Combining Different Existing Methods for Describing Steganography Hiding Methods

Aleksandra Mileva; Christian Kr\"atzer; Claus Vielhauer; Jana Dittmann; Luca Caviglione; Sebastian Zander; Steffen Wendzel; Tobias Schmidbauer

Combining Different Existing Methods for Describing Steganography Hiding Methods

T0 review · 0 major / 7 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper proposes a seven-component naming convention that lets any steganography hiding method be described in a unified, comparable form built from existing taxonomies.

desk verdict A modest tutorial that recombines the authors' own published taxonomies into a unified naming convention; fine for what it is, but the new content is the assembly, not the pieces. read the letter →

arxiv 2506.01700 v1 pith:WEXNCZPD submitted 2025-06-02 cs.CR cs.NI

Steffen Wendzel , Christian Krätzer , Jana Dittmann , Luca Caviglione , Aleksandra Mileva , Tobias Schmidbauer , Claus Vielhauer , Sebastian Zander This is my paper

classification cs.CRcs.NI

keywords steganographycovertchannelshidingpatternstaxonomynamingconventionnetworkstegomalwareunifieddescription

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper is a tutorial that argues the many overlapping steganography taxonomies can be combined into one structured naming convention. The convention describes a hiding method through seven components: locality, directness, activeness, level characteristic, reference-temporality, a free-form star property, and a mandatory hiding pattern taken from the 2025 generic taxonomy. If the approach works, researchers across fields get a common language for describing covert channels and stegomalware, reducing ambiguity and helping to expose methods that are really re-inventions of existing ones. The paper demonstrates the convention on network, audio, cyber-physical, and text steganography examples.

What carries the argument

The carrying mechanism is the seven-component naming convention itself, with the mandatory hiding pattern from the 2025 generic taxonomy as its anchor. A hiding pattern gives an abstract, rule-based name for how a secret is embedded or represented. The other components place that pattern in a fixed, ordered structure with defaults, so that any method can be expressed in the same slot-by-slot form and compared attribute by attribute.

What would settle it

Take a recent filesystem, AI-model, or air-gapped steganography method that is not among the paper's examples and run it through the convention; if it cannot be assigned any pattern from the 2025 taxonomy, or if two distinct methods receive the identical seven-component name, then the promised unified comparability does not hold.

Watch

Extended reading notes

Core claim

The paper's central claim is that existing description methods, each developed separately, can be combined without new theory into a single naming convention that yields a unified, comparable description of any steganography method. Every hiding method receives a name with up to seven slots: locality, directness, activeness, level characteristic, reference-temporality, a free-form star property, and a mandatory hiding pattern from the 2025 generic taxonomy. Default slots are omitted, so the shortest valid description is a single pattern code such as E1.3d1. Digital Media LSB State/Value Modulation. Multi-level and multi-media methods are rendered as ordered lists of layer-wise descriptions, which the underlying taxonomy alone does not provide.

Load-bearing premise

The convention assumes the 2025 hiding-pattern taxonomy and the indirect-pattern set are complete and correctly classify every hiding method, so any method they omit or mislabel will be misdescribed by every name built on them.

Editorial extensions

If this is right

A steganalyst or malware researcher can describe a hiding method with a single standardized name, making comparison across papers straightforward.
The mandatory hiding pattern makes re-inventions visible: if the same pattern code applies, the method is not new.
Multi-level steganography and methods spanning several media can be represented as an ordered list of layer descriptions, which the 2025 taxonomy alone does not capture.
The interactive online tool turns the convention into a practical aid for teaching and for classifying observed covert channels.
When the seven components do not cover all nuances, the unified description method's extra attributes supply the remaining detail.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A natural next step would be to require the convention in stegomalware reports, so that malware families are described with machine-readable pattern codes rather than prose.
The convention could be tested against hidden channels in filesystems, AI models, and air-gapped systems, domains the paper names but does not work through; success there would strengthen the claim of universality.
A falsifiable extension is to automate classification: given a natural-language description of a method, an algorithm could emit the seven-component name, and disagreement with human experts would reveal where the convention needs refinement.
The paper leaves countermeasures out, but a dual convention for defenses could be built on the same component skeleton, which the authors list as future work.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

This paper is a tutorial that stitches together seven description components for steganography methods into one naming convention. The components themselves come from the same group's prior work, and the new content is the assembly plus a set of worked examples. That is a fair and honest claim, and the paper sticks to it.

