{"id":16409862,"url":"https://github.com/cdpxe/nelphase","last_synced_at":"2025-04-22T12:34:55.262Z","repository":{"id":100166461,"uuid":"90241856","full_name":"cdpxe/NELphase","owner":"cdpxe","description":"Network Environment Learning (NEL) Phase for Covert Channels (with a Feedback Channel)","archived":false,"fork":false,"pushed_at":"2024-10-29T18:40:52.000Z","size":98,"stargazers_count":3,"open_issues_count":0,"forks_count":1,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-10-29T20:38:29.247Z","etag":null,"topics":["covert-channel","firewall","firewalls","information-hiding","network-security","network-steganography","performance-analysis","research","research-paper","research-project","research-tool","scientific-publications","security-tools","steganography"],"latest_commit_sha":null,"homepage":"http://ih-patterns.blogspot.de/p/nel-tool.html","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cdpxe.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":"CITATION.cff","codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-05-04T08:51:13.000Z","updated_at":"2024-10-29T18:40:56.000Z","dependencies_parsed_at":"2024-10-29T20:02:06.247Z","dependency_job_id":null,"html_url":"https://github.com/cdpxe/NELphase","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cdpxe%2FNELphase","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cdpxe%2FNELphase/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cdpxe%2FNELphase/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cdpxe%2FNELphase/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cdpxe","download_url":"https://codeload.github.com/cdpxe/NELphase/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223896873,"owners_count":17221463,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["covert-channel","firewall","firewalls","information-hiding","network-security","network-steganography","performance-analysis","research","research-paper","research-project","research-tool","scientific-publications","security-tools","steganography"],"created_at":"2024-10-11T06:21:45.202Z","updated_at":"2024-11-09T23:40:47.488Z","avatar_url":"https://github.com/cdpxe.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Network Environment Learning (NEL) Phase for Covert Channels (incl. a Feedback Channel and Warden Simulator).\n\nIn *Network Steganography* research, a covert channel is a stealthy communication channel. Some covert channels are capable of performing a so-called [**Network Environment Learning** phase](https://www.researchgate.net/publication/229091999_The_Problem_of_Traffic_Normalization_Within_a_Covert_Channel%27s_Network_Environment_Learning_Phase?ev=srch_pub\u0026_sg=yiWm%2Fl1DEUeQDayeMTW0oEMG5Uyxo4zfcmAAOkr6NkJtTx6g7xucnaWMAIFkzvlq_n6tx%2Fpj8MwJkZ%2FDhSCYZtVcY3G8XFjtuD0wGGY97liDms58KUp77JmWf%2F2uLjaFg_9rtZQe80mfDWVt%2BOxdHhJvIgvvSP8%2FJUpvi9Tx32b%2BASAG60z5JBglEJw%2Fx0RbUK) (or: **NEL** phase). Such covert channels can determine how data can be covertly exchanged in a way that countermeasures (firewalls, traffic normalizers, active wardens) can be bypassed.\n\nFor instance, a typical covert channel technique is to embed secret data in reserved or unused bits of protocol headers. A typical firewall filter could simply clear the bit to prevent such a covert channel. During the NEL phase, communicating covert channel peers can determine such a filter rule and switch to alternative covert channels.\n\nAlthough the NEL phase was originally discussed in academia about ten years ago, *no implementation was made available by other researchers*. With *NEL*, **we provide the first public implementation of a NEL phase** on the basis of *scapy* and *libpcap*. In addition, NEL can simulate the influence of regular (static), dynamic and adaptive wardens on the NEL phase. NEL is written in C and runs best under Linux.\n\n**Requirements:**\n\n- Scapy must be installed\n- gcc and make\n- pcap library, incl. libpcap-dev, must be installed\n- pthreads library\n\n**Documentation:** Please have a look at the *[documentation](https://github.com/cdpxe/NELphase/blob/master/documentation/README.md)*.\n\n**My open online class on Network Covert Channels:** available [here](https://github.com/cdpxe/Network-Covert-Channels-A-University-level-Course).\n\n\n**Other Covert Channel Tools:** See my repository on [network covert channel tools](https://github.com/cdpxe/NetworkCovertChannels).\n\n**Feedback:** Please send requests and feedback to the author ([Steffen Wendzel](https://www.wendzel.de)).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcdpxe%2Fnelphase","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcdpxe%2Fnelphase","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcdpxe%2Fnelphase/lists"}