Corentin Louis
email: corentin.louis@univ-rennes1.fr

Matthis Desoteux
email: matthis.desoteux@univ-rennes1.fr

Cédric Coulouarn
email: cedric.coulouarn@inserm.fr

Exosomal circRNAs: new players in the field of cholangiocarcinoma

Keywords: Cholangiocarcinoma, circular RNA, exosomes, biomarkers

Cholangiocarcinoma (CCA) is a deadly cancer worldwide associated with limited therapeutic options. A recent study published in Clinical Science by Wang and colleagues [Clinical Science (2019) 133, 1935-1953] brought new perspectives to CCA management and therapy by focusing on circular RNAs (circRNAs). CircRNAs belong to an emerging class of functional non-coding RNAs (ncRNAs) regulating numerous biological processes. Notably, circRNAs have been associated with cancer onset and progression, although reports in CCA are very limited so far. In this work, the expression of circular RNA circ-0000284 (aka circHIPK3) was specifically elevated in CCA cell lines, human tumor tissues and plasma exosomes. Gain and loss of function approaches were performed to better understand the molecular mechanisms regulated by circ-0000284. Notably, the authors evaluated the role of circ-0000284 as a microRNA (miRNA) sponge. By prediction analysis and functional tests, a direct interaction was demonstrated with miR-637 that targets lymphocyte antigen-6 E (LY6E). Increased expression of circ-0000284 was associated with enhanced migration, invasion and proliferation of CCA cell lines. Interestingly, exosomal-mediated circ-0000284 was reported to exhibit pro-oncogenic effects on surrounding normal cells. Altogether, these data not only highlight circRNAs as new players in CCA pathogenesis but also as promising molecules for innovative non-invasive biomarkers, as circRNAs are enriched and stable in exosomes. Further investigations on extracellular vesicles should provide the necessary tools to improve CCA diagnosis, and move towards targeted-therapies.

Introduction

Cholangiocarcinoma (CCA) refer to a heterogeneous group of aggressive tumors that arise within both intrahepatic and extrahepatic bile ducts. CCA represent the second most common cancer in the liver after hepatocellular carcinoma (HCC). CCA incidence has been steadily increasing during the last decades and the absence of characteristic symptoms restrains early diagnosis [START_REF] Bertuccio | Global trends in mortality from intrahepatic and extrahepatic cholangiocarcinoma[END_REF]. In addition, resistance of CCA to conventional chemotherapies and radiotherapies approaches limits therapeutic options [START_REF] Rizvi | Cholangiocarcinoma -evolving concepts and therapeutic strategies[END_REF]. Surgical approaches remain the best possibly curative alternative for a total recovery. However, even total resections with safety margins are associated with a high rate of recurrence and a 5-year survival ranging from 15% to 40% (3). Hence, fresh ideas aiming at identifying novel therapeutic strategies and biomarkers are urgently needed to improve the survival of patients with CCA.

circRNAs: an emerging class of functional ncRNAs

Recently, circular RNAs (circRNAs) emerged in the literature as a puzzling class of noncoding RNAs (ncRNAs). For a long time, circRNAs were viewed as splicing noise or byproducts of splicing errors. Eventually, they drew increasing interest after being found dysregulated in several types of cancer, including CCA (4). Subsequently, growing evidences indicated that circRNAs play a key role in cancer onset and progression, by regulating notably cell proliferation, migration or invasion [START_REF] Bach | Circular RNAs in Cancer[END_REF]. It is now recognized that circRNAs, unlike linear RNAs, are generated through back-splicing and form a covalently closed continuous loop without 3' and 5' extremities. This specific structure renders circRNAs more stable and resistant to exonuclease degradation. Hence, circRNAs could be of a valuable assistance for clinical diagnosis, possibly serving as potent predictive non-invasive biomarkers, notably in CCA [START_REF] Li | Circular RNA is enriched and stable in exosomes: a promising biomarker for cancer diagnosis[END_REF]. The origin, biogenesis, and functions of circRNAs remained unclear for many years.

Nevertheless, points of consensus are starting to emerge in the literature. For instance, one of the latest studies in the field strengthened the established process governing circRNA biogenesis [START_REF] Li | A unified mechanism for intron and exon definition and back-splicing[END_REF]. Thus, it was confirmed that circRNAs are natural byproducts of spliceosomemediated splicing. Notably, a model whereby intron definition, exon definition and back-splicing require the same spliceosome machinery has been highlighted, suggesting that alternative back-splicing may compete with canonical splicing and thus regulate cell function at a post-transcriptional level. Interestingly, canonical and alternative back-splicing may be regulated by cis or trans factors [START_REF] Li | A unified mechanism for intron and exon definition and back-splicing[END_REF]. Accordingly, Conn et al. identified the TGFβ-induced RNA binding protein Quaking (QKI) as a regulator of circRNA biogenesis binding on introns flanking circRNA-forming exons [START_REF] Conn | The RNA binding protein quaking regulates formation of circRNAs[END_REF].

Almost 30 years after the discovery of the first spliced circular products [START_REF] Nigro | Scrambled exons[END_REF], active research in the field improved our understanding of circRNA function. Thus, circRNAs were mainly described as post-transcriptional regulators due to their capability to sponge microRNAs (miRNAs). However, additional functions have been attributed to circRNAs over the last years, including sequestration of proteins, competition with canonical mRNA splicing, and transcriptional regulation of their host gene [START_REF] Barrett | Circular RNAs: analysis, expression and potential functions[END_REF]. In addition, a new school of thought is reconsidering the non-coding nature of some circRNAs. This assertion is supported by recent evidences identifying translation initiation systems in circRNAs [START_REF] Schneider | Circular RNAs: Coding or noncoding?[END_REF].

circRNAs: a wide-open field for research in CCA

To date, only few recent studies investigated the role of circRNAs in CCA pathogenesis. One of them focused on CDR1AS, a circRNA already largely described for its implication in cancer onset and progression. Thus, CDR1AS expression was significantly higher in CCA tissue samples and correlated with clinical features such as lymph node invasion, advanced TNM stage, and a poor overall survival [START_REF] Jiang | A novel prognostic biomarker for cholangiocarcinoma: circRNA Cdr1as[END_REF]. Another study reported the expression of circRNAs in intrahepatic cholangiocarcinoma (iCCA). Gene expression profiling using pangenomic microarrays identified TGFβ-induced long ncRNA TLINC (formerly known as CASC15) in iCCA cell lines. Subsequently, this work revealed the presence of circular isoforms of TLINC in iCCA tissue samples [START_REF] Merdrignac | A novel transforming growth factor beta-induced long noncoding RNA promotes an inflammatory microenvironment in human intrahepatic cholangiocarcinoma[END_REF]. Although the function of TLINC circRNA in CCA carcinogenesis was not explicitly explored, a putative role in cancer stem cell biology is supported by an elevated expression of TLINC circRNA in human embryonic stem cells. [START_REF] Salzman | Cell-type specific features of circular RNA expression[END_REF].

A couple of studies performed by Xu et al. pinpointed two aberrantly expressed circRNAs in both CCA cell lines and human tumors. The involvement of these circRNAs in CCA progression has been determined by both in vitro and in vivo experiments. Thus, circ-0001649 and circ-0005230 were respectively down-and up-regulated in CCA cell lines and human tumors and their role as putative miRNA sponge was evaluated. In both cases, these circRNAs were associated with CCA progression and deserve further investigations as therapeutic targets for CCA [START_REF] Xu | Downregulated circular RNA hsa_circ_0001649 regulates proliferation, migration and invasion in cholangiocarcinoma cells[END_REF][START_REF] Xu | Elevation of circular RNA circ_0005230 facilitates cell growth and metastasis via sponging miR-1238 and miR-1299 in cholangiocarcinoma[END_REF]. In fact, most of the studies reported in CCA so far highlighted circRNA deregulations and their clinical relevance rather than performing a deep and comprehensive functional analysis.

A comprehensive analysis of circ-0000284 (circHIPK3) in CCA

The recent study published in Clinical Science by Wang and colleagues identified for the first time in CCA, circ-0000284, an isoform of the well-known circHIPK3 circRNA involved in tumor progression [START_REF] Wang | Circ-0000284 arouses malignant phenotype of cholangiocarcinoma cells and regulates the biological functions of peripheral cells through cellular communication[END_REF]. Prediction data reported 21 isoforms of circHIPK3 deriving from the same pre-mRNA [START_REF] Zhong | CircPrimer: a software for annotating circRNAs and determining the specificity of circRNA primers[END_REF]. Although all these isoforms were extensively described in cancer, circ-0000284 is definitely the most investigated one [START_REF] Jeck | Circular RNAs are abundant, conserved, and associated with ALU repeats[END_REF][START_REF] Zheng | Circular RNA profiling reveals an abundant circHIPK3 that regulates cell growth by sponging multiple miRNAs[END_REF][START_REF] Chen | circHIPK3 regulates cell proliferation and migration by sponging miR-124 and regulating AQP3 expression in hepatocellular carcinoma[END_REF][START_REF] Jin | CircRNA circHIPK3 serves as a prognostic marker to promote glioma progression by regulating miR-654/IGF2BP3 signaling[END_REF][START_REF] Ke | CircHIPK3 promotes proliferation and invasion in nasopharyngeal carcinoma by abrogating miR-4288-induced ELF3 inhibition[END_REF][START_REF] Li | CircHIPK3 sponges miR-558 to suppress heparanase expression in bladder cancer cells[END_REF][START_REF] Zeng | CircHIPK3 promotes colorectal cancer growth and metastasis by sponging miR-7[END_REF]. However, opposite actions for circ-0000284 were reported depending on the type of cancer (Table 1). Thus, circ-0000284 can exhibit either an oncogenic or a tumor suppressor role. As it stands, it is impossible to conclude firmly on a general function of circ-0000284 in cancer. However, it seems increasingly clear that circ-0000284 acts mainly as a miRNA sponge (Table 1). To this extent, there are strong evidences showing that circ-0000284 rather exhibits pro-oncogenic features. Further investigations are needed to determine whether specific circHIPK3 isoforms carry either oncogenic or tumor-suppressive features. As far as CCA is concerned, the recent work by Wang and colleagues demonstrated that circ-0000284 was able to sponge miR-637 and to promote CCA progression. Hence, the authors demonstrated that circ-0000284 acts as an oncogene by promoting CCA cell migration, invasion and proliferation.

