# High-Capacity Robust Behavioral Steganography Method Based on Timestamp Modulation across Social Internet of Things

Authors: Mingliang Zhang; Xiangyang Luo; Pei Zhang; Hao Li; Yi Zhang; Lingling Li
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Social Internet of Things (SIoT) is an emerging field that combines IoT and Internet, which can provide many novel and convenient application scenarios but still faces challenges in data privacy protection. In this paper, we propose a robust behavioral steganography method with high embedding capacity across social networks based on timestamp modulation. Firstly, the IoT devices on the sending end modulate the secret message to be embedded into a timestamp by using the common property on social networks. Secondly, the accounts of multiple social networks are used as the vertices, and the timestamp mapping relationship generated by the interaction behaviors between them is used as the edges to construct a directed secret message graph across social networks. Then, the frequency of interaction behaviors generated by users of mainstream social networks is analyzed; the corresponding timestamps and social networks are used to implement interaction behaviors based on the secret message graph and the frequency of interaction behaviors. Next, we analyze the frequency of interaction behaviors generated by users in mainstream social networks, implement the interaction behaviors according to the secret message graph and the frequency of interaction behaviors in the corresponding timestamps and social networks, and combine the redundant mapping control to complete the embedding of secret message. Finally, the receiver constructs the timestamp mapping relationship through the shared account, key, and other parameters to achieve the extraction of secret message. The algorithm is robust and does not have the problem that existing multimedia-based steganography methods are difficult to extract the embedded messages completely. Compared with existing graph theory-based social network steganography methods, using timestamps and behaviors frequencies to hide message in multiple social networks increases the cost of detecting covert communication and improves concealment of steganography. At the same time, the algorithm uses a directed secret message graph to increase the number of bits carried by each behavior and improves the embedding capacity. A large number of tests have been conducted on mainstream social networks such as Facebook, Twitter, and Weibo. The results show that the proposed method successfully distributes secret message to multiple social networks and achieves complete extraction of embedded message at the receiving end. The embedding capacity is increased by 1.98–4.89 times compared with the existing methods SSN, NGTASS, and SGSIR.


---

## Body

## 1. Introduction

With the widespread use of IoT devices and social networks, people have combined them to form the SIoT [1], which build many interesting scenarios. For example, it allows users to convert data about plants, pets, and so forth acquired by sensors in their homes into posts, which are then posted to social networks to share their lives in real time. In this era of connected everything, users’ privacy protection is always a hot topic being discussed. For edge devices involving personal safety, more covert means of communication are needed to transmit secret commands that prevent communication data from being monitored and tampered within the link to avoid significant loss of life and property. Steganography is a privacy protection method that uses redundant methods such as human vision and hearing to conceal the existence of secret communication [2] and has received wide attention from scholars in the field of information security. It allows SIoT to deliver critical data with higher security requirements in an imperceptible manner while delivering ordinary data. Therefore, it is of great importance and practical value to study the covert communication of social IoT.This paper will focus on the way how edge devices of SIoT can implement steganography on social networks. The traditional steganography method based on multimedia has high embedding capacity and superior performance in resisting statistical detection [3]. However, the generated steganography object is vulnerable to channel attack when it is sent through a lossy channel, which will result in the inability to extract secret message correctly. Meanwhile, once the carrier is modified during the embedding of secret message [4], there is a risk of being identified as abnormal data [5]. Social network behavioral steganography (SNBS) is a method, which uses user's comments, forwardings, and other behaviors on social networks to realize covert communication. It combines the rich interaction behaviors of social networks [6] with steganography to make up for the shortcomings of traditional steganography methods in terms of robustness and detection resistance. On lossy channel, it does not cause the loss of behavioral data but ensures the robustness of steganography methods. In addition, secret message is hidden in behaviors, which effectively resists the analysis and detection technology for multimedia data; the sender and receiver do not directly establish communication to avoid causing special attention of the third party [7] and avoid the possibility of the sender’s exposure or betrayal to testify against the receiver. However, the embedding capacity of SNBS is very low. Although it avoids the detection of multimedia data, it also introduces behavioral abnormalities. This limits the practical use of such methods. How to improve the embedding capacity and correct the abnormal behaviors is an urgent problem to be solved in the practical application of SNBS technology. This paper will focus on the improvement of SNBS capacity and the correction of abnormal behaviors.Recently, researchers have developed a series of studies in the field of SNBS. Existing social network steganography methods can be divided into two categories according to the difference of secret message carriers: social network multimedia steganography (SNMS) and social network behavioral steganography (SNBS).SNMS refers to embedding secret message into multimedia such as posts and comments published by users. This kind of methods combines multimedia such as text [8–11], image [12–15], and video containing secret message with a social network and uses posts, comments, and other ways to realize covert communication.SNBS uses user’s interaction to convey secret message and can be further divided into non-graph-theory-based steganography and graph-theory-based steganography. For non-graph-theory-based steganography, in order to prove whether social network behavioral data can provide instructions for botnets, Pantic and Husain [16] use the length of Twitter to realize the transmission of secret data. This method has certain concealment, but it is easy to be detected. Zhang [17] proposes a method to send secret message by marking “love.” The behavioral steganography method of marking “love” attempts to send message in the WeChat Moments, which is widely used in China, but there are insufficient embedding capacity and detection resistance. In view of the problem that the relationship between friends is not considered in [17], Hu et al. [18] use the behavioral correlation between sender and friend to calculate the reasonable probability of marking “love” on a social network, which improves the security, but the embedding capacity needs to be improved. Regarding the “prisoner model,” the security issue between sender and receiver is not considered; Yang et al. [7] give a constraint framework to ensure content security and behavioral security and provide a reference method for the behavioral security of social network steganography. Li et al. [19] propose a framework for reposting posts and other network activities to hide secret message. This framework hides secret message in interactive activities and provides a theoretical basis for social network steganography. For graph-theory-based steganography, methods of using a graph theory to describe steganography can be traced back to [20]. This paper describes the method of using a dynamic data structure in memory to store secret messages. Nechta [21] constructs an undirected graph of secret message on social networks to achieve covert communication. The method proposed by Wu et al. [22] conveys secret message through an undirected graph and enhances the security of communication through a directed graph; however, there are some redundancies in the nodes of this method. To address the problem that the secret data may be exposed due to the attacker’s mastery of the reconstruction graph process, Wu et al. [23] improve the secret data security by remapping the correspondence between the vertices of the graph structure with a key, but the embedding capacity of the method still needs to be improved.In response to the above problems, this paper proposes a high-capacity and robust behavioral steganography method for cross-platform social networks based on timestamp modulation. This method uses accounts in multiple social networks to construct a directed secret message graph on the sender side and hides the secret message in the timestamps of the interaction behaviors generated by the secret message graph. At the receiving end, the receiver uses the shared account and key to extract the secret message through the public social networks. The main work of this paper is as follows:(1)
This paper proposes a method to construct a directed secret message graph across multiple social networks and map the secret message into the timestamp generated by the edge set of the secret message graph. Compared with existing methods, this method has a very high embedding capacity, and the effective number of bits transferred and the embedding rate are improved.(2)
This paper proposes a distribution modulation algorithm that hides secret messages into multiple social networks by timestamps and fits the frequency characteristics of ordinary user interactions. This algorithm increases the cost of attackers to analyze the covert communication, reduces the probability of anomalous behaviors, and improves the detection resistance.(3)
This paper proposes an algorithm to overcome the problem of information extraction failure due to interaction delay by increasing the redundancy time. The algorithm increases the number of mappings between participant account indexes and timestamps to avoid the possibility of mismatch between them and solve the robustness problem.The rest of this paper is organized as follows. Section2 briefly introduces the work related to SNBS. Section 3 introduces the method proposed in this paper. After that, Section 4 gives the experimental results and evaluation. Finally, this paper is concluded by Section 5.


