Steganography of VoIP Streams

1 Introduction

• VoIP’s increasing traffic makes it suitable for hidden communication, while the threat depends on network policy and covert-channel bandwidth.The cited policy examples treat rates above 100 bps as insecure for average security requirements and above 1 bps for high security requirements.Source: §1 · p. 1
• The paper reviews covert channels for VoIP conversation traffic, introduces two new methods, and experimentally estimates their potential bandwidth in a typical call.A detailed review of signaling-phase methods is cited as available elsewhere.Source: §1 · p. 2
• The paper proceeds from VoIP traffic and communication flow to steganographic methods, experiments, and conclusions.Source: §1 · p. 2

2 VoIP Communication Flow

• VoIP transport uses RTP, commonly over UDP, while speech codecs compress and decompress digital voice for transmission.Signaling protocols include SIP, H.323, and H.248/Megaco; supplementary protocols include SDP and RTCP.Source: §2 · p. 2
• RTCP controls RTP and monitors quality-of-service parameters while conveying information about session participants.Source: §2 · p. 2
• The paper’s call scenario separates signaling from conversation: SIP messages establish the call, followed by bidirectional RTP audio streams.SIP messages may pass through proxy or redirect servers; the figure depicts the call setup using SIP, SDP, RTP, and RTCP.Source: §2 · p. 2, Figure 1 · p. 3

3 Covert Channels in VoIP Streams Overview and New Insights

• The proposed model assumes both VoIP endpoints can modify and inspect packets, while the network may introduce delay, loss, or jitter and an active warden may inspect and modify traffic.The warden is assumed not to erase or alter data useful to overt users.Source: §3 · p. 3
• The analysis tracks raw bit rate or packet raw bit rate, total covert data sent in one direction during a typical call, and the distribution of covert data over time.Source: §3 · pp. 3–4
• Conversation-phase channels include IP/UDP/TCP/RTP and RTCP protocol fields, audio watermarking, SID frames, delayed audio packets, and VoWLAN-specific methods.Source: §3 · p. 4
• The paper proposes using RTP/RTCP security-mechanism fields and intentionally delayed audio packets, named LACK, for covert communication.Source: §3 · p. 4

3.1 IP/TCP/UDP Protocols Steganography

• IP/TCP/UDP steganography inserts covert data into redundant, unused, or optional header fields that are changed infrequently during communication.These protocols occur in signaling, audio, and control packets, so their fields can be used across VoIP traffic types.Source: §3.1 · pp. 4–5
• The IP/TCP/UDP packet raw bit rate accounts for capacity in the first packet separately from capacity in subsequent packets.The first packet may use initial field values; the later-packet capacity is counted across the remaining packets.Source: §3.1 · p. 5

3.2.1 RTP Free/Unused Fields Steganography

• RTP free-field channels may use padding, extension headers, initial sequence-number and timestamp values, or least significant timestamp bits.The RTP header figure marks sections that are encrypted and authenticated.Source: §3.2.1 · pp. 5–6, Figure 5 · p. 5
• Active wardens may eliminate or greatly limit free-field RTP channels through header normalization or small modifications, although no implementation is documented.Source: §3.2.1 · p. 6

3.2.2 RTP Security Mechanisms Steganography

• Altering SRTP authentication-tag contents can carry covert data because cryptographic operations make the tag appear nearly random; the receiving party with the preshared key can extract it despite invalid authentication.The approach uses an authentication tag recommended at 80 bits, with shorter values such as 32 bits also acceptable.Source: §3.2.2 · p. 6
• Stripping security fields is presented as the only way to prevent this channel, but it limits overt users’ security services and violates the active-warden rule.Source: §3.2.2 · p. 6
• 32-bit authentication tags with 20 ms audio-packet intervals yield an RTP security-mechanism covert raw bit rate of 1.6 kbit/s.Source: §3.2.2 · p. 7