Further mechanistic experiments established the ability of circ-0000284 to sponge miR-637, leading to increased expression of lymphocyte antigen-6 E (LY6E) through a competitive binding to miR-637 (Figure 1). LY6 complex is a group of alloantigens that was first discovered on lymphocytes. Interestingly, increased expression of LY6 family was reported in multiple types of cancer, and was subsequently associated with poor overall and disease free survival. Thus, high LY6E expression was significantly correlated with poor clinical outcome in colorectal cancer, glioma, ovarian cancer, gastric cancer, breast cancer and lung cancer. Altogether, these data suggest that LY6 family members play a crucial role in tumor progression and represent clinically relevant target [START_REF] Luo | Distinct lymphocyte antigens 6 (Ly6) family members Ly6D, Ly6E, Ly6K and Ly6H drive tumorigenesis and clinical outcome[END_REF]. To date, these data are the first to support a correlation between a high LY6E expression and a pro-oncogenic action in CCA, and providing a noteworthy mechanistic explanation [START_REF] Wang | Circ-0000284 arouses malignant phenotype of cholangiocarcinoma cells and regulates the biological functions of peripheral cells through cellular communication[END_REF]. However, LY6E is not the only target of miR-637 as reported in the literature (Table 2). Thus, miR-637 could affect CCA progression by targeting additional transcripts encoding proteins involved in cell proliferation and migration (e.g. CDK6, STAT3, AKT1) (Table 2). In addition, miR-637 could be itself regulated by non-coding endogenous competitors other than solely circHIPK3, as described in other diseases (26-34) (Table 2).

Exosomal circRNAs as non-invasive functional biomarkers in CCA

An important aspect of the study by Wang and colleagues relies on evaluating for the first time in CCA the influence of exosomal-transmited circRNAs on their immediate cellular microenvironment. Hence, autocrine and paracrine pro-tumorigenic actions mediated by exosomes-carried circRNAs (exo-circRNAs) were demonstrated (Figure 1). Although the elevated expression of exo-circ-0000284 has been measured in the host surrounding cells, no further information is provided as regard to the mechanisms that promotes cell migration and cell proliferation in these host cells. It was assumed that transformation of host cells was mediated by the same mechanism than the one described in tumor cells where exo-circ-0000284 was originating from. Thus, a mechanism involving miR-637 sponging needs to be more clearly defined. In addition, the possibility that exo-circ-0000284 involves different miRNA regulatory networks in host cells should not be excluded. Interestingly, an increased expression of circ-0000284 was also shown in plasma-derived exosomes from patients with CCA. To our knowledge, this is the first report of circulating exo-circRNAs in CCA. Thus, these findings provided a promising alternative for existing CCA biomarkers. Similarly, a recent paper highlighted the clinical relevance of protein biomarkers conveyed in body fluids via extracellular vesicles (EVs) in CCA [START_REF] Arbelaiz | Serum extracellular vesicles contain protein biomarkers for primary sclerosing cholangitis and cholangiocarcinoma[END_REF]. Thus, CCA-derived EVs from patient serum might serve as cargo for oncogenic proteins [START_REF] Arbelaiz | Serum extracellular vesicles contain protein biomarkers for primary sclerosing cholangitis and cholangiocarcinoma[END_REF]. Similar to circRNAs, EV-derived biomarkers are about to progressively challenge the poor established biomarkers in CCA.

For instance, serum level of carbohydrate antigen 19-9 (CA19-9) or carcinoembryonic antigen (CEA) are two possible biomarkers to suspect CCA diagnosis. However, several studies reported the poor specificity and sensitivity of these biomarkers, highlighting the need for more efficient substitutes for CCA diagnosis and prognosis [START_REF] Macias | Diagnostic and prognostic biomarkers in cholangiocarcinoma[END_REF][START_REF] Bergeat | Impact of stroma LOXL2 overexpression on the prognosis of intrahepatic cholangiocarcinoma[END_REF][START_REF] Sulpice | Epithelial cell adhesion molecule is a prognosis marker for intrahepatic cholangiocarcinoma[END_REF]. For that purpose, it would be of great interest to identify clinically relevant circRNA signatures in CCA to improve patient outcome, as circRNAs are easily detectable and stable in body fluids.

Conclusion

In conclusion, recent data provide evidence of circRNAs potential as robust biomarkers with diagnostic and prognostic values in CCA. Remarkably, Wang and colleagues identified, for the first time in CCA, an exosome-mediated circRNA that was able to display autocrine and paracrine actions promoting CCA progression. Interestingly, this circRNA was also found in plasma-derived-exosomes, opening new perspectives for the use of exo-circRNAs as noninvasive biomarkers. Further investigations should provide the necessary tools to improve CCA diagnosis, and move towards targeted-therapies.

APELIN circNOTCH1

Gastric cancer [START_REF] Guan | circ-NOTCH1 acts as a sponge of miR-637 and affects the expression of its target gene Apelin to regulate gastric cancer cell growth[END_REF] MMP19 circERBB2 [START_REF] Li | Upregulation of circular RNA circ-ERBB2 predicts unfavorable prognosis and facilitates the progression of gastric cancer via miR-503/CACUL1 and miR-637/MMP-19 signaling[END_REF] AKT1 FAL1 lncRNA Hirschsprung's disease [START_REF] Li | Long non-coding RNA FAL1 functions as a ceRNA to antagonize the effect of miR-637 on the down-regulation of AKT1 in Hirschsprung's disease[END_REF]

Table 1 : Examples of cancer-specific role and regulatory functions of circ-000284 Cancer type Function Oncogene or Tumor suppressor Reference

 1

	Bladder cancer	miRNA sponge (miR-558)	Tumor supressor	[23]
	Colorectal cancer	miRNA sponge (miR-7)	Oncogene	[24]
	Hepatocellular	miRNA sponge (miR-124)	Oncogene	[20]
	carcinoma
	Glioma	miRNA sponge (miR-654)	Oncogene	[21]
	Nasopharyngal	miRNA sponge (miR-4288)	Oncogene	[22]
	carcinoma
	Cholangiocarcinoma	miRNA sponge (miR-637)	Oncogene	[16]

Table 2 : Examples of disease-specific targets and regulatory functions of miR-637.

 2

	miR-637 target	Endogenous miR-637 competitor	Disease	Reference
	CDK6	LINC00473	Glioma	[26]
	KLK4	circCEACAM5	Ovarian cancer	[27]
	RING1	C5orf66-AS1 lncRNA	Cervical cancer	[28]
	STAT3	circHIPK3		[29]
			Colorectal cancer
		FAL1 lncRNA		[30]
	NUPR1
		LINC01234	Oral squamous cell carcinoma	[31]

Acknowledgements

Financial support and sponsorship

This work was supported by Inserm, Université de Rennes 1, INCa, and ITMO Cancer AVIESAN (Alliance Nationale pour les Sciences de la Vie et de la Santé) dans le cadre du Plan cancer (Non-coding RNA in cancerology: fundamental to translational; [Grant C18007NS to C.C.]). C.L. is supported by a PhD fellowship from Université de Rennes 1. M.D. is supported by a PhD fellowship from Ligue Contre le Cancer (CD22) and Région Bretagne. The authors are members of the European Network for the Study of Cholangiocarcinoma (ENSCCA) and participate in the initiative COST Action EUROCHOLANGIO-NET granted by the COST Association (CA18122).

Conflicts of interest

None.

Abbreviations: CCA, cholangiocarcinoma; circRNAs, circular RNAs; EVs, extracellular vesicles; exo-circRNAs, exosomes circRNAs; HCC, hepatocellular carcinoma; LY6E, lymphocyte antigen-6 E; miRNAs, microRNAs; ncRNAs, non-coding RNAs. (modified from Servier Medical images: https://smart.servier.com).


Wojciech Mazurczyk
email: w.mazurczyk@tele.pw.edu.pl

Steffen Wendzel
email: wendzel@hs-worms.de

Mehdi Chourib
email: mehdi.chourib@studium.fernuni-hagen.de

Jörg Keller
email: joerg.keller@fernuni-hagen.de

Countering adaptive network covert communication with dynamic wardens

Keywords:

Addresses the problem of increasingly sophisticated network covert channels.

• Presents a comprehensive taxonomy for wardens (covert channel countermeasures).

• Introduces the first warden to counter adaptive network covert channels.

Introduction

Network information hiding is a discipline that deals with the concealment of network communications or their characteristics and the hidden communication channel created by a data hiding method is referred to as a network covert channel [START_REF] Mazurczyk | formation Hiding in Communication Networks: Fundamentals, Mechanisms, Applications, and Countermeasures[END_REF].

