Analysis of protocol steganography methods in software-defined networks

Abstract

Networking (SDN), which constitutes a critical part of modern network infrastructure. The SDN specific characteristics are as follows: the centralized control, programmable routing logic, and separation of control and data planes. They
introduce both new threat vectors and opportunities for detecting covert communication channels.

The authors classify the steganographic techniques according to the OSI model layers, namely, from the physical to the application layer, including the session and presentation layers. The study covers both traditional approaches based on header manipulation and timing-based channels, as well as modern methods that exploit specific features of protocols such as OpenFlow, TLS, QUIC, HTTP, and DNS. Special attention is given to the inter-protocol steganography, control plane abuse, and synchronization-based covert channels that enable stealthy coordination of network nodes even in segmented environments.

A comparative analysis is conducted based on key characteristics such as bandwidth, undetectability, operational constraints, and detection vectors. The results are summarized in a comparative table, allowing a reasoned evaluation of risks across OSI layers and the identification of critical areas for steganalysis in SDN. The findings confirm the need for a multi-layered defense approach in SDN infrastructures, incorporating inter-protocol analysis, adaptive anomaly detection systems, and traffic normalization policies. The research provides a scientific foundation for the development of effective countermeasures against hidden communication in next-generation networks.