The exposition is clear and well organized. Each component is introduced with its source, the examples in Section 4 walk you through realistic cases, and Section 5 explicitly acknowledges the coverage limits. The interactive online tool is a nice touch and gives the paper a tangible deliverable. For a reader new to the steganography taxonomy literature, this would be a usable entry point.

Soft spots are there but not load-bearing. The circularity is real but acknowledged: the convention mandates a hiding pattern from Wendzel et al. 2025 and uses the indirect-pattern set from Schmidbauer and Wendzel 2022, both authored by this group, and the validation examples are classified using those same sources. There is no external benchmark, no inter-rater reliability test, and no completeness argument. That is typical for a tutorial, and the paper says so in Section 5, so I would not call it a fatal flaw, just a limit on how much weight the 'comprehensive' language carries.

I also noticed the minor inconsistencies the stress-test flagged: Section 4.3 labels E1.1n1 as plain Network State/Value Modulation, though E1.1n1 is the reserved/unused sub-pattern, and Section 3.2 describes the innermost layer as LSB when the listed pattern is E1.2f1 random modulation. These look like typos rather than conceptual errors, and they do not shake the central tutorial claim.

The bigger issue is significance. If the community adopts this convention, it could reduce terminological overlap. But that is a big 'if', and the paper gives no evidence that anyone outside the authors' circle would pick it up. The claim is modest and hedged, which is appropriate.

Who is this for? Someone teaching or entering steganography, or a researcher who wants to situate a new hiding method within a shared vocabulary. It deserves a serious referee because the tutorial goal is legitimate and the execution is competent. I would recommend accepting it with revisions, mainly to fix the typos and sharpen the limitation statements.

I would not cite it in my own work on covert channels, but I would send a student to it as a reading assignment.

Referee Report

0 major / 7 minor

Summary. The paper proposes a seven-component naming convention for describing steganography hiding methods, combining existing approaches: locality (local or distributed, with distribution patterns from Mazurczyk et al.), directness (direct or indirect, with redirector/broker patterns from Schmidbauer and Wendzel), activeness (active or passive variants), level characteristic (single- or multi-level), reference-temporality (present, history, or future data), a free-form star property, and a mandatory hiding pattern from the 2025 generic taxonomy of Wendzel et al. The paper is organized as a tutorial, with worked examples spanning network, audio, CPS/OPC UA, and text steganography, and it advertises an interactive online tool. Section 5 explicitly acknowledges coverage limitations and positions the work as an intermediate, extensible step rather than a complete standard.

Significance. If the proposed convention is adopted, it could reduce terminological overlap and re-invention in the steganography literature by providing a common vocabulary built from existing taxonomies. The tutorial format is appropriate for this goal, and the paper is honest about its dependency on the completeness of the underlying taxonomies, especially [48] and [41]. The main weaknesses are the absence of formal validation (e.g., inter-rater reliability or an independent corpus of classifications) and the fact that several mandatory components come from the authors' own prior work; however, these limitations are acknowledged and do not undermine the value of the tutorial as a synthesis and didactic contribution.

minor comments (7)