From an economic perspective, covert channels are firstly a contributing factor for malware communications, especially botnet command & control (C&C) [START_REF] Mazurczyk | Information hiding as a challenge for malware detection[END_REF][START_REF] Wendzel | Hidden and uncontrolled -on the emergence of network steganographic threats[END_REF]. With covert channels, botnets (in comparison to solely applying encryption) can keep their communications secret [START_REF] Mazurczyk | formation Hiding in Communication Networks: Fundamentals, Mechanisms, Applications, and Countermeasures[END_REF][START_REF] Zander | A survey of covert channels and countermeasures in computer network protocols[END_REF]. As rental botnets are offered in the darkweb and as covert channels (and encryption) are a major factor in the longevity of such botnet ''products'', their study is a key factor for the success of such botnets. Secondly, another economically important scenario is the fact that covert channels provide a means for the stealthy exfiltration of business data, e.g., internal research results, marketing plans, business contracts or development plans [START_REF] Mazurczyk | formation Hiding in Communication Networks: Fundamentals, Mechanisms, Applications, and Countermeasures[END_REF][START_REF] Zander | A survey of covert channels and countermeasures in computer network protocols[END_REF]. Thirdly, covert channel detection, limitation and elimination is a feature of today's anti-malware/-virus software products, which represent an important market. Defeating covert channels is expected to become not only more challenging (as sophisticated techniques emerge) but also more important (as covert channel application increases [START_REF] Cabaj | The new threats of information hiding: The road ahead[END_REF][START_REF] Mazurczyk | Information hiding: Challenges for forensic experts[END_REF]). From a more general perspective, cyber threats are causing massive economical damage and with the improvement of defense systems, cybercriminals turn to less detectable attack techniques, such as network covert channels [START_REF] Cabaj | The new threats of information hiding: The road ahead[END_REF]. One of the key techniques ante portas are adaptive covert channels that automatically adjust their covert communication so that they can bypass introduced filter technologies. Considering these aspects, it is important to develop effective countermeasures to address risks involved with the utilization of network covert channels.

In information hiding the network entity that tries to reveal the existence of (and subsequently eliminate) the covert channel is referred to as a warden. A warden's role is to enable auditing, detection, limitation or elimination of such hidden communications [START_REF] Zander | A survey of covert channels and countermeasures in computer network protocols[END_REF][START_REF] Fisk | Eliminating steganography in internet traffic with active wardens[END_REF]. The warden can be equipped with various countermeasures, which can be classified into passive and active techniques.

Passive wardens apply non-influential techniques that monitor the traffic (e.g. using statistical or behavioral traffic analysis) to detect the involvement of a party in a covert communication or the secret communication itself. On the other hand, active wardens [START_REF] Anderson | On the limits of steganography[END_REF] employ measures to monitor, analyze and manipulate the overt traffic (that potentially carries a covert channel), the covert traffic, or both in order to try to disrupt the covert communication (e.g. by modifying packet contents, injecting packets into existing connections, inflicting intentional packet losses and/or delays).

An active warden is typically realized by means of traffic normalization. Traffic normalizers aim to remove semantic ambiguities of the protocol header fields or unify the timing behavior of network traffic passing through the normalizer. For example, a normalizer can be equipped with rules to set unused, reserved, and padding bits to zero or to reorder certain portions of packet headers to limit the possibility to successfully hide information there. 1 Traffic normalization may also affect the passing traffic (both malicious and legitimate) significantly, resulting in the unwanted side-effects.

Primarily, it can have a negative impact on the Quality of Service (QoS) of the passing traffic. The two main sources of this degradation are: (i) a potentially high number of warden's normalization rules with which the traffic is inspected, which may incur additional delays; (ii) warden normalization behavior which, for example, can result in adding intentional delays or losses to counter covert channels that exploit the timing aspects of the network traffic.

Secondly, an important deficit of current wardens (referred to as regular wardens in the sequel) is that typically their functioning is static, i.e., the set of active normalization rules typically remains constant in time or changes very rarely and slightly (e.g. in reaction to the discovery of some previously unknown data hiding techniques, an administrator may manually add new rules). In particular, this means that if the covert sender and the covert receiver are able to infer the warden's normalization capabilities then they can try to adapt to them [START_REF] Yarochkin | Towards adaptive covert communication system[END_REF] by adjusting their behavior. This is achieved by first discovering (during a so-called network environment learning (NEL) phase, cf. Section 4) and then by exploiting the warden's vulnerabilities, e.g., a lack of certain normalization rules for a particular data hiding method. In result, both covert communication parties can select a network covert channel which is not influenced by the warden in order to perform their hidden communication in an uninterrupted manner.

In this paper, we address the above mentioned deficits, i.e., the warden's static behavior and its impact on the inspected traffic. In particular, we devise a novel warden operation strategy that we call dynamic. A dynamic warden performs periodic, randomized shuffling of the active subset of normalization rules. In result, the warden is evolving its normalization behavior over time and thus it is increasing the uncertainty for the adaptive covert communication parties by limiting their ability to successfully infer a warden's normalization capabilities.

Considering the above, the main contributions of this paper are to: (i) perform a first comprehensive analysis of various aspects and features of a warden which influence its capabilities and effectiveness in countering network covert channels -to this aim a novel taxonomy for wardens is introduced; (ii) propose a novel active warden strategy, i.e., the dynamic warden, which is based on the constantly evolving normalization behavior in order to increase [START_REF] Mazurczyk | formation Hiding in Communication Networks: Fundamentals, Mechanisms, Applications, and Countermeasures[END_REF] The utilization of reserved/unused header areas and similar approaches is common in covert channel research, cf. e.g. [START_REF] Zander | A survey of covert channels and countermeasures in computer network protocols[END_REF][START_REF] Lucena | International Workshop on Privacy Enhancing Technologies[END_REF][START_REF] Wolf | Covert channels in LAN protocols[END_REF][START_REF] Kundur | Practical internet steganography: Data hiding in IP[END_REF].

the uncertainty of the covert communication parties and to limit their chance for successful covert communication; (iii) create the first proof-of-concept implementation of a dynamic warden; (iv) perform an extensive experimental evaluation which proves that this concept is effective and, in particular, allows to achieve a trade-off between the time needed to completely transmit covert data and CPU load, with a longer completion time of the hidden transmission at CPU load similar to a regular warden.

The remainder of this paper is structured as follows. Section 2 summarizes the state-of-the-art research on wardens and their capabilities. In Section 3, we introduce a novel and comprehensive warden taxonomy which takes various aspects of wardens into account. In Section 4, the concept of a dynamic warden is introduced which is later evaluated in Section 5. Section 6 concludes and provides an outlook on future work.

Related work

Investigating the threat caused by covert channels is currently essential in order to assess the cybersecurity of communication networks in a complete manner. It must be also noted that IP networks with all their services and protocols currently offer a wide range of features that can be utilized for covert channels creation. During the last two decades, many techniques that enable information hiding for various networking environments have been proposed [START_REF] Zander | A survey of covert channels and countermeasures in computer network protocols[END_REF][START_REF] Mileva | Covert channels in TCP/IP protocol stack -extended version[END_REF][START_REF] Mazurczyk | Steganography in modern smartphones and mitigation techniques[END_REF] and continuously they are spanning to the new ICT fields [START_REF] Wendzel | Hidden and uncontrolled -on the emergence of network steganographic threats[END_REF][START_REF] Zielińska | Trends in steganography, Commun[END_REF]. It must be also noted that in [START_REF] Wendzel | Pattern-based survey and categorization of network covert channel techniques[END_REF] Wendzel et al. analyzed more than 100 data hiding techniques that have been grouped into several categories (patterns) based on the way that they function. This illustrates how diverse, complex and sophisticated network covert channels are and therefore this underlines the need for effective countermeasures.

The concept of a warden was first introduced in Simmons' prisoners' problem [START_REF] Simmons | The prisoners' problem and the subliminal channel[END_REF] where two prisoners, Alice and Bob, are monitored by the jail ward (warden) and try to covertly communicate in order to devise an escape plan. If their secret communication is detected then the prisoners will be confined and thus no longer able to escape. In digital scenarios, the secret communication between Alice and Bob can, e.g., be data hiding in images, audio files or network traffic. In the sequel, we consider network traffic and the warden which is the main entity responsible for inspecting all passing messages in search for the embedded information. Below we review the most notable previous works focused on the warden concept.

Anderson et al. [START_REF] Anderson | On the limits of steganography[END_REF] distinguish between a passive warden, that is capable of monitoring and reporting unauthorized traffic, and an active warden that can modify and drop traffic comprising covert data without unnecessarily interfering a legitimate communication. A subtype of an active warden is the malicious warden [START_REF] Craver | On public-key steganography in the presence of an active warden[END_REF] which may act on the legitimate communication with impunity, e.g., by trying to impersonate covert communication parties. A passive warden could use, for example, a network intrusion detection system that monitors and detects irregularities within the passing network traffic [START_REF] Fisk | Eliminating steganography in internet traffic with active wardens[END_REF] or a decision tree-or support vector machine (SVM)-based classifier [START_REF] Zander | Stealthier inter-packet timing covert channels[END_REF][START_REF] Sohn | A study on the covert channel detection of TCP/IP header using support vector machine[END_REF][START_REF] Iglesias | Decision tree rule induction for detecting covert timing channels in TCP/IP traffic[END_REF] to detect network covert channel utilization.

Most active wardens rely on some kind of traffic normalizer, which is generally a network gateway capable of forwarding, dropping or modifying traffic by, e.g., clearing or resetting a set of bits in the network protocol header fields [START_REF] Wendzel | The problem of traffic normalization within a covert channel's network environment learning phase[END_REF] or by modifying packet delays [START_REF] Wendzel | Preventing protocol switching covert channels[END_REF]. Several specialized versions of active wardens were introduced, including a number of traffic normalizers such as OpenBSD pf 's scrubbing feature [START_REF]OpenBSD pf FAQ[END_REF] or the Snort normalizer [START_REF]Snort normalizer[END_REF].

Another strategy of an active warden is to introduce random noise within the detected covert channel [START_REF] Blasco | A framework for avoiding steganography usage over HTTP[END_REF]. As introducing noise can negatively impact legitimate (overt) communications, Fisk referring to an acceptable level of warden-introduced noise for communication peers [START_REF] Fisk | Eliminating steganography in internet traffic with active wardens[END_REF].

