# A Crypto-Steganography Approach for Hiding Ransomware within HEVC Streams in Android IoT Devices
## 1 Introduction
Consequently, the authors in [14] compared current encryption algorithms such as AES, RSA, RC6, 3 DES, and blowfish regarding energy consumption. The Advanced Encryption Standard (AES) encryption algorithm is widely utilized by IoT security solutions due to its low power consumption [15; 16; 17] compared to other ciphers, especially asymmetric ciphers like RSA. AES is suitable when security and complexity concern the applied security solution. AES is a symmetric encryption algorithm used with a minimum 128-bit key and 128-bit initial value (IV) [18]. Symmetry indicates that for both encryption and decryption process, the same cipher key is used. In this work, an offensive algorithm is presented in which the ransomware is firstly encrypted and then concealed within HEVC video streams. The main contributions of this paper are listed below:  
1. Study the related state-of-the-art research to examine any introduced efforts to conceal ransomware apps within video streams. 2. Summarize the recent literature approaches employing steganography algorithms in concealing malicious software within multimedia data. 3. Propose a novel, efficient hybrid crypto-steganography approach to conceal encrypted ransomware apps using AES encryption and LSB (least significant bit)-based HEVC steganography. 4. Achieve randomness embedding for a proper selection of cover media pixels for hiding secret ransomware bits. * Employ objective and subjective simulations in detail to comprehensively assess the proposed multi-level security approach. * Achieve superior performance in the objective-based results for all examined 19 assessment metrics used to evaluate the HEVC stream quality after ransomware embedding, compared to recent related works. * Obtain extraordinary similarity in the subjective-based results between the original HEVC stream and stego HEVC stream resulting after ransomware embedding. * Succeed in bypassing 70 famous antivirus engines as part of the security analysis for the concealed ransomware within the HEVC stream. * Extract secret ransomware apps successfully with high performance. The primary threat model presented in this research exploits that most of the existing detection approaches take ransomware as an input to their systems. They assume that ransomware is always a visible app that can be scanned through their prediction systems. Even if the victim's detection system can detect the existence of the hidden ransomware, assuming they have the original cover video, it still needs to extract it. If the system manages to extract the hidden ransomware, it will find it encrypted, and the system requires the key to decrypt it, which is also challenging. This paper's main contribution is to bring attention to the ransomware detectors from an offensive point of view that ransomware could be distributed using cryptography & steganography. Cryptography encrypts the ransomware to ensure that even if the steganography approach is broken (in case the detectors know the steganography approach and original cover video), the detectors still cannot recognize that this app is ransomware. The rest of the paper is structured as follows. Section 2 presents a literature review on the related work on ransomware detection and hiding techniques in the IoT devices that were recently investigated. Section 3 discusses the proposed crypto-steganography approach. Section 4 provides the results analysis and discussion. Finally, the paper is concluded and future work is presented in Section 5.