[Section 3.2] The multi-level filesystem example is internally inconsistent: the list gives (c) E1.2f1 filesystem random state/value modulation, but the following sentence states that the innermost layer is LSB state/value modulation. Please correct either the list entry or the explanatory text so that the example teaches a single unambiguous description.
[Section 3.2] The first sophisticated example writes "E.1n1. network LSB state/value modulation", which appears to be a typo for E1.3n1 (network LSB state/value modulation); the extra dot after E and the missing sub-class number are not used elsewhere in the paper and should be fixed.
[Section 4.3 and Table 3] Example 3 is labeled "E1.1n1. Network State/Value Modulation", but E1.1 denotes reserved/unused state/value modulation; the example should say "Network Reserved/Unused State/Value Modulation". In the same section, the phrase "patterns E1n1. and R1n1." omits the sub-class numbers used in the taxonomy.
[Section 3 and Section 4.5] The convention states that default categories (non-distributed, direct, active, single-level, present-focused) can be omitted, but Example 4.5 explicitly classifies the simplest OPC UA method as "Non-Distributed E1.3c1..." and labels the other two methods as "Distributed E1.3c1..." without the bracketed distribution pattern (e.g., pattern variation or combination) that Section 3.1 requires. Please align the stated rule with the examples.
[Figure 1] The Directness component lists "redirector, dead proxy, drop", which does not match Table 2 or the referenced [41] taxonomy; it should read "redirector, proxy, dead drop" (or "redirector, dead drop, proxy"). Also, the figure uses "Levels" while the text and Section 3.1 use "Level Characteristic"; please harmonize the terminology.
[Section 2 and Section 4.2] There are a few wording/typo issues: Section 2 contains the garbled phrase "on atout court manner" (likely "in a tout court manner"), and Section 4.2 has "utilze" for "utilize". These should be corrected in a final proofreading pass.
[Section 4.2] The example uses "E1n1. Network State/Value Modulation" and "R2.2n1. Network Element Positioning"; the first pattern lacks the sub-class number that appears in other examples. Please clarify whether E1n1 is intended as a shorthand for the general E1 pattern and, if so, state this convention explicitly.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper is an explicitly acknowledged combination of prior taxonomies, not a derivation or prediction, so its claims reduce to its inputs only in the sense of deliberate aggregation.

full rationale

The paper is a tutorial that combines previously published taxonomies and description methods. It makes no fitted predictions and performs no derivations. Each component of the proposed naming convention is explicitly attributed to prior work, including the hiding-pattern taxonomy [48], the indirect-pattern set [41], the distribution terms [50,31], and the reference-temporality and activeness terms [49,52,23]. The examples in Section 4 are classifications of known steganography methods using those published components, not tests that could be forced by construction. The central claim—that combining existing methods allows a unified and comparable description—is true by explicit aggregation, not by hidden equivalence. The only substantive dependency is the completeness and validity of the cited taxonomies, and the paper directly acknowledges this in Section 5: 'our work might be limited due to the lack of some categorizations and subtaxonomies of information hiding topics.' That is an honest limitation, not circularity. The conclusion is also hedged ('could be reduced'), and no parameter is fitted and renamed as a prediction. Therefore no circular step can be exhibited, and the appropriate score is 0.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No numeric free parameters are fitted; the paper is a taxonomy proposal. The central claim rests on domain assumptions about the validity and composability of previously published taxonomies by the same research group. No new physical entities are introduced.

assumptions (4)

domain assumption The 2025 generic pattern taxonomy [48] is complete and correct enough to serve as the mandatory Hiding Pattern attribute for all steganography domains.
Section 3.1 states the Hiding Pattern attribute 'must mention the hiding pattern of the 2025 taxonomy [48]'; the combined description's validity inherits this taxonomy.
domain assumption The indirect pattern categories (redirector, broker, proxy, dead drop) from [41] are valid and can be applied beyond the network context.
Section 2 and Table 2 generalize the network-specific definitions to generic indirect hiding patterns; the Directness component in Fig. 1 depends on them.
ad hoc to paper The six naming components (locality, directness, activeness, level, reference-temporality, star-property) are independent and can be freely combined without semantic conflict.
Fig. 1 presents them as composable slots; the worked examples in Sect. 4 assume this orthogonality, which is not formally proven.
ad hoc to paper Default categories ('-') are unambiguous, so omitting a component (e.g., not saying 'active' or 'direct') does not change the described channel.
Fig. 1's dash notation and the instruction that defaults can be omitted require readers to share the same defaults; this is an assumption about interpretation.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Combining Different Existing Methods for Describing Steganography Hiding Methods." pith.science (2026). https://pith.science/paper/WEXNCZPD