Another type of warden counters protocol switching covert channels, i.e., channels that signal hidden information by utilizing different network protocols. Both, detection based on machine learning [START_REF] Wendzel | Detecting protocol switching covert channels[END_REF] and a countermeasure that jumbles packet orders of such protocol switching covert channels [START_REF] Wendzel | Preventing protocol switching covert channels[END_REF] have been proposed.

An advanced variant of the traffic normalizer is the so-called Network-Aware Active Warden (NAAW) which has knowledge of the network topology in which it operates and which implements stateful traffic inspection and normalization. NAAWs were first introduced by Lewandowski et al. to normalize potential covert channels in IPv6-based traffic [START_REF] Lewandowski | Analyzing network-aware active wardens in IPv6[END_REF]. NAAWs are based on the concept of active mapping [START_REF] Shankar | Active mapping: Resisting NIDS evasion without altering traffic[END_REF], which is a network protection technique that maps the network and its policies to perform improved decisions for traffic normalization.

A detailed description of current techniques used in wardens can be found in [START_REF] Mazurczyk | formation Hiding in Communication Networks: Fundamentals, Mechanisms, Applications, and Countermeasures[END_REF]Chap. 8].

To the best of the authors' knowledge, existing works and systems have the following limitations when compared to the concept introduced in this paper: (i) typically, they focus only on a single capability of the warden with respect to the covert communication parties, i.e., most related work focuses on the distinction between passive vs. active warden. In this paper, we perform a systematic review of warden types and features; (ii) no work investigates relationships between various warden capabilities; (iii) most proposed wardens operate in a static manner. If the covert sender and the covert receiver are able to infer the warden's traffic modification strategy then they could adjust their used covert technique and perform their hidden communication uninterrupted.

Warden types and features -a novel taxonomy

When considering covert communication, we typically analyze a model in which we distinguish two opposite sides: two (or more) covert communication parties and one (or more) wardens trying to detect, limit or eliminate the hidden data exchange.

It is also worth noting that, depending on the application or the aim of the covert techniques' utilization, a paradox exists. For some applications, the warden is considered as an adversary (e.g. a censor in an oppressive regime) -in that scenario covert communication parties are trying to protect their privacy and freedom of speech or free access to information. On the other hand, if information hiding techniques are used to exfiltrate user's confidential data, the warden is trying to prevent the actions of an adversary (e.g. a malware). Considering the above paradox, we are focusing on the scenario where a warden is a desired security measure whose aim is to fight the malicious utilization of information hiding techniques.

In the reminder of this section, we present a systematic review on various warden realizations and introduce a new taxonomy depending on the following warden features (Fig. 1): behavior, structure, localization, and knowledge about the covert communication process (i.e. specifics of the hiding algorithm, how the secret data are presented in the communication channel or on a local host and the hidden data scenario used). To the authors' best knowledge this is the first attempt to provide such a comprehensive approach.

Warden structure and localization

Depending on the extent of the network infrastructure being controlled by a warden and eventually the administrative body and resources involved, wardens can be divided into: local, statelevel oblivious and state-level omniscient wardens. This taxonomy has been derived by analogy from the censor's classification used in evaluating censorship circumvention systems [START_REF] Houmansadr | The parrot is dead: Observing unobservable network communications[END_REF]. A local warden controls at most a few network devices, is able to monitor only a small number of connections and its computational and/or storage resources are limited (it can be further divided into local host or local network warden). A state-level oblivious warden has access to a vast number of devices spread geographically but it cannot keep network traces for a long time nor perform complex traffic analyses (due to limited computational and storage resources). It can perform, e.g., deep-packet inspection but can inflict it on short observations of network traffic (single packets and not many connections). Finally, a state-level omniscient warden controls geographically dispersed devices, can perform a variety of complex traffic analyses and store vast amounts of the intercepted traffic. When evaluating new information hiding techniques, this taxonomy allows to clearly indicate which type of adversary is considered in a threat model. When it comes to the warden structure, it can monitor network traffic in a single (centralized warden) or at multiple locations in the network at the same time and share gathered information among them (distributed warden). In general, the localization and the number of locations in which the warden is able to inspect the traffic have a significant impact on the warden effectiveness.

The warden's localizations and structure are closely related also to the typical hidden communication scenarios (Fig. 2) as they are interdependent. Below we systematically reveal these relationships to better understand various types of wardens and how they can be realized to maximize the probability of successful network covert channel detection and prevention.

The possible hidden communication scenarios (S1 to S4 in Fig. 2) influence the passive and active strategies for the warden. Scenario S1 is the most common: the sender and the receiver establish a network connection while simultaneously exchanging secret data. The overt data communication path is the same as the hidden path. For the next three scenarios (S2 to S4 in Fig. 2), only a part of the end-to-end path is used for a hidden communication, as a result of actions undertaken by intermediate nodes (IN). Note that, in principle, in scenario S4, the overt sender and receiver are unaware of the covert communication's existence.

Considering the presented scenarios, three main localizations for a network warden are possible (denoted in Fig. 2 as LN1/2 and WN1) and four localizations for a local host warden (denoted in Fig. 2 as LH1/2 and IN1/2). The main difference between local host and network warden is that the former is also able to analyze dependencies between processes on the machine and link them to the traffic that is generated. This is especially important if on a certain host a covert sender is active and uses a network covert channel technique to impact the traffic, e.g., by modifying header fields or by modulating the packets' timing. In this case, such anomalous behavior can be easily spotted. In contrast, network wardens mainly focus on analyzing traffic at the network level as performing attribution at this point is sometimes hard to achieve.

Below, we describe the centralized/distributed warden case for the local and state-level oblivious wardens. Note that in Fig. 2 borders between local, state-level oblivious and omniscient wardens are only contractual.

For the centralized local warden (typically this is the most realistic assumption for real-life networks) two potential locations are possible: (i) the traffic generation and processing activities are performed on a local host (LH1) or (ii) the traffic exchanged between internal and outside networks is analyzed by the network warden (LN1). In the case of a distributed warden, information about the traffic can be exchanged and correlated between LH1 and LN1 and then any potential anomaly can be reported (such realization is similar to an IDS with distributed network and host sensors). A local warden is able to potentially detect the existence or eliminate a covert channel only in scenarios S1 and S2 as in the remaining scenarios the hidden data path is located outside its jurisdiction.

In case of a centralized state-level oblivious warden, the warden is able to inspect processes and the generated traffic on a device located in the LAN (LH1) or WAN (IN1 or IN2). Alternatively, a network warden can be installed within a local area network (LN1) or in a wide area network (WN1). In general, it must be noted that centralized monitoring of the traffic at a single location (within a network or at host/node) offers only limited capabilities to detect covert communication. However, in case of IN1, IN2, and WN1, disturbing covert channels in all scenarios is possible. Alternatively, when a distributed state-level oblivious warden is considered then information gathered by each warden can be shared between the local host/intermediary node wardens (LH1, IN1/2) and network wardens (LN1, WN1). In result, more opportunities for the detection and targeted elimination are possible (blind elimination can be potentially applied at each node). However, it must be reminded that a state-level oblivious warden possesses only limited computational and storage capabilities, and thus eventually some information hiding techniques can remain undiscovered.

Finally, a state-level omniscient warden has a wider view on the network infrastructure as a local host or intermediary node warden. Also, a network warden can be (practically) installed anywhere in the network. The considerations regarding its centralized and distributed structure are the same as in the previous case. However, a state-level omniscient warden has capabilities to perform complex processes and traffic analyses and store vast amounts of traffic and thus potentially offers more powerful detection opportunities.

Warden knowledge

As already mentioned, in the first concepts of a network warden [START_REF] Fisk | Eliminating steganography in internet traffic with active wardens[END_REF], it was assumed that no knowledge about its surroundings or possible information hiding techniques is available. However, later solutions [START_REF] Lewandowski | Analyzing network-aware active wardens in IPv6[END_REF] started to consider additional knowledge which a warden can utilize in order to be more effective. In general, such knowledge can typically pertain to the network topology or specifics about a covert communication.

If we consider a stateful warden (passive or active), then it can be further classified into network-aware or network-unaware. A network-aware warden has knowledge about the topology of a network in which it operates and implements traffic inspection [START_REF] Lewandowski | Analyzing network-aware active wardens in IPv6[END_REF]. This gives the warden an advantage as more information can be deduced about a covert communication from the traffic context. Obviously, a network-unaware warden lacks this knowledge.

The knowledge about a covert communication is directly related to potential countermeasure types that a warden can apply. Kaur et al. [START_REF] Kaur | Countermeasures for covert channel-internal control protocols[END_REF] proposed a knowledge classification for wardens in the context of covert channel-internal control protocols (socalled micro protocols [START_REF] Backs | Dynamic routing in covert channel overlays based on control protocols[END_REF]). They differentiate between four cases in which the warden is either unaware of a covert communication, aware of the presence of a covert channel, aware of the channel's coding and syntax, or fully aware of all related details of the covert channel. We adopt this concept and distinguish the knowledge of wardens in a slightly different way. The warden's knowledge can comprise the following aspects:

• Embedding and extraction processes of the network steganography methods (applicable for a local host warden): (i) the embedding process and micro protocol operation at the covert sender-side; (ii) the extraction process and micro protocol operation at the covert receiver side.

• The transferred covert channel packets between the sender and the receiver, i.e., the representation of the steganographic technique in the overt communication channel. Such representation takes the form of a so-called hiding pattern [START_REF] Wendzel | Pattern-based survey and categorization of network covert channel techniques[END_REF] and it describes a steganographic technique on a generic level. Such hiding patterns can be observed at the local or statelevel network wardens.

