{'fraction_non_alphanumeric': 0.029741148068669527, 'fraction_numerical': 0.014384388412017167, 'mean_word_length': 4.946465955537833, 'pattern_counts': {'":': 0, '<': 8, '<?xml version=': 0, '>': 8, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 2}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A Pattern-based Survey and Categorization of Network Covert Channel Techniques

Network covert channels are used to hide communication inside network protocols. Within the last decades, various techniques for covert channels arose. We surveyed and analyzed 109 techniques developed between 1987 and 2013 and show that these techniques can be reduced to only 11 different patterns. Moreover, the majority (69.7%) of techniques can be categorized in only four different patterns, i.e. most of the techniques we surveyed are very similar. We represent the patterns in a hierarchical catalog using a pattern language. Our pattern catalog will serve as a base for future covert channel novelty evaluation. Furthermore, we apply the concept of pattern variations to network covert channels. With pattern variations, the context of a pattern can change. For example, a channel developed for IPv4 can automatically be adapted to other network protocols. We also propose the pattern-based covert channel optimizations pattern hopping and pattern combination. Finally, we lay the foundation for pattern-based countermeasures: While many current countermeasures were developed for specific channels, a pattern-oriented approach allows to apply one countermeasure to multiple channels. Hence, future countermeasure development can focus on patterns, and the development of real-world protection against covert channels is greatly simplified.


INTRODUCTION
Covert channels represent unforeseen communication methods that break security policies [Lampson 1973]. Network covert channels transfer information through networks in ways that hide the fact that communication takes place (hidden information transfer). They are used in scenarios where simple communication is too revealing and just using encryption is not sufficient.
Network covert channels are considered a serious threat to Internet users [Gianvecchio and Wang 2007], because they can be used to hide command and control traffic of botnets, to coordinate DDoS attacks, to hide military and secret service communications, and to secretly leak sensitive data [Lucena et al. 2006;Zander et al. 2007]. On the other hand, network covert channels are a dual-use good and can prevent that illicit information transferred by journalists or whistle-blowers will be detected, and thus support the freedom of speech in networks with censorship [Zander et al. 2007].
Today's hiding techniques embed hidden information either 1. in protocol data units (PDUs), e.g. in unused or reserved header elements (sometimes also called header fields), 2. or through the timing of PDUs or protocol commands, e.g. by encoding a hidden message as a sequence of inter-arrival times or as a manipulated packet order.
A large amount of research was accomplished within the last decades to evaluate attributes of network protocols (e.g. IPv4, IPv6, TCP, and HTTP) regarding their potential to hide information. On the other hand, only little work exists on providing a general, protocol-independent approach. Although coarse categorizations of network covert channel techniques exist [Zander et al. 2007;Meadows and Moskowitz 1996;Shen et al. 2005;Llamas et al. 2005;Zhiyong and Yong 2009], no comprehensive and current catalog of the existing techniques is available.
Moreover, current techniques to counter network covert channels focus on single covert channels instead of common characteristics of multiple channels. The combination of dozens of countermeasures is required to achieve an acceptable protection, which is problematic in practice.
We consider a taxonomy for covert channel techniques very important in order to provide a framework to classify current and future research in the field, to determine similarities between techniques and to streamline the identification of novel countermeasures.
Patterns are a universal technique, which can be used to create taxonomies in a generic manner [Fincher et al. 2003]. In particular, the Pattern Language Markup Language (PLML) provides a consistent formalization of pattern descriptions and is the standard pattern language in the human computer interaction field [Fincher et al. 2003].
We apply the approach of pattern languages to network covert channels, extract common patterns for hiding techniques and combine them in a novel hierarchy. In comparison to existing taxonomy approaches, we also cover recent covert channels from 2009 to 2013. The focus of our pattern catalog is less on technical aspects but on the common abstract behavior of covert channel techniques, which is also a difference to existing categorizations.
We describe the identified covert channel patterns using PLML and publish an extensible pattern catalog, which will be available to the whole community as a moderated wiki. 1 Our catalog will simplify the future classification and novelty evaluation of upcoming covert channels. Only hiding techniques which require the integration of a new pattern into the catalog are very novel, others are simply variations of existing patterns. We show that the surveyed techniques can be reduced to only 11 different patterns. Moreover, the majority (69.7%) of techniques can be categorized in only four different patterns, i.e. most of the covert channel techniques we surveyed are very similar. Besides, our pattern catalog represents a systematic approach for identifying network covert channels in protocols in order to overcome the problem of requiring an exhaustive search [Sadeghi et al. 2012].
In addition, we present the idea of pattern variation. Pattern variation is based on pattern transformation [Engel et al. 2011;Engel et al. 2013], which allows authors and developers to alter the existing context of a pattern. For instance, a desktop browser interface pattern can be transformed to a user interface pattern for mobile devices and vice versa, i.e. the context changes from desktop to a mobile device [Engel et al. 2011].
Pattern variation is the first transformation-like approach for covert channels. We define the utilized network protocol as the pattern's context. Thus, a pattern's application can change from one network protocol to another -without re-implementing the hiding technique itself.
We also explain the improvement of pattern-based covert channels by introducing the concepts of pattern combination and pattern hopping. Pattern combination allows to use multiple patterns at the same time (e.g. for a single network packet or frame) to increase throughput while pattern hopping randomizes the use of patterns over time to increase stealthiness.
Furthermore, we motivate the development of countermeasures for network covert channels based on patterns. With patterns, covert channel protection in practice will become more realistic as the number of required countermeasures can be reduced greatly by targeting hiding techniques represented through generic patterns instead of targeting specific hiding techniques.
The remainder of this article is structured as follows. Section 2 covers fundamentals of network covert channels and discusses previous taxonomies while Section 3 explains the concept of patterns and their use in our taxonomy. We introduce the identified covert channel patterns and our hierarchical pattern catalog in Section 4 and present our concept of pattern variation in Section 5. Section 6 motivates and discusses pattern-based countermeasures. We conclude in Section 7.

