Steganalysis of Compressed Speech to Detect Covert VoIP Channels

A network covert channel is a passage along which information leaks across the network in violation of security policy in a completely undetectable manner. This paper reveals our findings in analysing the principle of G.723.1 codec that there are ‘unused’ bits in G.723.1 encoded audio frames, which can be used to embed secret messages. A novel steganalysis method that employs the second detection and regression analysis is suggested in this study. The proposed method can detect the hidden message embedded in a compressed VoIP speech, but also accurately estimate the embedded message length. The method is based on the second statistics, i.e. doing a second steganography (embedding information in a sampled speech at an embedding rate followed by embedding another information at a different level of data embedding) in order to estimate the hidden message length. Experimental results have proven the effectiveness of the steganalysis method for detecting the covert channel in the compressed VoIP speech.