# A Crypto-Steganography Approach for Hiding Ransomware within HEVC Streams in Android IoT Devices
## 3 Proposed Crypto-Steganography Approach  
This section introduces the crypto-steganography approach that composes three main processes: AES encryption, random pixel selection process, and LSB-based steganography. The major advantage of employing the LSB-based steganography process is achieving high imperceptibility. This is why recent works [38; 39] have utilized LSB to hide benign data. LSB steganography can hide the secret ransomware bits inside the LSBs of the cover video frames without causing a noticeable difference between the cover and stego frames. Therefore, by altering the LSBs of the color components of the input cover video frame to a particular target binary value, the pixel's color is slightly changed without making discrepancies in the resulting stego frame that human eyes can recognize. To achieve and develop a secure and robust ransomware hiding within HEVC frames, both symmetric AES encryption and random pixel embedding processes are implemented during the LSB steganography process. The associated secret key employed in the ransomware embedding process must be the same in the ransomware extraction process. In contrast, the embedding bits in the video cover frame are changed randomly during the hiding process. Therefore, without knowing and utilizing the original secret key, it is challenging and not possible to recover and retrieve the concealed ransomware data in the video frame. Thus, the decoder side needs to know the right secret key to rescue the hidden ransomware data within the stego video frame. The proposed crypto-steganography approach is established based on the introduced image steganography algorithm presented in [40]. The crypto-steganography approach comprises two algorithms; Algorithm 1: the ransomware hiding process, and Algorithm 2: the ransomware extraction process as indicated in Figure 1. Firstly, a user-defined secret key is used to control the random pixel embedding process to hide the encrypted ransomware in the cover video frame. Additionally, this secret key is used to generate the initial parameters to run the AES encryption algorithm and control the operation of the employed random number generator (RNG). The secret encrypted ransomware bits are randomly concealed within the HEVC frame to preclude the non-dedicated and undefined decoders from identifying the concealed secret data. One of the main contributions of the crypto-steganography approach is its capability to hide any size and amount of ransomware samples within the HEVC frame, constrained merely by the cover video frame size. The ransomware hiding algorithm takes as an input the cover HEVC frame (_cover_frame_), the user-defined secret key (_user_SK_), and the ransomware sample. Initially, the _user_SK_ is forwarded to a hashing algorithm (SHA-256) to produce a secret hash code (_hash_code_) with 256 bits. The obtained _hash_code_ is utilized to control the employed AES-128 encryption algorithm as follows:  
1. The first part of the generated hash code (128 bits) is used as an initialization vector (_IV_) for the applied AES-128 encryption algorithm. 2. The second part of the generated hash code (128 bits) is used as a symmetric secret key (_ASE_SK_) to encrypt the ransomware using AES-128 encryption algorithm. Figure 1: Proposed hiding/extraction stages of the crypto-steganography approach. Furthermore, the whole generated hash code (256 bits) is utilized as an input to the random number generator (\(RNG\)) to generate the hop number (\(hop\_num\)). The RNG further requires as an input the total number of encodable pixels (\(num\_encodable\_bits\)). Hence, this is calculated from the cover video frame ((\(M\)\(\times\)N)-N), where \(M\) and \(N\) are the dimensions of the cover video frame. The generated hop number (\(hop\_num\)) has the same binary size as the total number of encodable pixels, where each one of the encodable pixels requires to be characterized by a one-bit of the generated random hop number.