# A Crypto-Steganography Approach for Hiding Ransomware within HEVC Streams in Android IoT Devices
## 4 Results and Comparisons
### Histogram and Edge Results Analysis  
Histogram analysis shows a relationship between the pixel frequency and its intensity value of the video frame. Table 5 presents the outcomes of the pixel intensity distributions (histograms) of the stego/cover video frames introduced in Table 4. These obtained histograms substantiate and verify the high-performance accomplishment of the proposed approach, where both stego/cover video frames have roughly identical pixel distributions. Furthermore, the acquired histograms of the difference frames between stego/cover frames are around the zero value, thus there are no pixel distributions for them. To further verify the efficiency of the proposed approach, the visual outcomes of the Gaussian Laplacian edges are introduced as shown in Table 6. These Gaussian Laplacian edges can be obtained by estimating the value of the Laplacian operator for the whole pixels within the stego and cover video frames. The Laplacian operator can be represented by \(L(x(m,n))\), where \(x(m,n)\) is the input stego or cover video frame, and \((m,n)\) refers to the spatial location of the video frame pixels. This operator can be mathematically represented as in Equation (2) [56].  
\[L(x(m,n))=x(m+1,n)+x(m-1,n)+x(m,n+1)+x(m,n-1)-4x(m,n) \tag{2}\]  
Furthermore, the edge similarity between the stego and cover frames can be evaluated using the calculation of edge differential ratio (_EDR_). _EDR_ estimates the pixel error rate in edges between the stego and cover frames. Therefore, a low _EDR_ value is recommended. It is represented in Equation (3) [57].  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**HEVC Stream** & **Cover Frame** & **Stego Frame** & **Difference Frame** \\ \hline Balloon (Frame 5) (Ransomware 5) & & & \\ \hline Kimono (Frame 10) (Ransomware 4) & & & \\ \hline Shark (Frame 15) (Ransomware 3) & & & \\ \hline Microworld (Frame 20) (Ransomware 2) & & & \\ \hline CTFly (Frame 25) (Ransomware 1) & & & \\ \hline \hline \end{tabular}
\end{table}
Table 4: The employed objective quality assessment metrics.  
\[EDR=\frac{\sum_{m,n=1}^{K}|B(m,n)-\bar{B}(m,n)|}{\sum_{m,n=1}^{K}|B(m,n)+\bar{B}(m,n)|} \tag{3}\]  
where the binary pixel value of the cover frame edges is estimated by \(B(m,\,n)\), and the related binary pixel value of the setgo frame edges is estimated by \(\bar{B}(m,\,n)\). It appears from the results shown in Table 6 that both stego/cover video frames have identical edge distributions for their whole included objects by achieving zero EDR values for all examined HEVC streams. This verifies the hiding efficiency of the proposed approach for maintaining the same edge distributions of the stego frames compared to the cover frames.  
In addition, a comparative analysis study is conducted to compare the proposed crypto-steganography approach with recent steganography approaches as presented in Section 4.3. This study employed 17 objective-based metrics to apply fair and deep comparison with the related works.  
From a security perspective, the encrypted ransomware embedding performance is validated using antivirus scan analysis as indicated in Section 4.4. Seventy well-known antivirus engines were used to scan the ransomware before embedding and after embed  
\begin{table}
\begin{tabular}{c c c} \hline \hline
**HEVC Stream** & **Cover Frame** & **Stego Frame** & **Difference Frame** \\ \hline Balloon (Frame 5) (Ransomware 5) & \(-\) & \\ \hline Kimono (Frame 10) (Ransomware 4) & & \\ \hline Shark (Frame 15) (Ransomware 3) & & \\ \hline Microworld (Frame 20) (Ransomware 2) & & \\ \hline GTFly (Frame 25) (Ransomware 1) & & \\ \hline \hline \end{tabular}
\end{table}
Table 5: Histogram outcomes of the tested HEVC frames in case of using different ransomware samples.  
ding (stego frame & infected video). Finally, the integrity of the hidden ransomware was examined and proved in Section 4.5.