VoIP steganography and its Detection—A survey
---
paper_title: VoIP packet loss concealment based on two-side pitch waveform replication technique using steganography

paper_content:

Speech quality of VoIP (voice over Internet protocol) may potentially be degraded by transmission errors such as packet loss and delay, which is basically inevitable in best-effort communications. This study investigates an error concealment technique for such degradation by using a receiver-based technique called pitch waveform replication. For enhancing the conventional technique, this study proposes a waveform reconstruction technique that also takes account of the pitch variation between the backward and forward frames of gap frames. From experimental results of objective evaluation, it is indicated that the proposed technique may potentially be useful for improving the speech quality, compared with the conventional technique.
---
paper_title: A survey of covert channels and countermeasures in computer network protocols

paper_content:

Covert channels are used for the secret transfer of information. Encryption only protects communication from being decoded by unauthorised parties, whereas covert channels aim to hide the very existence of the communication. Initially, covert channels were identified as a security threat on monolithic systems i.e. mainframes. More recently focus has shifted towards covert channels in computer network protocols. The huge amount of data and vast number of different protocols in the Internet seems ideal as a high-bandwidth vehicle for covert communication. This article is a survey of the existing techniques for creating covert channels in widely deployed network and application protocols. We also give an overview of common methods for their detection, elimination, and capacity limitation, required to improve security in future computer networks.
---
paper_title: Communication using phantoms: covert channels in the Internet

paper_content:

We consider the problem of determining the transport capacity of point-to-point and broadcast channels implemented on top of a network that enforces max-min fair bandwidth allocations in its routers. Our main finding is that the use of inefficient codes to represent data that is intended to be used solely for network control operations (such as routing, sequencing, etc.), gives rise to the unintended creation of a covert channel. Sources can encode some information for their destinations into network control bits (on top of the standard method of encoding data into payload bits), by means of a mechanism which we refer to as the generation of "phantom" packets. Although phantoms provide only a marginal bandwidth increase, they could have potentially vast reaching implications in terms of security issues.
---
paper_title: Multimedia Security: Steganography and Digital Watermarking Techniques for Protection of Intellectual Property

paper_content:

This work explores the myriad of issues regarding multimedia security. It covers various issues, including perceptual fidelity analysis, image, audio, and 3D mesh object watermarking, medical watermarking, and error detection (authentication) and concealment.
---
paper_title: Embedding Covert Channels into TCP/IP

paper_content:

It is commonly believed that steganography within TCP/IP is easily achieved by embedding data in header fields seemingly filled with “random” data, such as the IP identifier, TCP initial sequence number (ISN) or the least significant bit of the TCP timestamp. We show that this is not the case; these fields naturally exhibit sufficient structure and non-uniformity to be efficiently and reliably differentiated from unmodified ciphertext. Previous work on TCP/IP steganography does not take this into account and, by examining TCP/IP specifications and open source implementations, we have developed tests to detect the use of naive embedding. Finally, we describe reversible transforms that map block cipher output onto TCP ISNs, indistinguishable from those generated by Linux and OpenBSD. The techniques used can be extended to other operating systems. A message can thus be hidden so that an attacker cannot demonstrate its existence without knowing a secret key.
---
paper_title: Hiding Data in VoIP

paper_content:

Abstract : The paper presents and compares steganographic techniques that can be used to enable hidden communication within computer networks. A new class ("steganophony") of such methods is introduced. Specific methods proposed by the authors - LACK, HICCUPS and SIP-based VoIP protocols' steganography - are briefly described. The main aim of network steganography is to hide secret data in users' normal data transmissions, ideally, so it cannot be detected by third parties. One of the most popular steganographic techniques is to use a covert channel, which enables manipulating certain properties of the communications medium in an unexpected, unconventional, or unforeseen way. In the past few years the interest in steganographic methods that may be used in computer networks has grown considerably, mostly due to presumed usage of hidden communication by terrorists. Many new methods have been proposed and analyzed also in meaning of translation among heterogeneous environments. In this paper we propose a classification of network steganography methods.
---
paper_title: Keyboards and covert channels

paper_content:

This paper introduces JitterBugs, a class of inline interception mechanisms that covertly transmit data by perturbing the timing of input events likely to affect externally observable network traffic. JitterBugs positioned at input devices deep within the trusted environment (e.g., hidden in cables or connectors) can leak sensitive data without compromising the host or its software. In particular, we show a practical Keyboard JitterBug that solves the data exfiltration problem for keystroke loggers by leaking captured passwords through small variations in the precise times at which keyboard events are delivered to the host. Whenever an interactive communication application (such as SSH, Telnet, instant messaging, etc) is running, a receiver monitoring the host's network traffic can recover the leaked data, even when the session or link is encrypted. Our experiments suggest that simple Keyboard JitterBugs can be a practical technique for capturing and exfiltrating typed secrets under conventional OSes and interactive network applications, even when the receiver is many hops away on the Internet.
---
paper_title: Potential of Value-Added Speech Communications by Using Steganography

paper_content:

This study investigates the potential of value-added speech communications by using steganography. The quality of speech communications based on VoIP may potentially be degraded by packet loss that is basically inevitable in best-effort communications. This study proposes a packet loss concealment technique for mitigating such degradation by using steganography. In addition, this study also proposes a band extension technique by using steganography.
---
paper_title: Using transcoding for hidden communication in IP telephony

paper_content:

The paper presents a new steganographic method for IP telephony called TranSteg (Transcoding Steganography). Typically, in steganographic communication it is advised for covert data to be compressed in order to limit its size. In TranSteg it is the overt data that is compressed to make space for the steganogram. The main innovation of TranSteg is to, for a chosen voice stream, find a codec that will result in a similar voice quality but smaller voice payload size than the originally selected. Then, the voice stream is transcoded. At this step the original voice payload size is intentionally unaltered and the change of the codec is not indicated. Instead, after placing the transcoded voice payload, the remaining free space is filled with hidden data. TranSteg proof of concept implementation was designed and developed. The obtained experimental results are enclosed in this paper. They prove that the proposed method is feasible and offers a high steganographic bandwidth while introducing small voice degradation. Moreover, TranSteg detection is difficult to perform when compared with existing VoIP steganography methods.
---
paper_title: Steganography of VoIP Streams

paper_content:

The paper concerns available steganographic techniques that can be used for creating covert channels for VoIP (Voice over Internet Protocol) streams. Apart from characterizing existing steganographic methods we provide new insights by presenting two new techniques. The first one is network steganography solution which exploits free/unused protocols' fields and is known for IP, UDP or TCP protocols but has never been applied to RTP (Real-Time Transport Protocol) and RTCP (Real-Time Control Protocol) which are characteristic for VoIP. The second method, called LACK (Lost Audio Packets Steganography), provides hybrid storage-timing covert channel by utilizing delayed audio packets. The results of the experiment, that was performed to estimate a total amount of data that can be covertly transferred during typical VoIP conversation phase, regardless of steganalysis, are also included in this paper.
---
paper_title: Techniques for data hiding

paper_content:

