A Survey of Covert Storage Channel Countermeasure and Elimination Methodologies to Develop NetWarden Architecture

There are several techniques for hidden transmission which takes place through covert channels such as network hidden timing channel, hidden storage channel, and hidden side channel and stenographic transmission. They are used for stealthy transmission of malware, to orchestrate nodes of botnets or to exfiltrate data over a dark web. This paper does a survey of construction of all network storage covert channels which makes use of IP and TCP header fields to transmit covert data and different countermeasures and elimination techniques either to slow down or to end the covert transmission. The document outlines efforts undertaken by researchers over a period of more than 20 years to either identify, eliminate, or reduce TCP/IP's hidden channels for network storage. In light of the regional network requirements for integration with the NetWarden architecture, a separate module concept called subversive channel manager, which is presented and discussed in this article, can be built using any one of these methodologies, or a combination of them, either to countermeasure or eliminate covert channel. Subversive channel manager is a proposed concept in this paper which is the detachable unit which can analyze and detect IPv4 traffic flow for network covert storage channel and can be programmed to eliminate the covert channel by selecting different methodologies of countermeasures and elimination techniques studied in this paper as required by network channel to eliminate detected covert channel.