Novel Ransomware Hiding Model Using HEVC Steganography Approach

Abstract

Ransomware is considered one of the most threatening cyberattacks. Existing solutions have focused mainly on discriminating ransomware by analyzing the apps themselves, but they have overlooked possible ways of hiding ransomware apps and making them difficult to be detected and then analyzed. Therefore, this paper proposes a novel ransomware hiding model by utilizing a block-based High-Efficiency Video Coding (HEVC) steganography approach. The main idea of the proposed steganography approach is the division of the secret ransomware data and cover HEVC frames into different blocks. After that, the Least Significant Bit (LSB) based Hamming Distance (HD) calculation is performed amongst the secret data's divided blocks and cover frames. Finally, the secret data bits are hidden into the marked bits of the cover HEVC frame-blocks based on the calculated HD value. The main advantage of the suggested steganography approach is the minor impact on the cover HEVC frames after embedding the ransomware while preserving the histogram attributes of the cover video frame with a high imperceptibility. This is due to the utilization of an adaptive steganography cost function during the embedding process. The proposed ransomware hiding approach was heavily examined using subjective and objective tests and applying different HEVC streams with diverse resolutions and different secret ransomware apps of various sizes. The obtained results prove the efficiency of the proposed steganography approach by achieving high capacity and successful embedding process while ensuring the hidden ransomware's undetectability within the video frames. For example, in terms of embedding quality, the proposed model achieved a high peak signal-to-noise ratio that reached 59.3 dB and a low mean-square-error of 0.07 for the examined HEVC streams. Also, out of 65 antivirus engines, no engine could detect the existence of the embedded ransomware app.

A Crypto-Steganography Approach for Hiding Ransomware within HEVC Streams in Android IoT Devices

“…To further ensure the superiority of the proposed crypto-steganography approach, we compared its accomplishment with recent related steganography algorithms that are introduced in [ 38 , 39 , 58 ]. These introduced algorithms are based on only one stage of LSB steganography without employing further security stages like encryption or random embedding strategy as investigated in our proposed work in this paper.…”

“…These introduced algorithms are based on only one stage of LSB steganography without employing further security stages like encryption or random embedding strategy as investigated in our proposed work in this paper. Table 7 shows the objective outcomes of the comparative analysis between the proposed approach compared to the related algorithms [ 38 , 39 , 58 ] in terms of all quality assessment metrics that were presented in Table 3 .…”

Truncation and Rounding-Based Scalable Approximate Multiplier Design for Computer Imaging Applications

“…Figure of merit PSNR is calculated using the mean-square error between the original and filtered images. The proposed truncated approximation multiplier is compared with various previous [22,[27][28][29][30], multipliers to validate the quality through the errors. Testing of the proposed is performed with sharpening and JPEG compression image processing applications.…”