# A Crypto-Steganography Approach for Hiding Ransomware within HEVC Streams in Android IoT Devices
## 2 Literature Review
After that, they performed two detection scenarios before and after implementing the steganography algorithm using Open Source Intelligence Tools such as VirusTotal. However, the results showed that several anti-virus engines could not detect the hidden malware. Nevertheless, the hidden malware was detected by some other anti-virus scanners. Another malware steganography attach was presented by [29]. In the proposed steganography system, the identity of the malware was hidden by generating fake network traffic, which mimics benign application traffic. Furthermore, steganography techniques can be utilized to create covert communication channels between the attacker and the malware. In [30], the authors developed a covert channel using the StegBlocks technique, which enables text communication between the active malware and its developer. However, the communication text file is limited to 23 KB. In several research works, stenography techniques are combined with other cryptography algorithms to enhance the security and privacy of hidden secret data. In [31], the authors combined cryptography and stenography techniques to obtain a high security standard. Initially, the data was encrypted using an AES algorithm. Subsequently, the resulting encrypted data was concealed in 3D cover images. [PERSON] et al. have also employed the AES algorithm as an additional security layer to their proposed stenography scheme [32]. Furthermore, the authors of [33] have also adopted the AES algorithm as a security technique to encrypt the data before hiding it with the carrier file. However, in [31], two schemes were proposed in which LSB stenography is applied along with image processing and cryptography in order to secure sensitive data. Moreover, the authors of [34] have proposed a new embedding algorithm in which they apply sequential multiples for LSB real-time data hiding algorithm. Additionally, they apply a visual cryptography algorithm for security robustness. In IoT platforms, a successful ransomware attack does not just result in compromising the victim's personal data, but also leads to hijacking the device functionality. Thus, ransomware can be considered a devastating threat with consequences of compromising billions of interconnected IoT devices. Frantic Locker is an example of a locker ransomware that hijacks smart TVs which blocks the display screen and disables the reset option. The ransomware is activated when the user runs a malicious movie application. Frantic Locker requests a ransom of $500 USD to be paid within three days [35]. In the research field, some ransomware applications have been developed to demonstrate the threat ransomware can cause to the IoT networks. Android Simplocker is locker ransomwaredeveloped by Symantec researchers [36]. The proposed ransomware penetrates the Android wearable device once the device is connected to a smartphone. Consequently, Android Simplocker locks the display of the wearable device. A proof of concept was proposed by [PERSON] et al. [37] to infiltrate the damage of ransomware on IoT devices in business organizations. A smart bulb was hijacked by utilizing an Android smartphone from a close car. The proposed attack proofs that ransomware can compromise and control the entire IoT network. Based on the above discussion, it can be concluded that most of the proposed detection systems assume that the ransomware is visible to be analyzed. Furthermore, the related works lack investigating the threat of encrypted malicious software. Therefore, in this paper, a novel offensive algorithm is proposed in which malware in general, and ransomware specifically, is encrypted and hidden in media streams.