{"id":"https://openalex.org/W7165967225","doi":"https://doi.org/10.1016/j.cose.2026.105043","title":"STUN comprehension-optional attributes as a covert channel: Design, implementation, and detection","display_name":"STUN comprehension-optional attributes as a covert channel: Design, implementation, and detection","publication_year":2026,"publication_date":"2026-06-25","ids":{"openalex":"https://openalex.org/W7165967225","doi":"https://doi.org/10.1016/j.cose.2026.105043"},"language":"en","primary_location":{"id":"doi:10.1016/j.cose.2026.105043","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.105043","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.cose.2026.105043","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5139371600","display_name":"Gorka Gorrochategui","orcid":null},"institutions":[{"id":"https://openalex.org/I136040515","display_name":"Universidad de Deusto","ror":"https://ror.org/00ne6sr39","country_code":"ES","type":"education","lineage":["https://openalex.org/I136040515"]}],"countries":["ES"],"is_corresponding":true,"raw_author_name":"Gorka Gorrochategui","raw_affiliation_strings":["Faculty of Engineering, University of Deusto, Avenida de las Universidades 24, Bilbao, 48007, Spain"],"raw_orcid":"https://orcid.org/0009-0008-6778-7625","affiliations":[{"raw_affiliation_string":"Faculty of Engineering, University of Deusto, Avenida de las Universidades 24, Bilbao, 48007, Spain","institution_ids":["https://openalex.org/I136040515"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5052785153","display_name":"Unai Zulaika","orcid":"https://orcid.org/0000-0002-7366-9579"},"institutions":[{"id":"https://openalex.org/I136040515","display_name":"Universidad de Deusto","ror":"https://ror.org/00ne6sr39","country_code":"ES","type":"education","lineage":["https://openalex.org/I136040515"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Unai Zulaika","raw_affiliation_strings":["Faculty of Engineering, University of Deusto, Avenida de las Universidades 24, Bilbao, 48007, Spain"],"raw_orcid":"https://orcid.org/0000-0002-7366-9579","affiliations":[{"raw_affiliation_string":"Faculty of Engineering, University of Deusto, Avenida de las Universidades 24, Bilbao, 48007, Spain","institution_ids":["https://openalex.org/I136040515"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5014996866","display_name":"Pablo Garaizar","orcid":"https://orcid.org/0000-0001-8160-9130"},"institutions":[{"id":"https://openalex.org/I136040515","display_name":"Universidad de Deusto","ror":"https://ror.org/00ne6sr39","country_code":"ES","type":"education","lineage":["https://openalex.org/I136040515"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Pablo Garaizar","raw_affiliation_strings":["Faculty of Engineering, University of Deusto, Avenida de las Universidades 24, Bilbao, 48007, Spain"],"raw_orcid":"https://orcid.org/0000-0001-8160-9130","affiliations":[{"raw_affiliation_string":"Faculty of Engineering, University of Deusto, Avenida de las Universidades 24, Bilbao, 48007, Spain","institution_ids":["https://openalex.org/I136040515"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5139371600"],"corresponding_institution_ids":["https://openalex.org/I136040515"],"apc_list":{"value":3190,"currency":"USD","value_usd":3190},"apc_paid":{"value":3190,"currency":"USD","value_usd":3190},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.82630507,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"170","issue":null,"first_page":"105043","last_page":"105043"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9072999954223633,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9072999954223633,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.008999999612569809,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12268","display_name":"Deception detection and forensic psychology","score":0.008100000210106373,"subfield":{"id":"https://openalex.org/subfields/3207","display_name":"Social Psychology"},"field":{"id":"https://openalex.org/fields/32","display_name":"Psychology"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/covert","display_name":"Covert","score":0.7329999804496765},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.2515999972820282},{"id":"https://openalex.org/keywords/covert-channel","display_name":"Covert channel","score":0.24420000612735748},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.2076999992132187}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7659000158309937},{"id":"https://openalex.org/C2779338814","wikidata":"https://www.wikidata.org/wiki/Q5179285","display_name":"Covert","level":2,"score":0.7329999804496765},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6873000264167786},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.33059999346733093},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.2515999972820282},{"id":"https://openalex.org/C29024540","wikidata":"https://www.wikidata.org/wiki/Q1476964","display_name":"Covert