## 2. Related Work

Steganography based on graph theory uses user’s accounts and interactions on social networks to construct secret message graphs to realize covert communication. Compared with SNMS, steganography based on graph theory has high robustness and there is no statistical anomaly for multimedia steganography, and it is effective against multimedia steganography analysis techniques. Therefore, this section will briefly introduce the previous research based on graph theory steganography, so as to explain the feasibility of designing steganography methods based on graph theory.Nechta [21] used social network behaviors to construct undirected graphs for covert communication, abbreviated as SSN. It constructs a secret message undirected graph GV,E,φ, where V denotes the set of vertices in the graph, E denotes the set of edges in the graph, and φ denotes the adjacency function. This function is shown in equation (1) and is used to define whether the edges between Va and Vb exist in graph G. V denotes the number of vertices in set V. Moreover, vertices va,vb are exhaustively enumerated, where a<b. The number of bits that can be transmitted by this method is N1 shown in equation (2).(1)φ=0,Ea,b∉E,1,Ea,b∈E(2)N1=V∗V−12.To facilitate the comparison of the ability of existing methods to deliver the size of secret messages, we take the product of the number of interactive behaviorsh and the average number of bits carried by each behavior as the embedding capacity c=h∗ls. Let the average number of bits carried by a single behavior be ls. In this paper, the numbers of bits sent in [21–23] are denoted as N1,N2,N3, and the numbers of interaction behaviors are denoted as h1,h2,h3, and their embedding capacities are denoted as c1,c2,c3, respectively. The embedding capacity in [21] is shown by the following equation:(3)c1=h∗N1h1=h∗V∗V−12h1.The paper in [21] proposed a novel method to enable covert communication on social network, which provides a good reference for steganographic methods to social networks.Wu et al. [22] used undirected graphs to hide secret message and directed graphs to hide topology and enhanced the security of the proposed method, abbreviated as NGTASS. For a graph GV,E, where V=v1,v2,…,vn and E=e1,e2,…,en, each bit of the secret message binary string is embedded as an edge of the undirected graph G0V0,E0 and then the message graph G0 is embedded into the directed graph G1V1,E1. The edges in the directed graph G1 correspond to the edges in the undirected graph G0, and the direction is from the high index vertex to the low index vertex. If we ignore the direction pointing, G0 is a subgraph of G1 actually. The premise of this method is that the steganography and extracting processes share a set U containing all vertices in G1. The interaction information of the social network is public, and the receiver can observe the interaction of the sender. When a receiver obtains G0 and G1, the secret message will be extracted. It is worth noting that the method uses V accounts to achieve covert communication, and one of the vertices is used to hide the topological information; in fact, V−1 vertices are used to encode the secret message. N2 is shown in equation (4) and c2 is shown in equation (5).(4)N2=V−1∗V−22,(5)c2=h∗N2h2=h∗V−1∗V−22h2.This method uses undirected graphs to encode secret message and uses additional vertices to hide the topology, which reduces the embedding capacity.Wu et al. [23] based their work on [22] to remap the correspondence between the vertices of the graph structure by a key, abbreviated as SGSIR. This method controls n+2 vertices, which are indexed from v0 to vn+1, and the vertex set consisting of v1 to vn is denoted by V. The edges whose starting and ending points belong to the vertex set V are denoted as the edge set E. The edge set E has m edges, where m is an integer power of 2. For the embedding process, the method selects m edges in E based on a random seed R and assigns an index. Then, the secret message is converted into a binary sequence, and every log2m group is converted into a decimal sequence D=d1,d2,…,dm and is allocated m+1 build operations. Finally, four types of build operations are performed to send the secret message to the social network. For the extracting process, a receiver reconstructs the graph structure and extracts the secret message by using R, V, and public social network. The method controls V vertices to achieve covert communication, but vertices vn and vn+1 are used to denote 0 and 1, respectively, so the method uses V−2 vertices to encode the secret message. N3 is shown in equation (6) and c3 is shown in equation (7).(6)N3=2log2V−2∗V−3/2∗log2V−2∗V−32,(7)c3=h∗N3h3=h∗2log2V−2∗V−3/2∗log2V−2V−3/2h3.This method uses an undirected graph to construct a secret message graph and uses interactive remapping to improve security. Even if the attacker successfully reconstructs the graph structure, he cannot obtain the embedded data. At the same time, each behavior can carry more secret messages. However, it consumes a certain amount of vertices to hide information such as key and topology and uses undirected graphs to realize covert communication, which reduces the embedding capacity of the method.We draw the basic framework of this type of method, as shown in Figure1. The main steps can be briefly described as follows:(i)
Encrypting secret message: encrypt the secret message to be transmitted(ii)
Converting secret message to binary: convert ciphertext information into binary which is easy to send(iii)
Building a secret message graph: the secret data is modulated into a secret message graph(iv)
Releasing the secret message graph to the social networks: the edges in the secret message graph will be interactively generated on the social networks in turn(v)
Extracting secret message: the extracting process of these methods is the reverse process of the embedding processFigure 1
Basic framework of behavioral steganography based on graph theory.Based on the principles of existing methods, it is clear that behavioral steganography methods based on graph theory using undirected graphs to hide secret message have shortcomings. They convey less secret message and have lower embedding capacity. Moreover, they use a single social network to achieve steganographic communication, which requires frequent operations on the social networks. Timestamp is one of the public properties of social networks, and if the secret message is transformed into timestamps distributed over multiple social networks and used to construct directed graphs, it can effectively reduce the number of interactions generated in a single social network and improve the detection resistance and embedding capacity. Therefore, in this paper, we focus on a high-capacity, anomaly-detection-resistant behavioral steganography method using social networks timestamps.The main notations in this paper are shown in Table1. The notations without subscripts have a general description, and the subscripts s and r denote belonging to the sender and receiver, respectively.Table 1
Notation table.
NotationsExplanationAsASCII code of the sender characterdMaximum interaction delayEThe set of edges inGFTime interval sequence of behaviorsGGraphIInteraction index matrixlbNumber of accounts actually controlled by the senderlpThe binary to be sentlrBinary with secret messagelsEmbedding capacity of a single behaviormNumber of edges inGpTime intervalrbEffective bit rateRRandom seedSTimestamp index sequenceSRRandom sequencetcCurrent timestampVThe set of vertices inGBs,BrGrouped binary for sender and receiverDs,DrDecimal sequence of sender and receiverEs,ErInteraction sequence of sender and receivern,NNumber of accounts actually controlledTs,TrSender and receiver timestamp sequenceVs,VrThe set of vertices of the sender and receiver


## 3. Proposed Method

Timestamp is a time representation, also called Unix timestamp, which is defined as the total number of seconds from 00:00:00 GMT on January 01, 1970, to a certain point in time. The proposed method modulates the secret message as timestamps, constructs a directed secret message graph, and releases the edges of the directed secret message graph to social networks in the form of interactive timestamps. In this section, we describe our proposed method through a framework diagram of the method, several key steps, and an example.The basic idea of this method is as follows: firstly, the sender-controlled accounts are used as the set of vertices of the graph, the possible edges between the vertices are traversed, and index numbers are assigned to construct the secret message graph. Then, the edges in the graph are used to construct the interaction index matrix, donated byI, whose elements are called interaction indexes, and the secret message is converted into interaction indexes, and the mapping relationship between interaction indexes and timestamps are constructed. Finally, the secret message is modulated into timestamps by using interaction indexes as an intermediate form, which enables the embedding process of covert communication. The framework of the proposed method is shown in Figure 2; Steps 1–5 belong to the embedding process, and Steps 6–9 belong to the extracting process.Figure 2
Framework of the proposed method.Step 1.
Data preprocessing: using the key, the plaintext is encrypted into ciphertext, and the ciphertext is converted into decimal data suitable for subsequent steps.Step 2.
Generating interaction index matrix: the accounts controlled by the sender are used as the set of vertices of graph, and the possible edges between vertices are traversed. Hash the key, take some of the values as random seed to assign index numbers to the edges in the graph, and build a matrix called interaction index matrix.Step 3.
Generating cross-platform interaction sequence and construct the cross-platform directed interaction graph: the preprocessed data is used to generate a sequence for interaction through an interaction index matrix, which can construct an interaction graph among multiple social networks.Step 4.
Generating cross-platform robust timestamp sequence: this step firstly obtains data about the user’s behaviors on the corresponding social networks, which is used to analyze the interaction patterns. Secondly, the behavior generated by a user at one moment may be recorded at the next moment, which will cause a delay in the timestamp of the behavior, resulting in the receiver not being able to extract the message correctly. This problem can be solved by using a time redundancy control mechanism, for which it is necessary to obtain the maximum time delay over a while. Finally, the mapping relationship between vertices and timestamps is constructed by random seed, and the timestamp sequence of behaviors is generated by combining the interaction sequence, interaction delay, and interaction patterns.Step 5.
Releasing secret message graph: combine directed interaction graphs and timestamp sequence to construct secret message graph and release it to social networks.Step 6.
Regenerating the interaction index matrix: the receiver uses the account set and key to generate the interaction index matrix. The process of generation is the same as Step2.Step 7.
Extracting timestamp sequence: the receiver uses the accounts to obtain user data from the corresponding social networks. The receiver parses the user interaction data in turn to obtain a sequence of timestamps, the elements of which are of the form <sender index,  timestamp>.Step 8.
Reconstructing directed secret message graph: the receiver senses and obtains the maximum interaction delay of these networks over a while and tries to reconstruct the index of interaction participants by the maximum interaction delay and timestamp. Then, parse the <sender index,  timestamp> element into a <sender index,  interaction index> element, and construct a directed secret message graph.Step 9.
Extracting secret message: decimal secret data can be extracted by interaction indexes. Then, the secret message can be obtained through a share key.
In this paper, we use graph theory to describe the interaction behaviors between accounts. For a directed graphG=V,E, G=<V,E>, V=v0,v1,…,vn−1 and E=e0,e1,…,em−1. ∀e∈E, e=<u,v>, which represents an interaction between accounts u and v. u is the account that generates the behaviors, and v is the account that interacts with u. For a directed graph G, with n vertices in V and m edges in E, n vertices can generate at most n2 different interaction behaviors. We use lb to denote the number of binary bits carried by each behavior. For coding purposes, m will be an integer power of 2, and lb=log2m will be an integer. In fact, the following relationship will exist between lb, m, and n in this method (note: “⋅” means rounding down):(8)lb=log2n2.
From equation (8), when n is determined, lb and m are obtained. For example, when n=6, lb=5 and m=32. The main steps of the method are described in detail in the following subsections.


