Steganalysis of Storage-based Covert Channels Using Entropy

Abstract

A covert channel is a means of transmitting information that is not normally allowed in a network protocol. For instance, unused or insignificant bits of a protocol could be used to transmit secret messages. We present a novel technique to uncover the existence of covert channels in networks. The technique uses entropy estimates, and can not only detect secret messages, but also estimate their size.