Steganalysis of transcoding steganography

Abstract

Transcoding steganography (TranSteg) is a fairly new IP telephony steganographic method that functions by compressing overt (voice) data to make space for the steganogram by means of transcoding. It offers high steganographic bandwidth, retains good voice quality, and is generally harder to detect than other existing VoIP steganographic methods. In TranSteg, after the steganogram reaches the receiver, the hidden information is extracted, and the speech data is practically restored to what was originally sent. This is a huge advantage compared with other existing VoIP steganographic methods, where the hidden data can be extracted and removed, but the original data cannot be restored because it was previously erased due to a hidden data insertion process. In this paper, we address the issue of steganalysis of TranSteg. Various TranSteg scenarios and possibilities of warden(s) localization are analyzed with regards to the TranSteg detection. A novel steganalysis method based on Gaussian mixture models and melfrequency cepstral coefficients was developed and tested for various overt/covert codec pairs in a single warden scenario with double transcoding. The proposed method allowed for efficient detection of some codec pairs (e.g., G.711/G.729), while some others remained more resistant to detection (e.g., iLBC/AMR).

Pitch‐based steganography for Speex voice codec

“…If the warden was located in the middle of the transmission path and had access to packets with hidden data instead of real FP values, the Speex decoder would continue its operation anyway, and just the output speech would sound a bit hoarse because of the manipulated pitch information. In contrast, in TranSteg , for such a location for the warden, it is most likely that nothing would be decoded in the case of an overt/covert codec mismatch.…”

“…in 2014 and later improved by Janicki et al . . This method, called TranSteg (Transcoding Steganography), consisted of replacing the original voice payload with the same speech data, but compressed at a higher compression ratio.…”

Improved adaptive partial-matching steganography for Voice over IP

“…The test results of a proof-of-concept implementation demonstrate that TranSteg can provide a steganographic bandwidth of 32 kbit/s while retaining good speech quality and introducing delays lower than 1 ms. Later, Janicki et al [35] extended this work by analyzing the influence of codec selection on TranSteg efficiency. Further, Janicki et al [36] presented a steganalysis method for TranSteg based on Gaussian mixture models and mel-frequency cepstral coefficients, which is efficient to detect codec pairs, such as G.711/G.726, Speex7/G.729 and Speex7/iLBC, but ineffective to detect other codec pairs, e.g., iLBC/AMR.…”

On the undetectability of transcoding steganography

“…Two specific approaches were evaluated for TranSteg steganalysis [,]. First, in , lightweight traffic analysis that relies on monitoring the first byte of the payload of each VoIP packet was utilized.…”

“…However, some of the codec pairs could still not be easily detected. That is why in , a novel steganalysis method based on GMM models and Mel‐Frequency Cepstral Coefficient (MFCC) parameters was proposed, implemented, and tested. Experimental results revealed that many codec pairs can be detected with an average detection probability of more than 85%.…”