### 3.1. Generating Interaction Index Matrix

Ann -order matrix I is initialized, whose elements are all −1, and, after the hash key, take part of the value as the random seed, and generate m different pseudorandom indexes i in I, where i∈0,m−1. At this time, the n2−m elements of I are still −1. The pseudocode to generate matrix I is shown in Algorithm 1.Algorithm 1: Interaction index matrix generation algorithm.
Input:Vs,ROutput:I(1)
Generate a random sequenceSR of length m from R(2)
n=lenVs //The len function represents the length of the acquired sequence(3)
Initialize ann -order matrix I, whose elements are all −1(4)
fori = 0 to m − 1 do(5)
temp=SRi(6)
row=temp/n(7)
column=temp−row∗n%n(8)
Irow,column=i(9)
end for(10)
returnI


### 3.2. Generating Cross-Platform Interaction Sequence and Construct Cross-Platform Directed Interaction Graph

The binary data obtained by encrypting the plaintext is divided into groups of 8 bits; each group is an element ofAs=a0,a1,…. Then, Ss is divided into lb groups and converted to decimal, denoted as Ds=d0,d1,…. If the number of binaries in the remaining Ss is less than lb, it needs to append 0 until its length is lb. ∀ij,k∈I, j,k are the row index and column index of matrix element i, respectively. By matching the positions of the elements in set Ds in matrix I, the row and column indexes of the elements are obtained, denoted as <vj,vk>, and append them to Es. The generation process of Es is shown in Algorithm 2, which is used to implement the cross-platform interactive sequence assignment. A cross-platform directed interaction graph can be constructed based on Es and Vs.Algorithm 2: Cross-platform interaction sequence allocation algorithm.
Input:Vs,I,DsOutput:Es(1)
l=len(Ds)(2)
fori=0 to l−1do(3)
temp=Dsi(4)
Get the row and column of temp in matrixI, and assign them to j and k respectively(5)
Es.append (vj,vk)(6)
end for(7)
returnEsAccounts on different social networks cannot interact with each other directly; for example, an account on Twitter cannot comment on a Facebook post. To enable the relationship between accounts on social networks, we assign timestamp indexes to accounts, denoted asSs = s0,s1,…,sn−1 = 0,1,…,n−1. A timestamp-timestamp index mapping is constructed. For a given timestamp t, there is a unique timestamp index corresponding to it. For example, for accounts va, vb, and vc, va and vb are two accounts on Facebook and vc is an account on Twitter; va commented on a post of vb at timestamp t. If the mapping value of t is c, it means that when timestamp is t, va established a relationship with vb, which is called logical interaction. va interacted with vb for real, which is called actual interaction. The logical and actual interactions are referred to as interactions. The graph formed by the logical interaction and its vertices is called the logical interaction graph. The graph formed by the actual interaction and its vertices is called the actual interaction graph, which is shown in Figure 2.


### 3.3. Generating Cross-Platform Robust Timestamp Sequence

User behavior data can be obtained from the corresponding social networks by accounts, and the time intervalp of the interaction behaviors of the regular user is extracted. The frequency of the interaction interval within p is statistically distributed in minutes, and the time interval sequence F to be interacted is obtained by p. F is a two-dimensional array, the dimension represents the corresponding social networks, and the second dimension stores the timestamps of specific social network interaction behaviors. Before sending a secret message, the interaction delay of the currently used social network is constantly sensed and the maximum interaction delay d corresponds to the number of redundancies in the redundancy mapping over time.Get the current time and convert it to the timestamp formtc. The mapping between Vs and timestamp can be constructed by R to obtain the timestamp index. The timestamp of the interaction behavior is used to specify the time when the behavior was generated, and its sequence is denoted by Ts. Ts is generated by Algorithm 3, which has an initial value of tc.Algorithm 3: Cross-platform robust timestamp sequence generation algorithm.
Input:Vs,Es,tc,d,S,F,pOutput:Ts(1)
l=lenEs(2)
n=lenVs(3)
forj=0 to p−1do(4)
fori=0 to l−1do(5)
e=Esi(6)
receiver_index=evj] //Get the receiving account of the interaction sequence(7)
tsi=Sreceiver_index(8)
repeat(9)
tc=tc+Fji(10)
ifi==1 and tc/d%n==tsithen(11)
Ts.append(tc)(12)
if else { tc/d+1%n==tsi and Tsi]>Tsi+1 }(13)
Tsappend(tc)(14)
else(15)
tc=tc+1(16)
end if(17)
untili==l−1(18)
Es append <vj,vk> //The append function means append the current element to the sequence Es(19)
end for(20)
end for(21)
returnTsAlgorithm3 uses the method of adding redundant mapping to increase the robustness of this method. ∀t∈Ts, the algorithm executes the preset interactive behavior at t; then the secret timestamp can be posted to the social networks. Combined with the generated timestamp sequence and the posts crawled in Step 4, release the secret message graph to the social network at the corresponding timestamp.


### 3.4. Reconstruction of the Directed Secret Message Graph

Initialize an empty interaction sequence, and, from the timestamps that have been arranged in ascending order in Step9, the timestamp index s can be calculated according to the following equation:(9)s=td+1%n.For any interaction element<vj,vk>, j is the index of the behavioral initiator in Vr, and k is the index of s in S. Get the interaction element <vj,vk> from j, k and append it to Er. Similarly, the elements in Tr are executed in sequence to obtain the interaction sequence Er, which reconstructs the secret message graph. Combining the subscripts of the sending and receiving account numbers of the elements of Er, the decimal information carried by this sequence can be determined from I in Step 6. For any interaction element <vj,vk>, the decimal data value transmitted can be determined from the following equation:(10)value=Ij,k.Using equation (10), the elements of sequence Er are executed sequentially, and the obtained values are appended to the initially empty Dr sequence in turn. Then, Dr is converted into binary Br and spliced into Sr. Finally, the secret message transmitted can be extracted.(11)I=20316113023−11618129−114−121−126024272712852817101542291332519.