@misc{pith2026250601700,
  author       = {Pith},
  title        = {Pith review of: Combining Different Existing Methods for Describing Steganography Hiding Methods},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/WEXNCZPD}},
  note         = {Machine review of arXiv:2506.01700}
}

read the original abstract

The proliferation of digital carriers that can be exploited to conceal arbitrary data has greatly increased the number of techniques for implementing network steganography. As a result, the literature overlaps greatly in terms of concepts and terminology. Moreover, from a cybersecurity viewpoint, the same hiding mechanism may be perceived differently, making harder the development of a unique defensive strategy or the definition of practices to mitigate risks arising from the use of steganography. To mitigate these drawbacks, several researchers introduced approaches that aid in the unified description of steganography methods and network covert channels. Understanding and combining all descriptive methods for steganography techniques is a challenging but important task. For instance, researchers might want to explain how malware applies a certain steganography technique or categorize a novel hiding approach. Consequently, this paper aims to provide an introduction to the concept of descriptive methods for steganography. The paper is organized in the form of a tutorial, with the main goal of explaining how existing descriptions and taxonomy objects can be combined to achieve a detailed categorization and description of hiding methods. To show how this can effectively help the research community, the paper also contains various real-world examples.

Figures

Figures reproduced from arXiv: 2506.01700 by the authors.

**Figure 1.** shows the general structure of our naming convention. Following the recent steganography taxonomy [48], here we apply the proposed pattern naming convention for “hiding patterns” (see the most-right component in the figure). At the same time, we also adjust it to incorporate the surrounding terms for categorization (see the remaining boxes in the figure). A dash (-) indicates a default category, i.e., it can be om… view at source ↗

**Figure 2.** The UDM of [48]. Our nomenclature is used within the attributes speci [PITH_FULL_IMAGE:figures/full_fig_p010_2.png] view at source ↗

**Figure 1.** 4.6 Text Hiding Method Most of the methods applied in text steganography are simple. For example, repeating white space characters in a text (open space method) [3,2] is a form of the pattern E2.1t1. Text Element Enumeration. However, these methods can be applied in heterogeneous scenarios, with different naming components, such as directness and activeness. For example, Mileva et al. [32] suggest three different ap… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

55 extracted references · 46 canonical work pages

[48]

ACM Comput

Wendzel, S., Caviglione, L., Mazurczyk, W., Mileva, A., Dittmann, J., Krätzer, C., Lamshöft, K., Vielhauer, C., Hartmann, L., Keller, J., Neubert, T., Zillien, S.: A generic taxonomy for steganography methods. ACM Comput. Surv.57(9), 1–37 (May 2025).https://doi.org/10.1145/3729165

work page doi:10.1145/3729165 2025
[41]

In: Proc

Schmidbauer, T., Wendzel, S.: SoK: A survey of indirect network-level covert chan- nels. In: Proc. 17th Asia Conf. Computer and Communications Security (ASI- ACCS). pp. 546–560. ACM (2022).https://doi.org/10.1145/3488932.3517418

arXiv 2022
[1]

Computers & Security144(2024).https://doi.org/10.1016/ j.cose.2024.103976 16 S

DomEye: Detecting network covert channel of domain fronting with through- put fluctuation. Computers & Security144(2024).https://doi.org/10.1016/ j.cose.2024.103976 16 S. Wendzel et al

arXiv 2024
[2]

Entropy21(4), 355 (2019)

Ahvanooey, M.T., Li, Q., Hou, J., Rajput, A.R., Chen, Y.: Modern text hiding, text steganalysis, and applications: A comparative analysis. Entropy21(4), 355 (2019)

work page 2019
[3]

IBM Systems Journal35 (Nos3&4), 313–336 (1996)