Considering the above, based on the knowledge about the network covert channel that could have been potentially utilized for the hidden communication, warden attacks can be classified into four main types (by an analogy to [START_REF] Kaur | Countermeasures for covert channel-internal control protocols[END_REF]). Obviously, attacks on covert channels can be performed only by active wardens.

Firstly, the warden can be unaware of the presence of the information hiding technique but suspects that some covert communication could be taking place. In such a case, a warden has no knowledge of the specifics of the information hiding technique. In result, only normalization rules based on the previous experiences can be applied in the hope that this will be sufficient to interfere or to destroy the covert channel. This type of attack is a form of a blind attack.

Secondly, the warden can be only aware of the presence of the steganographic method but it possesses no knowledge about the specifics of the technique used to create a covert channel. In this case, it tries to influence its operation and semantics randomly, e.g., by injecting false data or erasing some packets, sending falsified commands to entities potentially involved in the covert communication (e.g. fake commands to terminate the covert communication in the hope to match the channel's syntax). Then it observes and reacts to potential anomalies in the responses. This, too, is a form of a blind attack.

Thirdly, the warden can be partially aware of the presence and the specifics of the information hiding technique used to perform covert communication. The knowledge that the warden has can be related to the syntax or semantics of the method and it can be efficiently utilized to inject targeted, legitimately appearing but falsified data to interfere with or to eliminate the covert channel. This type of attack is a form of a targeted attack.

Finally, the warden can be fully aware of the presence and specifics of the technique used, and even the hidden data scenario in which covert communication takes place. In this case, the warden can try targeted attacks to exploit weaknesses in the network covert channel design. If such weaknesses are identified, the warden has the largest possible control, i.e., it can not only destroy the covert channel efficiently but it can also eavesdrop or influence it, e.g., by impersonating one of the communication sides. This, too, is a form of a targeted attack.

Warden behavior

Actions that the warden can perform in order to counter network covert channels include [START_REF] Mazurczyk | formation Hiding in Communication Networks: Fundamentals, Mechanisms, Applications, and Countermeasures[END_REF]: (i) becoming aware of the channel's existence and documenting it; (ii) eliminating or limiting the covert channel's use; or (iii) detecting and auditing covert channels. Before any actions can be taken against an information hiding technique, it first needs to be identified, i.e., the warden needs to become aware of the (potential) covert channel presence. Afterwards, the warden can eliminate the network covert channel or reduce its capacity below an acceptable limit (depending on the particular security policy). This is, as already mentioned, typically achieved by means of traffic normalization. Covert channels that cannot be eliminated or limited should be audited so that reliable detection methods are required for this purpose. For network covert channel detection, statistical approaches (e.g. [START_REF] Cabuk | IP covert timing channels: Design and detection[END_REF]) or machine learning techniques are often utilized. However, it must be noted that currently there is no one-size-fits-all solution available that will enable detection of all information hiding techniques. Typically, a specific detection method is crafted for each type of the covert channel.

Warden functionality concerns the inner mechanisms utilized which affects its efficiency and operations. As mentioned in Section 1, a warden can behave passively or actively. Both warden types can be also stateless or stateful. A stateless warden does not take previous packets into account whereas a stateful warden keeps historical information of previously analyzed packets and uses it to evaluate currently inspected traffic. Obviously, the amount of the historical data to be stored and processed is an important parameter as it impacts overall warden performance.

Considering the above, it is clearly visible that an active warden offers more opportunities from the countermeasures perspective. In more details, an active warden can also behave proactively or reactively. When it is proactive it can intentionally issue 'probes' (e.g. crafted packets) for known (or unknown) covert channels to provoke responses that will betray that the hidden communication is taking place. It can also assume in advance that its main aim is to interfere with any covert communication (and not to detect it) and induce certain rules (typically by means of normalization) that will affect all passing traffic whether it contains secret data or not (blind behavior). Alternatively, a warden can behave reactively and trigger an action only when certain events or patterns indicate that the covert data exchange has been observed (targeted behavior). Obviously, a hybrid solution that combines both proactive and reactive behaviors is also possible.

Finally, what is most related to the content presented in the following sections of this paper, the warden can behave in a static or in a dynamic manner. Up till now practically all wardens functioning was static, i.e., their active normalization rules remained constant in time or changed only slightly and rarely. This, as already mentioned, has certain disadvantages as the adaptive covert communication parties can infer the warden's normalization capabilities and adapt to them. Alternatively, as proposed in this paper, the warden can apply a dynamic operation strategy in which it performs periodic, randomized shuffling of the active subset of normalization rules. In result, the warden is able to evolve its normalization behavior over time which disturbs the functioning of the adaptive covert communication parties. The details on the dynamic warden behavior strategy are described in the next section.

Dynamic active wardens

In this section, we introduce our concept of a dynamic warden. To this aim we first describe the underlying threat model, followed by a detailed description of the warden's inner workings.

It must be noted that if we take into account the warden taxonomy introduced in Fig. 1, the concept can be described as follows: the dynamic warden is an active, stateless warden with a proactive behavior. Its main aim is to eliminate or limit potential covert channels. It can be deployed as a centralized network warden that can be part of a local, state-level oblivious or omniscient defense. Specifically, it can be also unaware of the network topology and of the presence of a particular hidden data exchange.

Threat model

Yarochkin et al. first proposed an adaptive covert communication scenario [START_REF] Yarochkin | Towards adaptive covert communication system[END_REF]. It consists of two parts: the network environment learning (NEL) phase and communication (COM) phase. During the NEL phase, the covert sender and the covert receiver are trying to identify the most suitable covert channel for performing their hidden communication in the presence of an active warden. To achieve this, the covert communication parties first passively monitor network traffic to infer information on the utilized network protocols. Based on this knowledge, they activate a handshake process, select suitable network protocols and send packet probes to each other in order to verify whether a chosen protocol will be blocked by the warden. This process continues unless at least one suitable protocol for a covert communication is determined. After the NEL phase is initially completed, the actual secret data exchange starts (the COM phase). However, the NEL process remains active to determine other suitable protocols and to discover potential changes in the administrative setups such as newly introduced warden rules that will block previously usable protocols.

In this paper, we assume that the number of available network covert channels which can be used by the adaptive covert communication parties is always (at least slightly) larger than the set of normalization rules available to the warden. This is a realistic assumption as it is commonly known that, considering the number of potential data hiding techniques and available network protocols, it is practically impossible to completely eliminate opportunities for covert communication [START_REF] Mazurczyk | formation Hiding in Communication Networks: Fundamentals, Mechanisms, Applications, and Countermeasures[END_REF][START_REF] Moskowitz | Covert channels-here to stay?[END_REF]. In the case of a regular (static) warden, the adaptive covert sender and the covert receiver will eventually always find a way to exchange data in a hidden manner.

Considering the above, the covert communication parties can use two strategies as introduced by Wendzel [START_REF] Wendzel | The problem of traffic normalization within a covert channel's network environment learning phase[END_REF] to determine the active warden's ruleset (Fig. 3):

Direct Communication Strategy (ST1): the covert sender (CS)

and the covert receiver (CR) use a pre-defined packet sequence with different network protocols and types of bit manipulations in their protocol headers to infer if the active warden is present and which normalizing strategy it is using (ST1 in Fig. 3). Such an approach improves over Yarochkin et al. [START_REF] Yarochkin | Towards adaptive covert communication system[END_REF] as it utilizes an active behavior instead of only passively monitoring network traffic. In addition, this approach does not only analyze whether some network protocol is normalized by the warden or not, but also which bits of a protocol header undergo normalization [START_REF] Wendzel | The problem of traffic normalization within a covert channel's network environment learning phase[END_REF].

Indirect Communication Strategy (ST2):

CS and CR use a third (usually temporary) participant IN (intermediate node) that is reachable by both CS and CR (ST2 in Fig. 3). 2 Using node IN, CS and CR are not able to perform covert communication to the full extent, e.g., this covert channel has a very low capacity or can only be used temporarily. However, they are able to exchange via IN some limited meta-data regarding the probe traffic they try to send through the communication path ST1 [START_REF] Wendzel | The problem of traffic normalization within a covert channel's network environment learning phase[END_REF]. In other words, they can announce probe traffic to each other and provide feedback about whether the probe packets were received successfully. This way, they are able to successfully determine which types of protocols can be utilized for the covert communication. It is worth noting that IN is not necessarily required to be aware of the covert communication between itself and CS or CR [START_REF] Backs | Dynamic routing in covert channel overlays based on control protocols[END_REF].

Both mentioned approaches have their limitations, i.e., the first strategy (sending a pre-defined sequence of probe packets) is error-prone and the second strategy depends on a third party IN connected to CS and CR. However, experiments that have been performed using popular normalizers [START_REF] Wendzel | The problem of traffic normalization within a covert channel's network environment learning phase[END_REF] have shown that normalizers can still be beaten especially by the second strategy.

2 Please note that this scenario is also applied to construct covert channel over- lay networks [START_REF] Szczypiorski | Trust-MAS: Trusted communication platform for multi-agent systems[END_REF][START_REF] Backs | Dynamic routing in covert channel overlays based on control protocols[END_REF] where new links must be established between communicating covert nodes. The utilization of a (slow) temporary IN is a supporting factor in such scenarios [START_REF] Wendzel | The problem of traffic normalization within a covert channel's network environment learning phase[END_REF]. We conclude that both strategies are efficient even if they face a combination of all popular normalizers. It turned out that the first strategy can only be affected if a large part of the sequence sent is normalized and then the solution is to choose protocols not supported by the normalizers. Since a normalizer cannot affect an already working covert channel via a third party IN, the second strategy can be applied in any case.

