@inproceedings{VielhauerFischerLamshoeftetal.2017, author = {Vielhauer, Claus and Fischer, Robert and Lamsh{\"o}ft, Kevin and Dittmann, Jana}, title = {Advanced issues in wireless communication security: Towards a security-demonstrator for smart-home environments}, series = {2017 International Carnahan Conference on Security Technology (ICCST) : proceedings : October 23-26, 2017, Universidad Autonoma de Madrid, Spain}, booktitle = {2017 International Carnahan Conference on Security Technology (ICCST) : proceedings : October 23-26, 2017, Universidad Autonoma de Madrid, Spain}, publisher = {IEEE}, address = {Piscataway, NJ}, isbn = {978-1-5386-1585-0 (online)}, doi = {10.1109/CCST.2017.8167864}, pages = {1 -- 6}, year = {2017}, language = {en} } @unpublished{WendzelCaviglioneMazurczyketal.2023, author = {Wendzel, Steffen and Caviglione, Luca and Mazurczyk, Wojciech and Mileva, Aleksandra and Dittmann, Jana and Kr{\"a}tzer, Christian and Lamsh{\"o}ft, Kevin and Vielhauer, Claus and Hartmann, Laura and Keller, J{\"o}rg and Neubert, Tom and Zillien, Sebastian}, title = {A Generic Taxonomy for Steganography Methods}, doi = {10.36227/techrxiv.20215373.v1}, year = {2023}, abstract = {A unified understanding of terms and their applicability is essential for every scientific discipline: steganography is no exception. Being divided into several domains (for instance, text steganography, digital media steganography, and network steganography), it is crucial to provide a unified terminology as well as a taxonomy that is not limited to some specific applications or areas. A prime attempt towards a unified understanding of terms was conducted in 2015 with the introduction of a pattern-based taxonomy for network steganography. Six years later, in 2021, the first work towards a pattern-based taxonomy for steganography was proposed. However, this initial attempt still faced several shortcomings, e.g., the lack of patterns for several steganography domains (the work mainly focused on network steganography and covert channels), various terminology issues, and the need of providing a tutorial on how the taxonomy can be used during engineering and scientific tasks, including the paper-writing process.

As the consortium who published this initial 2021-study on steganography patterns, in this paper we present the first comprehensive pattern-based taxonomy tailored to fit all known domains of steganography, including smaller and emerging areas, such as filesystem steganography and cyber-physical systems steganography. Besides, to make our contribution more effective and promote the use of the taxonomy to advance research on steganography, we also provide a thorough tutorial on its utilization.

Our pattern collection is available at https://patterns.ztt.hs-worms.de.

