Securing Networks Against ICMP Covert Channels: Detection and Countermeasures
Giovanni Kaddissi, Makram W. Hatoum, Khouloud Samrouth, Ali El Attar · 2025
Data exfiltration remains a major challenge in cybersecurity, with adversaries continuously devising innovative methods to extract confidential information from targeted systems stealthily. This research provides an in-depth examination of various techniques used for unauthorized data transfers, focusing particularly on covert channels within the TCP/IP protocol suite. Central to our investigation is the Internet Control Message Protocol (ICMP), a commonly underestimated protocol vulnerable to misuse for covert data extraction. By analyzing real-world incidents and experimental simulations, we demonstrate how ICMP can be exploited as a conduit for data breaches. Our study introduces the ICMP Covert Channel Ranking System (ICMP C2RS) model, which detects covert data exfiltration through ICMP packets in real-time. Our model effectively uncovers anomalies indicative of covert communication by analyzing three key sections of ICMP packets—the IP header, ICMP header, and ICMP payload. The findings from our simulations validate the efficacy of the ICMP C2RS model in identifying covert channels.