# Adaptive Warden Strategy for Countering Network Covert Storage Channels

arXiv: https://arxiv.org/abs/2111.03310 · HTML: https://mlsanity.com/paper/2111.03310/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 5 Nov 2021.

## Built on by (most cited first, 6 of 6)

- [TransMix: Attend to Mix for Vision Transformers](https://mlsanity.com/paper/2111.09833/) (2021)
- [SMMix: Self-Motivated Image Mixing for Vision Transformers](https://mlsanity.com/paper/2212.12977/) (2022)
- [A Survey on Dropout Methods and Experimental Verification in Recommendation](https://mlsanity.com/paper/2204.02027/) (2022)
- [SuperpixelGridCut, SuperpixelGridMean and SuperpixelGridMix Data Augmentation](https://mlsanity.com/paper/2204.08458/) (2022)
- [Uncertainty-Aware Cascaded Dilation Filtering for High-Efficiency Deraining](https://mlsanity.com/paper/2201.02366/) (2022)
- [Feature Weaken: Vicinal Data Augmentation for Classification](https://mlsanity.com/paper/2211.10944/) (2022)

## Abstract (arXiv)

The detection and elimination of covert channels are performed by a network node, known as a warden. Especially if faced with adaptive covert communication parties, a regular warden equipped with a static set of normalization rules is ineffective compared to a dynamic warden. However, dynamic wardens rely on periodically changing rule sets and have their own limitations, since they do not consider traffic specifics. We propose a novel adaptive warden strategy, capable of selecting active normalization rules by taking into account the characteristics of the observed network traffic. Our goal is to disturb the covert channel and provoke the covert peers to expose themselves more by increasing the number of packets required to perform a successful covert data transfer. Our evaluation revealed that the adaptive warden has better efficiency and effectiveness when compared to the dynamic warden because of its adaptive selection of normalization rules.