An Evaluation Framework for the Analysis of Covert Channels in the TCP/IP Protocol Suite.
David Llamas, Alan Miller, Colin Allison · 2005
Abstract: Information hiding techniques can be used by criminals and terrorists to communicate over covert channels within the TCP/IP protocol suite and can be used to overcome firewalls and most other forms of network intrusion detection and prevention systems. In this work we describe the covert channel concept and weaknesses in the five layered TCP/IP layered model. We then present an evaluation framework for the analysis of covert channels and illustrate this with an example featuring the heavily used IPv4 datagram header.