COVERT CHANNEL FUNDAMENTALS AND RELATED WORK
First, we provide background information on network covert channels and afterwards discuss previous work on the categorization of covert channels.

Covert Channels
This section provides some background on covert channels and introduces the terminology used in the rest of the article.
2.1.1. History. Covert channels were introduced by Lampson in 1973 and represent a technique for security policy-breaking communication that was not foreseen by a system designer [Lampson 1973;Murdoch 2007]. Covert channels became an important topic in the military context where a high-security process having sensitive information (the HIGH process) must be prevented from leaking information to a process with lower security (the LOW process) through covert channels [Ogurtsov et al. 1996]. For instance, a LOW process classified as "SECRET" should not be capable to access "TOP SECRET" data from a HIGH process.
Initially, the research community focussed on local covert channels -covert channels that can be used to leak data from a HIGH process to a LOW process on the same system. With the rise of computer networks starting from the early 1990's, the focus shifted towards network covert channels. Network covert channels encode hidden data in network protocols (also referred to as overt channels). For network covert channels, the focus is not solely on establishing a policy-breaking communication anymore. They are more broadly viewed as approaches to provide a hidden communication channels [Millen 1999]. Traditionally, network covert channels were classified in storage channels, which encode hidden data in protocol fields, and timing channels, which hide information by manipulating the timing of frames, packets, or messages.
In comparison to network steganography, which hides information in carriers that are interpreted by humans (e.g. audio or video streams), covert channels utilize carriers interpreted by machines (e.g. network protocol headers) [Fisk et al. 2003].
2.1.2. Adversary Scenario. Simmons introduced the so-called Prisoner's Problem in 1983 [Simmons 1983]. Alice and Bob are kept in prison cells, separated from each other, and want to cooperate in order to escape from jail. The only way for Alice and Bob to exchange messages is to give the messages to the warden Walter. Walter can read all messages exchanged between both prisoners. He decides whether he delivers or manipulates a message and can even forge messages. Alice and Bob therefore need to use a policy-breaking communication which Walter is not aware of, i.e. a covert channel, to achieve their goal. For instance, the prisoners could alter the row pitch between written lines in letters they hand to the warden.
In the context of covert channels, an adversary is either active or passive. A passive adversary, or passive warden, tries to determine the presence of a network covert channel and to extract the embedded message or to prove the involvement of a party in the covert communication [Pfitzmann 1996]. An active adversary, or active warden, can also try to modify the covert communication by removing or blocking elements within the data transfer or inserting its own (bogus) messages into the channel [Pfitzmann 1996;Craver 1998].
2.1.3. Channel Noise. In general, all covert channels can be noisy since network frames or packets of the overt channels can be reordered, modified or lost, which can lead to bit errors or bit deletions/erasures in the covert channel. However, storage channels exploit the fact that overt protocols, such as TCP, have mechanisms for reliable data transport. If the header fields in which the covert channels are encoded are not changed in the network, these channels are effectively noise-free. Timing channels on the other hand are always noisy, since the network always affects the timing of frames, packets or messages depending on the network conditions (e.g. congestion).
Active wardens (e.g. traffic normalizers) may also introduce noise. However, we do not consider this type of noise as part of the covert channel characteristics.
2.1.4. Network Covert Channels. The majority of the network covert channels proposed early were storage channels, for example Girling proposed embedding hidden information in address fields [Girling 1987] and Rowland suggested embedding covert channels in different unused areas in the IPv4 header and in the TCP header [Rowland 1997]. Storage channels are easy to use, as the header fields used are not modified inside the network and hence there is limited channel noise. However, most of these channels are also easy to detect and eliminate.
A few timing channels were proposed early on, for example Wolf presented a covert channel based on the timing of message acknowledgements [Wolf 1989]. However, timing channels have only received more attention in recent years, for example Cabuk et al. proposed to encode covert data into varying packet rates over time [Cabuk 2006] and Berk et al. proposed to encode covert bits by manipulating the gaps between consecutive packets (inter-packet gaps) [V. . Timing channels are harder to use and always noisy, but they are also harder to detect and to eliminate.
Network covert channels can either be active by generating their own traffic or can piggyback on traffic created by a third party [Rutkowska 2004;Shah et al. 2006] to increase the channel's covertness.

Related Work
We now describe existing surveys and classifications of network covert channels, and how our novel pattern-based classification improves on these.
An early taxonomy of covert channels in multilevel security systems (MLS) was presented by Meadows and Moskowitz [Meadows and Moskowitz 1996]. Covert channels were associated with four different contexts based on the service conditions in which they occur: High-to-low service covert channels, low-to-high service covert channels, shared service covert channels, and incomparable service covert channels. The taxonomy in [Meadows and Moskowitz 1996] concentrates on early covert channel techniques that break security policies but do not necessarily provide stealthy communication. Our work focuses on network covert channels and on their hiding techniques instead of the service conditions in which they appear.
Shen et al. classified local covert channels and proposed the idea to counter local covert channels based on their characteristics [Shen et al. 2005]. In comparison, our work discusses network covert channels and provides a hierarchical and more extensive categorization.
Llamas et al. surveyed covert channels in Internet protocols [Llamas et al. 2005]. The first part of the paper covers fundamentals of covert channel research for both, local and network covert channels. The second part summarizes publications on network covert storage and timing channels in TCP/IP protocols. However, [Llamas et al. 2005] merely lists the different covert channels and makes no attempt to categorize them.
In 2007, Zander et al. [Zander et al. 2007] published the most comprehensive survey on network covert channels. The work covers the terminology, adversary scenario, covert channel techniques and countermeasures. Moreover, a categorization is applied which differs between channels taking advantage of unused header bits, header extensions and padding, the IP Identifier and the Fragment Offset, the TCP Initial Sequence Number (ISN), checksum fields, the Time to Live (TTL) field, the modulation of address fields and packet lengths, the modulation of timestamp fields, packet rate and timing, message sequence timing, packet loss and packet sorting, frame collisions, ad-hoc routing protocol-based techniques, Wireless LAN techniques, HTTP-and DNSbased techniques, application layer protocol-based channels and payload tunneling. The categorization in [Zander et al. 2007] is fine-grained: channels are not only categorized by their underlying technique, but also by the protocol layer they operate on. Also, [Zander et al. 2007] does not provide a hierarchy or a standardized pattern definition.
Zhiyong and Yong proposed a taxonomy based on entropy, and their work is the closest to our own [Zhiyong and Yong 2009]. Each channel falls into one out of three categories depending on the 'source' used to encode the covert data: variety entropy, constant entropy or fixed entropy. As in our own work, [Zhiyong and Yong 2009] motivates the development of prevention techniques with a focus on covert channel categories instead of single techniques. We propose a hierarchical and more fine-grained categorization, which is not based on entropy but on the actual hiding techniques. While the development of more detailed and particular countermeasures for the provided classification was left for future work in [Zhiyong and Yong 2009], our categorization enables more practical countermeasures that can address covert channel patterns.
We define an improved network covert channel taxonomy based on patterns and present the concepts of pattern variation, pattern combination and pattern hopping. Pattern variation allows the adaption of one hiding technique to arbitrary network protocols. Pattern combination allows to simultaneously use multiple patterns for a single PDU (e.g. a single network packet) or for a sequence of PDUs, while pattern hopping randomizes multiple pattern-based covert channels to improve stealthiness. Pattern hopping enables a channel to adapt itself to changing conditions in networks (e.g. switching to another pattern if one pattern is blocked). We describe patterns using a variant of the PLML/1.1 standard and we provide our catalog to the community in order to allow the further updating of the catalog. Another advantage over the existing surveys is the fact that we include recent publications from 2009 to 2013 into our categorization. Besides presenting the patterns, we also discuss countermeasures in the context of the identified patterns.

