LC-IPL: locating covert data in the IPv4 header using LSTM

Internet Protocol version 4 (IPv4) is the most used Network Layer protocol, thus, ensuring the security aspect of this protocol is a vital concern. One such aspect includes identifying the possibility of Network Covert Channels (NCCs) over IPv4. NCCs facilitate information hiding in network protocols by hiding secret data in network traffic flows which can be used for malicious data transfers. Various techniques have been developed for detecting the presence of such covert channels over the IPv4 header. As per our knowledge, no work focuses on finding the location of covert data in an IPv4 packet’s header which is a vital step towards interpreting the hidden data. Thus, with this aim, this paper presents LC-IPL, a system that uses Long Short Term Memory classifier to identify a covert IPv4 packet and further locates the hidden data in that packet’s header. As no benchmark dataset was available that contained both normal and covert IPv4 packets, a dataset containing such packets was generated. Normal IPv4 packets were randomly picked from a CAIDA’s dataset and IPv4 packets with covert data were obtained using a network covert channel generation tool. The proposed system is compared with six different ML/DL classifiers. Experimental results show that LC-IPL detects and finds the header field carrying the covert data with an accuracy of 99.13% which is higher than the other considered counterparts.