Steganalysis of compressed speech to detect covert Voice over Internet Protocol channels

A network covert channel is a passage along which information leaks across the network in violation of security policy in a completely undetectable manner. This study reveals our findings in analysing the principle of G.723.1 codec that there are `unused` bits in G.723.1 encoded audio frames, which can be used to embed secret messages. A novel steganalysis method that employs the second detection and regression analysis is suggested in this study. The proposed method can not only detect the hidden message embedded in a compressed voice over Internet protocol (VoIP) speech, but also accurately estimate the embedded message length. The method is based on the second statistics, that is, doing a second steganography (embedding information in a sampled speech at an embedding rate followed by embedding another information at a different level of data embedding) in order to estimate the hidden message length. Experimental results have proven the effectiveness of the steganalysis method for detecting the covert channel in the compressed VoIP speech