3.3.1 RCTP Free/Unused Fields Steganography

• The paper presents RTCP as a new covert-channel carrier using Receiver Reports and Sender Reports, whose parameters convey network-status information.Source: §3.3.1 · p. 7
• Changing report-block parameters other than SSRC_1 can carry 160 bits per RTCP packet, but sacrifices some or all RTCP functionality.Other RTCP packet types, including SDES, APP, and BYE, may be used similarly.Source: §3.3.1 · pp. 7–8
• For sessions with few participants, RTCP messages are spaced 5 seconds apart, and RTCP traffic including overhead should stay below 5% of available session bandwidth.Source: §3.3.1 · p. 7
• More frequent RTCP packets can raise covert-channel capacity, but make the channel easier to uncover; active wardens can also limit it at a cost to overt RTCP functionality.Source: §3.3.1 · p. 8

3.3.2 RTCP Security Mechanisms Steganography

• The RTCP security-mechanism method applies the SRTP approach to RTCP, with its raw bit rate depending on authentication-tag size, call duration, and the number of RTCP messages.The paper defines these rate inputs as tag bits, call duration in seconds, and RTCP message count.Source: §3.3.2 · p. 8

• Available real-time VoIP watermarking methods include LSB, QIM, Echo Hiding, DSSS, and FHSS, and their bandwidth depends mainly on sampling rate and audio material.Source: §3.4 · p. 8
• Other than LSB watermarking, audio-watermarking covert-channel bandwidth ranges from a few to tens of bits per second under conditions intended to avoid excessive quality impact and limit disclosure.Source: §3.4 · p. 9, Table 1 · p. 9
• Audio watermarking trades embedded data volume against perceived call quality, while the audio stream makes covert-channel bandwidth constant.Source: §3.4 · p. 9
• Audio-watermark steganalysis is difficult and must be adapted to the algorithm; detection remains possible, and erasing a reasonably embedded watermark often greatly degrades voice quality.Source: §3.4 · p. 9

• During silence, SID frames can carry covert data by altering background-noise information without generating new packets; covert bandwidth depends on the codec and is generally low.G.729AB SID frames are 10 bits and G.723.1 SID frames are 24 bits; sending SID frames more often can increase bandwidth.Source: §3.5 · p. 9
• An active warden can eliminate or greatly reduce this channel by changing bits in SID frames, such as least-significant bits.Source: §3.5 · p. 10

3.6 LACK: Intentionally Delayed Audio Packets Steganography

• LACK uses selected audio-packet payloads for secret data: unaware receivers discard packets delayed excessively, while aware receivers can use their payloads.The authors describe this as the first proposal, to their knowledge, to use intentionally delayed and consequently lost packet payloads as a VoIP covert channel.Source: §3.6 · p. 10
• Added packet loss must remain within codec-dependent tolerances; exceeding the threshold can significantly reduce voice quality.The paper gives 1% for G.723.1, 2% for G.729A, and 3% for G.711 without PLC, or up to 5% with PLC.Source: §3.6 · pp. 10–11
• A selected packet must be delayed by at least the receiver’s de-jitter-buffer delay to be considered lost; that buffer is usually 30–70 ms.The paper says this delay also contributes to the end-to-end delay budget, which should not exceed 150 ms.Source: §3.6 · p. 11
• The probability p_i of using delayed packets must be adjusted to network loss conditions, which can be estimated from RTCP reports.The paper frames p_i as a maximum probability for delayed-packet loss alongside ordinary network packet loss.Source: §3.6 · pp. 11–12
• 320 b/s RBR and 6.4 bits/packet PRBR are reported for G.711 at 64 kbit/s, p_i = 0.5%, and I_f = 20 ms.The paper states that available bandwidth increases with speech codec frame rate.Source: §3.6 · p. 12
• The authors characterize LACK as less complex than most audio steganography algorithms, with bandwidth comparable to or higher than those methods.This is the paper’s stated comparison, not a quantified benchmark in the supplied passage.Source: §3.6 · p. 12
• Because ordinary IP-network losses are common, reasonable LACK packet-loss levels may be difficult to detect, but further in-depth steganalysis is needed.Suggested checks include lost-packet statistics from RTCP or RTP sequence numbers; an active warden may risk degrading conversation quality by dropping delayed packets.Source: §3.6 · pp. 12–13

