Detecting covertly stored payloads of data within a network

A method for detecting covert payloads of data within an IP network, said method comprising the steps of:

• monitoring activity at one or more hosts of the IP network for datagrams comprising error messages;
• identifying a selection of said datagrams comprising said error messages as containing one of said covert payloads, wherein each of said selection of said datagrams comprise at least two factors selected from the group consisting of:
• said error messages of said selection of said datagrams occur with a regularity that is greater than a natural statistical average for the IP network with a margin of error;
• said error messages of said selection of said datagrams are formatted identically to at least one prior error message within said monitored activity;
• and
• said error messages of said selection of said datagrams indicate arrival from a different address within the IP network than indicated in source addresses of headers of said error messages of said selection of said datagrams;
• generating a notification indicating that said covert payloads of data are found within said IP network;
• altering said selection of said datagrams to remove said covert payloads;
• and
• monitoring further transmission of said altered datagrams within said network.

A system for detecting covert payloads of data within an IP network, said system comprising:

• a number of hosts, each respective host comprising one or more processors and one or more electronic storage devices comprising software instructions, which when executed, configure said one or more processors to:
• monitor error messages generated by said respective host in response to datagrams received at said respective host;
• and
• identifying any of said received datagrams resulting in generation of said error messages with a regularity above a predetermined threshold.