# A Crypto-Steganography Approach for Hiding Ransomware within HEVC Streams in Android IoT Devices
## 2 Literature Review  
Due to the explosive expansion of IoT systems, the number of connected nodes is increasing dramatically. However, from this current IoT era and its related applications have arisen several security attacks including denial of service (DoS) and malware control which alarms real threats for any IoT device [19]. To overcome the main vulnerabilities of Android IoT devices, several solutions have been proposed to detect IoT Android malicious software using machine learning [1,20], neural network [2], and deep learning [21]. In [2], the authors developed a multi-layer deep learning model that provides decisions via analyzing the previous malware features. Initially, the features of the malicious software were divided into clusters. Subsequently, the detection system applied a unique deep learning model on each separated feature set. Finally, it combined the results in order to generate the final decision. Furthermore, they have stored the resulting decisions in a blockchain to be further utilized in training specialized clusters. Another IoT malware detection approach was proposed by [1]. The proposed scheme conducted a vulnerability prediction analysis on Android IoT applications by implementing machine learning algorithms. Even though the system provided recommendations on reducing the risk vulnerabilities, it lacks large dataset samples that might affect the performance of machine learning algorithms that generate the security measures. The authors of [21] implemented a deep learning approach to develop two malware detection algorithms. The proposed methods consume few resources; hence they were sufficient to be used by Android IoT devices. [PERSON] et al. proposed a run-time permission-based IoT malware detection scheme [22]. Initially, the detection algorithm performed a permission ranking and feature selection based on the permission similarity. Then, it applied permission mining utilizing association rules. Besides employing permissions in developing the IoT malware detection system, the authors of [23] utilized the application programming interface (API) calls to develop an event-driven detection system. By creating vent groups that describe behaviors of the application, the proposed system was able to classify new types of malicious software. Another testing framework was proposed by [24] which also aims to perform security analysis on IoT devices for new malware families using machine learning algorithms. Furthermore, the proposed test-learning framework implements genetic algorithms to generate Android malware applications for IoT devices. The authors of [25] developed an IoT malware detection framework that combines several machine learning algorithms along with the advanced technology of blockchain. The proposed framework extracted the malicious information and fed it to the blockchain by utilizing a classification algorithm, and consequently, improving the efficiency of the malware classification process since all the malicious information is stored in the blockchain. An additional proposed framework that uses the machine learning approach was proposed by [26]. The authors developed a subset of features based on examining the performance of various feature selection algorithms. However, the machine learning approach can be further utilized in detecting encrypted malware. [PERSON] et al. presented a ransomware detection algorithm that monitors the power consumption of Android IoT devices by implementing machine learning algorithms [27]. The system classifies the ransomware by calculating the energy consumption of the running processes. Despite the advanced proposed solutions for IoT malware detection, malware steganography is still considered a challenge that requires further investigation [9]. In [28], the authors investigated the effect of embedding malicious software within a media file. Initially, they embedded a Metasploit malware within an image.