# A Crypto-Steganography Approach for Hiding Ransomware within HEVC Streams in Android IoT Devices
## 4 Results and Comparisons
### Original/Extracted Ransomware Analysis  
The comparison between the original and extracted ransomware APK files was performed on two levels, APK-level and code-level. The APK-level comparison was performed using version 1.0 of Apkcompare tool ([[https://github.com/linea/ApkCompare](https://github.com/linea/ApkCompare)]([https://github.com/linea/ApkCompare](https://github.com/linea/ApkCompare)) accessed on 1 August 2021). The tool takes as an input the two APK files and generates a file listing the differences between the provided APK's. However, in our tests, the generated comparison files were empty, indicating identical APKs. On the other hand, in order to implement a code-level analysis, the ransomware APK files were decompiled using Apktool ([[https://ibotpeaches.github.io/Apktool/](https://ibotpeaches.github.io/Apktool/)]([https://ibotpeaches.github.io/Apktool/](https://ibotpeaches.github.io/Apktool/)) accessed on 1 August 2021)) to retrieve the original source code. Therefore, decompiling the original and the extracted ransomware APK files resulted in retrieving the manifest files and the small files of each APK, respectively. Subsequently, the retrieved source code files were compared using the Diffchecker tool ([[https://www.diffchecker.com](https://www.diffchecker.com)]([https://www.diffchecker.com](https://www.diffchecker.com)) accessed on 1 August 2021). The comparison analysis of the source code files reveals no difference between the original and the extracted ransomware files.This proves the optimal extraction of the embedded encrypted ransomware from the HEVC streams.  
Furthermore, to ensure the integrity of the proposed approach, the hash function SHA256 has been applied on the ransomware samples before the embedding and after performing the extraction algorithm. Table 8 shows the digest of the original ransomware samples matches the digest of the resulting ransomware succeeding the extraction process. Thus, it can be concluded that the ransomware samples were recovered completely and correctly.  
As can be observed from the above results, the mission of anti-steganography technology against our approach is very challenging due to the following reasons:  
* The difficulty of knowing the original cover media, mainly when it is in the format of video streaming. The attacker can utilize any trending video to hide ransomware there. It is not easy and maybe not be possible for the anti-steganography to be aware of the original video to detect the presence of the hidden data.
* The randomness of choosing the video frames and bits to embed the ransomware. This makes it even more difficult to recognize where the ransomware is hidden.
* Even if the above two conditions are satisfied and the anti-steganography techniques manage to locate the hidden ransomware within a video stream, the extracted data will be encrypted, and the key is needed to decrypt it and then analyze it, which is also very challenging as only the attacker knows the key.  
Therefore, our proposed approach is robust against the most common antivirus software even though they are equipped with up-to-date malware detection solutions.