PATTERN-RELATED FUNDAMENTALS AND THEIR TAXONOMY USE
After introducing fundamentals and related work on covert channels, we now cover the fundamentals of patterns and pattern languages. We moreover describe our use of PLML.

Patterns and Pattern Languages
Graphical notations like UML 2.0 are powerful modeling languages for the description of specifications and the subsequent documentation [Object Management Group (OMG) 2010] but only represent the end result of the design process. Since the late 70s patterns, in comparison, enable the successful documentation of design decisions during the development process. In 1977, Alexander introduced first design patterns for solving problems in architecture and urban planning [Alexander et al. 1977]. Eighteen years later, the Gang of Four (GoF) transferred the pattern concept to the domains of software architecture and software engineering [Gamma et al. 1994]. Today, patterns are also used in fields of human computer interaction (HCI) research [Fincher et al. 2003], usability engineering [Marcus 2004], user experience [Tiedtke et al. 2005], task modeling [Gaffar et al. 2004], and application security [Yoder and Barcalow 1997].
As shown in Fig. 1, all patterns represent a relation between a certain design problem and a solution in a given context. The problem is a description of the issue to be solved. The solution refers to a specific design that solves the given problem. The context describes a repetitious set of cases in which the pattern can be used.
The use of patterns has a number of advantages [Seffah 2010]: patterns are simple and easily readable for designers, developers and researchers, and they are useful for the collaboration between the people involved. Furthermore, patterns are based on established knowledge and capture fundamental principles for good designs. Patterns  also specify requirements in a general way that allows different implementations of the same pattern.

Utilization of PLML for a Covert Channel-based Taxonomy
In order to ensure a certain standard, patterns are summarized in a so-called pattern catalog [Alexander et al. 1977]. A catalog of related patterns that belong to a common domain is a so-called pattern language [Seffah 2010]. Today, widely accepted pattern catalogs exist in the field of HCI, such as the catalogs presented by van Welie [van Welie 2001], Tidwell [Tidwell 2009], and van Duyne [Van Duyne et al. 2007]. However, these pattern catalogs are described in different styles.
To enable the clear definition and comparison of patterns, so-called schemes were introduced [Alexander et al. 1977]. These schemes are divided into sections of textual and graphical descriptions. However, no standardized description of pattern scheme attributes existed, as numerous pattern catalogs were created based on a different understanding of attributes. Due to these inconsistencies, searching and referencing patterns across different catalogs is difficult. To overcome this problem, a standardized pattern language was developed based on XML: the Pattern Language Markup Language (PLML) v. 1.1 [Fincher et al. 2003]. PLML unifies and standardizes the schemes of different authors with the help of XML tags. Each XML tag represents a part of the scheme. Tab. I describes the tags from the PLML 1.1 we used to define covert channel patterns. A correct assignment of a name for each pattern is important for the retrieval of a pattern when the pattern becomes part of a second catalog. <alias> Patterns can have different names, which are specified in the <alias> tag. The alias tag helps to find the same pattern when the pattern has different names in different catalogs. <illustration> This tag describes an application scenario for the pattern. <context> This tag specifies the situations to which the pattern can be applied. <solution> This tag describes the solution for a problem to which the pattern can be applied. The attributes problem and context (cf. Fig. 1) are usually blurred but often not separated into two attributes. <evidence> This tag contains additional details about the pattern and its design. Moreover, the tag can contain examples for known uses of the pattern. <literature> This tag lists references to publications related to the pattern. <implementation> This tag introduces existing implementations, code fragments or implementational details.

CLASSIFICATION OF COVERT CHANNEL PATTERNS BY USING PLML
We evaluated the covert channels research of the last decades and could classify the 109 evaluated covert channel techniques into 11 abstract patterns.

Coverage of Techniques
To select the most significant covert channel techniques for our pattern catalog, we took the existing surveys by Llamas et al. [Llamas et al. 2005], Zander et al. [Zander et al. 2007] and Zhiyong and Yong [Zhiyong and Yong 2009] into account and included the referenced publications in our evaluation. Moreover, we cover additional papers with a significant amount of citations or novelty that were not mentioned in the surveys (e.g. because of their later publication between 2009 and 2013).