Taking the threat of an adaptive covert communication scenario (continuous NEL phase with strategy ST2 in Fig. 3) as a starting point, we want to reinforce the warden to be able to counter both offensive scenarios aimed at inferring warden capabilities. Therefore, we propose a new dynamic strategy for an active warden. The proposed approach can be treated as a type of moving target defense [START_REF] Fink | Defense on the move: Antbased cyber defense[END_REF] and aims to increase the uncertainty of CS and CR about the normalizing strategy employed by the warden. This will be achieved by systematically and periodically modifying the warden's normalizing behavior over time. In other words, during the NEL phase or at any other time instant, inferring which protocols can be efficiently used for covert communication purposes will be an increased challenge for the covert communicating parties.

Dynamic warden concept

The dynamic strategy for an active warden is characterized as follows. We assume the presence of CS and CR that know that a normalizing active warden exists on their communication path and they try to devise a way to bypass it. Therefore, CS and CR utilize an adaptive covert communication system with the NEL and the COM phases as described in Section 4.1. We further assume that the NEL phase can be performed in parallel to the covert data exchange. CS and CR try to infer the warden's active rules, i.e., the way it works, and if they can correctly transfer covert data through the warden during the NEL phase, they will use these successful (i.e. non-blocked) covert channel techniques to exchange secret data during their COM phase. If a typical regular warden, i.e., the one with a static set of applied normalization rules, is used, CS and CR will sooner or later establish a suitable covert channel to exchange secrets (by continuously switching between various potential network covert channels until at least a single non-blocked covert channel is found). If we let R T (T for total) denote the set of all possible rules that in an ideal case are able to counter all possible network covert channels, then as previously mentioned, we assume that a regular warden can have a set R R of rules which

are a subset of R T (|R R | < |R T |).
In contrast, a dynamic warden can randomly choose

R D rules from R R (|R D | ≪ |R R |)
and apply these rules for f R seconds (reload interval). To counter the adaptive covert communication parties scenario, the dynamic warden applies R D normalization rules independently of the actual network traffic or any other outside information but in a constantly varying manner as after f R seconds another R D randomly chosen rules will be selected from R R and applied for the same period of time. The newly chosen rules are independent from the previously chosen rules. Thus, it will be difficult for the CS/CR to influence the warden's behavior in any way and this renders inferring suitable network covert channels between CS and CR a hard and time-consuming task as the subset of rules each time is randomized.

In result of the dynamic warden's actions, there is a situation as follows: CS and CR know that the warden exists and they launch the NEL phase, e.g., through the node IN. After some time, they find a suitable protocol for their covert communication. Then, they initiate a hidden communication (COM phase). However, after a short time, the warden's rules are changed, making it harder (or, optimally, impossible) for the CS and CR to communicate any further. Finally, they have to select another suitable overt protocol for hidden communication purposes or reinitiate the NEL phase. This sequence of events, i.e., finding a suitable covert channel, restarting the covert communication, and ''loosing'' the previously usable network covert channel, continues in a loop. This way, CS and CR may be ''paralyzed'' or at least their communication is prolonged so much that in result the secret communication becomes more visible and less efficient.

Experimental evaluation

In this section we first describe the experimental test-bed and the proof-of-concept implementation of the dynamic warden in Section 5.1, followed by the outline of the utilized experimental methodology in Section 5.2 and presentation of the obtained results in Section 5.3.

Experimental setup and proof-of-concept implementation

To experimentally evaluate our proof-of-concept implementation of the dynamic warden and to compare this concept with the regular warden, we created an experimental test-bed (Fig. 4) consisting of three hosts (CS, CR and a warden). Each host has two network interfaces. As presented in Fig. 4, there are two distinct network communication links: the 'Warden Link' between CS and CR and the 'NEL Link' (which represents the connection over a temporary intermediate node IN). The 'Warden Link' is used between CS and CR to perform the covert communication (COM phase) and to realize part of the NEL phase (send probe packets) through the warden. Each probe packet is sent by CS using the Scapy tool and the packet received by CR is captured by libpcap filters. Both adaptive communication sides can utilize one of 50 implemented network covert channels for every new packet they exchange. The 'NEL Link' can be used between CS and CR only to exchange metadata related to the sent and received probe packets. Please note that no intermediate node is required in this setup as the role of the intermediate node is only to forward packets, i.e., we assume a ''perfect'' intermediate node by creating a direct NEL Link.

As mentioned, our tool can exchange data over 50 different covert channels. These covert channels represent covert storage channels that embed secret data into various areas of network protocol headers, e.g., one covert channel encodes a secret information by setting the 'reserved' flag of the IPv4 header, another covert channel sets the IPv4 'identifier' field to a pre-defined value (its presence indicates the secret bit), etc.

As a warden, we used a Python-based implementation that allows to influence network packets passing through the Linux netfilter firewall. For each covert channel technique there is one matching rule integrated into the warden to filter the particular covert channel. For instance, a rule to catch the above mentioned covert channel that embeds data in the 'reserved' field of IPv4 is realized by checking for the presence of the set reserved bit. There is a 1-on-1 matching between covert channels and the set R T of filter rules, i.e., each covert channel can be detected by exactly one rule of the warden.

In case of the regular warden, we statically load our warden with a predefined subset R R of normalization rules. For the dynamic warden, we randomly activate a selected subset R D of the filter rules for the interval f R . After f R seconds the subset is shuffled and the next |R D | randomly chosen rules are selected. Both types of wardens have access to exactly the same set R T of normalization rules. For the dynamic warden the number of active rules and their activation time are configurable.

NEL phase details. In our experimental setup, we let CS and CR perform a NEL phase as follows.

First, CS announces probe packets (via the 'NEL link') that will be sent to the CR. A single covert channel technique for this purpose is randomly selected. After announcement, CS transfers the particular probe packet through the 'Warden Link' while CR waits for the packet to arrive on its warden-connected interface. Each probe packet is sent five times in a row in order to alleviate the problem of packet loss occurrence. If one of the NEL phase's announced probe packets is successfully received by the CR (within a waiting time of 5 s), the particular covert channel technique is considered as nonblocked. The CR sends this information back to CS via the 'NEL link'. As soon as the CS and the CR establish at least one utilizable covert channel technique, they begin sending covert traffic, i.e., they enter the COM phase.

However, if the CR does not receive the announced packet within a certain time period it will inform the CS (via the 'NEL link') that the packet was filtered out, i.e., the particular covert channel technique cannot be used to exchange data in a hidden manner. Independently of the CR report, CS waits 1 s and then starts to test another randomly selected covert channel type within the NEL phase. The set of non-blocked protocols is constantly updated by the NEL phase that is running in parallel to the COM phase.

COM phase details. As mentioned, when at least one non-blocked covert channel is determined by the CS and CR then the COM phase begins. In this case CS sends five packets with secret data using this particular covert channel type over the 'Warden Link'. Next, CS randomly selects another non-blocked data hiding technique that is available on the list of the non-blocked covert channels and sends another five packets with secret data. This process continues on and on. In case that there is only one non-blocked technique it will be continuously used. However, it must be noted that packets of the COM phase can be blocked by the dynamic warden whenever the ruleset is changed, i.e., such packets may not reach the CR at all.

The CR uses a counter that is incremented whenever a COM phase packet is successfully received and we also count the number of normalized and forwarded (without modification) packets at the warden as well as we record the consumption of the CPU time and main memory consumption.

Experimental methodology

It must be noted that for the purpose of this paper we have decided to implement quite a sophisticated version of the NEL phase with a number of additional features of [START_REF] Wendzel | The problem of traffic normalization within a covert channel's network environment learning phase[END_REF] when compared with original proposal from [START_REF] Yarochkin | Towards adaptive covert communication system[END_REF]. This includes, for example, an ability to switch between protocol field-specific (instead of only protocol-specific) covert channels or the ability to utilize the temporary intermediate node (IN) to circumvent the warden at least partially. Therefore such a realization of an adaptive network covert communication can be considered as a worst case scenario from the warden's perspective.

The experimental methodology for the dynamic and regular wardens is as follows. The measurement starts when the first protocol/covert channel announcement is received by the CR over the NEL link. Thus we measure the total time it takes to find the suitable covert channels and then to successfully transfer a certain number of packets with secret data (during the COM phase). It is worth noting that we deliberately do not count NEL phase packets as packets with covert information. Instead, we treat them as an ''overhead'' of the adaptive covert communication parties scenario. When CR obtains a pre-defined number of COM phase packets (e.g. 400), the measurement stops. This rule is legitimate as CS and CR could use a fountain code such as LT code [START_REF] Luby | LT codes[END_REF] to encode their message: for a message comprising p packets, CS can generate a potentially infinite stream of encoded packets, and CR can reconstruct (with overwhelming probability) the message from any subset of encoded packets, where the size of the subset is only slightly larger than p [START_REF] Luby | LT codes[END_REF]. Thus, CS that knows the message size, only needs to announce the number of required packets to CR via the NEL link.

Scenario Considerations.

During performed measurements we analyzed the following three scenarios: (i) the regular warden scenario which features a static subset R R of rules that are active for the whole experiment; (ii) the dynamic warden scenario which periodically activates a smaller subset R D of randomly chosen rules

((|R D | ≪ |R R |))
for a short time period of length f R ; (iii) the no warden scenario where the warden is inactive, i.e., the warden is configured to just forward packets without any modifications.

For the regular warden, we experimented by activating a large subset of rules (R R = 95% of all available rules 3 ). The subset for the dynamic warden was significantly smaller: R D consists of 20%, 30%, or 40% of all available rules. The collected results are averaged over the entire dataset of repeated trials to have a proper statistical relevance.