### 3.5. Example

To make the proposed method easier to understand, this section gives an example to briefly describe the process of sending, using plaintext to deliver the secret message. The secret message sent is “hello”;Vs=v0,v1,⋯,v5; the key is “secret”; d=2; tc=1614704185. Thus, we can get n=|Vs|=6; then lb=5, m=32, and S=s0,s1,…,s5=0,1,…,5. When sending a secret message, the secret message is firstly converted to binary, divided into a group of every lb bits, and then converted to decimal, and the conversion process is shown in Table 2. Then, generate a random sequence SR of length m, assuming that at this time SR = [17, 9, 20, 33, 29, 24, 2, 21, 23, 31, 27, 3, 22, 32, 12, 28, 7, 26, 8, 35, 0, 14, 30, 5, 18, 34, 16, 19, 25, 10, 4, 1], through the parameters of Algorithm 1, using Algorithm 1 to obtain I, as shown in equation (11). For example, the value of index 0, element 17 in SR, calculated by Algorithm 1, is row=2 and column=5, so the element in row 2 and column 5 of I is 0.Table 2
Process of converting plaintext to decimal.
Secret messagehelloAs0110100001100101011011000110110001101111Ss0110100001100101011011000110110001101111Bs0110100001100101011011000110110001101111Ds13118222427315Then, through equation (11) and Algorithm2, the interaction sequence Es is generated. For example, the element with index 0 in sequence Ds is 13, and its row=5 and column=2 in equation (11). Therefore, <v5,v2> can be generated, which is shown in Table 3, and the constructed directed interaction diagram is shown in Figure 3(a).Table 3
Interaction diagram and timestamp sequence generation process.
Ds13118222427315Er<v5,v2><v1,v3><v1,v2><v5,v0><v3,v0><v3,v1><v5,v3><v4,v4>Ts16147041901614704193161470420816147042201614704238161470424116147042471614704250SNFacebookTwitterTwitterFacebookMicroBlogMicroBlogFacebookTwitterFigure 3
Logical interaction graph. (a) Logical interaction graph without timestamps. (b) Logical interaction graph with timestamps.
(a)(b)Next, the timestamp sequenceTs is generated by Algorithm 3. Here, take e0=<v5,v2> as an example, and briefly describe its generation process. <v5,v2> means that v5 needs to interact with v2, and the subscript value 2 of v2 is obtained by equation (9). The index of the timestamp corresponding to 1614704190 is 2. Therefore, v5 performs a certain interaction behavior at timestamp 1614704190, which means that <v5,v2> has a virtual interaction. The rest of the elements are calculated in the same way as shown in Table 3. The secret message graph is constructed based on Es and Vs, as shown in Figure 3(b). Finally, by combining Ts and the post message, the secret message graph is released to multiple social networks at the corresponding timestamps.The actual interaction graph generated by sending “hello” is shown in Figure4. The red timestamp in the figure indicates that the interactive behavior is delayed, the green timestamp indicates normal sending, and the orange social network icon indicates that it is not under the control of the sender account. According to Figure 4, we can extract the timestamp and other messages. The extracting process is the inverse of the embedding process and will not be repeated here.Figure 4
Actual interaction graph. (a) Mixed graph of logical and actual interactions. (b) Actual interactions graph.
(a)(b)


## 3.1. Generating Interaction Index Matrix

Ann -order matrix I is initialized, whose elements are all −1, and, after the hash key, take part of the value as the random seed, and generate m different pseudorandom indexes i in I, where i∈0,m−1. At this time, the n2−m elements of I are still −1. The pseudocode to generate matrix I is shown in Algorithm 1.Algorithm 1: Interaction index matrix generation algorithm.
Input:Vs,ROutput:I(1)
Generate a random sequenceSR of length m from R(2)
n=lenVs //The len function represents the length of the acquired sequence(3)
Initialize ann -order matrix I, whose elements are all −1(4)
fori = 0 to m − 1 do(5)
temp=SRi(6)
row=temp/n(7)
column=temp−row∗n%n(8)
Irow,column=i(9)
end for(10)
returnI


## 3.2. Generating Cross-Platform Interaction Sequence and Construct Cross-Platform Directed Interaction Graph

The binary data obtained by encrypting the plaintext is divided into groups of 8 bits; each group is an element ofAs=a0,a1,…. Then, Ss is divided into lb groups and converted to decimal, denoted as Ds=d0,d1,…. If the number of binaries in the remaining Ss is less than lb, it needs to append 0 until its length is lb. ∀ij,k∈I, j,k are the row index and column index of matrix element i, respectively. By matching the positions of the elements in set Ds in matrix I, the row and column indexes of the elements are obtained, denoted as <vj,vk>, and append them to Es. The generation process of Es is shown in Algorithm 2, which is used to implement the cross-platform interactive sequence assignment. A cross-platform directed interaction graph can be constructed based on Es and Vs.Algorithm 2: Cross-platform interaction sequence allocation algorithm.
Input:Vs,I,DsOutput:Es(1)
l=len(Ds)(2)
fori=0 to l−1do(3)
temp=Dsi(4)
Get the row and column of temp in matrixI, and assign them to j and k respectively(5)
Es.append (vj,vk)(6)
end for(7)
returnEsAccounts on different social networks cannot interact with each other directly; for example, an account on Twitter cannot comment on a Facebook post. To enable the relationship between accounts on social networks, we assign timestamp indexes to accounts, denoted asSs = s0,s1,…,sn−1 = 0,1,…,n−1. A timestamp-timestamp index mapping is constructed. For a given timestamp t, there is a unique timestamp index corresponding to it. For example, for accounts va, vb, and vc, va and vb are two accounts on Facebook and vc is an account on Twitter; va commented on a post of vb at timestamp t. If the mapping value of t is c, it means that when timestamp is t, va established a relationship with vb, which is called logical interaction. va interacted with vb for real, which is called actual interaction. The logical and actual interactions are referred to as interactions. The graph formed by the logical interaction and its vertices is called the logical interaction graph. The graph formed by the actual interaction and its vertices is called the actual interaction graph, which is shown in Figure 2.


## 3.3. Generating Cross-Platform Robust Timestamp Sequence

User behavior data can be obtained from the corresponding social networks by accounts, and the time intervalp of the interaction behaviors of the regular user is extracted. The frequency of the interaction interval within p is statistically distributed in minutes, and the time interval sequence F to be interacted is obtained by p. F is a two-dimensional array, the dimension represents the corresponding social networks, and the second dimension stores the timestamps of specific social network interaction behaviors. Before sending a secret message, the interaction delay of the currently used social network is constantly sensed and the maximum interaction delay d corresponds to the number of redundancies in the redundancy mapping over time.Get the current time and convert it to the timestamp formtc. The mapping between Vs and timestamp can be constructed by R to obtain the timestamp index. The timestamp of the interaction behavior is used to specify the time when the behavior was generated, and its sequence is denoted by Ts. Ts is generated by Algorithm 3, which has an initial value of tc.Algorithm 3: Cross-platform robust timestamp sequence generation algorithm.
Input:Vs,Es,tc,d,S,F,pOutput:Ts(1)
l=lenEs(2)
n=lenVs(3)
forj=0 to p−1do(4)
fori=0 to l−1do(5)
e=Esi(6)
receiver_index=evj] //Get the receiving account of the interaction sequence(7)
tsi=Sreceiver_index(8)
repeat(9)
tc=tc+Fji(10)
ifi==1 and tc/d%n==tsithen(11)
Ts.append(tc)(12)
if else { tc/d+1%n==tsi and Tsi]>Tsi+1 }(13)
Tsappend(tc)(14)
else(15)
tc=tc+1(16)
end if(17)
untili==l−1(18)
Es append <vj,vk> //The append function means append the current element to the sequence Es(19)
end for(20)
end for(21)
returnTsAlgorithm3 uses the method of adding redundant mapping to increase the robustness of this method. ∀t∈Ts, the algorithm executes the preset interactive behavior at t; then the secret timestamp can be posted to the social networks. Combined with the generated timestamp sequence and the posts crawled in Step 4, release the secret message graph to the social network at the corresponding timestamp.


## 3.4. Reconstruction of the Directed Secret Message Graph

Initialize an empty interaction sequence, and, from the timestamps that have been arranged in ascending order in Step9, the timestamp index s can be calculated according to the following equation:(9)s=td+1%n.For any interaction element<vj,vk>, j is the index of the behavioral initiator in Vr, and k is the index of s in S. Get the interaction element <vj,vk> from j, k and append it to Er. Similarly, the elements in Tr are executed in sequence to obtain the interaction sequence Er, which reconstructs the secret message graph. Combining the subscripts of the sending and receiving account numbers of the elements of Er, the decimal information carried by this sequence can be determined from I in Step 6. For any interaction element <vj,vk>, the decimal data value transmitted can be determined from the following equation:(10)value=Ij,k.Using equation (10), the elements of sequence Er are executed sequentially, and the obtained values are appended to the initially empty Dr sequence in turn. Then, Dr is converted into binary Br and spliced into Sr. Finally, the secret message transmitted can be extracted.(11)I=20316113023−11618129−114−121−126024272712852817101542291332519.