Bender, W., Gruhl, D., Morimoto, N., Lu, A.: Techniques for data hiding. IBM Systems Journal35 (Nos3&4), 313–336 (1996)

work page 1996
[4]

Bennett, K.: Linguistic steganography: Survey, analysis, and robustness concerns for hiding information in text. Tech. Rep. 2004-13, CERIAS Tech Report, Purdue University (2004)

work page 2004
[5]

ACM Computing Surveys (CSUR)49(2), 1–36 (2016)

Carrara, B., Adams, C.: Out-of-band covert channels—a survey. ACM Computing Surveys (CSUR)49(2), 1–36 (2016)

work page 2016
[6]

IEEE Security & Privacy20(5), 101–106 (2022)

Caviglione, L., Mazurczyk, W.: Never mind the malware, here’s the stegomalware. IEEE Security & Privacy20(5), 101–106 (2022)

work page 2022

Show all 55 references

[7]

IEEE Network38(5), 255–263 (2024)

Caviglione, L., Mazurczyk, W.: You can’t do that on protocols anymore: analysis of covert channels in ietf standards. IEEE Network38(5), 255–263 (2024)

2024
[8]

IEEE Transactions on Industrial Informatics13(4), 1921–1931 (2017)

Caviglione, L., Podolski, M., Mazurczyk, W., Ianigro, M.: Covert channels in per- sonal cloud storage services: The case of Dropbox. IEEE Transactions on Industrial Informatics13(4), 1921–1931 (2017)

2017
[9]

IEEE Trans

Chang, C.C., Lin, C.Y.: Reversible steganography for VQ-compressed images using side matching and relocation. IEEE Trans. Inform. Forens. and Sec.1(4), 493–501 (2006)

2006
[10]

INAE Letters4, 65–75 (2019)

Dey, A., Bhattacharya, S., Chaki, N.: Software watermarking: Progress and chal- lenges. INAE Letters4, 65–75 (2019)

2019
[11]

Information Security Journal: A Global Perspective30(2), 63–87 (2021)

Dhawan, S., Gupta, R.: Analysis of various data security techniques of steganog- raphy: A survey. Information Security Journal: A Global Perspective30(2), 63–87 (2021)

2021
[12]

DICOM: The DICOM standard (2025),https://www.dicomstandard.org/

2025
[13]

Eckstein,K.,Jahnke,M.:Datahidinginjournalingfilesystems.In:DigitalForensic Research Workshop (2005)

2005
[14]

Journal of Universal Computer Science (J

Fraczek, W., Mazurczyk, W., Szczypiorski, K.: Multi-level steganography: Improv- ing hidden communication in networks. Journal of Universal Computer Science (J. UCS)18(14), 1967–1986 (2012).https://doi.org/10.3217/jucs-018-14-1967

2012 doi
[15]

Cambridge University Press (2009).https://doi.org/10.1017/ CBO978113919290

Fridrich, J.: Steganography in Digital Media: Principles, Algorithms, and Applications. Cambridge University Press (2009).https://doi.org/10.1017/ CBO978113919290

2009
[16]

IEEE Transactions on Software Engi- neering13, 292–296 (February 1987)

Girling, C.G.: Covert channels in LAN’s. IEEE Transactions on Software Engi- neering13, 292–296 (February 1987)

1987
[17]

In: 2015 IEEE 28th Computer Security Foundations Symposium

Guri, M., Monitz, M., Mirski, Y., Elovici, Y.: BitWhisper: Covert signaling channel between air-gapped computers using thermal manipulations. In: 2015 IEEE 28th Computer Security Foundations Symposium. pp. 276–289 (2015).https://doi. org/10.1109/CSF.2015.26

2015 doi
[18]

In: 26th ACSAC

Han, J., Pan, M., Gao, D., Pang, H.: A multi-user steganographic file system on un- trusted shared storage. In: 26th ACSAC. pp. 317–326. ACM (2010).https://doi. org/10.1145/1920261.1920309,https://doi.org/10.1145/1920261.1920309

2010
[19]

In: 2023 IEEE 19th International Conference on e-Science (e-Science)

Heßeling, C., Keller, J., Litzinger, S.: Reversible network covert channel by payload modulation in streams of decimal sensor values. In: 2023 IEEE 19th International Conference on e-Science (e-Science). IEEE Computer Society, Los Alamitos, CA, USA (2023).https://doi.org/10.11...