Conducted experiments

In this section we present results of the experimental evaluation of the dynamic warden concept. During our analyses we mainly focus on two aspects. First of all, we are interested to measure the dynamic warden effectiveness in order to determine whether it is superior or inferior against the adaptive covert communication parties when compared with the regular warden. Secondly, we investigate the impact of the dynamic warden on the consumption of the resources like CPU time and RAM. For the performed measurements we initially show results for the COM phase which consists of 400 packets with secret data. Later, we also analyze the impact of the length of data hiding exchange by comparing the scenario of 400 packets with 100 and 200 packets scenarios. Finally, we also investigate the completely random variants of the dynamic warden.

3 By R R = 95%, we mean |R R | = 0.95 • |R T |.

Effectiveness analysis

In order to investigate the effectiveness of the dynamic warden, we first decided to determine the impact of the ruleset reload interval f R on the time needed by the adaptive covert communication parties to covertly transfer 400 packets with secret data. Obviously, the longer the time needed to complete such a hidden data transfer the better the warden performed (so the higher its effectiveness) as in result it is harder for the covert communication parties to establish a non-blocked covert channel and transfer secret messages. To determine the nature of this effect, we experimented with the different dynamic ruleset sizes (R D = 20%, 30%, and 40%) for the dynamic warden and various reload intervals (from 1 to 35 s). The obtained results are presented in Fig. 5.

First it must be observed that the regular warden with 95% of continuously active rules is very ineffective as it makes the covert connection longer only by 1% when compared with the 'no warden' scenario. This shows that indeed in order to deal with the adaptive covert communication parties' threat other more effective solutions are desired.

For the dynamic warden, we observe that the best results were yielded for the shorter reload intervals, i.e., 2 s and R D = 40%. This means that the results were ca. 25% better (with standard deviation of 19.05 s) when compared with the time needed to complete the covert data transfer for the regular warden scenario. Moreover, for all investigated reload intervals and all considered active ruleset sizes the dynamic warden performed better than the regular one. It must be also observed that the longer the reload interval is, the shorter is the time needed to complete the transfer of 400 packets with hidden data and the best results are achieved for the time interval in the range 1 to 5 s. This follows intuition as the more often the ruleset changes the greater the chance that the list of non-blocked covert channels maintained by the adaptive covert communication parties is (at least partially) outdated. Then, we explored the traffic statistics for both the dynamic and the regular wardens, i.e., how many packets were normalized, forwarded without modification and exchanged in total. This allows to establish the cause why the dynamic warden outperforms the regular warden in the adaptive covert communication scenario.

The obtained results are presented in Figs. 6-8. Based on these figures it can be observed that although the number of normalized packets is lower for the dynamic warden by on average ca. 30% for R D = 40% (by ca. 50% for R D = 30% and by ca. 70% for R D = 20%) the number of forwarded packets is much higher and in result the total number of exchanged packets is much higher for the dynamic warden than for the regular one (i.e. up to 35% for R D = 40%, up to 30% for R D = 30% and up to 25% for R D = 20%). This explains why the total time needed to complete the transfer of 400 covert packets under the dynamic warden is much longer than for the regular warden. Due to the periodical changes in the active ruleset the adaptive covert sender must continuously modify the covert channel used with increasing uncertainty. Although a covert channel may have previously been identified as non-blocked, a moment later the active ruleset on the dynamic warden changed, resulting in a blocked covert channel and the need to transfer additional probe packets (NEL phase). It must be also emphasized that the prolonged covert transmission time together with the significantly higher number of packets that need to be generated and transmitted may allow additionally deployed detection measures to spot increased volume of traffic.

Resource consumption analysis and impact on legitimate users' traffic

In the next step, we investigated which impact each type of warden has on the memory and processor usage.

The obtained experimental results are presented in Figs. 9 and 10. The RAM usage seems to be not affected by the reload interval f R and it is about 25% higher than in case of the regular warden (with a very low standard deviation of 0.25 MB).

As to the CPU usage, for the lowest f R values the load is the highest, e.g., for 1 s the load is ca. 280% higher for R D = 40% when compared to the regular warden (with a standard deviation of 0.6). This is understandable as shuffling the active ruleset for the dynamic warden so often must be reflected in the increased CPU consumption. However, it should be also emphasized that for slightly higher values of f R , e.g., f R = 4 s, the CPU consumption is the same for the dynamic warden with R D = 30% and for the regular warden (R R = 95%). This shows that it is still possible to find a suitable trade-off between the CPU consumption (which may be similar to those caused by the regular warden) and the effectiveness of the dynamic warden. For instance, for the dynamic warden with f R = 10 s and R D = 40% the CPU consumption will be comparable while the time to complete the covert transmission will be increased by 20%. It must be also emphasized that with the link bandwidth growing beyond 1 Gb/s, and average TCP packet sizes of less than 1 kbit, a normalizer must handle more than 1 million packets per second. Even if applying a rule needs only 100 instructions, a core running at 2 GHz and with an IPC4 of 1.5 cannot apply more than 30 rules. 5While the throughput can be increased by using multiple cores for different packets, latency still will grow beyond 1 microsecond for more than 30 rules, as fine-grained parallelism by using multiple cores for different rules on a single packet will not pay off because of parallelization overhead. Thus, negative side-effects for packets with real-time requirements, such as Voice-over-IP traffic, would be the consequence. At the same time, the number of possible network covert channels still grows, which means that additional rules will be necessary if all covert channels are to be blocked. Hence, an approach achieving this goal without using all rules all the time is necessary.

It must be noted that results presented above are in line with the existing works discussing the security solutions' overhead in terms of resource consumption, e.g., [START_REF] Caviglione | The energy impact of security mechanisms in modern mobile devices[END_REF][START_REF] Merlo | A survey on energy-aware security mechanisms[END_REF].

Finally, we have also conducted experiments in order to determine the performance losses perceived by the legitimate users when the dynamic warden is deployed and compare the obtained results with the regular warden scenario. In order to evaluate this impact we conducted the following experiment. Due to its popularity we decided to utilize HTTP-based traffic, i.e., downloading of a 100 MB file from an HTTP server to an HTTP client through the warden. As an HTTP server we used SimpleHTTPServer6 version 0.6 and as HTTP client wget7 version 1.18. We measured the downloading time of the 100 MB file first for the regular (static) warden (with 95% active normalization rules) and then for the dynamic warden (with 40% active normalization rules and 10 s reload interval -we selected the configuration with the highest percentage of active rules, i.e., a worst case scenario). Each experiment has been repeated ten times to have a proper statistical relevance. From the obtained results we conclude that when the dynamic warden is deployed between the HTTP client and HTTP server the download time is ca. 7% shorter than in case of the regular warden scenario. This shows that the performance losses perceived by the legitimate users are lower for the dynamic warden setup.

Impact of the covert transmission length

Finally, we also want to investigate how the length of the covert communication impacts the effectiveness and performance of the dynamic warden. For this purpose we varied the number of packets that need to be exchanged during data hiding transmission in the range 100 to 400. The obtained results are presented in Figs. 1112131415. We restricted performed experiments to a dynamic warden with R D = 40% as it is the strongest among the three variants investigated. The results show that apart from the RAM consumption which is stable regardless of the length of the covert transmission the rest of the parameters change linearly. For example, the average time needed to covertly transfer 100 packets is ca. 100 s, for 200 packets it is around 200 s while for 400 packets it is ca. 400 s. Similar relationships are visible when taking into account the number of packets or CPU consumption.

Random dynamic warden variant

Finally, we have also decided to investigate a random variant of the dynamic warden. A random variant means that both f R and R D are selected randomly with equidistribution from certain ranges. We have considered the following four subvariants: • V1: f R ∈ ⟨1 s; 35 s⟩ and R D ∈ ⟨2%; 100%⟩ (i.e. between 1 and 50 rules). This means that the reload interval and the size of an active ruleset are selected randomly for the typical values investigated for the dynamic warden in the previous experiments.

• V2: f R ∈ ⟨1 s; 35 s⟩ and R D ∈ ⟨20%; 40%⟩ (i.e. the size of the active ruleset is randomly selected between 10 and 20 rules). Such values were tested for the dynamic warden in the previous sections.

• V3: f R ∈ ⟨1 s; 10 s⟩ and R D ∈ ⟨20%; 100%⟩ (i.e. between 10 and 50 rules). This means that the reload interval is selected from the values for which the best results have been achieved for the dynamic warden in the previous experiments.

• V4: f R ∈ ⟨1 s; 10 s⟩ and R D ∈ ⟨20%; 40%⟩ (i.e. between 10 and 20 rules) -both the reload interval and the size of the active ruleset are selected randomly in the ranges for which the best experimental results have been obtained for the dynamic warden investigated in the previous experiments.

The obtained results for all variants are presented in Table 1. The collected results are averaged over the entire dataset of 20 repeated trials to have a proper statistical relevance.

From the obtained results it may be observed that the V3 variant offers the best results in terms of the time needed to complete the covert transfer and the volume of traffic generated by the adaptive covert channel parties which is comparable with the best results obtained in the previous subsections while offering lower CPU and RAM consumption. The second best variant is V1 with 3.6% decrease in the time needed to complete data hiding exchange, while V2 and V4 results are similar and worse by 9% when compared with V3.

Therefore the random variant must be considered also as a promising realization of the dynamic warden.

Summary

The dynamic warden turned out to be a more promising countermeasure against the adaptive covert communication parties than currently available regular (active) wardens as the time needed to complete the hidden data transfer for the adaptive scenario is significantly longer. Moreover, the dynamic warden ''forces'' the adaptive covert communication parties to exchange many additional packets in comparison to the regular warden. For example, in the case when 400 covert packets need to be transferred in the presence of the dynamic warden with R D = 40%, ca. 1100 packets are needed in case of the regular warden and for the dynamic warden it is ca. 1450 packets (up to 35% increase). In other words the dynamic warden ''buys'' more time for the defensive solutions to spot covert communication as well as it makes it more visible (due to the elevated number of packets needed to be exchanged by the adaptive covert communication parties). Thus, the dynamic warden slows down covert data exfiltration attacks.