Data hiding is the process of embedding data into image and audio signals. The process is constrained by the quantity of data, the need for invariance of the data under conditions where the `host' signal is subject to distortions, e.g., compression, and the degree to which the data must be immune to interception, modification, or removal. We explore both traditional and novel techniques for addressing the data hiding process and evaluate these techniques in light of three applications: copyright protecting, tamper-proofing, and augmentation data embedding.
---
paper_title: Tracking anonymous peer-to-peer VoIP calls on the internet

paper_content:

Peer-to-peer VoIP calls are becoming increasingly popular due to their advantages in cost and convenience. When these calls are encrypted from end to end and anonymized by low latency anonymizing network, they are considered by many people to be both secure and anonymous.In this paper, we present a watermark technique that could be used for effectively identifying and correlating encrypted, peer-to-peer VoIP calls even if they are anonymized by low latency anonymizing networks. This result is in contrast to many people's perception. The key idea is to embed a unique watermark into the encrypted VoIP flow by slightly adjusting the timing of selected packets. Our analysis shows that it only takes several milliseconds time adjustment to make normal VoIP flows highly unique and the embedded watermark could be preserved across the low latency anonymizing network if appropriate redundancy is applied. Our analytical results are backed up by the real-time experiments performed on leading peer-to-peer VoIP client and on a commercially deployed anonymizing network. Our results demonstrate that (1) tracking anonymous peer-to-peer VoIP calls on the Internet is feasible and (2) low latency anonymizing networks are susceptible to timing attacks.
---
paper_title: A note on the confinement problem

paper_content:

onfining a program during its execution so that it cannot transmit information to any other program except its caller. A set of examples attempts to stake out the boundaries of the problem. Necessary conditions for a solution are stated and informally justified.
---
paper_title: Steganography in Digital Media: Principles, Algorithms, and Applications

paper_content:

Steganography, the art of hiding of information in apparently innocuous objects or images, is a field with a rich heritage, and an area of rapid current development. This clear, self-contained guide shows you how to understand the building blocks of covert communication in digital media files and how to apply the techniques in practice, including those of steganalysis, the detection of steganography. Assuming only a basic knowledge in calculus and statistics, the book blends the various strands of steganography, including information theory, coding, signal estimation and detection, and statistical signal processing. Experiments on real media files demonstrate the performance of the techniques in real life, and most techniques are supplied with pseudo-code, making it easy to implement the algorithms. The book is ideal for students taking courses on steganography and information hiding, and is also a useful reference for engineers and practitioners working in media security and information assurance.
---
paper_title: A survey of covert channels and countermeasures in computer network protocols

paper_content:

Covert channels are used for the secret transfer of information. Encryption only protects communication from being decoded by unauthorised parties, whereas covert channels aim to hide the very existence of the communication. Initially, covert channels were identified as a security threat on monolithic systems i.e. mainframes. More recently focus has shifted towards covert channels in computer network protocols. The huge amount of data and vast number of different protocols in the Internet seems ideal as a high-bandwidth vehicle for covert communication. This article is a survey of the existing techniques for creating covert channels in widely deployed network and application protocols. We also give an overview of common methods for their detection, elimination, and capacity limitation, required to improve security in future computer networks.
---
paper_title: Information hiding—A survey

paper_content:

Information-hiding techniques have recently become important in a number of application areas. Digital audio, video, and pictures are increasingly furnished with distinguishing but imperceptible marks, which may contain a hidden copyright notice or serial number or even help to prevent unauthorized copying directly. Military communications systems make increasing use of traffic security techniques which, rather than merely concealing the content of a message using encryption, seek to conceal its sender, its receiver, or its very existence. Similar techniques are used in some mobile phone systems and schemes proposed for digital elections. Criminals try to use whatever traffic security properties are provided intentionally or otherwise in the available communications systems, and police forces try to restrict their use. However, many of the techniques proposed in this young and rapidly evolving field can trace their history back to antiquity, and many of them are surprisingly easy to circumvent. In this article, we try to give an overview of the field, of what we know, what works, what does not, and what are the interesting topics for research.
---
paper_title: A survey of covert channels and countermeasures in computer network protocols

paper_content:

Covert channels are used for the secret transfer of information. Encryption only protects communication from being decoded by unauthorised parties, whereas covert channels aim to hide the very existence of the communication. Initially, covert channels were identified as a security threat on monolithic systems i.e. mainframes. More recently focus has shifted towards covert channels in computer network protocols. The huge amount of data and vast number of different protocols in the Internet seems ideal as a high-bandwidth vehicle for covert communication. This article is a survey of the existing techniques for creating covert channels in widely deployed network and application protocols. We also give an overview of common methods for their detection, elimination, and capacity limitation, required to improve security in future computer networks.
---
paper_title: Embedding Covert Channels into TCP/IP

paper_content:

It is commonly believed that steganography within TCP/IP is easily achieved by embedding data in header fields seemingly filled with “random” data, such as the IP identifier, TCP initial sequence number (ISN) or the least significant bit of the TCP timestamp. We show that this is not the case; these fields naturally exhibit sufficient structure and non-uniformity to be efficiently and reliably differentiated from unmodified ciphertext. Previous work on TCP/IP steganography does not take this into account and, by examining TCP/IP specifications and open source implementations, we have developed tests to detect the use of naive embedding. Finally, we describe reversible transforms that map block cipher output onto TCP ISNs, indistinguishable from those generated by Linux and OpenBSD. The techniques used can be extended to other operating systems. A message can thus be hidden so that an attacker cannot demonstrate its existence without knowing a secret key.
---
paper_title: Techniques for data hiding

paper_content:

Data hiding is the process of embedding data into image and audio signals. The process is constrained by the quantity of data, the need for invariance of the data under conditions where the `host' signal is subject to distortions, e.g., compression, and the degree to which the data must be immune to interception, modification, or removal. We explore both traditional and novel techniques for addressing the data hiding process and evaluate these techniques in light of three applications: copyright protecting, tamper-proofing, and augmentation data embedding.
---
paper_title: Simple and effective speech steganography in G.723.1 low-rate codes

paper_content:

This paper presents a simple and effective steganography approach applied to 5.3 Kbps G.723.1 low-rate coded speech, based on analyzing the redundancy of coded parameters. Augmented identity matrix is used to reduce the modification to cover speech and enhance the imperceptibility of the mixed speech correspondingly. The scheme is with good transparency and low computational complexity, which is easy to be implemented in real applications.
---
paper_title: An Approach of Covert Communication Based on the Adaptive Steganography Scheme on Voice over IP

paper_content:

An effective covert communication system can be achieved based on steganography in stream media such as VoIP (Voice over IP), and the LSB-based (Least-Significant-Bit) methods are the most popular strategies. However, LSB embedding in the flat regions of the speech could inevitably bring about the perceptible distortion leading to the degradation of speech quality. Besides, LSB methods are vulnerable for manifold corresponding steganalysis like RS detection. This paper presents an adaptive steganography scheme that selects lower embedding bit rate in the flat segments, while the sharp segments can camouflage more secret message. Further, synchronous overflow judgment and the tradeoff between hiding requirement and speech quality are also taken into account to construct a practical covert communication system on G.711 VoIP. Extensive experiments showed that the proposed adaptive scheme outperformed the LSB and could evade RS steganalysis. This proposed scheme is efficient, simple and can be used in real-time VoIP network with high hiding capacity.
---
paper_title: VoIP packet loss concealment based on two-side pitch waveform replication technique using steganography

paper_content:

