# A Crypto-Steganography Approach for Hiding Ransomware within HEVC Streams in Android IoT Devices
## 3 Proposed Crypto-Steganography Approach
It is noticed that the total encodable pixels are calculated by subtracting the length by one row from the video frame size (\(M\)\(\times\)\(N\)), where this first row (row 0) is reserved to be the video frame header. This reserved video frame header has a length of 10 pixels that encompasses the length of the encrypted ransomware data in binary. The length of the encrypted ransomware data is an essential parameter to be stored within the video frame. The steganography approach exploits this length to decide where to finish the embedding and extraction processes. Prior to starting the embedding step, the generated random hop number (\(hop\_num\)) is converted into a binary sequence format (\(hop\_binary\)). Consequently, this binary sequence is considered as the prominent secret control key for randomly hiding the encrypted ransomware data within the HEVC frame. The embedding step starts from the first pixel of row 1 of the cover HEVC frame (\(cover\_frame\)). The embedding step is repeated for several rounds until all the data of the encrypted ransomware (\(encrypted\_RW\)) is fully concealed in the cover frame. For the first round, three bits of encrypted ransomware data (\(encrypted\_RW\)) are embedded in each LSB pixel of the colored HEVC frame only if this pixel maps to 1 in the random binary sequence. Nevertheless, in this initial round, the pixel is skipped if the pixel maps to 0 in the random binary sequence. ```
1:procedureransomware_Extraction
2:Input: stego_frame, user_SK, hop_num
3:Output: ransomware, original_frame
4:Initialisation:
5: Initialize hash_code: 256 bits
6: Initialize IV: 128 bits
7: Initialize AES_SK: 128 bits
8: Initialize decrypted_file_length: 10 pixels
9: hash_code = SHA2 (user_SK)
10: IV = First_Part (hash_code)
11: AES_SK = Second_Part (hash_code)
12: num_decodable_bits = (\(M\)x\(N\)) - \(N\)
13: decrypted_file_length = First_Part (cover_frame, R0)
14: hop_binary = Convert_Binary (hop_num)
15: round = 1
16:while (decrypted_file_length \(\
eq\) 0) do
17:if (hop_binary:pixel = 1) and (round = 1) then
18: encrypted_RW = Extract (stego_frame, 3 bits)
19:endif
20:if (hop_binary:pixel = 0) and (round = 2) then
21: encrypted_RW = Extract (stego_frame, 3 bits)
22:endif
23:if (stego_frame.end = True) then
24: round = 2
25:endif
26:endwhile
27: ransomware = AES-128 (encrypted_RW, IV, AES_SK)
28:endprocedure
```  
**Algorithm 2** Ransomware Extraction Process. However, if the end of the cover HEVC frame is reached while there is still encrypted ransomware data that need to be embedded, the embedding step is repeated for a second round. Starting from row 1 of the cover HEVC frame, the residual pixels in the encrypted ransomware data are embedded in the pixels of the cover HEVC that were initially skipped. Therefore, each pixel of the cover video frame maps to 0 in the random binary sequence is currently embedded with the residual of encrypted ransomware secret data. Finally, the stego video frame is obtained by collecting the encoded pixels resulted from the embedding process. It is demonstrated from the steps of Algorithm 1 that the whole pixels of the cover HEVC frame are potentially exploited for embedding the encrypted ransomware data as desirable based on its length. Furthermore, the most crucial advantage is that the encrypted ransomware data is widely spread throughout the cover video frame, which is considered a type of robustness and security against intruders. This is because by checking the LSBs of the pixels within the stego video frame, it is difficult to differentiate or guess whether or not these pixels have been modified or not. This is due to ciphering and scrambling the secret ransomware data utilizing the AES algorithm. So, the original LSBs of the pixels within the cover video frame may have identical values to the encrypted bits of the secret ransomware data being hidden. Consequently, no alteration would be observed in the resulting stego video compared to the original video frame.