DNS request for normal minima length distribution based on reference matrix

Abstract

Packet length covert channels are the methods to indirect conceal a secret message in the packet. A consideration on the distribution of the packet length in the network is necessary to assure the normal distribution of the packet. An analysis on standard DNS queries within a campus network showed that the distribution range of the packet is between 24 to 63 bytes of length. Hitherto, previous packet length covert channel produce abnormal packet length when the range of the packet length is less than 40. Therefore, this problem motivated the study to propose a novel hidden method based on indirect reference to DNS query to conceal the secret message. The proposed method was experimented against three DNS query sample. The result showed the propose method was within the normal packet length distribution. The contribution of this study was a normal distribution of packet length within a constrain of minima length distribution.