2023
[20]

In: Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security

Hildebrandt, M., Lamshöft, K., Dittmann, J., Neubert, T., Vielhauer, C.: Informa- tion hiding in industrial control systems: An opc ua based supply chain attack and its detection. In: Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security. pp. 115–1...

2020
[21]

In: Infor- mation hiding

Johnson, N.F., Katzenbeisser, S.: A survey of steganographic techniques. In: Infor- mation hiding. pp. 43–78 (2000)

2000
[22]

In: Proceedings of the 2024 ACM Workshop on Information Hiding and Multimedia Security

Knöchel, M., Karius, S.: Text steganography methods and their influence in mal- ware: A comprehensive overview and evaluation. In: Proceedings of the 2024 ACM Workshop on Information Hiding and Multimedia Security. pp. 113–124 (2024)

2024
[24]

Li, B., He, J., Huang, J., Shi, Y.Q.: A survey on image steganography and ste- ganalysis. J. Inf. Hiding Multim. Signal Process.2(2), 142–172 (2011)

2011
[25]

Liu, H., Zhang, C., Wang, Z., Guo, C., Gou, P., Shan, L., Lu, Z.: To deliver more information in coverless information hiding. Multim. Tools Appl.83(3), 7215–7229 (2024)

2024
[26]

In: Proc

Liu, T., Liu, Z., Liu, Q., Wen, W., Xu, W., Li, M.: Stegonet: Turn deep neu- ral network into a stegomalware. In: Proc. ACSAC’20. p. 928–938. ACM (2020). https://doi.org/10.1145/3427228.3427268

2020
[27]

IEEE Communications Magazine52(5), 225–229 (2014)

Lubacz, J., Mazurczyk, W., Szczypiorski, K.: Principles and overview of network steganography. IEEE Communications Magazine52(5), 225–229 (2014)

2014
[28]

Mathematics9(21), 2829 (2021)

Majeed, M.A., Sulaiman, R., Shukur, Z., Hasan, M.K.: A review on text steganog- raphy techniques. Mathematics9(21), 2829 (2021)

2021
[29]

techxiv (2024).https://doi.org/10.36227/techrxiv.173397886.68744435/v1

Masud, M.A., Akter, S., Sultana, N., Yousuf, M.A., Uddin, M.Z.: Multi-layered password-based steganography: A novel approach for tiered information hiding. techxiv (2024).https://doi.org/10.36227/techrxiv.173397886.68744435/v1

2024
[30]

In: Proc

Mazurczyk, W., Szary, P., Wendzel, S., Caviglione, L.: Towards reversible storage network covert channels. In: Proc. ARES 2019. pp. 1–8

2019
[31]

In: Proc

Mazurczyk, W., Wendzel, S., Cabaj, K.: Towards deriving insights into data hiding methods using pattern-based approach. In: Proc. ARES’18. pp. 10:1–10. ACM (2018).https://doi.org/10.1145/3230833.3233261

2018
[32]

In: CUING, ARES ’21: Proceedings of the 16th International Conference on Availability, Reliability and Security (2021).https://doi.org/10.1145/3465481.347007

Mileva, A., Caviglione, L., Velinov, A., Wendzel, S., Dimitrova, V.: Risks and opportunities for information hiding in dicom standard. In: CUING, ARES ’21: Proceedings of the 16th International Conference on Availability, Reliability and Security (2021).https://doi.org/10.1145...

