QuicCourier: Leveraging the Dynamics of QUIC- Based Website Browsing Behaviors Through Proxy for Covert Communication

Network covert channels transmit secret messages by manipulating network traffic, including packet headers, timing intervals, and communication patterns. The growth of network services has spurred interest in exploring these channels. Yet, the practical application of these channels faces challenges in transmission rate and reliability due to unpredictable network interference. QUIC-based websites offer promising opportunities for covert communication, given their inherent dynamic nature from web resource updates and network interferences. Repeated visits or refresh actions on the same website generate substantial statistical redundancy. Furthermore, widely used proxy tools introduce additional traffic morphology changes. This paper presents <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">QuicCourier</i>, a covert channel leveraging web traffic's dynamic characteristics and proxy service encapsulation to hide messages in QUIC packets from the service node to the client. Guided by a generative model for web resource patterns, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">QuicCourier</i> ensures that covert traffic closely resembles legitimate traffic, employing three packet-wise meta operations. The altered QUIC flows are then encased in proxy protocols, complicating the detection of embedded information. The covert receiver is incorporated into the proxy client. The efficacy of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">QuicCourier</i> is evaluated using a dataset of over 30,000 web browsing traffic samples, demonstrating its exceptional undetectability against state-of-the-art traffic classification tools and a high covert transmission rate.