Steganographic Analysis, Filtration and Elimination (SAFE)
Research in the area of steganography, as well as the state of the
art for security systems, is dominated by a reactive paradigm of
detection and response. However, by the time this reaction occurs,
substantial damage may have already occurred. To proactively stifle
steganography, covert channels, and other network attacks, the
RADIANT team is developing active warden security systems.
Using our model, all network traffic is routed through active
wardens which modify communications as to preserve overt
communications, yet prevent the propagation of extraneous or
ambiguous information that can be used for exploitation such as
covert channels, subliminal channels, and certain forms of intrusion
detection and intrusion detection evasion.
This is done by perturbing possible carriers to the level of their
Minimal Requisite Fidelity (MRF), which represents the
degree of signal fidelity that is both acceptable to end users but
destructive to covert channels. For a class of "unstructured"
carriers, MRF is defined by human perception, but for a class of
"structured" carriers, well-known semantics give us high assurance
that a warden can completely eliminate any subliminal or covert
channels.