2021
[33]

Open Computer Science4(2), 45–66 (2014)

Mileva, A., Panajotov, B.: Covert channels in TCP/IP protocol stack-extended version. Open Computer Science4(2), 45–66 (2014)

2014
[34]

In: Proc

Neubert, T., Peuker, B., Schueler, E., Ullrich, H., Buxhoidt, L., Vielhauer, C.: An analysis framework for steganographic network data in industrial control systems. In: Proc. SECURWARE 2024. IARIA (2024)

2024
[35]

Soft computing19(11), 3331–3339 (2015)

Ogiela, M.R., Koptyra, K.: False and multi-secret steganography in digital images. Soft computing19(11), 3331–3339 (2015)

2015
[36]

OPC Foundation: official website (2025),https://opcfoundation.org

2025
[37]

In: Advances in Neural Information Processing Systems (2022)

Pan, X., Zhang, S., Zhang, M., Yang, M.: House of cans: Covert transmission of internal datasets via capacity-aware neuron steganography. In: Advances in Neural Information Processing Systems (2022)

2022
[38]

Petitcolas, F.A.P., Anderson, R.J., Kuhn, M.G.: Information hiding-a survey. Proc. of the IEEE87(7), 1062–1078 (1999)

1999
[39]

IEEE security & privacy1(3), 32–44 (2003)

Provos, N., Honeyman, P.: Hide and seek: An introduction to steganography. IEEE security & privacy1(3), 32–44 (2003)

2003
[40]

CAAI Transactions on Intelligence Technology6(2), 180–191 (2021) 18 S

Regazzoni,F.,Palmieri,P.,Smailbegovic,F.,Cammarota,R.,Polian,I.:Protecting artificial intelligence ips: a survey of watermarking and fingerprinting for machine learning. CAAI Transactions on Intelligence Technology6(2), 180–191 (2021) 18 S. Wendzel et al

2021
[42]

In: Proc

Song, C., Zhang, Y., Lu, G.: Reversible data hiding in encrypted images based on image partition and spatial correlation. In: Proc. International Workshop On Digital Watermarking (IWDW). pp. 180–194 (2018)

2018
[43]

In: Proc

Song, C., Ristenpart, T., Shmatikov, V.: Machine learning models that remember too much. In: Proc. ACM CCS 2017. pp. 587–601. ACM (2017).https://doi. org/10.1145/3133956.3134077

2017
[44]

In: International Workshop on Digital Watermarking

Spiekermann, D., Keller, J., Eggendorfer, T.: Towards covert channels in cloud environments: a study of implementations in virtual networks. In: International Workshop on Digital Watermarking. pp. 248–262. Springer (2017).https://doi. org/10.1007/978-3-319-64185-0_19

2017 doi
[45]

In: Proc

Strachanski, F., Petrov, D., Schmidbauer, T., Wendzel, S.: A comprehensive pattern-based overview of stegomalware. In: Proc. ARES’24 (2024).https://doi. org/10.1145/3664476.3670886

2024
[46]

IEEE Access7, 161899–161915 (2019).https: //doi.org/10.1109/ACCESS.2019.2951425

Velinov, A., Mileva, A., Wendzel, S., Mazurczyk, W.: Covert channels in the MQTT-based Internet of Things. IEEE Access7, 161899–161915 (2019).https: //doi.org/10.1109/ACCESS.2019.2951425

2019
[47]

Neurocomputing488, 226–247 (2022)

Wan, W., Wang, J., Zhang, Y., Li, J., Yu, H., Sun, J.: A comprehensive survey on robust image watermarking. Neurocomputing488, 226–247 (2022)

2022
[49]

IEEE Transactions on Dependable and Secure Computing (TDSC) (2024).https://doi.org/10.1109/ TDSC.2024.3410679

Wendzel, S., Schmidbauer, T., Zillien, S., Keller, J.: DYST (did you see that?): An amplified covert channel that points to previously seen data. IEEE Transactions on Dependable and Secure Computing (TDSC) (2024).https://doi.org/10.1109/ TDSC.2024.3410679

2024
[50]

Wendzel, S., Zander, S., Fechner, B., Herdin, C.: Pattern-based survey and cat- egorization of network covert channel techniques. Comp. Surveys47(3) (2015). https://doi.org/10.1145/2684195