}, language = {en} } @article{LamshoeftNeubertHielscheretal.2022, author = {Lamsh{\"o}ft, Kevin and Neubert, Tom and Hielscher, Jonas and Vielhauer, Claus}, title = {Knock, knock, log: Threat analysis, detection \& mitigation of covert channels in syslog using port scans as cover}, series = {Forensic Science International: Digital Investigation}, volume = {40}, journal = {Forensic Science International: Digital Investigation}, publisher = {Elsevier}, issn = {2666-2817}, doi = {10.1016/j.fsidi.2022.301335}, year = {2022}, language = {en} } @inproceedings{LamshoeftNeubertKraetzeretal.2021, author = {Lamsh{\"o}ft, Kevin and Neubert, Tom and Kr{\"a}tzer, Christian and Vielhauer, Claus and Dittmann, Jana}, title = {Information Hiding in Cyber Physical Systems: Challenges for Embedding, Retrieval and Detection using Sensor Data of the SWAT Dataset}, series = {IH\&MMSec '21: Proceedings of the ACM Workshop on Information Hiding and Multimedia Security; Virtual Event Belgium, June 22 - 25, 2021}, booktitle = {IH\&MMSec '21: Proceedings of the ACM Workshop on Information Hiding and Multimedia Security; Virtual Event Belgium, June 22 - 25, 2021}, publisher = {ACM}, address = {New York}, isbn = {978-1-4503-8295-3}, doi = {10.1145/3437880.3460413}, pages = {113 -- 124}, year = {2021}, language = {en} } @inproceedings{WendzelCaviglioneMazurczyketal.2021, author = {Wendzel, Steffen and Caviglione, Luca and Mazurczyk, Wojciech and Mileva, Aleksandra and Dittmann, Jana and Kr{\"a}tzer, Christian and Lamsh{\"o}ft, Kevin and Vielhauer, Claus and Hartmann, Laura and Keller, J{\"o}rg and Neubert, Tom}, title = {A Revised Taxonomy of Steganography Embedding Patterns}, series = {Konferenz: ARES 2021: The 16th International Conference on Availability, Reliability and Security, Vienna Austria, 2021/ Konferenzband: Proc. of the 16th International Conference on Availability, Reliability and Security (ARES'21), August 17--20, 2021, Vienna, Austria}, booktitle = {Konferenz: ARES 2021: The 16th International Conference on Availability, Reliability and Security, Vienna Austria, 2021/ Konferenzband: Proc. of the 16th International Conference on Availability, Reliability and Security (ARES'21), August 17--20, 2021, Vienna, Austria}, publisher = {ACM}, address = {Vienna Austria}, isbn = {978-1-4503-9051-4}, doi = {10.1145/3465481.3470069}, pages = {1 -- 12}, year = {2021}, abstract = {Steganography embraces several hiding techniques which spawn across multiple domains. However, the related terminology is not unified among the different domains, such as digital media steganography, text steganography, cyber-physical systems steganography, network steganography (network covert channels), local covert channels, and out-of-band covert channels. To cope with this, a prime attempt has been done in 2015, with the introduction of the so-called hiding patterns, which allow to describe hiding techniques in a more abstract manner. Despite significant enhancements, the main limitation of such a taxonomy is that it only considers the case of network steganography. Therefore, this paper reviews both the terminology and the taxonomy of hiding patterns as to make them more general. Specifically, hiding patterns are split into those that describe the embedding and the representation of hidden data within the cover object. As a first research action, we focus on embedding hiding patterns and we show how they can be applied to multiple domains of steganography instead of being limited to the network scenario. Additionally, we exemplify representation patterns using network steganography.}, language = {en} } @inproceedings{HildebrandtLamshoeftDittmannetal.2020, author = {Hildebrandt, Mario and Lamsh{\"o}ft, Kevin and Dittmann, Jana and Neubert, Tom and Vielhauer, Claus}, title = {Information Hiding in Industrial Control Systems: An OPC UA based Supply Chain Attack and its Detection}, series = {Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security (IH\&MMSec'20), June 22-24, 2020, Denver, CO, USA}, booktitle = {Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security (IH\&MMSec'20), June 22-24, 2020, Denver, CO, USA}, publisher = {The Association for Computing Machinery}, address = {New York}, doi = {10.1145/3369412}, pages = {115 -- 120}, year = {2020}, language = {en} } @inproceedings{HildebrandtAltschaffelLamshoeftetal.2020, author = {Hildebrandt, Mario and Altschaffel, Robert and Lamsh{\"o}ft, Kevin and Lange, Mathias and Szemkus, Martin and Neubert, Tom and Vielhauer, Claus and Ding, Yongjian and Dittmann, Jana}, title = {Threat Analysis of Steganographic and Covert Communication in Nuclear I\&C Systems}, series = {Konferenz: International Conference on Nuclear Security: Sustaining and Strengthening Efforts (ICONS), Vienna, Austria, 2020/ Konferenzband: International Conference on Nuclear Security: Sustaining and Strengthening Efforts}, booktitle = {Konferenz: International Conference on Nuclear Security: Sustaining and Strengthening Efforts (ICONS), Vienna, Austria, 2020/ Konferenzband: International Conference on Nuclear Security: Sustaining and Strengthening Efforts}, publisher = {IAEA}, address = {Vienna, Austria}, pages = {14}, year = {2020}, abstract = {Steganographic and covert communication is increasingly used for hiding attacks. Often information hiding is used by attackers in advanced persistent threats in order to operate without being noticed. Attackers might use it to hide data exfiltration or control channels for persistent malware. The paper analyzes potential threats to operational technology by investigating different communication protocols towards their suitability as cover channels. Using a generalized network architecture model and the communication flows of nuclear power plants, the attack potential using information hiding is exemplary assessed. An example for a supply chain attack for command injection is given on the foundation of the OPC UA protocol and an off-theshelf programmable logic controller. Subsequently, recommendations for a strategic and operational preparation for operators towards the prevention and detection of information hiding attacks are derived.}, language = {en} }