Annals of Telecommunications manuscript No. (will be inserted by the editor) Hidden and Under Control A Survey and Outlook on Covert Channel-internal Control Protocols Steffen Wendzel · J¨orgKeller Received: 11 June 2013 / Accepted: 7 January 2014 This is the accepted version of the article. The final publication is available at link.springer.com. Abstract Network covert channels are policy-breaking and stealthy commu- nication channels in computer networks. These channels can be used to bypass Internet censorship, to exfiltrate data without raising attention, to allow a safe and stealthy communication for members of political oppositions and for spies, to hide the communication of military units at the battlefield from the enemy, and to provide stealthy communication for today’s malware, especially for bot- nets. To enhance network covert channels, researchers started to add protocol headers, so called micro protocols, to hidden payload in covert channels. Such protocol headers enable fundamental features such as reliability, dynamic rout- ing, proxy capabilities, simultaneous connections, or session management for network covert channels — features which enrich future botnet communica- tions to become more adaptive and more stealthy than nowadays. In this survey, we provide the first overview and categorization of existing mi- cro protocols. We compare micro protocol features and present currently un- covered research directions for these protocols. Afterwards, we discuss the sig- nificance and the existing means for micro protocol engineering. Based on our findings, we propose further research directions for micro protocols. These fea- tures include to introduce multi-layer protocol stacks, peer auto-configuration, and peer group communication based on micro protocols, as well as to develop protocol translation in order to achieve inter-connectivity for currently sepa- rated overlay networks. S. Wendzel Fraunhofer FKIE, Bonn, Germany E-mail: steffen.wendzel@fkie.fraunhofer.de J. Keller Faculty of Mathematics and Computer Science FernUniversit¨at in Hagen, Hagen, Germany E-mail: joerg.keller@FernUni-Hagen.de