channel","level":5,"score":0.24420000612735748},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.2280000001192093},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.22789999842643738},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.2076999992132187},{"id":"https://openalex.org/C125209513","wikidata":"https://www.wikidata.org/wiki/Q4037520","display_name":"Doors","level":2,"score":0.18780000507831573}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.cose.2026.105043","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.105043","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.cose.2026.105043","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.cose.2026.105043","pdf_url":null,"source":{"id":"https://openalex.org/S12529635","display_name":"Computers & Security","issn_l":"0167-4048","issn":["0167-4048","1872-6208"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers & Security","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":6,"referenced_works":["https://openalex.org/W1981844530","https://openalex.org/W1993704367","https://openalex.org/W2152988830","https://openalex.org/W2889467899","https://openalex.org/W3017460886","https://openalex.org/W4383620399"],"related_works":[],"abstract_inverted_index":{"Real-time":[0],"communication":[1],"protocols":[2],"carry":[3],"implicit":[4],"trust":[5],"at":[6],"perimeter":[7],"defenses":[8],"because":[9],"enterprise":[10],"networks":[11],"must":[12],"allow":[13],"them":[14],"for":[15,66],"Voice":[16],"over":[17],"IP":[18,161],"(VoIP)":[19],"and":[20,37,51,76,146,163,193,295],"Web":[21],"Real-Time":[22,40,303],"Communication":[23,304],"(WRTC)":[24],"operation.":[25],"Existing":[26],"covert-channel":[27],"literature":[28],"has":[29,82],"explored":[30],"Session":[31,63],"Initiation":[32],"Protocol":[33,42],"(SIP)":[34],"signaling":[35,306],"(Mazurczyk":[36],"Szczypiorski,":[38],"2008),":[39],"Transport":[41],"(RTP)/RTCP":[43],"media":[44],"(Mazurczyk,":[45],"2013;":[46],"Schmidt":[47],"et":[48,55,59,111],"al.":[49,56,60],"2018),":[50],"WRTC":[52],"streams":[53],"(Barradas":[54],"2020;":[57],"Figueira":[58],"2022),":[61],"but":[62],"Traversal":[64],"Utilities":[65],"NAT":[67,74],"(STUN),":[68],"despite":[69],"its":[70,77],"central":[71],"role":[72],"in":[73,79,252,290],"traversal":[75],"ubiquity":[78],"modern":[80],"networks,":[81],"not":[83],"been":[84],"investigated":[85],"as":[86,218],"a":[87,93,129,164,194,227,286],"covert":[88,96,208,241,272],"channel":[89,97,242],"carrier.":[90],"We":[91],"design":[92],"Layer":[94],"2":[95],"that":[98],"encapsulates":[99],"arbitrary":[100],"Ethernet":[101],"frames":[102],"within":[103],"STUN":[104,255],"comprehension-optional":[105],"attributes,":[106],"which":[107],"RFC":[108],"5389":[109],"(Rosenberg":[110],"al.,":[112],"2008)":[113],"requires":[114],"compliant":[115],"implementations":[116],"to":[117,232],"silently":[118],"ignore.":[119],"A":[120,141,265],"bidirectional":[121],"polling":[122],"mechanism":[123],"overcomes":[124],"STUN\u2019s":[125],"client\u2013server":[126],"asymmetry,":[127],"producing":[128,275],"full-duplex":[130],"tunnel":[131],"indistinguishable":[132],"from":[133,257,263],"legitimate":[134,254,281],"Interactive":[135],"Connectivity":[136],"Establishment":[137],"(ICE)":[138],"keep-alive":[139],"traffic.":[140],"portable":[142],"proof-of-concept":[143],"was":[144,172],"implemented":[145],"deployed":[147],"on":[148],"two":[149],"embedded":[150],"Linux":[151],"devices":[152],"of":[153,239,299],"distinct":[154],"architectures:":[155],"an":[156],"ARM-based":[157],"Yealink":[158],"T19P":[159],"E2":[160],"phone":[162],"MIPS-based":[165],"Ubiquiti":[166],"EdgeRouter":[167],"X.":[168],"Empirical":[169],"evasion":[170],"testing":[171],"conducted":[173],"against":[174],"Snort":[175],"3":[176],"with":[177,183,189],"47,143":[178],"Talos":[179],"rules,":[180],"Suricata":[181],"8":[182],"the":[184,190,216,222,240,248,258,280,297],"ET":[185],"Open":[186],"ruleset,":[187],"Zeek":[188],"spicy_STUN":[191],"analyzer,":[192],"FortiGate":[195],"40F":[196],"firewall":[197],"running":[198],"full":[199],"Unified":[200],"Threat":[201],"Management":[202],"(UTM)":[203],"services.":[204],"Across":[205],"3646":[206,271],"data-carrying":[207],"messages,":[209],"no":[210],"signature":[211],"or":[212],"protocol-aware":[213],"engine":[214],"flagged":[215],"traffic":[217],"anomalous.":[219],"To":[220],"address":[221],"detection":[223,288],"gap,":[224],"we":[225],"propose":[226],"lightweight":[228],"Shannon-entropy":[229],"detector":[230],"applied":[231],"optional-attribute":[233],"payloads.":[234],"The":[235],"mean":[236],"per-attribute":[237],"entropy":[238,250],"reaches":[243],"6.247":[244],"bits/byte,":[245],"well":[246],"above":[247],"highest":[249],"observed":[251],"1358":[253],"messages":[256,273],"ITC-Net-blend-60":[259],"dataset":[260],"(4.392":[261],"bits/byte":[262,267],"Telegram).":[264],"4.5":[266],"threshold":[268],"flags":[269],"all":[270],"while":[274],"zero":[276],"false":[277],"positives":[278],"across":[279],"corpus.":[282],"These":[283],"results":[284],"expose":[285],"systemic":[287],"gap":[289],"current":[291],"network":[292],"defense":[293],"strategies":[294],"motivate":[296],"integration":[298],"entropy-aware":[300],"inspection":[301],"into":[302],"(RTC)":[305],"protocols.":[307]},"counts_by_year":[],"updated_date":"2026-07-02T06:12:58.138171","created_date":"2026-06-26T00:00:00"}