Taxonomy/Classification
We provide a hierarchical view of the discovered patterns in order to structure our findings. The hierarchy is visualized in Fig. 2 where white boxes represent categories of patterns and gray boxes represent patterns. Conforming to the PLML standard, a covert channel pattern can also be a child pattern of a parent pattern, as in case of the Case pattern.
The major categorization of all network covert channels is into timing and storage channels. We introduce additional sub-categories for storage channels due to their diversity. We distinguish between storage channels which alter payload -these channels are steganographic channels and thus outside our scope -and storage channels which alter non-payload (e.g. header elements or padding bits). These non-payload modifying channels do either change or preserve the structure of a PDU -a novel difference we discovered in the analysis process.
In case of a structure modification, a pattern either alters the order of elements in the protocol header or it changes the size of the PDU. We discovered different patterns for both variants. On the other hand, if a pattern preserves the structure of a PDU, the pattern must modify a data element in the PDU (e.g. a header field). Besides the given hierarchical representation, Tab. II categorizes all patterns regarding the following additional aspects: -Semantic: The semantic of a PDU is changed if the pattern modifies header elements in a way that leads to a different interpretation of the PDU. For instance, the semantic of an IPv4 header is changed if a "record route" option is attached but preserved if the reserved flag is set as the reserved flag does not lead to a changed interpretation of the packet. In general, a channel raises less attention if the semantic of network data is not modified. -Syntax: We call a modification of the PDU structure a syntax modification. For instance, adding additional header elements changes the PDU structure. As with the semantic, a covert channel pattern can either modify or preserve the syntax.
The syntax categorization is only applied to storage channels as timing channels do not change the structure of a PDU. -Noise: In general, noise in the form of bit corruptions or packet loss can affect all presented patterns. Here we only categorize a pattern as noisy if the channel is a timing channel and thus, always faces noise, or if it is embedded in PDU fields which are modified in the network (like the TTL in the IPv4 header). Although active wardens can introduce additional noise in many patterns (e.g. by removing IPv4 options used to carry hidden data), we do not take normalization effects into account.
The semantic of Sequence and Position patterns is only preserved if an utilized element's position or the sequence of elements have no effect on the PDU's semantic. b Fragmentation can cause noise for channels using the Size Modulation pattern since routers can fragment large packets into multiple smaller packets. c The semantic of a PDU can change if the covert channel modifies currently unused elements (e.g. a set DF flag in the IPv4 header would prevent fragmentation). On the other hand, a utilization of currently unused elements can preserve the semantic, e.g. if the covert channel sets the MF flag in IPv4 to zero, the modification of the Fragment Offset will not lead to a changed semantic. d If the channel utilizes a protocol that provides packet sorting at the receiver side, the PDU Order pattern can preserve the semantic of the data transfer, otherwise it can change the semantic. e Intentionally corrupted PDUs are not interpreted and thus do neither change nor preserve the semantic of a PDU. f A value modulation can lead to noise (e.g. if the IP TTL is used) but can also be noiseless (e.g. if the source address is modulated).

Pattern List
We now describe all patterns. For better readability, in the following textual presentation of the pattern catalog we merged the content of the literature and evidence attributes in the evidence attribute and removed pattern attributes from PLML which are either redundant or not pertinent to our contribution. Some papers propose various techniques belonging to the same pattern (e.g. [Lucena et al. 2006] presents 10 hiding techniques forming part of the Add Redundancy pattern). In such cases, we do not mention all techniques explicitly.
For some patterns less than three use cases exist in the literature. In such cases, we added our own ideas for hiding techniques to provide a minimum of three use cases. Our hiding techniques have no citation, as they are initially proposed in this paper.

P1. Size Modulation Pattern:
Illustration: The covert channel uses the size of a header element or of a PDU to encode the hidden message. Context: Network Covert Storage Channels → Modification of Non-Payload → Structure Modifying Evidence: 1. Modulation of data block length in LAN frames [Girling 1987 [Getchell 2008] 7. Hide data in unused bits of the DHCP chaddr field if the hlen field is set to a value that is larger than the size of a network address [Rios et al. 2012] 8. Encapsulate IP packets with a smaller size than specified in the Ethernet frame size and use the space between the end of the IP packet and the Ethernet trailer for covert data [Muchene et al. 2013] 9. Encode hidden information through the presence/absence of "type" or "xml:lang" attributes in the Extensible Messaging and Presence Protocol (XMPP) or through the presence of leading/trailing white spaces in XMPP messages [Patuck and Hernandez-Castro 2013] P4. PDU Corruption/Loss Pattern: Illustration: The covert channel generates corrupted PDUs that contain hidden data or actively utilizes packet loss to signal hidden information. Context: Network Covert Storage Channels → Modification of Non-Payload → Structure Modifying Evidence: 1. Generate corrupted messages in broadcast erasure channels [Servetto and Vetterli 2001] 2. Transfer corrupted frames in IEEE 802.11 [Kraetzer et al. 2006] 3. A man-in-the-middle adversary between two VPN sites drops selected packets exchanged between the VPN sites to introduce covert information into an established connection of adversaries located within the VPN sites [Sadeghi et al. 2012].

P5. Random Value Pattern:
Illustration: The covert channel embeds hidden data in a header element containing a "random" value. Context: Network Covert Storage Channels → Modification of Non-Payload → Structure Preserving → Modification of an Attribute Evidence: 1. Utilize the IPv4 Identifier field [Rowland 1997] 2. Utilize the first sequence number of a TCP connection -the Inital Sequence Number (ISN) [Rowland 1997;Rutkowska 2004] 3. Hide data in the TCP ISN using a bounce server [Rowland 1997] 4. Utilize the DHCP xid field [Rios et al. 2012] 5. Utilize the Secure Shell (SSH) protocol Message Authentication Code (MAC field) [Lucena et al. 2004] Notes: As some header elements, such as the TCP ISN, follow a distribution which conforms to a particular operating system or context, their values cannot be considered perfectly random and the placement of "random" values in such elements can lead to different value distributions, which can be detected [Murdoch 2007].

