEEE Conf Sensor and Ad Hoc Communications and Networks (SECON)"},{"key":"ref65","article-title":"Wi-Fi Advanced Stealth","author":"butti","year":"2006","journal-title":"Proc Black Hat US"},{"key":"ref66","article-title":"WLAN Steganography: a First Practical Review","author":"kr\ufffdtzer","year":"2006","journal-title":"Proc 8th ACM Multimedia and Security Wksp"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1145\/1005140.1005152"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.17487\/rfc2616"},{"key":"ref2","doi-asserted-by":"crossref","DOI":"10.21236\/ADA059221","author":"padlipsky","year":"1978","journal-title":"Limitations of End-to-End Encryption in Secure Computer Networks"},{"key":"ref69","author":"bowyer","year":"2002","journal-title":"Firewall Bypass via Protocol Steganography"},{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1145\/362375.362389"},{"key":"ref109","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1995.398932"},{"key":"ref95","first-page":"226","article-title":"Covert Channels in Trusted LANs","author":"donaldson","year":"1988","journal-title":"Proc 11th NBS\/NCSC National Computer Security Conf"},{"key":"ref108","doi-asserted-by":"publisher","DOI":"10.1109\/RISP.1994.296592"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1109\/32.106972"},{"key":"ref107","doi-asserted-by":"publisher","DOI":"10.1109\/SP.1987.10013"},{"key":"ref93","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2002.1176284"},{"key":"ref106","doi-asserted-by":"publisher","DOI":"10.1002\/j.1538-7305.1948.tb00917.x"},{"key":"ref92","doi-asserted-by":"publisher","DOI":"10.1145\/357369.357374"},{"key":"ref105","article-title":"Glavlit: Preventing Exfiltration at Wire Speed","author":"schear","year":"2006","journal-title":"Proc 5th Wksp Hot Topics in Networks (HotNets)"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1109\/SP.1982.10014"},{"key":"ref104","first-page":"8","article-title":"Reducing Timing Channels with Fuzzy Time","author":"wei-ming","year":"1991","journal-title":"Proc IEEE Computer Society Symp Research in Security and Privacy"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1109\/SP.1981.10008"},{"key":"ref103","doi-asserted-by":"crossref","first-page":"226","DOI":"10.1007\/3-540-45067-X_20","article-title":"Malicious ICMP Tunneling: Defense against the Vulnerability","author":"singh","year":"2003","journal-title":"Proc 8th Australasian Conf Information Security and Privacy (ACISP)"},{"key":"ref102","article-title":"Network Intrusion Detection: Evasion, Traffic Normalization","author":"handley","year":"2001","journal-title":"Proc 10th Usenix Security Symp"},{"key":"ref111","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.1991.213014"},{"key":"ref112","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.1993.315448"},{"key":"ref110","author":"gray","year":"2000","journal-title":"Countermeasures and Tradeoffs for a Class of Covert Timing Channels"},{"key":"ref98","article-title":"On Network Covert Channel Analysis","author":"jeng","year":"1987","journal-title":"Proc 3rd Aerospace Computer Security Conf"},{"key":"ref99","first-page":"28","article-title":"Architectural Implications of Covert Channels","author":"proctor","year":"1992","journal-title":"Proc 15th National Computer Security Conf"},{"key":"ref96","article-title":"Covert Channels Detection in Protocols Using Scenarios","author":"h\ufffdlou\ufffdt","year":"2003","journal-title":"Proc Wksp Security Protocols Verification (SPV)"},{"key":"ref97","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-30138-7_24"},{"key":"ref10","article-title":"Tor: The Secondgeneration Onion Router","author":"dingledine","year":"2004","journal-title":"Usenix Security Symp"},{"key":"ref11","author":"danezis","year":"2005","journal-title":"Covert Communications Despite Traffic Data Retention"},{"key":"ref12","article-title":"Keyboards and Covert