## 3.5. Example

To make the proposed method easier to understand, this section gives an example to briefly describe the process of sending, using plaintext to deliver the secret message. The secret message sent is “hello”;Vs=v0,v1,⋯,v5; the key is “secret”; d=2; tc=1614704185. Thus, we can get n=|Vs|=6; then lb=5, m=32, and S=s0,s1,…,s5=0,1,…,5. When sending a secret message, the secret message is firstly converted to binary, divided into a group of every lb bits, and then converted to decimal, and the conversion process is shown in Table 2. Then, generate a random sequence SR of length m, assuming that at this time SR = [17, 9, 20, 33, 29, 24, 2, 21, 23, 31, 27, 3, 22, 32, 12, 28, 7, 26, 8, 35, 0, 14, 30, 5, 18, 34, 16, 19, 25, 10, 4, 1], through the parameters of Algorithm 1, using Algorithm 1 to obtain I, as shown in equation (11). For example, the value of index 0, element 17 in SR, calculated by Algorithm 1, is row=2 and column=5, so the element in row 2 and column 5 of I is 0.Table 2
Process of converting plaintext to decimal.
Secret messagehelloAs0110100001100101011011000110110001101111Ss0110100001100101011011000110110001101111Bs0110100001100101011011000110110001101111Ds13118222427315Then, through equation (11) and Algorithm2, the interaction sequence Es is generated. For example, the element with index 0 in sequence Ds is 13, and its row=5 and column=2 in equation (11). Therefore, <v5,v2> can be generated, which is shown in Table 3, and the constructed directed interaction diagram is shown in Figure 3(a).Table 3
Interaction diagram and timestamp sequence generation process.
Ds13118222427315Er<v5,v2><v1,v3><v1,v2><v5,v0><v3,v0><v3,v1><v5,v3><v4,v4>Ts16147041901614704193161470420816147042201614704238161470424116147042471614704250SNFacebookTwitterTwitterFacebookMicroBlogMicroBlogFacebookTwitterFigure 3
Logical interaction graph. (a) Logical interaction graph without timestamps. (b) Logical interaction graph with timestamps.
(a)(b)Next, the timestamp sequenceTs is generated by Algorithm 3. Here, take e0=<v5,v2> as an example, and briefly describe its generation process. <v5,v2> means that v5 needs to interact with v2, and the subscript value 2 of v2 is obtained by equation (9). The index of the timestamp corresponding to 1614704190 is 2. Therefore, v5 performs a certain interaction behavior at timestamp 1614704190, which means that <v5,v2> has a virtual interaction. The rest of the elements are calculated in the same way as shown in Table 3. The secret message graph is constructed based on Es and Vs, as shown in Figure 3(b). Finally, by combining Ts and the post message, the secret message graph is released to multiple social networks at the corresponding timestamps.The actual interaction graph generated by sending “hello” is shown in Figure4. The red timestamp in the figure indicates that the interactive behavior is delayed, the green timestamp indicates normal sending, and the orange social network icon indicates that it is not under the control of the sender account. According to Figure 4, we can extract the timestamp and other messages. The extracting process is the inverse of the embedding process and will not be repeated here.Figure 4
Actual interaction graph. (a) Mixed graph of logical and actual interactions. (b) Actual interactions graph.
(a)(b)


## 4. Experiments and Evaluation

To evaluate the performance of the proposed method, we implemented the methods in [21–23] and implemented the method proposed in this paper using Python.


### 4.1. Experimental Settings

The experiment usesGone with the Wind as the secret message, “world” as the key, and 6 accounts on 3 platforms as the sending account. Therefore, n=V=6, and then lb=5 and m=32. To determine the maximum interaction delay, we measured the time delay of Facebook, Twitter, and Weibo within 2 hours before the experiment. The specific method is as follows: use an automated tool to automatically perform a certain behavior at the expected timestamp. Then the time data that have been extracted on social networks can be converted to a timestamp form. The corresponding results are shown in Figure 5. Through observation, we have conducted more than 200 interactions within 2 hours, and the maximum interaction delay is d=4. In addition, Figure 6(a) shown by the interaction patterns of regular users on social networks can determine p=0,16.Figure 5
Interaction delay over a period of time.Figure 6
Interaction patterns. (a) Interaction patterns of ordinary users. (b) Interaction patterns of the proposed method.
(a)(b)


### 4.2. Comparative Experiments and Evaluation Related to Embedding Capacity

There are 4 groups of experiments in this subsection. The first group of experiments provided data support for the three following groups of experiments.


#### 4.2.1. Comparative Experiments and Evaluation on the Average Number of Bits Carried by a Single Behavior

Whenn and the secret message are determined, the length of secret message required in [21–23] is determined. Starting from the first character of Gone with the Wind, we select the character length of the secret message required for the 4 methods. The number of bits carried by a single behavior obtained by delivering a secret message once has large randomness. To ensure that the average number of bits carried by a single behavior is representative, the average number of bits carried by a single behavior is calculated by sending the secret message 500 and 1000 times, respectively, and is denoted as ls. According to the definition of embedding capacity in Section 2, ls represents the embedding capacity of a single behavior. If the difference in the number of sendings is large and there is no significant difference in ls, it means that ls has stabilized and is representative.Figures7(a) and 7(b) show ls calculated when n∈7,16 and the secret message is sent 500 times. It shows that ls of our method is higher in comparison to other methods. Besides, ls is stable when sending 500 and 1000 secret messages, respectively. Therefore, ls is representative when sending 1000 secret messages. The following experiments will be based on this data.Figure 7
Comparison experiment of the average number of bits carried by a single behavior. (a) The average number of bits carried by a single behavior whenn∈7,16 and 500 messages are sent. (b) The average number of bits carried by a single behavior when n∈7,16 and 1000 messages are sent. (c) The average number of bits carried by a single behavior when n∈7,50 and 500 messages are sent. (d) The average number of bits carried by a single behavior when n∈7,50 and 1000 messages are sent.
(a)(b)(c)(d)To observe the trend ofls under larger n, we did a group of experiments at n∈7,50, which are shown in Figures 7(c) and 7(d). Figures 7(c) and 7(d) show that our method is still higher than other compared methods in the larger n range. As n increases, the superiority of the proposed method becomes more prominent.


#### 4.2.2. Comparative Experiments and Evaluation on Embedding Capacity

Figure8(a) shows the embedding capacity under different n when the number of behaviors is 10, and Figure 8(b) shows the embedding capacity trend of n in a larger range. Although they have the same trend as Figure 7, they have different meanings. For example, when n=35, the embedding capacity of our method is 100 bits.Figure 8
The embedded capacity in 10 interaction behaviors. (a) The embedding capacity ofn∈7,16. (b) The embedding capacity of n∈7,50.
(a)(b)Table4 shows the embedding capacity of the four methods when the number of behaviors is 10, and n is 10, 15, 20, 25, 30, 35, 40, 45, and 50, respectively. Compared with other methods, our method improves the embedding capacity. Table 4 shows that when n is 10, 15, 20, 25, 30, 35, 40, 45, and 50, as n increases, the embedding capacity shows an upward trend. When n is 20, the rate of the embedding capacity between our method and the compared method has a minimum of 1.98. When n is 50, the rate of embedding capacity between this method and the compared method has a maximum of 4.89. When n is the else value, the rate of the embedding capacity between our method and the compared method is between 1.98 and 4.89. Therefore, the experimental results show that the embedding capacity in our paper is significantly higher in comparison to the other methods. When n∈10,50 and the step size is 5, it increases by 1.98 to 4.89 times.Table 4
Comparison data of embedding capacity (bit).
n101520253035404550MethodMethod in [21]22.7122.4722.5322.5822.5622.5622.5322.522.49Method in [22]22.6622.5722.4922.5922.5522.5522.5522.522.49Method in [23]22.1734.0340.3740.3741.9349.3549.3549.3546.85Proposed method6070809090100100100110Minimum multiple of boost2.642.061.982.232.142.022.022.032.34Maximum multiple of improvement2.73.123.563.993.994.434.444.444.89


#### 4.2.3. Comparative Experiments and Evaluation on the Number of Behaviors

Suppose that the sender intends to sendlp binary bits, and the steganography method can send lr binary bits each time. If lp <lr, the lp binary sent is called the valid sent bits, and the remaining lr−lp binary bits are invalid sent bits.For the methods proposed in [21–23] and our method, when lp bits are sent and lp is not an integer multiple of lb, lr=lb−lp%lb bits. The number of bits lp sent by the sender may not be equal to lr. In these four methods, 7 social accounts are controlled and 8-bit information needs to be sent. Our method [21–23] needs to be appended with 2, 7, 13, and 17 invalid bits, respectively, to convey the secret message. From this, the effective bit rate rb=lp/lr can be calculated as 0.8, 0.53, 0.38, and 0.33 for sending effective bits, respectively.Figure9 shows the number of behaviors generated by sending the same effective number of bits when n is 7. It shows that our method sends the same effective number of bits, and the number of behaviors generated is significantly lower compared to the other three methods. When using a suitable time interval to perform interactive behaviors, our method will consume less time. Figure 9(b) shows that as the number of effective bits sent increases, the number of behaviors of our method is still gradually increasing, which is smaller than the compared method. Compared with the other three methods, our method generates fewer behaviors when sending the same effective number of bits, and the effective bit rate is higher. At the same time, Figure 9 shows that our method is more flexible in sending message.Figure 9
The number of behaviors generated under transmission of different effective bits. (a) The number of behaviors generated by the number of effective bits of [5, 16] whenn = 7. (b) The number of behaviors generated by the number of effective bits of [5, 50] when n = 7.
(a)(b)


