DNS ID Covert Channel based on Lower Bound Steganography for Normal DNS ID Distribution

The covert channel is a method used to send secret data within a communication channel in unauthorized ways. This is performed by exploiting the weaknesses in packet or network communications with the intention to hide the existence of a covert communication. The DNS identification (DNS ID) method has been exploited by Thyer. However, the major problem in Thyer's implementation is that the encrypted cipher was directly inserted as a DNS ID value, which is abnormal, compared to the normal DNS ID distribution. We have overcome this problem through the application of Steganography to insert the cipher value into the DNS ID. The data set test for normal DNS ID is taken from MAWI. We tested four different message lengths and plotted the distribution graph. We found that the proposed result is normal compared to normal distribution of the DNS ID. Therefore, this method produces a normal distribution for DNS ID covert channel. .