An Improved Retransmission-based Network Steganography: Design and Detection

Network steganography is a covert communication technique that uses redundancies in network protocols to transfer secret information. The retransmission-based steganography (RSTEG) embeds covert messages into the payload field of the intentionally retransmission packets. So its capacity is higher than most of the existing methods. Because TCP checksum field of the original packet is different from that of the retransmitted packet, RSTEG is not stealthy in fact. An improved method named IRSTEG is presented to resolve the flaw by introducing the payload compensation. Further, a method is proposed to detect IRSTEG based the payload segment comparison. Experiments show that the method can detect IRSTEG well.