P6. Value Modulation Pattern:
Illustration: The covert channel selects one of n values a header element can contain to encode a hidden message. Context: Network Covert Storage Channels → Modification of Non-Payload → Structure Preserving → Modification of an Attribute Evidence: 1. Send a frame to one of n available Ethernet addresses in the local network [Girling 1987] 2. Encode information by n of the possible IP header Time-to-live (TTL) values (e.g. a high or a low TTL value) [Zander et al. 2006] 3. Encode information by n of the possible Hop Limit values in the IPv6 header [Lucena et al. 2006] 4. Encode information by sending a packet using one of n possible application layer protocols [Wendzel and Zander 2012] or application layer ports [Borland 2008] 5. Encode information by selecting one of n possible messages types in the Building Automation and Control Networking (BACnet) protocol  5. Encode information in the target IP of address resolution protocol (ARP) messages [Ji et al. 2010] 6. Change the value of the "type" or "xml:lang" attributes in XMPP [Patuck and Hernandez-Castro 2013] 7. Send IPSec packets from one VPN site to specific destination IPs within another VPN site [Sadeghi et al. 2012].

P6.a. Case Pattern:
Illustration: The covert channel uses case-modification of letters in header elements to encode hidden data. Context: Network Covert Storage Channels → Modification of Non-Payload → Structure Preserving → Modification of an Attribute → Value Modulation Evidence: 1. Case modification in HTTP headers [Dyatlov and Castro 2005] 2. Modify the case of the "type" or "id" attributes in XMPP [Patuck and Hernandez-Castro 2013] 3. Case modification in SMTP, Post Office Protocol (POP3), or Network News Transfer Protocol (NNTP), commands and headers

P6.b. Least Significant Bit (LSB) Pattern:
Illustration: The covert channel uses the least significant bit(s) of header elements to encode hidden data.
Context: Network Covert Storage Channels → Modification of Non-Payload → Structure Preserving → Modification of an Attribute → Value Modulation Evidence: 1. Encode into the IPv4 timestamp option by effectively sending at even/odd times [Handel and Sandford 1996] 2. Modify the low order bits of the timestamp option in TCP [Giffin et al. 2003] 3. Utilize the least significant bits of the secs field in the DHCP header [Rios et al. 2012] 4. Encode covert bits in slight modifications of view angles (yaw, pitch) of player's avatars in the Quake3 multiplayer game protocol [Zander et al. 2008 [Sadeghi et al. 2012].

P8. Inter-arrival Time Pattern:
Illustration: The covert channel alters timing intervals between network PDUs (interarrival times) to encode hidden data.

Context: Network Covert Timing Channels
Evidence: 1. Alter the timings between LAN frames sent [Girling 1987] 2. Alter the response time of a HTTP server [Esser 2005] 3. Alter the timings between BACnet/IP packets  4. Introduce artificial delays into inter-arrival times of SSH packets sent based on keyboard input (interactive shell) [Shah et al. 2006] 5. Acknowledge IEEE 802.2 I-format frames immediately or after a second Iformat frame was received [Wolf 1989] 6. A man-in-the-middle (MitM) adversary in the public network between two VPNsecured sites modifies the inter-arrival times of packets transferred between two man-in-the-edge (

P9. Rate Pattern:
Illustration: The covert channel sender alters the data rate of a traffic flow from itself or a third party to the covert channel receiver. Alias: Throughput Pattern Context: Network Covert Timing Channels Evidence: 1. Exhaust the performance of a switch to affect the throughput of a connection from a third party to a covert channel receiver over time [Li et al. 2011] 2. Manipulate the serial communication port's throughput by delaying Clear to Send/Ready to Send commands [Handel and Sandford 1996] 3. Directly alter the data rate of a legitimate channel between a covert channel sender and receiver.

P10. PDU Order Pattern:
Illustration: The covert channel encodes data using a synthetic PDU order for a given number of PDUs flowing between covert sender and receiver.  (4), modify the order of IPSec packets for inbound or outbound VPN traffic [Sadeghi et al. 2012]. 3. A covert channel sender transfers frames in a way they are sent before or after a legitimate user's frames in CSMA/CD networks. The covert channel receiver analyzes the order of arriving frames [Handel and Sandford 1996].  [Kraetzer et al. 2006] 3. Encode hidden data by re-transmitting selected TCP segments.

Occurrence Rates of Particular Patterns
Besides the fact that we were able to 'reduce' the 109 hiding techniques to only 11 patterns, our findings also show that the majority (76 of 109 or 69.7%) of hiding techniques is based on only four patterns, namely the Reserved/Unused pattern (24 techniques), the Add Redundancy pattern (21 techniques), the Value Modulation pattern (21 techniques, including its child patterns Case and LSB), and the Random Value pattern (10 techniques). In other words, many of the surveyed and analyzed techniques are of relatively little novelty as they are based on existing techniques. Fig. 3 compares the number of covert channel techniques associated with the particular patterns. It would be interesting to compare the occurrence rates of patters in the literature with their actual number of uses in practice. However, no information about the usage rates of covert channels are available.

Extensibility of the Pattern Catalog
The patterns introduced in our work will be made available publicly online in a moderated wiki. A wiki allows the collaboration among experts from both, research institutions and industry: it allows active discussion and, through moderation, the controlled extension and modification of the pattern catalog. If a novel hiding technique requires the integration of a new pattern, researchers can add the pattern to the catalog. On the other hand, we can add upcoming hiding techniques that are based on an already existing pattern to the evidence property of the particular pattern.

VARIATION OF COVERT CHANNEL PATTERNS
Covert channels are not only used for malicious purposes (e.g. the control of botnets) but are also used to support the freedom of speech (e.g. of journalists). Furthermore, research on covert channel improvements enables the further development of necessary countermeasures against malicious users; the research community must identify improvements for covert channel techniques before malicious users take advantage of them.
We will now describe the variation of the patterns defined in the previous section. A pattern variation automatically adapts a pattern to a new context. In case of network covert channels, we define the utilized network protocol, used as carrier for the hidden data, as the context. If the channel switches the protocol, the context changes as well and thus, the pattern must be adapted to the new context. For instance, a pattern that was previously applied to hide data in IPv4 can be adjusted to hide data in IPv6.
A pattern variation is only useful if it is an automatic process for both, the sender and the receiver. The automatic process generates new code that implements the pattern for the altered context. Thus, a pattern variation eliminates the necessity of programming a pattern from scratch if it needs to be adapted to another network protocol. Fig. 4 visualizes the concept of a covert channel pattern variation: While a general network protocol implementation is required to hide data within a protocol or the protocol's timing behavior, a pattern has information which enable the application of the pattern to other network protocols.

