Mohamed, Emad EldinMnaouer, Adel BenBarka, Ezedin2020-02-092020-02-0920162016Mohamed, E. E., Mnaouer, A. B., & Barka, E. (2016). PSCAN: A port scanning network covert channel. In Proceedings - Conference on Local Computer Networks, LCN (pp. 631–634). https://doi.org/10.1109/LCN.2016.1099781509020546http://dx.doi.org/10.1109/LCN.2016.10920.500.1251https://hdl.handle.net/9/124This conference paper is not available at CUD collection. The version of scholarly record of this conference paper is published in 2016 IEEE 41st Conference on Local Computer Networks (LCN) (2016), available online at: https://doi.org/10.1109/LCN.2016.109.This paper introduces PSCAN, a port scanning-based network covert channel that violates non-discretionary system security policy that does not allow data transfer from a given process (the sender) to another given process (the receiver). Using PSCAN, the sender opens and closes network ports in a way that encodes covert data. The receiver performs a synchronized port scanning procedure on the sender's host to determine which ports are open and which ones are closed then decodes the data. The paper defines the covert channel and analyzes its data rate, stealthiness, and robustness. In addition, the paper investigates countermeasures against the channel. © 2016 IEEE.enPermission to reuse abstract has been secured from IEEE Computer SocietyComputer networksData transferScanningCovert channelInformation hidingITS dataNetwork covert channelPort scanningSystem securityNetwork securityConference PaperCopyright : 2016 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.