@inproceedings{HildebrandtNeubertMakrushinetal.2017, author = {Hildebrandt, Mario and Neubert, Tom and Makrushin, Andrey and Dittmann, Jana}, title = {Benchmarking face morphing forgery detection: Application of stirtrace for impact simulation of different processing steps}, series = {Konferenz: 2017 5th International Workshop on Biometrics and Forensics (IWBF), 2017/ Titel: 2017 5th International Workshop on Biometrics and Forensics (IWBF)}, booktitle = {Konferenz: 2017 5th International Workshop on Biometrics and Forensics (IWBF), 2017/ Titel: 2017 5th International Workshop on Biometrics and Forensics (IWBF)}, publisher = {IEEE}, address = {Coventry, United Kingdom}, isbn = {978-1-5090-5791-7}, doi = {10.1109/IWBF.2017.7935087}, pages = {1 -- 6}, year = {2017}, abstract = {We analyze StirTrace towards benchmarking face morphing forgeries and extending it by additional scaling functions for the face biometrics scenario. We benchmark a Benford's law based multi-compression-anomaly detection approach and acceptance rates of morphs for a face matcher to determine the impact of the processing on the quality of the forgeries. We use 2 different approaches for automatically creating 3940 images of morphed faces. Based on this data set, 86614 images are created using StirTrace. A manual selection of 183 high quality morphs is used to derive tendencies based on the subjective forgery quality. Our results show that the anomaly detection seems to be able to detect anomalies in the morphing regions, the multi-compression-anomaly detection performance after the processing can be differentiated into good (e.g. cropping), partially critical (e.g. rotation) and critical results (e.g. additive noise). The influence of the processing on the biometric matcher is marginal.}, language = {en} } @inproceedings{Neubert2017, author = {Neubert, Tom}, title = {Face Morphing Detection: An Approach Based on Image Degradation Analysis}, series = {Konferenz: International Workshop on Digital Watermarking, 2017/ Titel: Digital Forensics and Watermarking}, booktitle = {Konferenz: International Workshop on Digital Watermarking, 2017/ Titel: Digital Forensics and Watermarking}, editor = {Kraetzer, Christian and Shi, Yun-Qing and Dittmann, Jana and Kim, Hyoung Joong}, publisher = {Springer International Publishing}, address = {Magdeburg, Germany}, isbn = {978-3-319-64184-3 978-3-319-64185-0}, doi = {10.1007/978-3-319-64185-0_8}, pages = {93 -- 106}, year = {2017}, abstract = {In 2014 a novel identity theft scheme targeting specific application scenarios in face biometrics was introduced. In this scheme, a so called face morph melts two or more face images of different persons into one image, which is visually similar to multiple real world persons. Based on this non authentic image, it is possible to apply for an image based identity document to be issued by a corresponding authority. Thus, multiple persons can use such a document to pass image based person verification scenarios with a single document containing an artificially weakened template. Currently there is no reliable existing security mechanism to detect this attack.}, language = {en} } @inproceedings{NeubertHildebrandtDittmann2016, author = {Neubert, Tom and Hildebrandt, Mario and Dittmann, Jana}, title = {Image pre-processing detection: Evaluation of Benford's law, spatial and frequency domain feature performance}, series = {Konferenz: 2016 First International Workshop on Sensing, Processing and Learning for Intelligent Machines (SPLINE)/ Titel: 2016 First International Workshop on Sensing, Processing and Learning for Intelligent Machines (SPLINE)}, booktitle = {Konferenz: 2016 First International Workshop on Sensing, Processing and Learning for Intelligent Machines (SPLINE)/ Titel: 2016 First International Workshop on Sensing, Processing and Learning for Intelligent Machines (SPLINE)}, publisher = {IEEE}, address = {Aalborg, Denmark}, isbn = {978-1-4673-8917-4}, doi = {10.1109/SPLIM.2016.7528405}, pages = {1 -- 5}, year = {2016}, abstract = {This Paper proposes a novel method for the blind detection of image pre-processing techniques by means of statistical pattern recognition in image forensics. The technique is intended to detect sensor intrinsic pre-processing steps as well as manually applied filters. We have exemplary chosen 6 pre-processing filters with different parameter settings. The concept utilizes 29 image features which are supposed to allow for a reliable model creation during supervised learning. The evaluation of the trained models indicates average accuracies between 82.50 and 94.53\%. The investigation of image data from 8 sensors leads to the detection of credible pre-processing filters. Those results adumbrate that our method might be suitable to prove the authenticity of the data origin and the integrity of image data based on the detected preprocessing techniques. The preliminary evaluation for manually applied filters yields recognition accuracies between 39.09\% (14 classes) and 53.33\% (7 classes).