PLML-based Pattern Variation
Our approach is similar to that of Engel et al. who store the information required for a pattern transformation within the implementation property of PLML [Engel et al. 2011;Engel et al. 2013]. We introduce so called settings into the implementation property. These settings contain all significant information for a variation.
Engel et al. define a configuration for each context of a pattern [Engel et al. 2013]. We match this aspect as well by introducing specific settings for each supported overt network protocol. For instance, a protocol A may provide 4 bits of space for a pattern and the location of the bits is at an offset of 6 bits from the first bit of the header. In the new context of protocol B, the pattern can only use 3 bits and these 3 bits are located at an offset of 20 bits from the first bit of protocol B's header. Figure 5 shows example settings for the Random Value pattern. For IPv4, these settings would utilize the 16 bit Identifier field and for TCP, the 32 bit ISN would be settings . ipv4 . Offset =32; settings . ipv4 . Len =16; settings . tcp . Offset =32 settings . tcp . Len =32 settings . tcp . OnlyFirstPkt = true used. As the ISN is only random in the first packet of a flow, a limitation (OnlyFirstPkt) must be enforced.
We found that the following settings can be necessary for covert channel patternsdepending on the particular pattern.
-Offset: Number of bits between the first bit of the protocol header and the first bit of the utilized area -Len: Size of the utilized area -OnlyFirstPkt: Only use the first packet of a flow (e.g. for the TCP ISN) -Min/MaxSize: Minimum/maximum size of a (padding) field or of a frame -Min/MaxElements: Minimum/maximum number of elements to use (e.g. minimum number of IPv4 options or DHCP options for the Position pattern or the Sequence pattern) -ValueRange/ValuesAllowed: These fields limit the range of allowed values for a field and the particular values which can be stored in the field. For instance, the Value Modulation pattern may only be allowed to place the values "a"-"j" in a field or only the values "yes", "no" and "optional". For passive covert channels, i.e. those piggybacking third-party traffic, constraints can be defined in order to allow only limited modulations. For instance, a constraint can allow only TTL modifications in a range of +/-1. -Min/Max/DistributionIPG: Minmum/maximum time difference between packets or definition of a value distribution for these time differences. While this attribute is generally useful, it is especially required to configure limits for the Inter-arrival Time pattern. -Min/MaxRate: Minimum/maximum packet rate. This attribute is similar to the Min/MaxIPG attribute but configures the number of PDUs the channel is allowed to transfer per time t. The attribute is of general use but especially required to configure the limits for the PDU Order pattern to ensure stealthiness. In future work rate profiles could be defined as well in order to match the actual traffic behavior as close as possible.
While the actual hiding technique of a pattern can be adapted automatically, protocols with header fields which depend on other header fields still require the additional use of libraries and tools like scapy 2 . For instance, the calculation of the IPv4 Checksum as well as the adjustment of the Internet header length and total length fields are not included in the pattern variation process and must be done additionally. We therefore decided to include scapy commands into our settings as scapy automatically calculates values for header fields the user does not not explicitly define. Thus, the use of scapy eliminates the need to implement a variation's utilized network protocols. Therefore, additional settings must be defined in the form settings.protocol.value=bit value,scapystring=command.
Like our pattern catalog, the settings proposed for pattern variation also serve as a basis for future work, i.e. they can be extended by adding additional settings in the future.

Requirements-based Pattern Variation
Pattern variation is also applicable in the context of situational requirements. For instance, the transfer of a video stream over a covert channel requires a higher throughput than the transfer of a password within the same time.
Each overt channel (the utilized network protocol) provides a particular amount of space to carry hidden data and has a different potential to raise attention [Wendzel and Keller 2011]. A pattern variation for a given requirement can thus also switch the overt channel used in order to provide a high throughput or a high covertness. If the pattern is required to transfer a video stream it may use an overt channel providing a high throughput while the pattern may use an overt channel with a low throughput and high covertness if only a few hidden bits must be transferred. Therefore, a pattern cannot only change the overt channel but can also adjust the number of manipulated bits in the overt channel as fewer modified bits are less suspicious [Wendzel and Keller 2011].

Similar Approaches to Pattern Variation
Similarly of using multiple covert channel techniques simultaneously (such as in [Wendzel and Keller 2011;Yarochkin et al. 2008]), a covert channel can use multiple patterns simultaneously. Therefore, a pattern must not be varied but combined or switched.

Pattern Combination.
To increase the throughput of a covert channel and its stealthiness, we can combine multiple patterns, e.g. by applying them in parallel to a single packet -an idea already shown for single hiding techniques in the field of network steganography [Fraczek et al. 2012] -or sequentially to subsequent packets. As an example, consider the parallel application of the Random Value and Add Redundancy patterns: A covert channel sender could modify the Identifier in the IPv4 header as well as it attaches an IPv4 option used to carry additional hidden data. A parallel application of a particular set of patterns to a single packet may not always be possible. In future work we will determine dependencies between patterns so that feasible pattern combinations can be identified. Much simpler is the sequential application of different patterns to subsequent packets. For instance, for one packet the Value Modulation pattern could be used to modify an unused field and LSB value modulation could be used for another field for the following packet.

