Method for identifying and blocking embedded communications

• US 8,443,101 B1
• Filed: 04/09/2010
• Issued: 05/14/2013
• Est. Priority Date: 05/24/2005
• Status: Expired due to Fees

• Current Assignee: the united states of america as represented by the secretary of the navy
• Original Assignee: the united states of america as represented by the secretary of the navy
• Inventors: Geissler, William Karl, McEachen, John Colin
• Primary Examiner(s): Etienne, Ario
• Assistant Examiner(s): Shiu, Ho
• Application Number:
  US12/757,429
• Time in Patent Office: 1,131 Days
• Field of Search: None
• US Class Current: 709/235
• CPC Class Codes: H04L 1/0061 Error detection codes
• CPC Class Codes: H04L 1/0079 Formats for control data H04L1/16 takes precedence; training sequences H04L25/00 and H04L27/00
• CPC Class Codes: H04L 1/1664 the supervisory signal being transmitted together with payload signals; piggybacking
• CPC Class Codes: H04L 1/1854 Scheduling and prioritising arrangements
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/163 In-band adaptation of TCP data exchange; In-band control procedures

Abstract

A method and system for steganography and steganalytic techniques are provided for effecting embedded communications in a variety of communication environments. One aspect may include an embedded transmitter for inserting embedded data into a packet and an embedded receiver for receiving the packet via, for example, a packetized communication network such as the Internet. Various aspects of the present invention provide robust communications with optimized throughput and may include various error handlers to maximize performance and ensure transfer of incorrupt data. A method for identifying and blocking embedded communications is also provided.

Claims

1. A method for identifying embedded communications in a communication network, the method comprising:

establishing a baseline checksum failure rate measurement for packets communicated in accordance with a specified communication protocol in a predetermined route in a transport layer of the communication network;

monitoring traffic on the predetermined route in the transport layer of the communication network to detect checksum failures of the packets;

establishing a current checksum failure rate measurement based on the detected checksum failures;

comparing the current checksum failure rate measurement with the baseline checksum failure rate measurement;

when the current checksum failure rate measurement is greater than the baseline checksum failure rate measurement, determining an embedded communication of covert data is being communicated in the specified communication protocol; and

blocking the embedded communication in the transport layer of the communication network by discarding packets having a detected checksum failure.

2. The method of claim 1, wherein the monitoring traffic and establishing a current checksum failure rate measurement includes use of a network monitoring log application.

3. The method of claim 1,

wherein said method is implemented in an application level firewall or a proxy server between a transmitter and a receiver in the communication network to thwart embedded communications of covert data.

4. The method of claim 1, further comprising:

communicating the determination of the embedded communication.