2015 doi
[51]

In: Proc

Wolf, M.: Covert channels in LAN protocols. In: Proc. LAN Security, LNCS, vol. 396, pp. 89–101. Springer (1989)

1989
[52]

Zander, S.: Performance of selected noisy covert channels and their countermea- sures in IP networks. Ph.D. thesis, Swinburne Univ. (2010)

2010
[53]

Communications Surveys & Tutorials9(3), 44–57 (2007)

Zander, S., Armitage, G., Branch, P.: A survey of covert channels and countermea- sures in computer network protocols. Communications Surveys & Tutorials9(3), 44–57 (2007)

2007
[54]

In: Proc

Zhiyong, C., Yong, Z.: Entropy based taxonomy of network convert channels. In: Proc. 2nd Int. Conf. on Power Electronics and Intelligent Transportation System (PEITS). pp. 451–455 (2009)

2009
[55]

Soft Comput.23(13), 4927–4938 (2019)

Zhou, Z., Mu, Y., Wu, Q.M.J.: Coverless image steganography using partial- duplicate image retrieval. Soft Comput.23(13), 4927–4938 (2019)

2019
[56]

Computers & Security29(6), 686–696 (2010).https://doi.org/10.1016/j

Zi, X., Yao, L., Pan, L., Li, J.: Implementing a passive network covert timing chan- nel. Computers & Security29(6), 686–696 (2010).https://doi.org/10.1016/j. cose.2009.12.010

2010 doi

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.

[1] [48]

ACM Comput

Wendzel, S., Caviglione, L., Mazurczyk, W., Mileva, A., Dittmann, J., Krätzer, C., Lamshöft, K., Vielhauer, C., Hartmann, L., Keller, J., Neubert, T., Zillien, S.: A generic taxonomy for steganography methods. ACM Comput. Surv.57(9), 1–37 (May 2025).https://doi.org/10.1145/3729165

work page doi:10.1145/3729165 2025

[2] [41]

In: Proc

Schmidbauer, T., Wendzel, S.: SoK: A survey of indirect network-level covert chan- nels. In: Proc. 17th Asia Conf. Computer and Communications Security (ASI- ACCS). pp. 546–560. ACM (2022).https://doi.org/10.1145/3488932.3517418

arXiv 2022

[3] [1]

Computers & Security144(2024).https://doi.org/10.1016/ j.cose.2024.103976 16 S

DomEye: Detecting network covert channel of domain fronting with through- put fluctuation. Computers & Security144(2024).https://doi.org/10.1016/ j.cose.2024.103976 16 S. Wendzel et al

arXiv 2024

[4] [2]

Entropy21(4), 355 (2019)

Ahvanooey, M.T., Li, Q., Hou, J., Rajput, A.R., Chen, Y.: Modern text hiding, text steganalysis, and applications: A comparative analysis. Entropy21(4), 355 (2019)

work page 2019

[5] [3]

IBM Systems Journal35 (Nos3&4), 313–336 (1996)

Bender, W., Gruhl, D., Morimoto, N., Lu, A.: Techniques for data hiding. IBM Systems Journal35 (Nos3&4), 313–336 (1996)

work page 1996

[6] [4]

Bennett, K.: Linguistic steganography: Survey, analysis, and robustness concerns for hiding information in text. Tech. Rep. 2004-13, CERIAS Tech Report, Purdue University (2004)

work page 2004

[7] [5]

ACM Computing Surveys (CSUR)49(2), 1–36 (2016)

Carrara, B., Adams, C.: Out-of-band covert channels—a survey. ACM Computing Surveys (CSUR)49(2), 1–36 (2016)

work page 2016

[8] [6]

IEEE Security & Privacy20(5), 101–106 (2022)

Caviglione, L., Mazurczyk, W.: Never mind the malware, here’s the stegomalware. IEEE Security & Privacy20(5), 101–106 (2022)

work page 2022