3.7 Medium Dependent Steganography

• Medium-dependent steganography typically uses layer 1 or layer 2 of the ISO OSI RM; HICCUPS is an example for homogeneous WLANs.The example’s reported data rate is 216 kbit/s under IEEE 802.11g at 54 Mbit/s, with frame error rate changing from 1.5% to 2.5% and 40% bandwidth usage.Source: §3.7 · p. 13
• HICCUPS is difficult to implement because it requires modifying network cards.Source: §3.7 · p. 13
• HICCUPS steganalysis is difficult because it requires analysis of physical-layer frames.Source: §3.7 · p. 13

4 Experimental Evaluation of VoIP Streams Covert Channels Bandwidth

• Total bandwidth B_T is the sum of each method’s bandwidth B_j across k steganographic techniques used during the call.The paper expresses bandwidth as RBR or PRBR.Source: §4 · p. 13
• Total bandwidth depends on the techniques and codec, including compression, voice-frame size, packet interval, silence-suppression mechanisms, packet loss, and method-specific conditions.The paper notes that fewer transmitted packets reduce total covert bandwidth and that packet loss can discard covert information.Source: §4 · pp. 13–14
• The test used 30 averaged, nine-minute calls with G.711 A-law, 20 ms of voice per packet, and 160-byte payloads; audio flowed directly between endpoints.SIP signaling passed through a proxy, RTCP conveyed network-performance information, and incoming traffic was captured at SIP UA B to measure one direction.Source: §4 · p. 14, Figure 7 · p. 14
• The experiment estimates total covert data for a typical conversation phase, not resistance to steganalysis; assumed PRBR values were chosen as reasonable in that context.The selected methods were chosen for ease of implementation, contribution, natural fit to VoIP, and representation of different protocol layers.Source: §4 · p. 15, Table 2 · p. 15
• RTP-based methods cover 99.9% of the VoIP traffic in the experiment.The traffic-distribution table reports average results.Source: §4 · p. 15, Table 3 · p. 15
• RBR stays between 2450 and 2600 bits/s and PRBR between 48 and 53 bits/packet; periodic peaks are caused by LACK’s intentionally delayed packets.Bandwidth rises when delayed packets carrying steganograms reach the receiver.Source: Figure 8 · p. 15, §4 · p. 16, Figure 9 · p. 16
• During a typical call, more than 1.3 Mbits (170 KB) of data can be transferred in one direction, with RBR about 2.5 kbit/s (50 bits/packet for PRBR).Source: §4 · p. 16
• Network steganography provides about 64% of covert bandwidth for IP/UDP and 32% for RTP; LACK provides about 2.6% and audio watermarking about 1.2%.RTCP steganography provides only minor bandwidth compared with the other methods.Source: Table 5 · p. 16, §4 · p. 17

5 Conclusions

• More than 1.3 Mbits can be sent covertly in one direction during a typical VoIP call.The authors report that IP/UDP/RTP protocol steganography provides over 96% of achieved covert bandwidth; delayed audio packets provide about 2.6% and audio watermarking about 1.2%.Source: §5 · p. 17
• The paper introduces RTP/RTCP protocol steganography and intentionally delayed audio packets steganography (LACK), alongside descriptions of existing VoIP-stream methods..Source: §5 · p. 17
• Not all steganographic methods were tested, and steganalysis may limit covert-channel bandwidth; active-warden quality effects need further study.The authors note there is no documented active-warden implementation and that packet analysis could add delays that affect call quality.Source: §5 · p. 17