TY - JOUR A1 - Lamshöft, Kevin A1 - Neubert, Tom A1 - Hielscher, Jonas A1 - Vielhauer, Claus T1 - Knock, knock, log: Threat analysis, detection & mitigation of covert channels in syslog using port scans as cover JF - Forensic Science International: Digital Investigation Y1 - 2022 U6 - https://doi.org/10.1016/j.fsidi.2022.301335 SN - 2666-2817 VL - 40 PB - Elsevier ER - TY - JOUR A1 - Whiskerd, Nicholas A1 - Körtge, Nicklas A1 - Jürgens, Kris A1 - Ezennaya-Gomez, Salatiel A1 - Vielhauer, Claus A1 - Dittmann, Jana A1 - Hildebrandt, Mario T1 - Keystroke biometrics in the encrypted domain: a first study on search suggestion functions of web search engines JF - EURASIP Journal on Information Security KW - keystroke dynamics KW - biometrics KW - search engines KW - encrypted domain Y1 - 2020 U6 - https://doi.org/10.1186/s13635-020-0100-8 IS - 2020:2 PB - Springer ER - TY - CHAP A1 - Hildebrandt, Mario A1 - Lamshöft, Kevin A1 - Dittmann, Jana A1 - Neubert, Tom A1 - Vielhauer, Claus T1 - Information Hiding in Industrial Control Systems: An OPC UA based Supply Chain Attack and its Detection T2 - Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security (IH&MMSec’20), June 22–24, 2020, Denver, CO, USA KW - Information Hiding KW - Steganography KW - Process automation KW - Industrial Control Systems KW - OPC UA Y1 - 2020 U6 - https://doi.org/10.1145/3369412 SP - 115 EP - 120 PB - The Association for Computing Machinery CY - New York ER - TY - CHAP A1 - Vielhauer, Claus A1 - Loewe, Fabian A1 - Pilgermann, Michael T1 - Towards Modeling Hidden & Steganographic Malware Communication based on Images T2 - IH&MMSEC '25: ACM Workshop on Information Hiding and Multimedia Security, San Jose, CA, USA, 2025 N2 - Recently, an increasing number of IT security incidents involving malware, which makes use of hidden and steganographic channels for malicious communication (a.k.a. as "stegomalware"), can be observed in the wild. Especially the use of images to hide malicious code is rising. In consideration of this shift, a new model is proposed in this paper, which aims to help security professionals to identify and analyze incidents revolving around steganographic malware in the future. The model focuses on practical aspects of steganalysis of communication data to elaborate linking properties to previous code analysis knowledge. The model features two distinct roles that interact with a knowledge base which stores malware features and helps building a context for the incident. For evaluation, two image steganography malware types are chosen from popular databases (malpedia and MITRE ATT&CK®), which are analyzed in multiple steps including steganalysis and code analysis. It is conceptually shown, how the extracted features can be stored in a knowledge base for later use to identify stegomalware from communication data without the need of a thorough code analysis. This allows to uncover previously hidden meta-information about the examined malicious programs, enrich the incident’s forensic context traces and thus allows for thorough forensic insights, including attribution and improved preventive security measures in the future. Y1 - 2025 UR - https://dl.acm.org/doi/pdf/10.1145/3733102.3733152 U6 - https://doi.org/10.1145/3733102.3733152 SP - 52 EP - 63 ER -