Especially, one solution is favorable when R D = 40% and f R = 2 s. However, in this case the CPU usage is elevated which is a result of the frequent changes applied to the normalization table. If the high CPU consumption is an issue then the dynamic warden with R D = 40% and f R = 10 s should be selected as it has practically the same performance as a regular warden while at the same time prolonging the length of the covert transmission by 25%.

Another alternative if the high CPU consumption is an issue is to realize the dynamic warden in a random variant where the CPU and RAM utilization are lower yet the other efficacy parameters are similar. The best variant of the random dynamic warden turned out to be the one where f R has quite a low value (i.e. randomly selected from the range ⟨1 s; 10 s⟩) and R D is chosen from ⟨20%; 100%⟩ range. In this case the CPU consumption is lower by ca. 50%, while the RAM usage decreases by ca. 25% and is similar to the regular warden scenario.

As already mentioned our approach introduces random shuffling of normalization rules to counter the frequent change of the network covert channels used by the covert sender and the covert receiver. It must be noted that when CS/CR infer this behavior they may further try to modify (simplify) their strategy, however, this will not be an advantageous option. Consider a simple scenario where CS/CR use a single covert channel (selected from the pool of available data hiding techniques) for the whole length of the covert transmission. In this case it does not matter which covert channel CS/CR will use as each of the data hiding techniques is only blocked part of the time, on average: |R D |/|R T | (or 40% of the time for the variant that turned out to be most effective for the dynamic warden).

Thus, the packets in which secret data is hidden will be success- the time needed to complete covert transmission would be 66% longer (compared to 25% increase in transmission time obtained in our experiments). This means that a dynamic warden cannot be easily overcome when the CS and CR are utilizing such a strategy (i.e. no change of used covert channel throughout the hidden data transmission).

Conclusion and future work

Covert channels are an increasingly important factor within the cyber economy. Their presence influences the lifespan and quality of illegal and legal products, such as botnets, anti-malware software or data leakage (protection). In recent years, covert channels became more adaptive and sophisticated, resulting in a demand for improved countermeasures, i.e., wardens.

In this paper, we first introduced a novel taxonomy that allows to comprehensively describe and understand wardens' features. Moreover, we identified weaknesses of existing regular (active but static) warden approaches, i.e., that they are not able to efficiently interfere with an adaptive covert communication parties scenario. In order to address this issue, we introduced a new type of warden, called a dynamic warden which is able to effectively limit the capabilities of the adaptive covert communication parties and renders it difficult for them to infer the warden's normalization strategy. To prove that the proposed solution is effective, we implemented a proof-of-concept and evaluated our dynamic warden concept by comparing it with a regular warden. We demonstrated that a significantly smaller number of active normalization rules is needed to interfere with the adaptive covert communication parties scenario, i.e., the data hiding transmission lasts up to 25% longer and up to 35% more packets must be exchanged. This provides defenders with an opportunity to detect and prevent further covert transfer as it is exposed for a longer time with a higher volume of data.

In currently ongoing work, we are going to implement a stateful version of the dynamic warden, which we call an adaptive warden. The adaptive warden introduces normalization rules based on the previously seen traffic. The main goal of the adaptive warden is to require fewer rules than the dynamic warden for the same degree of covert channel limitation while providing a better performance (as fewer rules must be checked per packet).

Our future work will comprise a stochastic model of the dynamic (and adaptive) wardens with Markov chains to see how good the wardens exploit their possibilities, and what their limits are.

Fig. 1 .

 1 Fig. 1. The proposed taxonomy of warden features.et al. introduced the concept of a Minimum Requisite Fidelity (MRF), referring to an acceptable level of warden-introduced noise for communication peers[START_REF] Fisk | Eliminating steganography in internet traffic with active wardens[END_REF].Another type of warden counters protocol switching covert channels, i.e., channels that signal hidden information by utilizing different network protocols. Both, detection based on machine learning[START_REF] Wendzel | Detecting protocol switching covert channels[END_REF] and a countermeasure that jumbles packet orders of such protocol switching covert channels[START_REF] Wendzel | Preventing protocol switching covert channels[END_REF] have been proposed.An advanced variant of the traffic normalizer is the so-called Network-Aware Active Warden (NAAW) which has knowledge of the network topology in which it operates and which implements stateful traffic inspection and normalization. NAAWs were first introduced by Lewandowski et al. to normalize potential covert channels in IPv6-based traffic[START_REF] Lewandowski | Analyzing network-aware active wardens in IPv6[END_REF]. NAAWs are based on the concept of active mapping[START_REF] Shankar | Active mapping: Resisting NIDS evasion without altering traffic[END_REF], which is a network protection technique that maps the network and its policies to perform improved decisions for traffic normalization.A detailed description of current techniques used in wardens can be found in[START_REF] Mazurczyk | formation Hiding in Communication Networks: Fundamentals, Mechanisms, Applications, and Countermeasures[END_REF] Chap. 8].To the best of the authors' knowledge, existing works and systems have the following limitations when compared to the concept introduced in this paper: (i) typically, they focus only on a single capability of the warden with respect to the covert communication parties, i.e., most related work focuses on the distinction between passive vs. active warden. In this paper, we perform a systematic review of warden types and features; (ii) no work investigates relationships between various warden capabilities; (iii) most proposed wardens operate in a static manner. If the covert sender and the covert receiver are able to infer the warden's traffic modification strategy then they could adjust their used covert technique and perform their hidden communication uninterrupted.

Fig. 2 .

 2 Fig. 2. Covert communication scenarios and potential warden structure and locations.

Fig. 3 .

 3 Fig. 3. Dynamic warden concept to defeat strategies performing a NEL phase.

Fig. 4 .

 4 Fig. 4. Experimental setup for comparing the performance of regular and dynamic wardens.

Fig. 5 .

 5 Fig. 5. Influence of the f R on the time needed to complete the transfer of 400 covert packets for different types of wardens.

Fig. 6 .

 6 Fig. 6. Influence of the f R on the number of normalized packets from CS to CR for different types of wardens.

Fig. 7 .

 7 Fig. 7. Influence of the f R on the number of forwarded packets from CS to CR for different types of wardens.

Fig. 8 .

 8 Fig. 8. Influence of the f R on the total number of packets from CS to CR for different types of wardens.

Fig. 9 .

 9 Fig. 9. Influence of the f R on the RAM usage for different types of wardens.

Fig. 10 .

 10 Fig. 10. Influence of the f R on the CPU usage for different types of wardens.

Fig. 11 .

 11 Fig. 11. Influence of the f R on the time needed to complete the transfer of covert packets for different lengths of the covert transmissions (R D = 40%).

Fig. 12 .

 12 Fig. 12. Influence of the f R on the number of normalized packets for different lengths of the covert transmissions (R D = 40%).

Fig. 13 .

 13 Fig. 13. Influence of the f R on the number of forwarded packets for different lengths of the covert transmissions (R D = 40%).

Fig. 14 .

 14 Fig. 14. Influence of the f R on the total number of packets for different lengths of the covert transmissions (R D = 40%).

  fully transferred in a fraction 1 -|R D |/|R T | or 60% of the time. This multiplies the time until a given number of covert channel-related packets is transmitted (compared to the no warden scenario) by 1/(1 -|R D |/|R T |) or 1/60% = 1.66. This means that in this case

Fig. 15 .

 15 Fig. 15. (a) Influence of the f R on the RAM usage for different lengths of the covert transmissions (R D = 40%). (b) Influence of the f R on the CPU usage for different lengths of the covert transmissions (R D = 40%).

Table 1

 1 Experimental results for various variants of the random dynamic warden. Std. dev. CPU usage [s] Std. dev. RAM usage [MB] Std. dev. # of norm. pkts. Std. dev. # of forw. pkts. Std. dev.

	Var. # of COM	Time of
		phase pkts.	covert
			transfer [s]
		400	400.2	21.71	4.17	0.4	354.09	0.85	319.25	43.8	1070.5	92.8
	V1	200	207.16	21.05	2.16	0.3	354.02	0.92	159.95	27.43	535.4	62.32
		100	106.88	16.12	1.11	0.33	353.57	0.49	77.5	28.28	252.35	34.14
		400	378.59	22.98	3.23	0.2	354.25	0.89	191.75	26.43	1177.8	83.88
	V2	200	192.35	14.57	1.62	0.11	354.01	0.75	96.55	11.41	578.1	42.02
		100	103.32	11.79	0.87	0.1	354.1	1.1	43.35	11.72	297.9	38.06
		400	415.9	28.94	6.72	0.48	354.36	0.79	418.95	27.90	999.80	78.57
	V3	200	215.79	25.32	3.45	0.39	353.99	0.71	199.6	21	520.1	76.92
		100	112.78	12.57	1.11	0.13	353.82	0.82	92.5	20.58	47.1	19.06
		400	379.29	18.22	4.15	0.19	354.07	0.69	199.55	23.77	1167.65	50.24
	V4	200	202.69	14.23	2.17	0.15	353.84	0.67	106.95	14.18	602.25	35.81
		100	107.31	13.79	1.11	0.13	353.79	0.61	44.05	13.7	305.45	39.37

Instructions per cycle, even a superscalar core normally does not reach higher counts.

While the above figures are synthetic, they match projections of Handley et al.[START_REF] Handley | Network intrusion detection: Evasion, traffic normalization, and end-to-end protocol semantics[END_REF] into current performance range.

https://docs.python.org/2/library/simplehttpserver.html#module- SimpleHTTPServer.

7 https://www.gnu.org/software/wget/.