Indirect DNS covert channel based on name reference for minima length distribution

Covert Channels is the methods to conceal a message in network communications. Until now, covert channels based on packet length produce abnormal packet length when the size of the packets' length is minima. Standard DNS request has minima range in length, which is could not support by previous packet length covert channels. Abnormal packet length, especially in normal DNS requests will expose the covert channels to network security perimeter. Therefore, it motivated the study to propose a method based on reference matrix to hide the secret message in DNS request. Standard DNS requests' packet was collected from campus network. The proposed and the previous packet length covert channels were compared to standard DNS requests. The comparisons were done through percentages and frequency range of length and statistical T-test. The results show that, there is no significant different between the packet lengths of standard DNS request and propose covert, which outperform the previous packet length covert channels.