A Multi-Layer Network Steganography Framework Using ICMP and NTFS Alternative Data Streams for Secure Covert

Abstract With the rapid expansion of digital communication networks, protecting sensitive information against interception, traffic analysis, and cyber surveillance has become increasingly challenging. While cryptography secures the content of messages, it does not hide the existence of communication, making encrypted traffic vulnerable to detection and blocking. Network steganography addresses this limitation by embedding secret data into legitimate network traffic using covert channels. However, most existing network steganography techniques rely on single layer hiding mechanisms, which suffer from limited bandwidth, low robustness, and high detectability under modern intrusion detection systems. This paper proposes a multi-layer network steganography framework that integrates ICMP-based covert channels with NTFS Alternative Data Streams (ADS) to significantly enhance capacity, security, and stealth. The proposed approach hides secret files and messages inside ADS at the file-system level and then encapsulates the ADS-based payload within ICMP packets at the network level, forming a hierarchical covert communication architecture. This layered model is inspired by multi-layer steganography principles and onion-routing-style security, where each layer provides an additional level of protection. Experimental analysis demonstrates that the proposed multi-layer framework achieves higher hidden data capacity and stronger resistance to detection compared to conventional ICMP-based covert channels, while maintaining normal network behavior. The results confirm that combining file-system-level and network-level steganography offers a powerful mechanism for secure covert communication in modern networks. Keywords Network steganography, covert channels, ICMP, NTFS Alternative Data Streams, multi-layer security, information hiding.