Network steganography based on traffic behavior in dynamically changing wireless sensor networks

Previous work on network steganography mainly focused on which field(s) in the cover packet should be used to embed secret information, while largely ignoring how to generate the cover packet in the first place to make it hard to detect. As a result, the cover packet itself may raise suspicions which would defeat the purpose of network steganography. In this paper, we propose a novel traffic behavior learning scheme that can be leveraged to construct hard-to-detect cover packets even if the network traffic is analyzed at a deeper level (i.e., traffic patterns or behaviors). An unsupervised learning method based on the topic model is adopted to discover network traffic behavior. Previously captured network traces in a given network environment are used to train the topic model to learn traffic behavior. The results serve as reference to generate typical network traffic in any given environment and adapt to the network even if it is dynamically changing. In addition to traffic behavior, our model is able to capture network nodes' behavior. This is useful in that both traffic information (what packets to mimic) and node information (which nodes to mimic) can be taken into account when crafting cover packets. Our extensive simulation results show the effectiveness of the proposed scheme learning traffic behavior, indicating that the scheme can potentially be applied to other applications where traffic behavior is needed, besides network steganography.