An Improved Retransmission Steganography and Its Detection Algorithm

Network steganography (referred to as network covert channel) is a covert communication technique that uses the redundancies of network protocol to transfer secret information. The retransmission steganography (RSTEG) is first proposed by Szczypiorski in 2009. It embeds secret information in the payload field of the retransmission packets which are produced intended by the communicators. However, this algorithm ignores the checksum fields of the original packets and the retransmission packets are different, which will decrease its stealthy. In this paper, an improved RSTEG algorithm (IRSTEG) is proposed first. This improved algorithm makes the checksum field of the original and the retransmission packets same. This will make the IRSTEG stealthier than RSTEG. Then, the payload sampling comparison detection method is proposed. At last, the experiments are given about the IRSTEG and its detection algorithm.