Channels","author":"shah","year":"2006","journal-title":"Proc Usenix Security Symp"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/MICRO.2004.31"},{"key":"ref14","article-title":"Infranet: Circumventing Web Censorship and Surveillance","author":"feamster","year":"2002","journal-title":"Proc 11th Usenix Security Symp"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.5210\/fm.v2i5.528"},{"key":"ref118","doi-asserted-by":"publisher","DOI":"10.1109\/SECPRI.1995.398929"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/SADFE.2005.21"},{"key":"ref82","article-title":"LOKI2: The Implementation","volume":"7","year":"1997","journal-title":"Phrack Magazine"},{"key":"ref117","doi-asserted-by":"publisher","DOI":"10.1145\/168588.168604"},{"key":"ref17","year":"2003","journal-title":"Know Your Enemy Sebek ? A Kernel Based Data Capture Tool"},{"key":"ref81","author":"smeets","year":"2006","journal-title":"Research Report Covert Channels"},{"key":"ref18","first-page":"616","article-title":"Covert Distributed Processing with Computer Viruses","author":"white","year":"1989","journal-title":"Proceedings of the 9th Annual International Cryptology Conference on Advances in Cryptology"},{"key":"ref84","author":"zelenchuk","year":"2004","journal-title":"Skeeve ? ICMP Bounce Tunnel"},{"key":"ref119","doi-asserted-by":"crossref","first-page":"249","DOI":"10.1007\/978-3-540-30191-2_20","article-title":"Automatic Covert Channel Analysis of a Multilevel Secure Component","author":"lanotte","year":"2004","journal-title":"Proc 6th Int'l Conf Information and Commun Security (ICICS)"},{"key":"ref19","article-title":"Quasi-Anonymous Channels","author":"moskowitz","year":"2003","journal-title":"Proc Communication Network and Information Security (CNIS)"},{"key":"ref83","author":"st\ufffddle","year":"2005","journal-title":"Ptunnel - Ping Tunnel"},{"key":"ref114","doi-asserted-by":"publisher","DOI":"10.1109\/ISIT.2000.866341"},{"key":"ref113","doi-asserted-by":"publisher","DOI":"10.1109\/ICPADS.2005.290"},{"key":"ref116","doi-asserted-by":"publisher","DOI":"10.1109\/NDSS.1997.579214"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.17487\/rfc0959"},{"key":"ref115","author":"bell","year":"1973","journal-title":"Secure computer systems Mathematical Foundation"},{"key":"ref120","doi-asserted-by":"crossref","first-page":"313","DOI":"10.1007\/978-3-540-39927-8_29","article-title":"A Study on the Covert Channel Detection of TCP\/IP Header Using Support Vector Machine","author":"sohn","year":"2003","journal-title":"Proc Int Conf Inf Commun Security"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1145\/360051.360056"},{"key":"ref121","author":"tumoian","year":"2005","journal-title":"Detecting NUSHU Covert Channels Using Neural Networks"},{"key":"ref122","doi-asserted-by":"publisher","DOI":"10.1109\/LCN.2005.92"},{"key":"ref123","doi-asserted-by":"publisher","DOI":"10.17487\/rfc1323"},{"key":"ref85","author":"padgett","year":"2001","journal-title":"Corkscrew"},{"key":"ref86","author":"dyatlov","year":"2003","journal-title":"Firepass ? Is a Tunneling Tool"},{"key":"ref87","author":"leboutillier","year":"2005","journal-title":"HTTunnel"},{"key":"ref88","author":"lundstr\ufffdm","year":"0","journal-title":"MailTunnel"}],"container-title":["IEEE Communications Surveys & Tutorials"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx5\/9739\/4317615\/04317620.pdf?arnumber=4317620","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,3,21]],"date-time":"2023-03-21T16:12:28Z","timestamp":1679415148000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/4317620\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2007]]},"references-count":126,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/comst.2007.4317620","relation":{},"ISSN":["1553-877X","2373-745X"],"issn-type":[{"value":"1553-877X","type":"electronic"},{"value":"2373-745X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2007]]}}}