Application of Perfectly Undetectable Network Steganography Method for Malware Hidden Communication

Bak, Patryk; Bieniasz, Jędrzej; Krzemiński, Michał; Szczypiorski, Krzysztof

doi:10.1109/icfsp.2018.8552057

Cited by 16 publications

(3 citation statements)

References 3 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…This section highlights different steganography techniques presented in the literature [14][15][16][17][18][19][20][21][22][23][24][25][26][27][28]. Tab.…”

Section: Literature Reviewmentioning

confidence: 99%

“…Network steganography plays a significant role in malware information hiding in which one or more components of the malicious software are embedded in the network traffic [24]. In [25], a hidden communication system was implemented utilizing the StegBlocks technique to perform text communication between the attacker and the active malicious software. However, the attacker output text file is restricted to 23 kB.…”

Section: Literature Reviewmentioning

confidence: 99%

See 1 more Smart Citation

Novel Ransomware Hiding Model Using HEVC Steganography Approach

Almomani¹,

Alkhayer²,

El‐Shafai³

2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

Ransomware is considered one of the most threatening cyberattacks. Existing solutions have focused mainly on discriminating ransomware by analyzing the apps themselves, but they have overlooked possible ways of hiding ransomware apps and making them difficult to be detected and then analyzed. Therefore, this paper proposes a novel ransomware hiding model by utilizing a block-based High-Efficiency Video Coding (HEVC) steganography approach. The main idea of the proposed steganography approach is the division of the secret ransomware data and cover HEVC frames into different blocks. After that, the Least Significant Bit (LSB) based Hamming Distance (HD) calculation is performed amongst the secret data's divided blocks and cover frames. Finally, the secret data bits are hidden into the marked bits of the cover HEVC frame-blocks based on the calculated HD value. The main advantage of the suggested steganography approach is the minor impact on the cover HEVC frames after embedding the ransomware while preserving the histogram attributes of the cover video frame with a high imperceptibility. This is due to the utilization of an adaptive steganography cost function during the embedding process. The proposed ransomware hiding approach was heavily examined using subjective and objective tests and applying different HEVC streams with diverse resolutions and different secret ransomware apps of various sizes. The obtained results prove the efficiency of the proposed steganography approach by achieving high capacity and successful embedding process while ensuring the hidden ransomware's undetectability within the video frames. For example, in terms of embedding quality, the proposed model achieved a high peak signal-to-noise ratio that reached 59.3 dB and a low mean-square-error of 0.07 for the examined HEVC streams. Also, out of 65 antivirus engines, no engine could detect the existence of the embedded ransomware app.

show abstract

“…This section highlights different steganography techniques presented in the literature [14][15][16][17][18][19][20][21][22][23][24][25][26][27][28]. Tab.…”

Section: Literature Reviewmentioning

confidence: 99%

Section: Literature Reviewmentioning

confidence: 99%

Novel Ransomware Hiding Model Using HEVC Steganography Approach

Almomani¹,

Alkhayer²,

El‐Shafai³

2022

Computers, Materials &Amp; Continua

View full text Add to dashboard Cite

show abstract

“…Так, в роботі [2] було розроблено метод мережної стеганографії, який не можна виявити. В роботі [3] запропоновано його застосування для встановлення прихованого зв'язку між зловмисником і активним шкідливим додатком на стороні зараженого терміналу. В свою чергу, в роботі [4] запропоновано новий метод мережної стеганографії -«метод опцій», та описано теоретичну основу на прикладі опцій «запис маршруту» та «тимчасовий штамп».…”

Section: вступunclassified

Analysis of privacy and stability to interference in the communication channel of network steganography methods

Shcherbak¹,

Astrakhantsev²,

Shcherbak³

et al. 2018

Problemi Telekomunìkacìj

View full text Add to dashboard Cite

In this paper, for the first time, the effectiveness of network steganography methods has been investigated using channel coding of data when they are transmitted over communication channels with interferences, and the method of mathematical modeling evaluates the stability of network steganography methods to the detection. The network steganography methods concealing data in such protocols as HTTP, TCP and ICMP were considered. Using the ICMP «Secure» mode of the developed method, the greatest throughput was achieved. To study the noise resistance of the methods before transmission by the communication channel, the packets were encoded using the 2 Binary 1 Quandary linear coding algorithm, after which additive white Gaussian noise was added to the stego object. The paper substantiates the possibility of using network steganography methods to protect biometric data from unauthorized access in the case of using remote biometric authentication. Based on the research results, it was determined that the network steganography method based on hiding data in TCP is more efficient when working via communication channels with noise. It makes possible to recover a message with small distortions at a dispersion value of 0.4. But according to a set of criteria for resistance to noise and detection probability, the best is the «Fast» mode of the network steganography method based on hiding data in ICMP. Анотація-В роботі вперше досліджено ефективність методів мережної стеганографії за умови використання канального кодування даних при їх передачі каналом зв'язку з шумами та оцінено стійкість методів мережної стеганографії до виявлення. На основі результатів досліджень визначено, що метод мережної стеганографії з використанням протоколу TCP є більш ефективним за умови роботи каналами зв'язку з шумами, але за сукупністю критеріїв стійкість до шумів / прихованість найкращим є режим «Швидкий» методу мережної стеганографії з використанням протоколу ICMP.

show abstract