For network timing covert channels, hash-based covert carrier filtering reduces ML classifier AUC from 0.99 (L=0) to below 0.6 for all three classifiers (SVM, XGBoost, DT) at filter key size L=5, indistinguishable from the baseline normal-traffic AUC of 0.55. Sparse, aperiodic timing modulation events at L≥5 are masked by the network's inherent jitter, eliminating the autocorrelation and regularity signatures that standard timing-channel detectors exploit.

The hash-based filtering strategy shifts covert channel security from algorithm secrecy to key secrecy per Kerckhoffs's principle: even when the covert algorithm is fully exposed, an adversary without the pre-shared key cannot identify which sparse subset (~1/2^L) of packets carries covert data, transforming the detection problem from statistical pattern recognition to exhaustive key-space search. The authors recommend a minimum Input Key length of 128 bits.

§3.2, §4.1, §4.2.4 defense

At filter key length L=6, approximately 1.56% of packets are selected as covert carriers, yielding a unit covert capacity (packets required per covert bit) of 3.1–8 depending on bits embedded per packet. Each additional filter key bit halves the carrier selection rate (r = 1/2^L), so L=8 selects 0.39% of packets and pushes unit covert capacity above 32.

§4.2.2, §5.3.2, Table 6 evaluation

The filtering strategy introduces no measurable increase in bit error rate (BER) or reduction in effective transmission rate (ETR) under packet loss rates up to 15%, reordering rates up to 20%, and delay jitter up to 100±50 ms, because the filter only selects carriers — data embedding and extraction logic remain identical to unfiltered channels.

§5.3.1, Figure 5 evaluation

Per-packet processing overhead for SHA-256-based covert carrier filtering remains below 8 µs across all tested filter key sizes (L=1–8): storage channels (709-byte average payload) take 5.7–6.48 µs; timing channels (1146-byte average payload) take 7.44–7.87 µs, measured on a 12th-gen Intel Core i5-12400 at 2.50 GHz. This overhead does not cause packet loss or measurable end-to-end latency increase.

§5.3.3, Table 5 evaluation

Introducing hash-based covert carrier filtering does not affect bit error rate (BER) or effective transmission rate (ETR) of the underlying covert channel under packet loss up to 15%, reordering up to 20%, or delays up to 100±50 ms, because the filtering layer only governs carrier selection and leaves embedding and extraction logic unchanged. Results for L=0 and L=6 were statistically indistinguishable across all tested network impairment conditions.

§5.3.1, Fig.5 evaluation

Hash-based covert carrier filtering reduces ML classifier AUC for network storage covert channels from 1.0 (no filtering, L=0) to well below 0.7 when filter key size L≥6; SVM detection approaches random-guessing levels. The strategy selects a sparse, pseudo-random 1/2^L subset of packets as covert carriers using SHA-256 keyed by a pre-shared secret, diluting statistical anomalies in header field modifications with a large volume of unmodified legitimate packets.

§5.3.2, Fig.6 defense

The covert carrier filtering strategy shifts channel covertness from algorithm secrecy to key strength: once the embedding algorithm is exposed, an adversary must exhaustively search a 2^L key space to enumerate the covert carrier set rather than applying pattern recognition. At L=6, only 1/64 (~1.56%) of candidate packets are selected as covert carriers, yielding unit covert capacity Ucc=8 per packet for 8-bit embeddings and Ucc=3.1 for 21-bit embeddings.

§3.2, §4.2.2, Table 6 defense

Based on analysis of over 100,000 leaked Geedge Networks documents, InterSecLab (2025) found that Geedge supplied China-GFW-equivalent censorship and surveillance systems to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The systems include deep packet inspection, real-time mobile user monitoring, fine-grained traffic control, regionally customizable censorship rules, and — per WIRED's reporting — ML-based extraction of metadata from encrypted traffic to determine whether a flow is likely from a VPN or circumvention tool.

2026-anon-2026-27-vpn §8 (InterSecLab / WIRED section) dpiml-classifierfully-encrypted-detecttraffic-shape

Existing Provably Secure Steganography (PSS) schemes require access to the explicit output distribution of the generative model, a requirement that is impractical for black-box API deployments. This paper demonstrates that computational indistinguishability between normal and steganographic output can be achieved using only a seed-based model API, with no distribution access required.

2026-bai-provable-secure-steganography Abstract / §1 Introduction traffic-shapeml-classifier

NATA (Non-invasive Active Traffic-correlation Analysis) injects low-frequency bandwidth waveforms (sinusoidal, square-wave, triangular) into Tor TCP connections at an upstream gateway without endpoint compromise, payload decryption, or Tor-browser modification. BM-Net, a selective state-space classifier trained on the exit-side observations, achieves a 99.65% binary detection F1 score distinguishing watermarked from natural traffic on a 20,000-trace real-world dataset.

2026-fan-activeflowmark-assessing-tor §IV, §VI.D, Table III flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score for distinguishing bandwidth-watermarked Tor flows from natural traffic, outperforming all evaluated baselines (next best: TikTok at 75.96% F1). The accuracy gap stems from active perturbation imposing a deterministic low-frequency throughput constraint rather than relying on subtle natural metadata, making the detection task fundamentally easier than passive website fingerprinting.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III–IV flow-correlationtraffic-shapeml-classifier

BM-Net achieves a 99.65% binary detection F1 score distinguishing watermarked from natural Tor flows, and a 97.5% macro-F1 score for fine-grained modulation classification across sinusoidal, square-wave, and triangular patterns. The fine-grained test set contains 201 held-out samples collected from ten clients across five geographic regions (Europe, North America, Australia, Southeast Asia, East Asia), with training traces including traffic collected under WTF-PAD and Walkie-Talkie defenses.

2026-fan-activeflowmark-assessing-tor §VI-D, Table III, Table V flow-correlationml-classifiertraffic-shape

BM-Net achieves a 97.5% macro-F1 score for fine-grained classification of three modulation geometries (sinusoidal, square-wave, triangular) from noisy exit-side Tor observations using only 201 labeled test samples collected across cross-continental Tor paths. Residual errors concentrate between natural traffic and square-wave modulation, as abrupt low-rate transitions are partially smoothed by Tor multiplexing and network jitter. Per-class F1 is 95.7% for square-wave, the hardest class, versus 99.0% each for sinusoidal and triangular.

2026-fan-activeflowmark-assessing-tor §VI-D, Table V flow-correlationml-classifiertraffic-shape