Detection of covert voice-over Internet protocol communications using sliding window-based steganalysis

The authors describe a reliable and accurate steganalysis method for detecting covert voice-over Internet protocol (VoIP) communication channels. The proposed method utilises a unique sliding window mechanism and an improved regular singular (RS) algorithm for VoIP steganalysis, which detects the presence of least significant bit embedded VoIP streams. With this mechanism, the detection window moves forward one packet or several packets each time to screen VoIP streams. The optimum detection threshold for the proposed detection metric is computed by modelling the distributions of the new metric for stego and cover VoIP streams. Experimental analysis reveals that the proposed method improves the detection time significantly, utilising less memory resources for VoIP steganalysis, thereby enabling real-time detection of stego VoIP streams. The proposed method also provides a significant improvement on precision in detecting multiple covert VoIP channels when compared to the conventional RS method.