Hiding the Trees in the Forest: Building Network Covert Channels with Hash-Based Covert Carrier Filtering

The hash-based filtering strategy shifts covert channel security from algorithm secrecy to key secrecy per Kerckhoffs's principle: even when the covert algorithm is fully exposed, an adversary without the pre-shared key cannot identify which sparse subset (~1/2^L) of packets carries covert data, transforming the detection problem from statistical pattern recognition to exhaustive key-space search. The authors recommend a minimum Input Key length of 128 bits.

§3.2, §4.1, §4.2.4 defense ml-classifiertraffic-shapefully-encrypted-detect generic

At filter key length L=6, approximately 1.56% of packets are selected as covert carriers, yielding a unit covert capacity (packets required per covert bit) of 3.1–8 depending on bits embedded per packet. Each additional filter key bit halves the carrier selection rate (r = 1/2^L), so L=8 selects 0.39% of packets and pushes unit covert capacity above 32.

§4.2.2, §5.3.2, Table 6 evaluation ml-classifiertraffic-shape generic

The filtering strategy introduces no measurable increase in bit error rate (BER) or reduction in effective transmission rate (ETR) under packet loss rates up to 15%, reordering rates up to 20%, and delay jitter up to 100±50 ms, because the filter only selects carriers — data embedding and extraction logic remain identical to unfiltered channels.

§5.3.1, Figure 5 evaluation traffic-shape generic

Per-packet processing overhead for SHA-256-based covert carrier filtering remains below 8 µs across all tested filter key sizes (L=1–8): storage channels (709-byte average payload) take 5.7–6.48 µs; timing channels (1146-byte average payload) take 7.44–7.87 µs, measured on a 12th-gen Intel Core i5-12400 at 2.50 GHz. This overhead does not cause packet loss or measurable end-to-end latency increase.

§5.3.3, Table 5 evaluation generic

Introducing hash-based covert carrier filtering does not affect bit error rate (BER) or effective transmission rate (ETR) of the underlying covert channel under packet loss up to 15%, reordering up to 20%, or delays up to 100±50 ms, because the filtering layer only governs carrier selection and leaves embedding and extraction logic unchanged. Results for L=0 and L=6 were statistically indistinguishable across all tested network impairment conditions.

§5.3.1, Fig.5 evaluation generic

Hash-based covert carrier filtering reduces ML classifier AUC for network storage covert channels from 1.0 (no filtering, L=0) to well below 0.7 when filter key size L≥6; SVM detection approaches random-guessing levels. The strategy selects a sparse, pseudo-random 1/2^L subset of packets as covert carriers using SHA-256 keyed by a pre-shared secret, diluting statistical anomalies in header field modifications with a large volume of unmodified legitimate packets.

§5.3.2, Fig.6 defense ml-classifiertraffic-shape generic

For network timing covert channels, hash-based covert carrier filtering reduces ML classifier AUC from 0.99 (L=0) to below 0.6 for all three classifiers (SVM, XGBoost, DT) at filter key size L=5, indistinguishable from the baseline normal-traffic AUC of 0.55. Sparse, aperiodic timing modulation events at L≥5 are masked by the network's inherent jitter, eliminating the autocorrelation and regularity signatures that standard timing-channel detectors exploit.

§5.3.2, Fig.7 defense ml-classifiertraffic-shape generic

The covert carrier filtering strategy shifts channel covertness from algorithm secrecy to key strength: once the embedding algorithm is exposed, an adversary must exhaustively search a 2^L key space to enumerate the covert carrier set rather than applying pattern recognition. At L=6, only 1/64 (~1.56%) of candidate packets are selected as covert carriers, yielding unit covert capacity Ucc=8 per packet for 8-bit embeddings and Ucc=3.1 for 21-bit embeddings.

§3.2, §4.2.2, Table 6 defense ml-classifier generic