DETECTING MP3STEGO EMBEDDED CONTENTS: A STATISTICAL ANALYSIS ON A PARITY STEGANOGRAPHY ALGORITHM

ABSTRACT

Steganographic algorithms are designed to hide the existence of communications, and often do so by embedding hidden contents into innocuous covert media. Such forms of communication present a problem to security personnel and others concerned with detecting suspected groups’ communication over the Internet. One tool available to conduct steganographic embedding in MP3 audio files is MP3Stego. In this thesis, we analyze the algorithm that MP3Stego uses, and study how MP3Stego capitalizes on the MP3 encoding algorithm to embed contents. We then dissect the MP3 file, and statistically analyze the lengths of the audio data blocks to test if we can differentiate MP3 files with MP3Stego embedded contents from those that do not. We compare our results to prior research, and find that the results do not agree with prior experimentation on MP3Stego. We then show and conclude that the best statistical predictor to examine when testing for MP3Stego embedded contents is the minimum value of the MP3 files’ block lengths.

 

Chapter 1 

 

Introduction

The rise and proliferation of the Internet, the “World Wide Web,” has created a plethora of avenues for communication among colleagues, academia, business, and pleasure. While most of these communications use “normal” methods, such as email, web sites, and blogging, some forms of communication attempt to avoid discovery, and thus are designed to escape any attention. The science of communicating without alerting others to the existence of the communication is known as steganography.

Steganography is not a new science, and in fact documented instances of steganographic communication date back to Ancient Greece. However, the ubiquity of the Internet and the complexity of digital communications offer a powerful and accessible medium for hidden communication. In particular, modern compression algorithms have allowed for digital communication techniques that are extremely difficult to detect.

Most accessible steganographic programs utilize JPEG image compression to hide or embed content into carrier programs. Other encoding schemes offer other opportunities, and steganography is not restricted to image data. The MP3 encoding scheme has presented a medium for audio compression steganography, and the freely available program MP3Stego capitalizes on this opportunity.

Programs such as MP3Stego represent a conceptual proof of a powerful and complicated communications channel. Recent events have given rise to the belief, even fear, of certain malignant organizations using covert Internet communications to propagate and organize the efforts of terrorists, and even if these beliefs are unrealistic, understanding methods of steganographic communication present a worthwhile research problem. With this in mind, we 2

direct our research toward the mechanisms used to embed content with the program MP3Stego, and then conduct a statistical analysis to discover whether we can differentiate, via quantitative means, a meaningful method to separate files with hidden content from those that do not.

We are mindful of prior research involving MP3Stego. After assembling our experiment’s control and hypothesis groups, we compare our statistical analysis with prior quantitative analysis, and find that previously found results that imply that the variance of the MP3 files’ block lengths can detect hidden content do not agree with our results. We conduct statistical trials, and attempt to differentiate MP3Stego embedded content by the factors or variance, range, and finally the maximum and minimum values found for each sample. Our results indicate that the minimum value provides the best indication of MP3Stego embedded content, and screening our sample MP3 files by a minimum value threshold correctly segregates 99.5% of our sample set.

This study contributes to the awareness and understanding of steganographic techniques, primarily those that utilize advanced compression techniques. Because the MP3Stego program capitalizes on the advanced file format of the MP3 file and the complex encoding and compression techniques used to create MP3 files, gaining and understanding of how the program manipulates these processes will be useful for analyzing future steganographic algorithms, and attacking steganographic algorithms for which there is currently no known method of breaking the algorithm. Finally, our analysis provides a method with which to analyze MP3 files if MP3Stego embedded content is suspected.

This thesis consists of five chapters. Chapter one introduces the research problem and gives a very broad overview of the analysis vector, the software involved, and the contribution of the thesis research. Chapter 2 provides a brief analysis of the origin of steganography and information hiding, and describes prior steganographic programs, and also research regarding breaking and attacking such information hiding algorithms. We also discuss why the problem of steganography is important, and why research regarding steganography is becoming more common. Chapter 3 begins by providing a more detailed view of the mechanisms involved in the encoding and creation of MP3 files. The basics of the MP3 file format are described, including the frame header, the side information, and the meaning of the various parameters of the file. The second section of Chapter 3 explains the concept of parity-based information hiding, the vehicle upon which the algorithm for MP3Stego is based. After parity-hiding is covered, the third section of Chapter 3 provides a detailed description of the process that is used by MP3Stego to hide an embedded file into an MP3 file during the encoding process. The final section of the chapter is a brief discussion of the strengths and weaknesses of the MP3Stego algorithm. Chapter 4 describes the procedures used in analyzing MP3Stego in this study. The first section describes the methods and location of the data that is analyzed. The next section describes the research hypotheses that we attempt to validate, and elaborates on why these hypotheses are meaningful to both the experiment we are conducting and the overall understanding of how MP3Stego changes an MP3 file when the hidden content is embedded. After the research hypotheses are set we discuss the metrics of evaluating the performance of our statistical predictors, and what indications the different types of success and failure provide. The final section of Chapter 4 provides the results of the data, our conclusions with respect to our hypotheses, and which predictor we feel is the strongest chance of detecting MP3Stego embedded content. The final chapter of this thesis summarizes the conclusions we have made.

DETECTING MP3STEGO EMBEDDED CONTENTS: A STATISTICAL ANALYSIS ON A PARITY STEGANOGRAPHY ALGORITHM

Sharing is caring!