#### 4.2.4. Comparative Experiments and Evaluation on Embedding Rate

The embedding rate in this paper refers to the number of bits that each account can carry; that is, embeddingrate=c/n. The embedding capacity in this subsection is calculated when the number of behaviors is 10, and the embedding rate is shown in Figure 10. In Figure 10(a), the number of n ranges from 7 to 16. The embedding rate of our method is much higher compared to the other methods. In Figure 10(b), as n increases, the embedding rate generally shows a downward trend, but the embedding rate of our method is higher compared to the other methods.Figure 10
Embedding rate when the number of behaviors is 10. (a) Embedding rate when the number of behaviors is 10,n∈7,16. (b) Embedding rate when the number of behaviors is 10, n∈7,50.
(a)(b)This subsection conducts a comparative experiment of the average number of bits carried by a single behavior and conducts an experiment of embedding capacity on the basis of the average number of bits carried by a single behavior. The experimental results show that our method carries out an average number of bits and a large number of bits carried by a single behavior. The embedding capacity of each behavior has better performance. In addition, this subsection also conducts a comparative experiment on the number of behaviors and the embedding rate generated by the transmission of the effective number of bits. The experimental results show that when sending a certain length of effective bit, this method will generate fewer behaviors. Meanwhile, this method has a higher embedding rate for each account that sends secret message; that is, each account can carry more information.


### 4.3. Experiments and Evaluation on Detection Resistance

References [7, 16, 18] collect and fit the user’s behavior frequency to avoid anomalies caused by the sender’s behaviors. For this reason, we take the same method to ensure resistance to detection. Firstly, we crawled more than 160,000 posts from 94 bloggers in the “entertainment” section of public social networks and calculated the time interval between two adjacent posts or retweeted by the same blogger. Then, we merged the time interval data of all bloggers and sorted them and removed the top 10% and bottom 10% data to plot Figure 6(a). The time interval between retweets or posts on social networks is consistent with the frequency of interactions, and anomalous behavior can be avoided if the time interval between interactions on social networks is consistent with this pattern.This experiment selects the first paragraph of text fromGone with the Wind as a secret message to send. Figure 6(a) shows the patterns of the interaction behaviors of ordinary users on social networks, and Figure 6(b) shows the patterns of the interactive behavior generated by our method. Based on Figure 5 of Section 4.1, d=4 is the interaction time delay. As shown in Figure 6(b), the difference of the timestamps of the interaction behaviors during the secret message transmission is plotted as a frequency, and the time interval for generating the interaction behaviors is 0,16. The trend in Figure 6(b) is generally consistent with Figure 6(a) and the interval is also consistent, which indicates that the interaction behaviors generated by our method are consistent with the interaction behaviors of social network users. Therefore, our method can resist the analysis and detection of attackers in terms of behavioral anomalies.


### 4.4. Experiments and Evaluation on Robustness

Robustness is a measure of the stability of a method. When the carrier data passes through a lossy channel, the channel or the attacker may destroy the carrier data. The execution time of the behavior may be influenced by various factors, for which we need to verify the robustness of the method. In this paper, we ensure the robustness of the proposed method by sensing the interaction delay and using redundancy control mechanism. This method allows the receiver to extract the secret message correctly even if there is an interaction delay when the sender delivers the secret message. To verify the robustness of our method, we have done the following experiments.FromGone with the Wind, part of the data is selected and sent 100 times as secret messages, and the maximum interaction delay d=4 can be seen from Figure 5 in Section 4.1. A total of 24,800 behaviors are generated during the sending process, and the interaction delays of the first 2,000 behaviors are selected and plotted in Figure 11(a). Figure 11(b) shows the relationship between the cumulative number of secret messages sent and the cumulative number of successful extractions.Figure 11
Robustness performance of the proposed method. (a) Interaction delay of the proposed method. (b) Extraction effect of the proposed method.
(a)(b)Figure11(a) shows that the interaction delay during the sending process does not exceed 4 seconds. From Figure 11(a), it can be observed that when d=4, the secret message sent is always extracted correctly. This implies that the interaction delay is less than 4 seconds during the period when the secret message is sent. Otherwise, it is difficult for all secret messages to be extracted correctly. It also indicates that the redundancy number of redundant mappings can resist the effect of interaction delay on the correct extraction of secret messages. Figures 11(a) and 11(b) show that our method can resist the effect of interaction delay, which shows our method is robust.


### 4.5. Experiments and Evaluation on Time Consumption

To avoid behavioral anomalies, the behavioral frequency of some users needs to be fitted when sending secret messages, which requires a certain time sacrifice. In addition, the interaction delay can also have an impact on the consumed time. To examine the impact of different interaction delays on time consumption when sending secret messages of a certain length, we designed a set of experiments. The experiments consider the effect of interaction delay and the number of accounts on the time consumed. Firstly, 100 sentences fromGone with the Wind were selected as secret messages and the time consumed was counted. Then, it was divided into 3 groups and the average time was calculated. Finally, the consumed time is converted uniformly to the time consumed when sending 100 bits, and the statistics are shown in Table 5.Table 5
Average time consumed to send 100 bits of data with different behavioral delay(s).
n=7n=11n=15Delay1st group2nd group3rd group1st group2nd group3rd group1st group2nd group3rd groupd=2547.08561.07584.10323.15341.53359.12242.97262.33286.41d=3554.20569.94587.16331.38348.69364.47247.34265.33284.78d=4562.41578.54597.31340.98360.38377.56255.19274.77290.72Whend=2 and n=7, it consumed 547.08 seconds on average after the first group of messages. When d=2 and n=11, it consumed 323.15 seconds on average after the first group of messages. When d=3 and n=7, it consumed 554.20 seconds on average after the first group of messages. Table 5 shows that the time consumed increases as the delay increases and decreases as the number of accounts increases. The reason for the above situation is that as the delay increases, the number of redundant mappings goes up and takes up more time. When the number of accounts increases, the number of simultaneously generated behaviors also increases, which will consume less time.


## 4.1. Experimental Settings

The experiment usesGone with the Wind as the secret message, “world” as the key, and 6 accounts on 3 platforms as the sending account. Therefore, n=V=6, and then lb=5 and m=32. To determine the maximum interaction delay, we measured the time delay of Facebook, Twitter, and Weibo within 2 hours before the experiment. The specific method is as follows: use an automated tool to automatically perform a certain behavior at the expected timestamp. Then the time data that have been extracted on social networks can be converted to a timestamp form. The corresponding results are shown in Figure 5. Through observation, we have conducted more than 200 interactions within 2 hours, and the maximum interaction delay is d=4. In addition, Figure 6(a) shown by the interaction patterns of regular users on social networks can determine p=0,16.Figure 5
Interaction delay over a period of time.Figure 6
Interaction patterns. (a) Interaction patterns of ordinary users. (b) Interaction patterns of the proposed method.
(a)(b)


## 4.2. Comparative Experiments and Evaluation Related to Embedding Capacity

There are 4 groups of experiments in this subsection. The first group of experiments provided data support for the three following groups of experiments.


### 4.2.1. Comparative Experiments and Evaluation on the Average Number of Bits Carried by a Single Behavior

Whenn and the secret message are determined, the length of secret message required in [21–23] is determined. Starting from the first character of Gone with the Wind, we select the character length of the secret message required for the 4 methods. The number of bits carried by a single behavior obtained by delivering a secret message once has large randomness. To ensure that the average number of bits carried by a single behavior is representative, the average number of bits carried by a single behavior is calculated by sending the secret message 500 and 1000 times, respectively, and is denoted as ls. According to the definition of embedding capacity in Section 2, ls represents the embedding capacity of a single behavior. If the difference in the number of sendings is large and there is no significant difference in ls, it means that ls has stabilized and is representative.Figures7(a) and 7(b) show ls calculated when n∈7,16 and the secret message is sent 500 times. It shows that ls of our method is higher in comparison to other methods. Besides, ls is stable when sending 500 and 1000 secret messages, respectively. Therefore, ls is representative when sending 1000 secret messages. The following experiments will be based on this data.Figure 7
Comparison experiment of the average number of bits carried by a single behavior. (a) The average number of bits carried by a single behavior whenn∈7,16 and 500 messages are sent. (b) The average number of bits carried by a single behavior when n∈7,16 and 1000 messages are sent. (c) The average number of bits carried by a single behavior when n∈7,50 and 500 messages are sent. (d) The average number of bits carried by a single behavior when n∈7,50 and 1000 messages are sent.
(a)(b)(c)(d)To observe the trend ofls under larger n, we did a group of experiments at n∈7,50, which are shown in Figures 7(c) and 7(d). Figures 7(c) and 7(d) show that our method is still higher than other compared methods in the larger n range. As n increases, the superiority of the proposed method becomes more prominent.


