@inproceedings{WendzelCaviglioneMazurczyketal.2021, author = {Wendzel, Steffen and Caviglione, Luca and Mazurczyk, Wojciech and Mileva, Aleksandra and Dittmann, Jana and Kr{\"a}tzer, Christian and Lamsh{\"o}ft, Kevin and Vielhauer, Claus and Hartmann, Laura and Keller, J{\"o}rg and Neubert, Tom}, title = {A Revised Taxonomy of Steganography Embedding Patterns}, series = {Konferenz: ARES 2021: The 16th International Conference on Availability, Reliability and Security, Vienna Austria, 2021/ Konferenzband: Proc. of the 16th International Conference on Availability, Reliability and Security (ARES'21), August 17--20, 2021, Vienna, Austria}, booktitle = {Konferenz: ARES 2021: The 16th International Conference on Availability, Reliability and Security, Vienna Austria, 2021/ Konferenzband: Proc. of the 16th International Conference on Availability, Reliability and Security (ARES'21), August 17--20, 2021, Vienna, Austria}, publisher = {ACM}, address = {Vienna Austria}, isbn = {978-1-4503-9051-4}, doi = {10.1145/3465481.3470069}, pages = {1 -- 12}, year = {2021}, abstract = {Steganography embraces several hiding techniques which spawn across multiple domains. However, the related terminology is not unified among the different domains, such as digital media steganography, text steganography, cyber-physical systems steganography, network steganography (network covert channels), local covert channels, and out-of-band covert channels. To cope with this, a prime attempt has been done in 2015, with the introduction of the so-called hiding patterns, which allow to describe hiding techniques in a more abstract manner. Despite significant enhancements, the main limitation of such a taxonomy is that it only considers the case of network steganography. Therefore, this paper reviews both the terminology and the taxonomy of hiding patterns as to make them more general. Specifically, hiding patterns are split into those that describe the embedding and the representation of hidden data within the cover object. As a first research action, we focus on embedding hiding patterns and we show how they can be applied to multiple domains of steganography instead of being limited to the network scenario. Additionally, we exemplify representation patterns using network steganography.}, language = {en} } @inproceedings{KevinHildebrandtAltschaffeletal.2022, author = {Kevin, Lamsh{\"o}ft and Hildebrandt, Mario and Altschaffel, Robert and Keil, Oliver and Hempel, Ivo and Dittmann, Jana and Neubert, Tom and Vielhauer, Claus}, title = {Resilience against and detection of information hiding in nuclear instrumentation and control systems within the scope of NSS 17-T}, series = {Kerntechnik 2022, Leipzig, 21. - 22. Juni 2022}, booktitle = {Kerntechnik 2022, Leipzig, 21. - 22. Juni 2022}, publisher = {INFORUM Verlags- und Verwaltungsgesellschaft mbH}, address = {Berlin}, pages = {6}, year = {2022}, language = {en} } @inproceedings{NeubertCaballeroMorcilloVielhauer2022, author = {Neubert, Tom and Caballero Morcillo, Antonio Jos{\´e} and Vielhauer, Claus}, title = {Improving Performance of Machine Learning based Detection of Network Steganography in Industrial Control Systems}, series = {ARES 2022: The 17th International Conference on Availability, Reliability and Security Vienna Austria August 23 - 26, 2022}, booktitle = {ARES 2022: The 17th International Conference on Availability, Reliability and Security Vienna Austria August 23 - 26, 2022}, publisher = {Association for Computing Machinery}, address = {New York, NY}, doi = {10.1145/3538969.3544427}, pages = {1 -- 8}, year = {2022}, language = {en} } @inproceedings{NeubertVielhauerKraetzer2021, author = {Neubert, Tom and Vielhauer, Claus and Kraetzer, Christian}, title = {Artificial Steganographic Network Data Generation Concept and Evaluation of Detection Approaches to secure Industrial Control Systems against Steganographic Attacks}, series = {ARES 2021: The 16th International Conference on Availability, Reliability and Security, August 2021}, booktitle = {ARES 2021: The 16th International Conference on Availability, Reliability and Security, August 2021}, doi = {10.1145/3465481.3470073}, pages = {1 -- 9}, year = {2021}, language = {en} } @inproceedings{HildebrandtLamshoeftDittmannetal.2020, author = {Hildebrandt, Mario and Lamsh{\"o}ft, Kevin and Dittmann, Jana and Neubert, Tom and Vielhauer, Claus}, title = {Information Hiding in Industrial Control Systems: An OPC UA based Supply Chain Attack and its Detection}, series = {Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security (IH\&MMSec'20), June 22-24, 2020, Denver, CO, USA}, booktitle = {Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security (IH\&MMSec'20), June 22-24, 2020, Denver, CO, USA}, publisher = {The Association for Computing Machinery}, address = {New York}, doi = {10.1145/3369412}, pages = {115 -- 120}, year = {2020}, language = {en} } @article{NeubertVielhauer2020, author = {Neubert, Tom and Vielhauer, Claus}, title = {Kill Chain Attack Modelling for Hidden Channel Attack Scenarios in Industrial Control Systems}, series = {IFAC-PapersOnLine}, journal = {IFAC-PapersOnLine}, publisher = {Elsevier}, issn = {24058963}, doi = {10.1016/j.ifacol.2020.12.246}, pages = {11074 -- 11080}, year = {2020}, language = {en} } @inproceedings{HildebrandtAltschaffelLamshoeftetal.2020, author = {Hildebrandt, Mario and Altschaffel, Robert and Lamsh{\"o}ft, Kevin and Lange, Mathias and Szemkus, Martin and Neubert, Tom and Vielhauer, Claus and Ding, Yongjian and Dittmann, Jana}, title = {Threat Analysis of Steganographic and Covert Communication in Nuclear I\&C Systems}, series = {Konferenz: International Conference on Nuclear Security: Sustaining and Strengthening Efforts (ICONS), Vienna, Austria, 2020/ Konferenzband: International Conference on Nuclear Security: Sustaining and Strengthening Efforts}, booktitle = {Konferenz: International Conference on Nuclear Security: Sustaining and Strengthening Efforts (ICONS), Vienna, Austria, 2020/ Konferenzband: International Conference on Nuclear Security: Sustaining and Strengthening Efforts}, publisher = {IAEA}, address = {Vienna, Austria}, pages = {14}, year = {2020}, abstract = {Steganographic and covert communication is increasingly used for hiding attacks. Often information hiding is used by attackers in advanced persistent threats in order to operate without being noticed. Attackers might use it to hide data exfiltration or control channels for persistent malware. The paper analyzes potential threats to operational technology by investigating different communication protocols towards their suitability as cover channels. Using a generalized network architecture model and the communication flows of nuclear power plants, the attack potential using information hiding is exemplary assessed. An example for a supply chain attack for command injection is given on the foundation of the OPC UA protocol and an off-theshelf programmable logic controller. Subsequently, recommendations for a strategic and operational preparation for operators towards the prevention and detection of information hiding attacks are derived.}, language = {en} } @article{NeubertSchuelerUllrichetal.2025, author = {Neubert, Tom and Schueler, Eric and Ullrich, Henning and Buxhoidt, Laura and Vielhauer, Claus}, title = {Extended Analysis, Detection and Attribution of Steganographic Embedding Methods in Network Data of Industrial Controls Systems}, series = {International Journal on Advances in Security}, volume = {18}, journal = {International Journal on Advances in Security}, number = {1\&2}, publisher = {IARIA}, pages = {112 -- 122}, year = {2025}, abstract = {Since the last decade, it is well known that Industrial Control Systems (ICS) are under attack and attackers nowadays increasingly use stealthy malware (i.e., stegomalware) imple- mented by steganographic embedding methods to in- and exfil- trate hidden information. Unfortunately, current mechanisms to distinguish between network steganographic embedding methods and embedded message types need improvement for a potential attribution of attackers. For the analysis of steganographic em- bedding methods which are utilized in stealthy malware, the work presented in this paper builds upon a state-of-the-art analysis testbed proposed earlier, which is recapitulated here. It offers the opportunity to analyze network steganographic embedding methods in ICS to elaborate methods to detect and distinguish between them to gain forensic information for attribution of potential attackers and their methods. In this work, we introduce a novel machine learning based approach to distinguish between five selected embedding methods and two embedded message types. We use the analysis testbed to evaluate and determine the accuracy of the novel approach compared to a state-of-the-art approach. In our extensive evaluation, our novel approach has shown to be able to distinguish between network steganographic embedding methods with an average accuracy of 85.7\%, which is an improvement in comparison to the state-of-the-art by +5.9\% and enables a more accurate attribution of attackers. Additionally, the novel approach is able to improve the accuracy of distinction between embedding method and embedded message type by +9.3\% in comparison to the evaluated state-of-the-art approach.}, language = {en} }