On Tuning the Knobs of Distribution-Based Methods for Detecting VoIP Covert Channels

Abstract

Abstract-We study the parameters (knobs) of distributionbased anomaly detection methods, and how their tuning affects the quality of detection. Specifically, we analyze the popular entropy-based anomaly detection in detecting covert channels in Voice over IP (VoIP) traffic.There has been little effort in prior research to rigorously analyze how the knobs of anomaly detection methodology should be tuned. Such analysis is, however, critical before such methods can be deployed by a practitioner. We develop a probabilistic model to explain the effects of the tuning of the knobs on the rate of false positives and false negatives. We then study the observations produced by our model analytically as well as empirically. We examine the knobs of window length and detection threshold. Our results show how the knobs should be set for achieving high rate of detection, while maintaining a low rate of false positives. We also show how the throughput of the covert channel (the magnitude of the anomaly) affects the rate of detection, thereby allowing a practitioner to be aware of the capabilities of the methodology.

VoIP steganography and its Detection—A survey

“…The "cost" for the extra reliability is a loss of some fraction of the steganographic bandwidth. Arackaparambil et al [2012] described a simple VoIP steganography method in which chosen RTP packets' payloads are replaced with a steganogram and the RTP header's sequence number, and/or timestamp fields are intentionally changed to make them appear as if they were excessively delayed by the network. This solution can be treated as a variation of the LACK method described above.…”

“…Experimental results showed that the subspace-based model proved to be very simple and yielded very good performance, while the convex set-based one was more powerful, but more timeconsuming. Arackaparambil et al [2012] analysed how in distribution-based steganalysis, the length of the window of the detection threshold and in which the distribution is measured, should be depicted to provide the greatest chance for success. The results obtained showed how these two parameters should be set for achieving a high rate of detection, whilst maintaining a low rate of false positives.…”

On the undetectability of transcoding steganography

“…Arackaparambil et al analyzed how, in distribution‐based steganalysis, the length of the window of the detection threshold and in which the distribution was measured should be depicted to provide the greatest chance of success. The results obtained showed how these two parameters should be set for achieving a high rate of detection, while maintaining a low rate of false positives.…”

Steganalysis of transcoding steganography

“…We assume that for the purposes of this paper it is not crucial which steganogram spreading mechanism is used, and thus it is out of the scope of this work. (1), typically transcoded (2), and encoded with covert codec (3) The performance of TranSteg depends, most notably, on the characteristics of the pair of codecs: the overt codec originally used to encode user speech and the covert codec utilized for transcoding. In ideal conditions the covert codec should not significantly degrade user voice quality compared to the quality of the overt codec (in an ideal situation there should be no negative influence at all).…”