### 4.2.2. Comparative Experiments and Evaluation on Embedding Capacity

Figure8(a) shows the embedding capacity under different n when the number of behaviors is 10, and Figure 8(b) shows the embedding capacity trend of n in a larger range. Although they have the same trend as Figure 7, they have different meanings. For example, when n=35, the embedding capacity of our method is 100 bits.Figure 8
The embedded capacity in 10 interaction behaviors. (a) The embedding capacity ofn∈7,16. (b) The embedding capacity of n∈7,50.
(a)(b)Table4 shows the embedding capacity of the four methods when the number of behaviors is 10, and n is 10, 15, 20, 25, 30, 35, 40, 45, and 50, respectively. Compared with other methods, our method improves the embedding capacity. Table 4 shows that when n is 10, 15, 20, 25, 30, 35, 40, 45, and 50, as n increases, the embedding capacity shows an upward trend. When n is 20, the rate of the embedding capacity between our method and the compared method has a minimum of 1.98. When n is 50, the rate of embedding capacity between this method and the compared method has a maximum of 4.89. When n is the else value, the rate of the embedding capacity between our method and the compared method is between 1.98 and 4.89. Therefore, the experimental results show that the embedding capacity in our paper is significantly higher in comparison to the other methods. When n∈10,50 and the step size is 5, it increases by 1.98 to 4.89 times.Table 4
Comparison data of embedding capacity (bit).
n101520253035404550MethodMethod in [21]22.7122.4722.5322.5822.5622.5622.5322.522.49Method in [22]22.6622.5722.4922.5922.5522.5522.5522.522.49Method in [23]22.1734.0340.3740.3741.9349.3549.3549.3546.85Proposed method6070809090100100100110Minimum multiple of boost2.642.061.982.232.142.022.022.032.34Maximum multiple of improvement2.73.123.563.993.994.434.444.444.89


### 4.2.3. Comparative Experiments and Evaluation on the Number of Behaviors

Suppose that the sender intends to sendlp binary bits, and the steganography method can send lr binary bits each time. If lp <lr, the lp binary sent is called the valid sent bits, and the remaining lr−lp binary bits are invalid sent bits.For the methods proposed in [21–23] and our method, when lp bits are sent and lp is not an integer multiple of lb, lr=lb−lp%lb bits. The number of bits lp sent by the sender may not be equal to lr. In these four methods, 7 social accounts are controlled and 8-bit information needs to be sent. Our method [21–23] needs to be appended with 2, 7, 13, and 17 invalid bits, respectively, to convey the secret message. From this, the effective bit rate rb=lp/lr can be calculated as 0.8, 0.53, 0.38, and 0.33 for sending effective bits, respectively.Figure9 shows the number of behaviors generated by sending the same effective number of bits when n is 7. It shows that our method sends the same effective number of bits, and the number of behaviors generated is significantly lower compared to the other three methods. When using a suitable time interval to perform interactive behaviors, our method will consume less time. Figure 9(b) shows that as the number of effective bits sent increases, the number of behaviors of our method is still gradually increasing, which is smaller than the compared method. Compared with the other three methods, our method generates fewer behaviors when sending the same effective number of bits, and the effective bit rate is higher. At the same time, Figure 9 shows that our method is more flexible in sending message.Figure 9
The number of behaviors generated under transmission of different effective bits. (a) The number of behaviors generated by the number of effective bits of [5, 16] whenn = 7. (b) The number of behaviors generated by the number of effective bits of [5, 50] when n = 7.
(a)(b)


### 4.2.4. Comparative Experiments and Evaluation on Embedding Rate

The embedding rate in this paper refers to the number of bits that each account can carry; that is, embeddingrate=c/n. The embedding capacity in this subsection is calculated when the number of behaviors is 10, and the embedding rate is shown in Figure 10. In Figure 10(a), the number of n ranges from 7 to 16. The embedding rate of our method is much higher compared to the other methods. In Figure 10(b), as n increases, the embedding rate generally shows a downward trend, but the embedding rate of our method is higher compared to the other methods.Figure 10
Embedding rate when the number of behaviors is 10. (a) Embedding rate when the number of behaviors is 10,n∈7,16. (b) Embedding rate when the number of behaviors is 10, n∈7,50.
(a)(b)This subsection conducts a comparative experiment of the average number of bits carried by a single behavior and conducts an experiment of embedding capacity on the basis of the average number of bits carried by a single behavior. The experimental results show that our method carries out an average number of bits and a large number of bits carried by a single behavior. The embedding capacity of each behavior has better performance. In addition, this subsection also conducts a comparative experiment on the number of behaviors and the embedding rate generated by the transmission of the effective number of bits. The experimental results show that when sending a certain length of effective bit, this method will generate fewer behaviors. Meanwhile, this method has a higher embedding rate for each account that sends secret message; that is, each account can carry more information.


## 4.2.1. Comparative Experiments and Evaluation on the Average Number of Bits Carried by a Single Behavior

Whenn and the secret message are determined, the length of secret message required in [21–23] is determined. Starting from the first character of Gone with the Wind, we select the character length of the secret message required for the 4 methods. The number of bits carried by a single behavior obtained by delivering a secret message once has large randomness. To ensure that the average number of bits carried by a single behavior is representative, the average number of bits carried by a single behavior is calculated by sending the secret message 500 and 1000 times, respectively, and is denoted as ls. According to the definition of embedding capacity in Section 2, ls represents the embedding capacity of a single behavior. If the difference in the number of sendings is large and there is no significant difference in ls, it means that ls has stabilized and is representative.Figures7(a) and 7(b) show ls calculated when n∈7,16 and the secret message is sent 500 times. It shows that ls of our method is higher in comparison to other methods. Besides, ls is stable when sending 500 and 1000 secret messages, respectively. Therefore, ls is representative when sending 1000 secret messages. The following experiments will be based on this data.Figure 7
Comparison experiment of the average number of bits carried by a single behavior. (a) The average number of bits carried by a single behavior whenn∈7,16 and 500 messages are sent. (b) The average number of bits carried by a single behavior when n∈7,16 and 1000 messages are sent. (c) The average number of bits carried by a single behavior when n∈7,50 and 500 messages are sent. (d) The average number of bits carried by a single behavior when n∈7,50 and 1000 messages are sent.
(a)(b)(c)(d)To observe the trend ofls under larger n, we did a group of experiments at n∈7,50, which are shown in Figures 7(c) and 7(d). Figures 7(c) and 7(d) show that our method is still higher than other compared methods in the larger n range. As n increases, the superiority of the proposed method becomes more prominent.


## 4.2.2. Comparative Experiments and Evaluation on Embedding Capacity

Figure8(a) shows the embedding capacity under different n when the number of behaviors is 10, and Figure 8(b) shows the embedding capacity trend of n in a larger range. Although they have the same trend as Figure 7, they have different meanings. For example, when n=35, the embedding capacity of our method is 100 bits.Figure 8
The embedded capacity in 10 interaction behaviors. (a) The embedding capacity ofn∈7,16. (b) The embedding capacity of n∈7,50.
(a)(b)Table4 shows the embedding capacity of the four methods when the number of behaviors is 10, and n is 10, 15, 20, 25, 30, 35, 40, 45, and 50, respectively. Compared with other methods, our method improves the embedding capacity. Table 4 shows that when n is 10, 15, 20, 25, 30, 35, 40, 45, and 50, as n increases, the embedding capacity shows an upward trend. When n is 20, the rate of the embedding capacity between our method and the compared method has a minimum of 1.98. When n is 50, the rate of embedding capacity between this method and the compared method has a maximum of 4.89. When n is the else value, the rate of the embedding capacity between our method and the compared method is between 1.98 and 4.89. Therefore, the experimental results show that the embedding capacity in our paper is significantly higher in comparison to the other methods. When n∈10,50 and the step size is 5, it increases by 1.98 to 4.89 times.Table 4
Comparison data of embedding capacity (bit).
n101520253035404550MethodMethod in [21]22.7122.4722.5322.5822.5622.5622.5322.522.49Method in [22]22.6622.5722.4922.5922.5522.5522.5522.522.49Method in [23]22.1734.0340.3740.3741.9349.3549.3549.3546.85Proposed method6070809090100100100110Minimum multiple of boost2.642.061.982.232.142.022.022.032.34Maximum multiple of improvement2.73.123.563.993.994.434.444.444.89