Speech quality of VoIP (voice over Internet protocol) may potentially be degraded by transmission errors such as packet loss and delay, which is basically inevitable in best-effort communications. This study investigates an error concealment technique for such degradation by using a receiver-based technique called pitch waveform replication. For enhancing the conventional technique, this study proposes a waveform reconstruction technique that also takes account of the pitch variation between the backward and forward frames of gap frames. From experimental results of objective evaluation, it is indicated that the proposed technique may potentially be useful for improving the speech quality, compared with the conventional technique.
---
paper_title: Steganography in Inactive Frames of VoIP Streams Encoded by Source Codec

paper_content:

This paper describes a novel high-capacity steganography algorithm for embedding data in the inactive frames of low bit rate audio streams encoded by G.723.1 source codec, which is used extensively in Voice over Internet Protocol (VoIP). This study reveals that, contrary to existing thought, the inactive frames of VoIP streams are more suitable for data embedding than the active frames of the streams; that is, steganography in the inactive audio frames attains a larger data embedding capacity than that in the active audio frames under the same imperceptibility. By analyzing the concealment of steganography in the inactive frames of low bit rate audio streams encoded by G.723.1 codec with 6.3 kb/s, the authors propose a new algorithm for steganography in different speech parameters of the inactive frames. Performance evaluation shows embedding data in various speech parameters led to different levels of concealment. An improved voice activity detection algorithm is suggested for detecting inactive audio frames taking into packet loss account. Experimental results show our proposed steganography algorithm not only achieved perfect imperceptibility but also gained a high data embedding rate up to 101 bits/frame, indicating that the data embedding capacity of the proposed algorithm is very much larger than those of previously suggested algorithms.
---
paper_title: LPC parameters substitution for speech information hiding

paper_content:

Abstract Information hiding techniques adopted in secret communication should meet the requirements of high hiding capacity, real-time and high robustness. For the purpose of real-time speech secure communication, an information hiding algorithm based on the analysis-by-synthesis (ABS) speech coding scheme is presented in this article. This algorithm substitutes secret speech data bits for linear predictive coefficients (LPCs) in linear predictive coding (LPC). Statistics show that the change of voiced signal track is slow and the codebook for LPCs vector is large in ABS coding scheme. Therefore, a new concept, filter similarity, is proposed to determine the LPC parameters for substituting with secret speech information, and to generate multi-codebook for saving storage space to store secret speech information. To achieve the best effects of information hiding, a dynamic threshold is built to make an optimal trade-off among hiding-capacity, security, robustness, transparence and real time. Experiments show that the proposed approach meets the requirements of information hiding and secret communication speech quality. The test results indicate that this approach reaches high hiding capacity with an excellent speech quality and complicating speakers' recognition.
---
paper_title: G.711-Based adaptive speech information hiding approach

paper_content:

This paper presents an adaptive LSB (Least Significant Bit) algorithm to embed dynamic secret speech information data bits into public speech of G.711-PCM (Pulse Code Modulation) for the purpose of secure communication according to energy distribution, with high efficiency in steganography and good quality in output speech. It is superior to available classical algorithms, LSB. Experiments show that the proposed approach is capable of embedding up to 20 Kbps information data of secret speech into G.711 speech at an average embedded error rate of 10−5. It meets the requirements of information hiding, and satisfies the secure communication speech quality constraints with an excellent speech quality and complicating speakers’ recognition.
---
paper_title: An M-Sequence Based Steganography Model for Voice over IP

paper_content:

Differing from applying steganography on storage cover media, steganography on Voice over IP (VoIP) must often delicately balance between providing adequate security and maintaining low latency for real-time services. This paper presents a novel real-time steganography model for VoIP that aims at providing good security for secret messages without sacrificing real-time performance. We achieve this goal by employing the well-known least-significant-bits (LSB) substitution approach to provide a reasonable tradeoff between the adequate information hiding requirement (good security and sufficient capacity) and the low latency requirement for VoIP. Further, we incorporate the m-sequence technique to eliminate the correlation among secret messages to resist the statistical detection based on the fact that the distribution of the LSBs in the stego-speech is not uniform and to provide a short-term security protection of secret messages. To accurately recover secret messages at the receiver side, we design a synchronization mechanism based on the RSA key agreement and the synchronized sequence transmission using techniques of the protocol steganography, which can effectively enhance the flexibility of the covert communication system and be extended to other steganography schemes based on real-time systems. We evaluate the effectiveness of our model with ITU-T G.729a as the codec of the cover speech in StegTalk, a covert communication system based on VoIP. The experimental results demonstrate that our technique provides good security and transparency for transmitting secret messages while adequately meeting the real-time requirement of VoIP.
---
paper_title: Dynamic matrix encoding strategy for voice-over-IP steganography

paper_content:

In order to optionally regulate embedding capacity and embedding transparency according to user’s requirements in voice-over-IP (VoIP) steganography, a dynamic matrix encoding strategy (DMES) was presented. Differing from the traditional matrix encoding strategy, DMES dynamically chose the size of each message group in a given set of adoptable message sizes. The appearance possibilities of all adoptable sizes were set in accordance with the desired embedding performance (embedding rate or bit-change rate). Accordingly, a searching algorithm that could provide an optimal combination of appearance possibilities was proposed. Furthermore, the roulette wheel algorithm was employed to determine the size of each message group according to the optimal combination of appearance possibilities. The effectiveness of DMES was evaluated in StegVoIP, which is a typical covert communication system based on VoIP. The experimental results demonstrate that DMES can adjust embedding capacity and embedding transparency effectively and flexibly, and achieve the desired embedding performance in any case. For the desired embedding rate, the average errors are not more than 0.000 8, and the standard deviations are not more than 0.002 0; for the desired bit-change rate, the average errors are not more than 0.001 4, and the standard deviations are not more than 0.002 6.
---
paper_title: A Novel Phase Coding Technique for Steganography in Auditive Media

paper_content:

Steganography is used to embed secret messages in cover media. This is especially important in areas where the use of cryptography is prohibited. In this paper we introduce a novel steganographic algorithm applicable for audio data as cover media. The proposed algorithm is based on the phase coding technique which embeds data in the phase spectrum of the frequency domain signal. Differing from previous works we retain the original phase values in order to best keep the quality of the cover audio signal. Secret bits are embedded by introducing a configurable phase difference between selected chunks of blocks from the cover medium instead of discarding the original phase values and introducing a random phase like other approaches. Variable parameters guarantee the security of our system and we show that the wrong selection leads to high reception errors. Also robustness tests were performed using popular signal processing operations like noise addition, cropping and resampling, giving reasonable results. In addition listening tests show that the original audio quality is not noticeable reduced by our algorithm. After pointing out related approaches we highlight our contributions with respect to the embedding and extraction processes. Also a view on the synchronization issue at reception is given. This is a vital part for the steganographic receiver when the communication happens for example over a mobile network. Following to that the results from tests with our working prototype are presented and further usage scenarios in relation to future research are given.
---
paper_title: Information Hiding in Real-Time VoIP Streams

paper_content:

The real-time speech hiding is to hide the secret speech into a cover speech in real-time communication systems. By hiding one secret speech into the cover speech, we can get a stego speech, which sounds meaningful and indistinguishable from the original cover speech. Therefore, even if the attackers catch the audio packets on Internet, they would not notice that there is another speech hidden inside it. In this paper, we propose a scheme for speech hiding in a real-time communication system such as voice over Internet Protocol (VoIP). We propose a novel design of real-time speech hiding for G.711 codec, which is widely supported by almost every VoIP device. Experimental results show that the processing time for the proposed algorithm takes only 0.257 ms, which is suitable for real-time VoIP applications.
---
paper_title: An adaptive steganography scheme for voice over IP

paper_content:

This paper presents an adaptive steganography scheme for Voice over IP (VoIP). Differing from existing steganography techniques for VoIP, this scheme enhances the embedding transparency by taking into account the similarity between Least Significant Bits (LSBs) and embedded messages. Moreover, we introduce the notion of Partial Similarity Value (PSV). By properly setting the threshold PSV, we can adaptively balance the embedding transparency and capacity. We evaluate the effectiveness of this scheme with G.729a as the codec of the cover speech in StegTalk, a covert communication system based on VoIP. The experimental results demonstrate that our technique provides better performance than the traditional method.
---
paper_title: A Semi-lossless Steganography Technique for G.711 Telephony Speech

paper_content:

Steganography may be employed for secretly transmitting side information in order to improve the performance of signal processing such as packet loss concealment and band extension of telephony speech. The previous studies employ LSB replacement technique for embedding steganogram information into speech data. Instead of such a lossy steganography technique, this study has investigated a loss less steganography technique for G.711, the most common codec for telephony systems such as VoIP. The proposed technique in this study exploits the redundancy of G.711 for embedding steganogram information into speech data without degradation. This paper newly investigates the possibility of a semi-loss less steganography technique for increasing the capacity of the loss less steganography technique.
---
paper_title: Adaptive VoIP Steganography for Information Hiding within Network Audio Streams

paper_content:

With the rapid development of the Internet, steganography on Voice over IP (VoIP) has been attracted a lot of research efforts. To date, existing VoIP steganography research commonly focus on information hiding in the LSB bits of Network Audio Streams, yet, we found this approach may raise serious security threat, where the hidden information may be easily removed, detected and attacked. Towards this issue, in this paper, we propose AVIS, a novel Adaptive VoIP steganography approach to hide information within Network Audio Streams. AVIS consists of two parts, named VAMI and VADDI. VAMI works by dynamically select multiple bits based on the VoIP vector value, while VADDI dynamically changes embedding intervals to avoid detection and attacking. We also implemented AVIS and conducted extensive experiments in real systems. Experimental results demonstrate the effectiveness of our proposed AVIS scheme.
---
paper_title: Least-significant-digit steganography in low bitrate speech

paper_content:

For steganography over speech frames, least-significant-bit (LSB) approach has been one of the most important alternatives. However, its embedded capacity is quite limited, due to the low redundancy characteristic of low bitrate speech. Thus, we suggest a novel least significant digit (LSD) method in this paper, which makes full use of the frame bits to hide secret messages and provides a larger embedding capacity than the LSB method. The LSD method exploits the multiple adjacent states of frame parameters, which are produced by multiple modifications (e.g. +1, −1, +2, −2) and encoded as LSDs using a multi-ary numeration system. Beyond providing a considerable embedding capacity, the LSD method further extends the key space for key-based steganography, which can enhance the security of covert communication. The LSD method is implemented and evaluated with G.723.1 as the codec for speeches. The experiment results show that, compared with the previous LSB method, the LSD method increases around 30% of embedding capacity, and induces less distortion given the same embedding capacity.
---
paper_title: Adaptive partial-matching steganography for voice over IP using triple M sequences

paper_content:

Although steganographic transparency and steganographic bandwidth are believed to be two conflicting objectives in the design of steganographic systems, it is possible and necessary to strike an optimal balance between them. This paper presents an adaptive partial-matching steganography for voice over IP (VoIP). We introduce the notion of partial similarity value (PSV) to evaluate the partial matching between covers and secret messages. By properly setting a low threshold of PSV and a high threshold of PSV, we can adaptively balance steganographic transparency and bandwidth. Moreover, we employ triple m sequences to eliminate the correlation among secret messages, guide the adaptive embedding process, and encrypt synchronization signaling patterns. In addition, we introduce an improved strategy that takes into account the similarity between not only covers and encrypted messages but also covers and original messages. We evaluate the proposed approach and its improved strategy with ITU-T G.729a as the codec of the cover speech in StegVoIP that is a prototypical covert communication system based on VoIP and compare them with some existing approaches. The experimental results demonstrate that the proposed approaches can provide a better balance between steganographic transparency and bandwidth. Furthermore, the results of delay tests show that they adequately meet the real-time requirement of VoIP.
---
paper_title: Perceptually Transparent Information Hiding in G.729 Bitstream

paper_content:

In this paper a information hiding algorithm applied to compressed speech bitstream is proposed. Covering codes are used to hide information in the least important bits in G.729 frames. The embedding rate is fairly high compared with the state of art algorithms, while the experiment results show that the distortion of the speech signal is imperceptible.
---
paper_title: An Approach to Information Hiding in Low Bit-Rate Speech Stream

paper_content:

In this paper we introduce a novel codebook partition algorithm for quantization index modulation (QIM), which is applied to information hiding in instant low bit-rate speech stream. The QIM method divides the codebook into two parts, each representing '0' and '1' respectively. Instead of randomly partitioning the codebook, the relationship between codewords is considered. The proposed algorithm - complementary neighbor vertices (CNV) guarantees that every codeword is in the opposite part to its nearest neighbor, and the distortion is limited by a bound. The feasibility of CNV is proved with graph theory. Moreover, in our work the secret message is embedded in the field of vector quantization index of LPC coefficients, getting the benefit that the distortion due to QIM is lightened adaptively by the rest of the encoding procedure. Experiments on iLBC and G.723.1 verify the effectiveness of the proposed method. Both objective and subjective assessments show the proposed method only slightly decreases the speech quality to an indistinguishable degree. The hiding capacity is no less than 100 bps. To the best of our knowledge, this is the first work adopting graph theory to improve the codebook partition while using QIM in low bit-rate streaming media.
---
paper_title: Potential of Value-Added Speech Communications by Using Steganography

paper_content:

This study investigates the potential of value-added speech communications by using steganography. The quality of speech communications based on VoIP may potentially be degraded by packet loss that is basically inevitable in best-effort communications. This study proposes a packet loss concealment technique for mitigating such degradation by using steganography. In addition, this study also proposes a band extension technique by using steganography.
---
paper_title: Secure Hybrid Spread Spectrum System for Steganography in Auditive Media

paper_content:

Steganography is used to embed secret messages in cover media. This is especially important in areas, where the use of cryptography is prohibited. In this paper, we introduce a novel hybrid steganographic algorithm for digital audio data. We enhance a direct sequence spread spectrum (DSSS) system with aspects of frequency hopping to vary the carrier frequency of the binary phase shift keying (BPSK) signal, representing the secret message. Further, we adopt the number of chips per secret bit. These modifications give a more secure steganographic system, making guesses about the bit-rate or message length less feasible. Further, an adaptive amplitude control is used to guarantee inaudibility, even in silent passages. After an overview of the DSSS technique, we highlight our contributions to form a more secure steganographic system. The results from our working prototype are pointed out and further usage scenarios in relation to future research are given.
---
paper_title: A Covert Communication Model Based on Least Significant Bits Steganography in Voice over IP

paper_content:

Steganography, as one of alternative techniques for secure communications, has drawn more and more attentions. This paper presents a covert communication model based on least significant bits (LSB) steganography in Voice over IP (VoIP). The model aims at providing nice security of secret messages and real-time performance that is vital for VoIP. Therefore, we employ a simple encryption of secret messages before embedding them. This encryption strikes a good balance between adequate short-term protection for secret messages and low latency for VoIP. Furthermore, we design a structure of embedded messages. It can provide flexible length and avoid effectually both extraction attack and deceptive attack. We evaluate the model with ITU-T G.729a as the codec of the cover speech in StegTalk, our platform for study on covert communications theory in VoIP. In this case, the proposed model can provide two optional covert transmission speeds, i.e. 0.8 kb/s and 2.6 kb/s, where the maximum payload ratio is 99.98%. The experimental results show that our method has negligible effects on speech quality and well meets the real-time requirement of VoIP.
---
paper_title: A Technique of Lossless Steganography for G.711 Telephony Speech

paper_content:

This study proposes a technique of lossless steganography for G.711, the most common codec for digital speech communications such as VoIP (Voice over IP). The proposed technique in this study exploits the characteristics of G.711 for embedding steganogram information without any degradation. This paper shows the capacity of the proposed technique.
---
paper_title: ABS-based speech information hiding approach

paper_content:

An approach for speech information hiding based on the analysis by synthesis algorithm is presented. This approach can embed dynamic secret speech information data bits into original carrier speech data, with good efficiency in steganography and good quality in output speech. It is superior to classical algorithms, e.g., least significant bit, which can only embed fixed 1, 2 and 4 bit data into original carrier speech individually.
---
paper_title: An assessment of VoIP covert channel threats

paper_content:

A VoIP covert channel is a mechanism that utilizes an IP phone conversation to illicitly transfer information across a network. In this paper, we present a model of VoIP covert channels that explains their main components and functions. We provide a performance evaluation framework, and quantify the threat to users. Our results demonstrate that covert channels represent an immediate threat to VoIP users. We discuss possible course of actions to detect attacks and mitigate the risk of information leakage.
---
paper_title: Approach to hide secret speech information in G.721 scheme

paper_content:

This paper presents an approach for speech information hiding based on G.721 scheme. This approach proposes an Analysis-By-Synthesis (ABS)- based speech information hiding and extracting algorithm, is called ABS algorithm, which form the theoretical basis for designing a secure speech communication system. The ABS algorithm adopts a speech synthesizer in a speech coder. Speech embedding and coding are synchronous, i.e. fusing of secret speech information data into speech coding. Dynamic secret speech information data bits can be embedded into original carrier speech data, with high efficiency in steganography and good quality in output speech. This method is superior to available classical algorithms on hiding capacity and robustness. This paper implements the proposed approach based on speech coding scheme G.721 and the experiments show that this approach meets the requirements of information hiding, satisfies the constraints of speech quality for secure communication, and achieves high hiding capacity of 1.6Kbps with an excellent speech quality and complicating speakers' recognition.
---
paper_title: Lossless Steganography Techniques for IP Telephony Speech Taking Account of the Redundancy of Folded Binary Code

paper_content:

can be employed for transmitting side information improving the performance of signal processing such as packet loss concealment and band extension of telephony speech. The previous studies employ LSB replacement technique for embedding steganogram information into speech data. Instead of such a lossy steganography technique, this study investigates the possibility of lossless steganography techniques for G.711 and DVI-ADPCM, the codecs employed in IP telephony services. The proposed techniques in this study exploit the redundancy of the folded binary code employed in these codecs for embedding steganogram information into speech data without degradation.
---
paper_title: A novel covert speech communication system and its implementation

paper_content:

In this paper, a Covert Speech Telephone (CST) is designed and implemented based on the information hiding technique, which works on the internet. To solve the large embedding capacity problem for real-time information hiding, a steganographic system combined with a watermarking scheme is proposed, which skillfully transfers the secret speech into watermarking information. The basic idea is to use the speech recognition to significantly reduce the size of information that has to be transmitted in a hidden way. Furthermore, an improved DFT watermarking scheme is proposed which adaptively chooses the embedding locations and applies the multi-ary modulation technique. Based on the GUI (Graphical User Interface) software, the CST operates on both ordinary and secure mode. It is a completely digital system with high speech quality. Objective and subjective tests show that the CST is robust against normal signal processing attacks and steganalysis. The proposed scheme can be used in terms of military applications.
---
paper_title: Keyboards and covert channels

paper_content:

This paper introduces JitterBugs, a class of inline interception mechanisms that covertly transmit data by perturbing the timing of input events likely to affect externally observable network traffic. JitterBugs positioned at input devices deep within the trusted environment (e.g., hidden in cables or connectors) can leak sensitive data without compromising the host or its software. In particular, we show a practical Keyboard JitterBug that solves the data exfiltration problem for keystroke loggers by leaking captured passwords through small variations in the precise times at which keyboard events are delivered to the host. Whenever an interactive communication application (such as SSH, Telnet, instant messaging, etc) is running, a receiver monitoring the host's network traffic can recover the leaked data, even when the session or link is encrypted. Our experiments suggest that simple Keyboard JitterBugs can be a practical technique for capturing and exfiltrating typed secrets under conventional OSes and interactive network applications, even when the receiver is many hops away on the Internet.
---
paper_title: Covert Channels through External Interference

paper_content:

This paper introduces interference channels, a new kind of covert channel that works by creating external interference on a shared communications medium (such as a wireless network). Unlike previous covert channels, here the covert sender does not need to compromise an authorized sender or require the ability to send messages on the network, but only needs the ability to jam traffic for short intervals. We describe an implementation of a wireless interference channel for 802.11 networks that can be used to superimpose low bandwidth messages over data streams, even when the network is encrypted or has other access controls. This channel is particularly well suited to watermarking VoIP flows, without compromising any routers or endpoint hosts.
---
paper_title: On the anonymity and traceability of peer-to-peer VoIP calls

paper_content:

Voice over Internet protocol is a technology that enables people to use the Internet, rather than the traditional public switched telephone network, as the transmission medium for voice communications. VoIP is becoming increasingly popular due to its significant advantages in cost and flexible features compared with the plain old telephone system. The proliferation of VoIP calls has significant implications on the security and privacy aspects of voice calls. For example, the use of VoIP has made it much easier to achieve confidentiality and anonymity in voice communications. On the other hand, VoIP has imposed significant new challenges in providing the same call-identifying and wiretapping capabilities as those that exist in traditional circuit-switched networks. In this article we examine the privacy and security aspects of peer-to-peer (P2P) VoIP calls and show how the use of VoIP has substantially shifted the previous balance between privacy and security that exists in traditional PSTN calls. In particular, we show that the use of strong encryption and available low-latency anonymizing network at the same time does not necessarily provide the level of anonymity to VoIP that people would intuitively expect
---
paper_title: Tracking anonymous peer-to-peer VoIP calls on the internet

paper_content:

Peer-to-peer VoIP calls are becoming increasingly popular due to their advantages in cost and convenience. When these calls are encrypted from end to end and anonymized by low latency anonymizing network, they are considered by many people to be both secure and anonymous.In this paper, we present a watermark technique that could be used for effectively identifying and correlating encrypted, peer-to-peer VoIP calls even if they are anonymized by low latency anonymizing networks. This result is in contrast to many people's perception. The key idea is to embed a unique watermark into the encrypted VoIP flow by slightly adjusting the timing of selected packets. Our analysis shows that it only takes several milliseconds time adjustment to make normal VoIP flows highly unique and the embedded watermark could be preserved across the low latency anonymizing network if appropriate redundancy is applied. Our analytical results are backed up by the real-time experiments performed on leading peer-to-peer VoIP client and on a commercially deployed anonymizing network. Our results demonstrate that (1) tracking anonymous peer-to-peer VoIP calls on the Internet is feasible and (2) low latency anonymizing networks are susceptible to timing attacks.
---
paper_title: Covert Channels in SIP for VoIP signalling

paper_content:

In this paper, we evaluate available steganographic techniques for SIP (Session Initiation Protocol) that can be used for creating covert channels during signaling phase of VoIP (Voice over IP) call. Apart from characterizing existing steganographic methods we provide new insights by introducing new techniques. We also estimate amount of data that can be transferred in signalling messages for typical IP telephony call.
---
paper_title: Covert Channels Based on Jitter Field of the RTCP Header

paper_content:

Covert channels are used to secretly transfer information. Due to the widely existence of network protocols, encoding covert channels into computer network protocols is highly applicable. The jitter field of RTCP header possesses a characteristic that could be used to set up covert channels. Thus, in this paper, a novel covert channel on jitter field is proposed. In order to set up this channel, statistical parameters of the jitter field in the current network are calculated. Then the secret message is modulated into the jitter field according to the parameters obtained. Because of this modulation method, the characteristic of the covert channel is similar to that of the overt channel. We analyzed the natural variation of jitter data and verified the proposed channel. The test result shows that the attacker could not detect the covert channel by its statistical parameters.
---
paper_title: Influence of Speech Codecs Selection on Transcoding Steganography

paper_content:

The typical approach to steganography is to compress the covert data in order to limit its size, which is reasonable in the context of a limited steganographic bandwidth. Trancoding steganography (TranSteg) is a new IP telephony steganographic method that was recently proposed that offers high steganographic bandwidth while retaining good voice quality. In TranSteg, compression of the overt data is used to make space for the steganogram. In this paper we focus on analyzing the influence of the selection of speech codecs on hidden transmission performance, that is, which codecs would be the most advantageous ones for TranSteg. Therefore, by considering the codecs which are currently most popular for IP telephony we aim to find out which codecs should be chosen for transcoding to minimize the negative influence on voice quality while maximizing the obtained steganographic bandwidth.
---
paper_title: Using transcoding for hidden communication in IP telephony

paper_content:

The paper presents a new steganographic method for IP telephony called TranSteg (Transcoding Steganography). Typically, in steganographic communication it is advised for covert data to be compressed in order to limit its size. In TranSteg it is the overt data that is compressed to make space for the steganogram. The main innovation of TranSteg is to, for a chosen voice stream, find a codec that will result in a similar voice quality but smaller voice payload size than the originally selected. Then, the voice stream is transcoded. At this step the original voice payload size is intentionally unaltered and the change of the codec is not indicated. Instead, after placing the transcoded voice payload, the remaining free space is filled with hidden data. TranSteg proof of concept implementation was designed and developed. The obtained experimental results are enclosed in this paper. They prove that the proposed method is feasible and offers a high steganographic bandwidth while introducing small voice degradation. Moreover, TranSteg detection is difficult to perform when compared with existing VoIP steganography methods.
---
paper_title: Steganography of VoIP Streams

paper_content:

The paper concerns available steganographic techniques that can be used for creating covert channels for VoIP (Voice over Internet Protocol) streams. Apart from characterizing existing steganographic methods we provide new insights by presenting two new techniques. The first one is network steganography solution which exploits free/unused protocols' fields and is known for IP, UDP or TCP protocols but has never been applied to RTP (Real-Time Transport Protocol) and RTCP (Real-Time Control Protocol) which are characteristic for VoIP. The second method, called LACK (Lost Audio Packets Steganography), provides hybrid storage-timing covert channel by utilizing delayed audio packets. The results of the experiment, that was performed to estimate a total amount of data that can be covertly transferred during typical VoIP conversation phase, regardless of steganalysis, are also included in this paper.
---
paper_title: LACK - a VoIP Steganographic Method

paper_content:

The paper presents a new steganographic method called LACK (Lost Audio PaCKets Steganography) which is intended mainly for VoIP. The method is presented in a broader context of network steganography and of VoIP steganography in particular. The analytical results presented in the paper concern the influence of LACK's hidden data insertion procedure on the method's impact on quality of voice transmission and its resistance to steganalysis.
---
paper_title: ReLACK: A Reliable VoIP Steganography Approach

paper_content:

VoIP steganography is a real-time network steganography, which utilizes VoIP protocols and traffic as a covert channel to conceal secret messages. Recently, there has been a noticeable increase in the interest in VoIP steganography due to the volume of VoIP traffic generated, which proved to be economically feasible to utilize. This paper discusses VoIP steganography challenges, compares the existing mechanisms, and proposes a new VoIP steganography approach. Current VoIP steganography techniques lack mechanisms to provide reliability without weakening the steganography system. Accordingly, this paper modifies the (k, n) threshold secret sharing scheme, which is based on Lagrange's Interpolation, and then applies a two phase approach on the LACK steganography mechanism to provide reliability and fault tolerance and to increase steganalysis complexity. The cost of reliability is a loss in bandwidth, therefore, the proposed approach also provides mechanisms to maximize packets utilization to mitigate the effect of adding redundancy.
---
paper_title: Steganography of VoIP Streams

paper_content:

The paper concerns available steganographic techniques that can be used for creating covert channels for VoIP (Voice over Internet Protocol) streams. Apart from characterizing existing steganographic methods we provide new insights by presenting two new techniques. The first one is network steganography solution which exploits free/unused protocols' fields and is known for IP, UDP or TCP protocols but has never been applied to RTP (Real-Time Transport Protocol) and RTCP (Real-Time Control Protocol) which are characteristic for VoIP. The second method, called LACK (Lost Audio Packets Steganography), provides hybrid storage-timing covert channel by utilizing delayed audio packets. The results of the experiment, that was performed to estimate a total amount of data that can be covertly transferred during typical VoIP conversation phase, regardless of steganalysis, are also included in this paper.
---
paper_title: Steganalysis of compressed speech to detect covert voice over Internet protocol channels

paper_content:

A network covert channel is a passage along which information leaks across the network in violation of security policy in a completely undetectable manner. This study reveals our findings in analysing the principle of G.723.1 codec that there are `unused` bits in G.723.1 encoded audio frames, which can be used to embed secret messages. A novel steganalysis method that employs the second detection and regression analysis is suggested in this study. The proposed method can not only detect the hidden message embedded in a compressed voice over Internet protocol (VoIP) speech, but also accurately estimate the embedded message length. The method is based on the second statistics, that is, doing a second steganography (embedding information in a sampled speech at an embedding rate followed by embedding another information at a different level of data embedding) in order to estimate the hidden message length. Experimental results have proven the effectiveness of the steganalysis method for detecting the covert channel in the compressed VoIP speech.
---
paper_title: Steganalysis of Transcoding Steganography

paper_content:

Transcoding steganography (TranSteg) is a fairly new IP telephony steganographic method that functions by compressing overt (voice) data to make space for the steganogram by means of transcoding. It offers high steganographic bandwidth, retains good voice quality, and is generally harder to detect than other existing VoIP steganographic methods. In TranSteg, after the steganogram reaches the receiver, the hidden information is extracted, and the speech data is practically restored to what was originally sent. This is a huge advantage compared with other existing VoIP steganographic methods, where the hidden data can be extracted and removed, but the original data cannot be restored because it was previously erased due to a hidden data insertion process. In this paper, we address the issue of steganalysis of TranSteg. Various TranSteg scenarios and possibilities of warden(s) localization are analyzed with regards to the TranSteg detection. A novel steganalysis method based on Gaussian mixture models and mel-frequency cepstral coefficients was developed and tested for various overt/covert codec pairs in a single warden scenario with double transcoding. The proposed method allowed for efficient detection of some codec pairs (e.g., G.711/G.729), while some others remained more resistant to detection (e.g., iLBC/AMR).
---
paper_title: Covert channel detection in VoIP streams

paper_content:

This paper presents two approaches to detect VoIP covert channel communications using compressed versions of the data packets. The approach is based on specialized random projection matrices that take advantage of prior knowledge about the normal traffic structure. The reduction scheme relies on the assumption that normal traffic packets belong to a subspace of smaller dimension or that can be included a convex set. We show that through the incorporation of this information in the design of the random projection matrices, the detection of anomalous traffic packets can be performed in the compressed domain with a slight performance loss with respect to the uncompressed domain. The validation of the detection algorithm is based on real data captured on a test bed designed to that end.
---
paper_title: Detection of covert voice-over Internet protocol communications using sliding window-based steganalysis

paper_content:

The authors describe a reliable and accurate steganalysis method for detecting covert voice-over Internet protocol (VoIP) communication channels. The proposed method utilises a unique sliding window mechanism and an improved regular singular (RS) algorithm for VoIP steganalysis, which detects the presence of least significant bit embedded VoIP streams. With this mechanism, the detection window moves forward one packet or several packets each time to screen VoIP streams. The optimum detection threshold for the proposed detection metric is computed by modelling the distributions of the new metric for stego and cover VoIP streams. Experimental analysis reveals that the proposed method improves the detection time significantly, utilising less memory resources for VoIP steganalysis, thereby enabling real-time detection of stego VoIP streams. The proposed method also provides a significant improvement on precision in detecting multiple covert VoIP channels when compared to the conventional RS method.
---
paper_title: On Tuning the Knobs of Distribution-Based Methods for Detecting VoIP Covert Channels

paper_content:

We study the parameters (knobs) of distribution-based anomaly detection methods, and how their tuning affects the quality of detection. Specifically, we analyze the popular entropy-based anomaly detection in detecting covert channels in Voice over IP (VoIP) traffic. There has been little effort in prior research to rigorously analyze how the knobs of anomaly detection methodology should be tuned. Such analysis is, however, critical before such methods can be deployed by a practitioner. We develop a probabilistic model to explain the effects of the tuning of the knobs on the rate of false positives and false negatives. We then study the observations produced by our model analytically as well as empirically. We examine the knobs of window length and detection threshold. Our results show how the knobs should be set for achieving high rate of detection, while maintaining a low rate of false positives. We also show how the throughput of the covert channel (the magnitude of the anomaly) affects the rate of detection, thereby allowing a practitioner to be aware of the capabilities of the methodology.
---
paper_title: Steganography and steganalysis in voice-over IP scenarios: operational aspects and first experiences with a new steganalysis tool set

paper_content:

Based on the knowledge and experiences from existing image steganalysis techniques, the overall objective of the paper is to evaluate existing audio steganography with a special focus on attacks in ad-hoc end-to-end media communications on the example of Voice over IP (VoIP) scenarios. One aspect is to understand operational requirements of recent steganographic techniques for VoIP applications. The other aspect is to elaborate possible steganalysis approaches applied to speech data. In particular we have examined existing VoIP applications with respect to their extensibility to steganographic algorithms. We have also paid attention to the part of steganalysis in PCM audio data which allows us to detect hidden communication while a running VoIP communication with the usage of the PCM codec. In our impelementation we use Jori's Voice over IP library by Jori Liesenborgs (JVOIPLIB) that provides primitives for a voice over IP communication. Finally we show first results of our prototypic implementation which extents the common VoIP scenario by the new feature of steganography. We also show the results for our PCM steganalyzer framework that is able to detect this kind of hidden communication by using a set of 13 first and second order statistics.
---
paper_title: An assessment of VoIP covert channel threats

paper_content:

A VoIP covert channel is a mechanism that utilizes an IP phone conversation to illicitly transfer information across a network. In this paper, we present a model of VoIP covert channels that explains their main components and functions. We provide a performance evaluation framework, and quantify the threat to users. Our results demonstrate that covert channels represent an immediate threat to VoIP users. We discuss possible course of actions to detect attacks and mitigate the risk of information leakage.
---
paper_title: A novel packet size based covert channel attack against anonymizer

paper_content:

Anonymizer is a proprietary anonymous communication system. We discovered its architecture and found that the size of web packets through Anonymizer are very dynamic at the client. Motivated by this finding, we investigated a novel packet size based covert channel attack, against the anonymity service. In the attack, one attacker manipulates the web packet size between the web server and Anonymizer and embed signal symbols into the target traffic. An accomplice at the user side can sniff the traffic and recognize the secret signal. We developed intelligent and robust algorithms to cope with the packet size distortion incurred by Anonymizer and Internet. We developed several techniques to make the attack harder to detect: (i) We pick up right packets of web objects to manipulate in order to preserve the regularity of the TCP packet size dynamics; (ii) We adopt the Monte Carlo sampling technique to preserve the distribution of the web packet size despite manipulation. We have implemented the attack over Anonymizer and conducted extensive analysis and experimental evaluations. It is observed that the attack is highly efficient and requires only tens of packets to compromise the anonymous web surfing. The experimental results are consistent with our theoretical analysis.
---
paper_title: An Entropy-Based Approach to Detecting Covert Timing Channels

paper_content:

The detection of covert timing channels is of increasing interest in light of recent exploits of covert timing channels over the Internet. However, due to the high variation in legitimate network traffic, detecting covert timing channels is a challenging task. Existing detection schemes are ineffective at detecting most of the covert timing channels known to the security community. In this paper, we introduce a new entropy-based approach to detecting various covert timing channels. Our new approach is based on the observation that the creation of a covert timing channel has certain effects on the entropy of the original process, and hence, a change in the entropy of a process provides a critical clue for covert timing channel detection. Exploiting this observation, we investigate the use of entropy and conditional entropy in detecting covert timing channels. Our experimental results show that our entropy-based approach is sensitive to the current covert timing channels and is capable of detecting them in an accurate manner.
---
paper_title: Blind Detection of Spread Spectrum Flow Watermarks

paper_content:

Recently, the direct sequence spread-spectrum (DSSS)-based technique has been proposed to trace anonymous network flows. In this technique, homogeneous pseudo-noise (PN) codes are used to modulate multiple-bit signals that are embedded into the target flow as watermarks. This technique could be mali- ciously used to degrade an anonymous communication network. In this paper, we propose a simple single flow-based scheme to detect the existence of these watermarks. Our investigation shows that even if we have no knowledge of the applied PN code, we are still able to detect malicious DSSS watermarks via mean-square autocorrelation (MSAC) of a single modulated flow's traffic rate time series. MSAC shows periodic peaks due to self-similarity in the modulated traffic caused by homogeneous PN codes that are used in modulating multiple-bit signals. Our scheme has low complexity and does not require any PN-code synchronization. We evaluate this detection scheme's effectiveness via simulations and real-world experiments on Tor. Our results demonstrate a high detection rate with a low false positive rate. Our scheme is more flexible and accurate than an existing multi-flow-based approach in DSSS watermark detection.
---
paper_title: DSSS-Based Flow Marking Technique for Invisible Traceback

paper_content:

Law enforcement agencies need the ability to conduct electronic surveillance to combat crime, terrorism, or other malicious activities exploiting the Internet. However, the proliferation of anonymous communication systems on the Internet has posed significant challenges to providing such traceback capability. In this paper, we develop a new class of flow marking technique for invisible traceback based on direct sequence spread spectrum (DSSS), utilizing a pseudo-noise (PN) code. By interfering with a sender's traffic and marginally varying its rate, an investigator can embed a secret spread spectrum signal into the sender's traffic. The embedded signal is carried along with the traffic from the sender to the receiver, so the investigator can recognize the corresponding communication relationship, tracing the messages despite the use of anonymous networks. The secret PN code makes it difficult for others to detect the presence of such embedded signals, so the traceback, while available to investigators is, effectively invisible. We demonstrate a practical flow marking system which requires no training, and can achieve both high detection and low false positive rates. Using a combination of analytical modeling, simulations, and experiments on Tor (a popular Internet anonymous communication system), we demonstrate the effectiveness of the DSSS-basedflow marking technique.
---
paper_title: Steganography of VoIP Streams

paper_content:

The paper concerns available steganographic techniques that can be used for creating covert channels for VoIP (Voice over Internet Protocol) streams. Apart from characterizing existing steganographic methods we provide new insights by presenting two new techniques. The first one is network steganography solution which exploits free/unused protocols' fields and is known for IP, UDP or TCP protocols but has never been applied to RTP (Real-Time Transport Protocol) and RTCP (Real-Time Control Protocol) which are characteristic for VoIP. The second method, called LACK (Lost Audio Packets Steganography), provides hybrid storage-timing covert channel by utilizing delayed audio packets. The results of the experiment, that was performed to estimate a total amount of data that can be covertly transferred during typical VoIP conversation phase, regardless of steganalysis, are also included in this paper.
---
paper_title: Tracking anonymous peer-to-peer VoIP calls on the internet

paper_content:

Peer-to-peer VoIP calls are becoming increasingly popular due to their advantages in cost and convenience. When these calls are encrypted from end to end and anonymized by low latency anonymizing network, they are considered by many people to be both secure and anonymous.In this paper, we present a watermark technique that could be used for effectively identifying and correlating encrypted, peer-to-peer VoIP calls even if they are anonymized by low latency anonymizing networks. This result is in contrast to many people's perception. The key idea is to embed a unique watermark into the encrypted VoIP flow by slightly adjusting the timing of selected packets. Our analysis shows that it only takes several milliseconds time adjustment to make normal VoIP flows highly unique and the embedded watermark could be preserved across the low latency anonymizing network if appropriate redundancy is applied. Our analytical results are backed up by the real-time experiments performed on leading peer-to-peer VoIP client and on a commercially deployed anonymizing network. Our results demonstrate that (1) tracking anonymous peer-to-peer VoIP calls on the Internet is feasible and (2) low latency anonymizing networks are susceptible to timing attacks.
---

Title: VoIP Steganography and its Detection—A Survey

Section 1: Introduction
Description 1: Provide an overview of the survey, explaining why VoIP is an appealing target for steganography and the main features of VoIP that make it suitable for such purposes.

Section 2: Steganography: Terminology, Communication Model, and Scenarios
Description 2: Discuss the terminology used in network steganography, the communication models like the "prisoners' problem," and the scenarios for hidden communication in VoIP.

Section 3: VoIP Steganography
Description 3: Explore the origins of VoIP steganographic methods, including digital media steganography and covert channels in network protocols. Detail various methods under different categories such as payload modification, time relations, and hybrid methods.

Section 4: Steganographic Methods Applied to Voice Payload
Description 4: Describe specific steganographic methods related to modifying the voice payload of VoIP, including Least Significant Bit (LSB) based methods and other advanced techniques like phase coding, QIM, and spectrum techniques.

Section 5: Methods That Modify Protocol Data Unit Time Relations (S2)
Description 5: Examine the methods that rely on altering the time relations of Protocol Data Units (PDUs) in VoIP, such as modifying interpacket delays and introducing intentional jitter.

Section 6: Methods That Modify Protocol Data Unit-Protocol-Specific Fields (S1)
Description 6: Detail the methods that involve making modifications to specific fields in the protocol headers and payloads of VoIP packets, including TranSteg and other techniques aimed at protocol-specific alterations.

Section 7: Hybrid Methods (S3)
Description 7: Discuss hybrid steganographic methods that involve modifying both the content and time relations of VoIP PDUs, providing examples and their effectiveness.

Section 8: VoIP Steganalysis
Description 8: Analyze the existing methods for detecting steganography in VoIP, the typical approaches, and their effectiveness. Mention the roles of classifiers like Support Vector Machines (SVM) and experimental results.

Section 9: Conclusions
Description 9: Summarize the key findings of the survey, the current state of VoIP steganography and steganalysis, the challenges in detection, and future research directions.