Pattern
Hopping. Sequential pattern combination uses a simple linear combination, which could be easily detected. To make detection more difficult, we propose a simple mechanism based on the concepts of protocol hopping covert channels [Wendzel and Keller 2011] and synchronized random number generators similar to [Gianvecchio et al. 2008].
Let P be a set of patterns. The sender S and receiver R agree to use a certain cryptographically secure pseudo-random number generator (CSPRNG) with a certain seed value V . The agreement on CSPRNG and V has to be done separately over a secure transmission channel, since the covert communication could be easily uncovered if both are known. The sender S and receiver R initialize their CSPRNG with V . Both CSPRNGs now are synchronized. Let t be the sequential number of the transferred pattern, incremented each time a packet is being sent (and received). t is initialized with 0. For example, t could also be the timestamp or the sequence number of a packet (immutable between S and R). S chooses p i ∈ P where i = CSPRNG(V, t) mod |P | and applies p i to the actual packet to send. R knows the pattern since R gets t and knows V and CSPRNG. Thus, the patterns used are randomized. Instead of using a pattern for each packet we can also increase the modulus and 'unmapped' patterns are ignored (limiting the bandwidth).
As network packets, and with it, the transfer of covert data, can be error-prone due to packet loss or re-transmissions caused by transport layer protocols, a reliable communication is a necessity to prevent the de-synchronization of the CSPRNG. To overcome this synchronization problem, so-called micro protocols can be used, i.e. covert channel-internal control protocols with reliability features [Ray and Mishra 2008]. Micro protocols have been well studied over the last years and optimized micro protocols are available [Wendzel and Keller 2012b;Backs et al. 2012].
Moreover, the selection of patterns can be done with adaptive techniques [Yarochkin et al. 2008]. Adaptive covert channels dynamically customize the use of covert channel techniques in order to bypass blocked communications [Yarochkin et al. 2008] and thus provide a more reliable data transfer. In combination with micro protocols and pattern hopping, adaptive covert channels could not only switch between network protocols but between patterns in case a technique or pattern will be administratively blocked. While it is comparably easy to block a specific covert channel technique, it is more challenging to eliminate a covert channel that switches to a different pattern if one pattern was blocked, as this requires implementing countermeasures against multiple patterns.

COUNTERMEASURES
Protection techniques for covert channels either aim on eliminating a covert channel, limiting a channel's capacity or detecting a covert channel [Zander et al. 2007]. The research community considers covert channel protection a challenging task [Gianvecchio and Wang 2007] and due to the large number of existing covert channel techniques, it is currently difficult to counter all covert channels in practice.
Previous approaches only targeted selected covert channels in a given network protocol. The introduction of patterns which comprise a generic description of a hiding technique enables a more practical approach to develop countermeasures for a whole set of hiding techniques linked to the same pattern. As our 11 patterns represent at least the 109 discussed covert channel techniques, a comparably small number of approaches would be enough to counter these covert channel techniques. Thus, the integration of pattern-based countermeasures will lead to a significant reduction of necessary protection mechanisms in practice.
On the other hand, some specific countermeasures may be more effective than a more general technique that can counter all covert channels associated with a partic-ular pattern. For instance, some countermeasures are optimized for detecting hidden data in a header field of protocol X. The direct adaption of such a countermeasure to another network protocol, where the particular header field is linked to a different value distribution, may lead to a lower detection accuracy. Therefore, countermeasures for patterns require a variation (analog to Sect. 5) as well in order to get adapted to particular network protocols on demand.