## 4.2.3. Comparative Experiments and Evaluation on the Number of Behaviors

Suppose that the sender intends to sendlp binary bits, and the steganography method can send lr binary bits each time. If lp <lr, the lp binary sent is called the valid sent bits, and the remaining lr−lp binary bits are invalid sent bits.For the methods proposed in [21–23] and our method, when lp bits are sent and lp is not an integer multiple of lb, lr=lb−lp%lb bits. The number of bits lp sent by the sender may not be equal to lr. In these four methods, 7 social accounts are controlled and 8-bit information needs to be sent. Our method [21–23] needs to be appended with 2, 7, 13, and 17 invalid bits, respectively, to convey the secret message. From this, the effective bit rate rb=lp/lr can be calculated as 0.8, 0.53, 0.38, and 0.33 for sending effective bits, respectively.Figure9 shows the number of behaviors generated by sending the same effective number of bits when n is 7. It shows that our method sends the same effective number of bits, and the number of behaviors generated is significantly lower compared to the other three methods. When using a suitable time interval to perform interactive behaviors, our method will consume less time. Figure 9(b) shows that as the number of effective bits sent increases, the number of behaviors of our method is still gradually increasing, which is smaller than the compared method. Compared with the other three methods, our method generates fewer behaviors when sending the same effective number of bits, and the effective bit rate is higher. At the same time, Figure 9 shows that our method is more flexible in sending message.Figure 9
The number of behaviors generated under transmission of different effective bits. (a) The number of behaviors generated by the number of effective bits of [5, 16] whenn = 7. (b) The number of behaviors generated by the number of effective bits of [5, 50] when n = 7.
(a)(b)


## 4.2.4. Comparative Experiments and Evaluation on Embedding Rate

The embedding rate in this paper refers to the number of bits that each account can carry; that is, embeddingrate=c/n. The embedding capacity in this subsection is calculated when the number of behaviors is 10, and the embedding rate is shown in Figure 10. In Figure 10(a), the number of n ranges from 7 to 16. The embedding rate of our method is much higher compared to the other methods. In Figure 10(b), as n increases, the embedding rate generally shows a downward trend, but the embedding rate of our method is higher compared to the other methods.Figure 10
Embedding rate when the number of behaviors is 10. (a) Embedding rate when the number of behaviors is 10,n∈7,16. (b) Embedding rate when the number of behaviors is 10, n∈7,50.
(a)(b)This subsection conducts a comparative experiment of the average number of bits carried by a single behavior and conducts an experiment of embedding capacity on the basis of the average number of bits carried by a single behavior. The experimental results show that our method carries out an average number of bits and a large number of bits carried by a single behavior. The embedding capacity of each behavior has better performance. In addition, this subsection also conducts a comparative experiment on the number of behaviors and the embedding rate generated by the transmission of the effective number of bits. The experimental results show that when sending a certain length of effective bit, this method will generate fewer behaviors. Meanwhile, this method has a higher embedding rate for each account that sends secret message; that is, each account can carry more information.


## 4.3. Experiments and Evaluation on Detection Resistance

References [7, 16, 18] collect and fit the user’s behavior frequency to avoid anomalies caused by the sender’s behaviors. For this reason, we take the same method to ensure resistance to detection. Firstly, we crawled more than 160,000 posts from 94 bloggers in the “entertainment” section of public social networks and calculated the time interval between two adjacent posts or retweeted by the same blogger. Then, we merged the time interval data of all bloggers and sorted them and removed the top 10% and bottom 10% data to plot Figure 6(a). The time interval between retweets or posts on social networks is consistent with the frequency of interactions, and anomalous behavior can be avoided if the time interval between interactions on social networks is consistent with this pattern.This experiment selects the first paragraph of text fromGone with the Wind as a secret message to send. Figure 6(a) shows the patterns of the interaction behaviors of ordinary users on social networks, and Figure 6(b) shows the patterns of the interactive behavior generated by our method. Based on Figure 5 of Section 4.1, d=4 is the interaction time delay. As shown in Figure 6(b), the difference of the timestamps of the interaction behaviors during the secret message transmission is plotted as a frequency, and the time interval for generating the interaction behaviors is 0,16. The trend in Figure 6(b) is generally consistent with Figure 6(a) and the interval is also consistent, which indicates that the interaction behaviors generated by our method are consistent with the interaction behaviors of social network users. Therefore, our method can resist the analysis and detection of attackers in terms of behavioral anomalies.


## 4.4. Experiments and Evaluation on Robustness

Robustness is a measure of the stability of a method. When the carrier data passes through a lossy channel, the channel or the attacker may destroy the carrier data. The execution time of the behavior may be influenced by various factors, for which we need to verify the robustness of the method. In this paper, we ensure the robustness of the proposed method by sensing the interaction delay and using redundancy control mechanism. This method allows the receiver to extract the secret message correctly even if there is an interaction delay when the sender delivers the secret message. To verify the robustness of our method, we have done the following experiments.FromGone with the Wind, part of the data is selected and sent 100 times as secret messages, and the maximum interaction delay d=4 can be seen from Figure 5 in Section 4.1. A total of 24,800 behaviors are generated during the sending process, and the interaction delays of the first 2,000 behaviors are selected and plotted in Figure 11(a). Figure 11(b) shows the relationship between the cumulative number of secret messages sent and the cumulative number of successful extractions.Figure 11
Robustness performance of the proposed method. (a) Interaction delay of the proposed method. (b) Extraction effect of the proposed method.
(a)(b)Figure11(a) shows that the interaction delay during the sending process does not exceed 4 seconds. From Figure 11(a), it can be observed that when d=4, the secret message sent is always extracted correctly. This implies that the interaction delay is less than 4 seconds during the period when the secret message is sent. Otherwise, it is difficult for all secret messages to be extracted correctly. It also indicates that the redundancy number of redundant mappings can resist the effect of interaction delay on the correct extraction of secret messages. Figures 11(a) and 11(b) show that our method can resist the effect of interaction delay, which shows our method is robust.


## 4.5. Experiments and Evaluation on Time Consumption

To avoid behavioral anomalies, the behavioral frequency of some users needs to be fitted when sending secret messages, which requires a certain time sacrifice. In addition, the interaction delay can also have an impact on the consumed time. To examine the impact of different interaction delays on time consumption when sending secret messages of a certain length, we designed a set of experiments. The experiments consider the effect of interaction delay and the number of accounts on the time consumed. Firstly, 100 sentences fromGone with the Wind were selected as secret messages and the time consumed was counted. Then, it was divided into 3 groups and the average time was calculated. Finally, the consumed time is converted uniformly to the time consumed when sending 100 bits, and the statistics are shown in Table 5.Table 5
Average time consumed to send 100 bits of data with different behavioral delay(s).
n=7n=11n=15Delay1st group2nd group3rd group1st group2nd group3rd group1st group2nd group3rd groupd=2547.08561.07584.10323.15341.53359.12242.97262.33286.41d=3554.20569.94587.16331.38348.69364.47247.34265.33284.78d=4562.41578.54597.31340.98360.38377.56255.19274.77290.72Whend=2 and n=7, it consumed 547.08 seconds on average after the first group of messages. When d=2 and n=11, it consumed 323.15 seconds on average after the first group of messages. When d=3 and n=7, it consumed 554.20 seconds on average after the first group of messages. Table 5 shows that the time consumed increases as the delay increases and decreases as the number of accounts increases. The reason for the above situation is that as the delay increases, the number of redundant mappings goes up and takes up more time. When the number of accounts increases, the number of simultaneously generated behaviors also increases, which will consume less time.


## 5. Conclusion

To enhance the communication security of edge IoT devices, this paper proposes a behavioral steganography method based on timestamp modulation. It utilizes timestamps under social networks to achieve cross-platform covert communication and uses directed graphs to encode secret messages to improve the embedding capacity. At the same time, the method reduces the number of behaviors generated on a single platform by spreading the secret message across multiple social networks, which reduces the probability of an attacker discovering the covert communication. The experimental results show that the proposed method is highly robust and resistant to detection, and the embedding capacity, the number of effective bits transmitted, and the embedding rate are better than those of the compared methods. However, there is still a gap in embedding capacity between social network-based behavioral steganography and traditional methods. In future research, we will continue to focus on and follow up the privacy protection in SIoT and further improve the embedding capacity of behavioral steganography.



---

*Source: 6351144-2021-12-31.xml*