Steganalysis of Transcoding Steganography

TL;DR

This paper presents a steganalysis method for TranSteg, a covert communication technique in VoIP, using MFCC and GMMs to detect hidden data with varying success depending on codec pairs.

Contribution

It introduces a novel MFCC-GMM based steganalysis approach for TranSteg, addressing detection challenges across different codec combinations.

Findings

Effective detection of some codec pairs like G.711/G.729

Certain codec pairs like iLBC/AMR are more resistant to detection

The method achieves high detection accuracy in specific scenarios

Abstract

TranSteg (Trancoding Steganography) is a fairly new IP telephony steganographic method that functions by compressing overt (voice) data to make space for the steganogram by means of transcoding. It offers high steganographic bandwidth, retains good voice quality and is generally harder to detect than other existing VoIP steganographic methods. In TranSteg, after the steganogram reaches the receiver, the hidden information is extracted and the speech data is practically restored to what was originally sent. This is a huge advantage compared with other existing VoIP steganographic methods, where the hidden data can be extracted and removed but the original data cannot be restored because it was previously erased due to a hidden data insertion process. In this paper we address the issue of steganalysis of TranSteg. Various TranSteg scenarios and possibilities of warden(s) localization are analyzed with regards to the TranSteg detection. A steganalysis method based on MFCC (Mel-Frequency Cepstral Coefficients) parameters and GMMs (Gaussian Mixture Models) was developed and tested for various overt/covert codec pairs in a single warden scenario with double transcoding. The proposed method allowed for efficient detection of some codec pairs (e.g., G.711/G.729), whilst some others remained more resistant to detection (e.g., iLBC/AMR).