# A Crypto-Steganography Approach for Hiding Ransomware within HEVC Streams in Android IoT Devices
## 1 Introduction  
The revolution of IoT systems has been growing significantly through the development of daily life applications in various fields, including smart cities, education, healthcare, and considerably more. IoT systems primarily consist of sensors and electronic devices, which collect data and perform required actions accordingly [1]. Many advanced IoT devices, specifically smartphones and smartwatches, are built on the Android platform due to its high resilience and hardware support [2]. These Android-based IoT devices provide the user a convenient way to interact and control other IoT devices such as smart TV, cameras, and refrigerator through special applications. Thus, the Android operating system (OS) is essential for communication and data exchange in IoT devices. However, the continuous emergence of Android IoT devices increases malicious attacks. In 2019, the totalAndroid malicious software detected globally reached 10.5 million, whereas the malware development increased by 480,000 in 2020 ([[https://www.statista.com/statistics/680705/global-android-malware-volume/](https://www.statista.com/statistics/680705/global-android-malware-volume/)]([https://www.statista.com/statistics/680705/global-android-malware-volume/](https://www.statista.com/statistics/680705/global-android-malware-volume/)) accessed on 1 September 2021). Such malicious attacks may trespass the victim device to affect other connected nodes on the network, resulting in violating the whole IoT ecosystem. Among the most notorious harmful malware that threatens Android devices is ransomware. Ransomware is a subset of malicious software which takes control over the victim's device by blocking access to the system resource or encrypting sensitive data. The victim gets the control back only if a ransom is paid to the attacker. According to [3], ransomware targets individual users, governmental parties, and business companies resulting in significant financial loss. Mainly, ransomware is classified into two main categories, locker-based ransomware, and crypto-based ransomware. In the locker-based ransomware, a lock screen is displayed on the user device blocking access to the system resources. Hence, a ransom is requested to remove the lock window [4]. On the other hand, the crypto-based ransomware encodes the system data requesting a ransom to retrieve the decryption key. Even though several works have been proposed on implementing ransomware detection systems [5; 6; 7; 8], studies have discussed that such systems might not be sufficient enough in detecting the malicious software that implements steganography and encryption techniques [9]. Steganography is the art of concealing the presence of secret data by embedding it within a cover object [10]. The applied techniques of steganography are mainly classified into three categories based on how covert communication is established [9]. In the first technique, the malicious software is concealed by simulating the network traffic of a benign app. While in other types of steganography methods, parts of the malicious software components are embedded within the network traffic. However, in media steganography techniques, the malicious software is embedded within a media file. Among several media files that can be utilized as a carrier object, the high-efficiency video coding (HEVC) is gaining increasing interest due to its high embedding capacity [11; 12]. Additionally, attackers might combine the implementation of steganography algorithms with encryption techniques to increase the undetectability levels of malicious software. In this case, even if a detection system revealed the hidden ransomware application, it will not be classified as malware due to the implemented encryption technique. However, in the scope of IoT devices, the limited resources and restricted energy consumption means that the encryption algorithm must be carefully selected and implemented in IoT-based solutions [13].