Countermeasures for Patterns
In order to evaluate the applicability of existing countermeasures to patterns, we focused on countermeasures covered by the surveys of Llamas et al. [Llamas et al. 2005] and Zander et al. [Zander et al. 2007]. Our evaluation does not include measures that focus on local covert channels (e.g. the fuzzy time approach [Hu 1991]) or on the prevention of covert channels at the time of system development (e.g. the shared resource matrix methodology or covert flow trees [Kemmerer 1983;Porras and Kemmerer 1991]). In particular, we considered traffic normalization, the network pump, statistical approaches, and machine learning approaches.
6.1.1. Traffic Normalization (TN). Traffic normalizers remove ambiguities and policybreaking elements in network traffic, which especially enable them to counter storage channel patterns. The application of normalizers results in side-effects as the normalization of PDU headers often includes setting header fields to default values, i.e. these fields are not usable anymore [Handley et al. 2001]. Existing traffic normalizers are, for instance, the network-aware active warden [Lewandowski et al. 2007], the Snort normalizer [Snort Project 2012], and norm [Handley et al. 2001] which, taken together, provide more than 100 normalization techniques. Literature divides normalizers into stateless and stateful normalizers. Stateless normalizers focus on one packet at a time, and they do not take previous packets into account, while stateful normalizers cache information of previously received packets to evaluate traffic in a more advanced manner and can also detect more covert channels, as shown in [Lucena et al. 2006]. For always legitimate values (e.g. allowed values for the IPv4 protocol field or allowed destination addresses in LAN frames), the creation of normalization rules is challenging and linked to constrictive side-effects [Fisk et al. 2003], which makes normalization ineffective against different forms of the Value Modulation pattern 3 . A problem of traffic normalizers is their limited buffer size [Handley et al. 2001]: Buffers cache packets of data flows to re-assemble these flows. Normalization techniques which require large buffers, for instance, to re-order network packets (PDU Order pattern) or to normalize the inter-arrival timings and data rate (Inter-arrival Time pattern and Rate pattern), are only useful as long as the normalizer's resources are not exhausted. Another problem, especially in IP networks, is that traffic can take different routes and thus, not all packets of a connection must pass a normalizer which can result in incomplete information about connections (e.g. missed packets of TCP handshakes [Handley et al. 2001]). Traffic normalization can only be applied to all network traffic ('blind' normalization) if the normalization is transparent (it does not affect the traffic significantly). Hence, blind normalization cannot eliminate all covert channels. However, if accurate detection methods exist, detected covert channels can be eliminated or limited using targeted normalization or even disruptive measures, e.g. the overt traffic could simply be blocked. 6.1.2. Network Pump and Related Concepts (NPRC). Techniques to limit the capacity of network covert timing channels based on the Inter-arrival Time and Rate patterns (e.g. the pump [Kang and Moskowitz 1993] and the ACK filter [Ogurtsov et al. 1996]) are traffic normalizers as well. These countermeasures either prevent the entire data flow from HIGH to LOW or do only allow the transmission of acknowledgement messages from HIGH to LOW (related to a data flow from LOW to HIGH). Another approach presented by Wendzel and Keller [Wendzel and Keller 2012a] limits the covert channel discussed in [Wendzel and Zander 2012] (Value Modulation pattern) which encodes hidden information in the sequence of utilized network protocols. The approach is called a protocol switching-aware active warden (PCAW) and introduces delays on protocol switches. As in the case of traffic normalization, buffer sizes and routing effects limit the capabilities of the NPRC approaches.
6.1.3. Statistical Approaches (SA). The detection of covert timing channels based on inter-arrival times was achieved by Cabuk et al. [Cabuk et al. 2009] by representing recorded, rounded inter-arrival times as strings. The strings are compressed and the compressibility of a string is used as an indicator for the presence of a covert timing channel. The method takes advantage of the fact that covert timing channels generate traffic with a few characteristic inter-arrival times to signal the different covert bits and thus, result in a few similar strings which can be compressed more efficiently than normal random inter-arrival times. Cabuk et al. presented two additional statistical approaches, one based on the calculation of the -similarity and another based on the standard deviation of recorded inter-arrival times [Cabuk et al. 2009]. Berk et al. developed another detection approach for inter-arrival time channels . Their technique uses the fact that timing channels generate inter-arrival times that differ from inter-arrival times of normal application traffic regarding the percentage of transfered packets for a given inter-arrival time range. Gianvecchio and Wang showed that covert timing channels can be detected with high accuracy by analyzing the entropy of inter-arrival times [Gianvecchio and Wang 2007].
While statistical approaches have been effective primarily against channels based on the Inter-arrival Time pattern and the Random Value pattern, their application to all other patterns is thinkable, since the use of all covert channels leads to changes of statistical value distributions.
6.1.4. Machine Learning (ML). Covert channels can be detected using supervised ML approaches where some statistical features are used to characterize covert channels and normal traffic. Classifier models are then trained based on provided examples of features of covert channels and normal traffic. Sohn et al. demonstrated that simple covert channels encoded in the IP ID or TCP ISN field can be discovered with high accuracy by Support Vector Machines (SVMs) [Sohn et al. 2003]. Tumoian et al. showed that a neural network can detect Rutkowska's TCP ISN covert channel [Rutkowska 2004] with high accuracy [Tumoian and Anikeev 2005] (both Random Value pattern). Zander et al. demonstrated that inter-packet timing channels can be detected by C4.5 decision trees trained on several features [Zander et al. 2011] (Inter-arrival Time pattern). Wendzel and Zander showed that C4.5 decision trees also detect simple protocol switching channels (Value Modulation pattern) with high accuracy [Wendzel and Zander 2012]. Besides the mentioned patterns, the application of ML to detect all other patterns appears possible. 6.1.5. Applicability of Countermeasures. Tab. III summarizes our findings on the applicability of the discussed countermeasures in the context of covert channel patterns.
We did not only take existing applications of countermeasures but also potential applications into account, since no pattern-specific implementations are available yet. In general, the prevention of covert channels is always feasible if all traffic is blocked but such approaches are not applicable in practice or demand a high-quality covert channel detection. Therefore, Tab. III does not cover techniques which block the entire traffic.

Illustration: Traffic Normalization
Although traffic normalization was never discussed in the context of covert channel patterns, the existing normalizers already have pattern-oriented capabilities. As dozens of normalization techniques exist, we will discuss only selected ones to show that pattern-oriented countermeasures are feasible. For instance, existing normalizers can replace the TTL of IPv4 packets with a fixed value to eliminate covert channels. Traffic normalizers can apply the same technique to counter covert channels in the IPv6 hop limit field. The technique thus counters the LSB pattern even in case of a pattern variation to different network protocols. The LSB pattern could also be applied to the BACnet NPDU hop count field -no new normalization technique must be implemented for the same pattern.
Fisk et al. mention general cases for the application of traffic normalization [Fisk et al. 2003]. For instance, unused fields can be cleared (Reserved/Unused pattern); decreasing fields (like the TTL) can be set to fixed values (LSB pattern and Value Modulation pattern); and derivate fields (i.e. those depending on other fields, like the Checksum or the Internet Header Length in IPv4) can be re-placed with correct values or the particular packets can be dropped (PDU Corruption/Loss pattern). Such general applications of normalization rules can be used in a protocol-independent manner and are thus capable of countering a whole set of hiding techniques which are based on the same pattern.

Illustration: Protocol Switching-aware Active Warden
The aforementioned PCAW [Wendzel and Keller 2012a] introduces delays on protocol switches and thus limits the bitrate of covert channels that signal hidden information through the use of particular network protocols. As shown in [Wendzel and Keller 2012a], the PCAW cannot only be successfully applied to protocol switching covert channels based on IPv4 but also to building automation networks using BACnet and thus exemplifies the variation of countermeasures as well.

CONCLUSION
We evaluated 109 network covert channel techniques from the last decades and extracted abstract patterns from these techniques. We were able to represent all 109 techniques by 11 patterns which we arranged in a hierarchical catalog based on the Pattern Language Markup Language (PLML). Moreover, we showed that the majority of these techniques can be reduced to only four different patterns -evidence that many network covert channel techniques invented represent very similar techniques.
The pattern catalog will be provided on-line in order to allow the scientific community to modify and extend the covert channel pattern collection. Our catalog eases the novelty evaluation of future covert channel techniques.
We presented the concept of pattern variation for covert channels. Pattern variation allows the automatic adaption of the generic hiding technique to different network protocols without requiring a re-implementation of the technique itself. Since covert channels are a dual-use good, we also introduced the pattern-based approaches pattern hopping and pattern combination to improve the throughput and stealthiness of covert channels.
If prevention approaches counter generic patterns instead of hiding techniques, the number of necessary countermeasures is greatly reduced. Under the assumption that future techniques for covert channels will often fall into one of the existing pattern categories, the value of our pattern-based approach increases even further.
Future work will comprise the generation of a PLML-based pattern catalog for local covert channels and for steganographic network channels as well as the evaluation of countermeasures for local and steganographic network channels against the particular patterns.