How to hide bit frequency of the inter-packet delays covert channel?

Question

I encode a hidden message as different delays between packets of another data stream.

My implementation now is that for each bit,

• if the bit is 0, a inter-packet delay between min and middle is generated and
• if the bit is 1, a inter-packet delay between middle and max is generated.

Here's my code in Python:

binary_string = ''
m_time = 0.5
min_time = 0.2
max_time = 0.9
csv_array = []
package_stream_array = []
last_timecode = 0
for c in secret:
    binary_string += bin(ord(c))[2:].rjust(7,'0')
for key, digi in enumerate(binary_string):
    if digi == '0':
        last_timecode += uniform(min_time, m_time) 
        csv_array.append(last_timecode)
        package_stream_array.append("p({0:d},{1:.2f})".format(key+1, last_timecode ))
    elif digi == '1':
        last_timecode += uniform(m_time,max_time)
        package_stream_array.append("p({0:d},{1:.2f})".format(key+1, last_timecode))
        csv_array.append(last_timecode)
for memeber in package_stream_array:
    print memeber

After I plot a chart, I found the 0,1-frequency still can be observed.

Is there a better way to improve this?

Answer 1

With Steganography, we take a short message, and embed that into a much larger signal, with the goal being that someone seeing the larger signal cannot tell that there's the embedded message. Now, this larger signal (which might be JPEG, a handwritten message, or in your case, interpacket delays) has a natural distribution; one way of viewing the goal of Steganography is that we want to generate an artificial signal; we pick it in such a way to mimic the natural distribution (so that someone cannot tell that we picked it artificially), however the precise signal we did pick encodes the message we want.

Usually, we do Steganography by taking a real signal, and tweaking it slightly to form the artificial signal. The hope is that the tweaks do not move the signal significantly out of the natural distribution (at least, not enough to be detectable). This means that we don't have to understand the entire natural distribution (e.g. if we were embedding our messages into JPEG files, which files would look plausible and which wouldn't); instead, we just need to understand it well enough to know which tweaks don't disrupt the distribution detectably.

However, that's not what you're doing. You don't have a real signal (that is, there is no original interpacket delay source); you are individually crafting the interpacket delays yourself. In that case, you really need to answer the question "what does the natural distribution look like"; that is, what do real interpacket delays look like?

Well, we could guess what these delays might look like (perhaps approximately normal distributed with a certain mean and standard deviation), however if you are serious about this, you will need to actually select a real packet source, and measure the delays. This is more subtle than just measuring the distribution of delays; it also involves (at least) looking at the short term correlations between delays.

Once you have a reasonable model of the probability distribution of a real source, it should not be difficult to craft a way of selecting an element from that distribution. However, until you have such a model, you really don't have much hope of fooling an intelligent evesdropper who is actively looking for a signal.