Steganalysis of Compressed Speech to Detect Covert VoIP Channels

A network covert channel is a passage along which information leaks across the network in violation of security policy in a completely undetectable manner. This paper reveals our findings in analysing the principle of G.723.1 codec that there are ‘unused’ bits in G.723.1 encoded audio frames, which can be used to embed secret messages. A novel steganalysis method that employs the second detection and regression analysis is suggested in this study. The proposed method can detect the hidden message embedded in a compressed VoIP speech, but also accurately estimate the embedded message length. The method is based on the second statistics, i.e. doing a second steganography (embedding information in a sampled speech at an embedding rate followed by embedding another information at a different level of data embedding) in order to estimate the hidden message length. Experimental results have proven the effectiveness of the steganalysis method for detecting the covert channel in the compressed VoIP speech.

[1]  John C. Wray.  An Analysis of Covert Timing Channels , 1992, J. Comput. Secur..

[2]  Andreas Pfitzmann,et al.  Attacks on Steganographic Systems , 1999, Information Hiding.

[3]  Jessica J. Fridrich,et al.  Detecting LSB Steganography in Color and Gray-Scale Images , 2001, IEEE Multim..

[4]  Andreas Westfeld.  Detecting Low Embedding Rates , 2002, Information Hiding.

[5]  Jessica J. Fridrich,et al.  Steganalysis of JPEG Images: Breaking the F5 Algorithm , 2002, Information Hiding.

[6]  Jessica J. Fridrich,et al.  Practical steganalysis of digital images: state of the art , 2002, IS&T/SPIE Electronic Imaging.

[7]  J. Dittmann,et al.  Network based intrusion detection to detect steganographic communication channels: on the example of audio data , 2004, IEEE 6th Workshop on Multimedia Signal Processing, 2004..

[8]  Jana Dittmann,et al.  Steganography and steganalysis in voice-over IP scenarios: operational aspects and first experiences with a new steganalysis tool set , 2005, IS&T/SPIE Electronic Imaging.

[9]  Thomas J. Walsh,et al.  Security Considerations for Voice Over IP Systems , 2005 .

[10]  Hong-Juan Zhang,et al.  Steganalysis of audio: attacking the Steghide , 2005, 2005 International Conference on Machine Learning and Cybernetics.

[11]  Wojciech Mazurczyk,et al.  New VoIP Traffic Security Scheme with Digital Watermarking , 2006, SAFECOMP.

[12]  Jana Dittmann,et al.  Design and evaluation of steganography for voice-over-IP , 2006, 2006 IEEE International Symposium on Circuits and Systems.

[13]  Ismail Avcibas.  Audio steganalysis with content-independent distortion measures , 2006, IEEE Signal Processing Letters.

[14]  Xing Li,et al.  Steganography-Oriented Noisy Resistance Model of G.729a , 2006, The Proceedings of the Multiconference on "Computational Engineering in Systems Applications".

[15]  Ismail Avcibas,et al.  Steganalytic Features for JPEG Compression-Based Perturbed Quantization , 2007, IEEE Signal Processing Letters.

[16]  Jana Dittmann,et al.  Mel-cepstrum-based steganalysis for VoIP steganography , 2007, Electronic Imaging.

[17]  Wojciech Mazurczyk,et al.  Steganography of VoIP Streams , 2008, OTM Conferences.

[18]  Shanyu Tang,et al.  An Approach to Information Hiding in Low Bit-Rate Speech Stream , 2008, IEEE GLOBECOM 2008 - 2008 IEEE Global Telecommunications Conference.

[19]  Jin Liu,et al.  An adaptive steganography scheme for voice over IP , 2009, 2009 IEEE International Symposium on Circuits and Systems.

[20]  Qingzhong Liu,et al.  Temporal Derivative-Based Spectrum and Mel-Cepstrum Audio Steganalysis , 2009, IEEE Transactions on Information Forensics and Security.