}, language = {en} } @inproceedings{NeubertKraetzerDittmann2019, author = {Neubert, Tom and Kraetzer, Christian and Dittmann, Jana}, title = {A Face Morphing Detection Concept with a Frequency and a Spatial Domain Feature Space for Images on eMRTD}, series = {Konferenz: IH\&MMSec '19: ACM Information Hiding and Multimedia Security Workshop; Paris, France; July 3-5, 2019/ Titel: Proceedings of the ACM Workshop on Information Hiding and Multimedia Security}, booktitle = {Konferenz: IH\&MMSec '19: ACM Information Hiding and Multimedia Security Workshop; Paris, France; July 3-5, 2019/ Titel: Proceedings of the ACM Workshop on Information Hiding and Multimedia Security}, publisher = {ACM}, isbn = {978-1-4503-6821-6}, doi = {10.1145/3335203.3335721}, pages = {95 -- 100}, year = {2019}, abstract = {Since the face morphing attack was introduced by Ferrara et al. in 2014, the detection of face morphings has become a wide spread topic in image forensics. By now, the community is very active and has reported diverse detection approaches. So far, the evaluations are mostly performed on images without post-processing. Face images stored within electronic machine readable documents (eMRTD) are ICAO-passport-scaled to a resolution of 413x531 and a JPG or JP2 lesize of 15 kilobytes. This paper introduces a face morphing detection concept with 3 modules (ICAO-aligned pre- processing module, feature extraction module and classi cation module), tailored for such images on eMRTD. In this work we exemplary design and evaluate two feature spaces for the feature extraction module, a frequency domain and a spatial domain feature space. Our evaluation will compare both feature spaces and is carried out with 66,229 passport-scaled images (64,363 morphed face images and 1,866 authentic face images) which are completly independent from training and include all images provided for the IHMMSEC'19 special session: "Media Forensics - Fake or Real?". Furthermore, we investigate the in uence of di erent morph gen- eration pipelines to the detection accuracies of the concept and we analyse the impact of neutral and smiling genuine faces to the morph detector performance. The evaluation determines a detection rate of 86.0\% for passport-scaled morphed images with a false alarm rate of 4.4\% for genuine images for the spatial domain feature space.}, language = {en} } @inproceedings{MakrushinKraetzerNeubertetal.2018, author = {Makrushin, Andrey and Kraetzer, Christian and Neubert, Tom and Dittmann, Jana}, title = {Generalized Benford's Law for Blind Detection of Morphed Face Images}, series = {Konferenz: IH\&MMSec '18: 6th ACM Workshop on Information Hiding and Multimedia Security, 2018/ Titel: Proceedings of the 6th ACM Workshop on Information Hiding and Multimedia Security}, booktitle = {Konferenz: IH\&MMSec '18: 6th ACM Workshop on Information Hiding and Multimedia Security, 2018/ Titel: Proceedings of the 6th ACM Workshop on Information Hiding and Multimedia Security}, publisher = {ACM}, address = {Innsbruck Austria}, isbn = {978-1-4503-5625-1}, doi = {10.1145/3206004.3206018}, pages = {49 -- 54}, year = {2018}, language = {en} } @article{NeubertMakrushinHildebrandtetal.2018, author = {Neubert, Tom and Makrushin, Andrey and Hildebrandt, Mario and Kraetzer, Christian and Dittmann, Jana}, title = {Extended StirTrace benchmarking of biometric and forensic qualities of morphed face images}, series = {IET Biometrics}, journal = {IET Biometrics}, number = {Augabe: 4/ Band: 7}, publisher = {Wiley}, issn = {2047-4938, 2047-4946}, doi = {10.1049/iet-bmt.2017.0147}, pages = {325 -- 332}, year = {2018}, abstract = {Since its introduction in 2014, the face morphing forgery (FMF) attack has received significant attention from the biometric and media forensic research communities. The attack aims at creating artificially weakened templates which can be successfully matched against multiple persons. If successful, the attack has an immense impact on many biometric authentication scenarios including the application of electronic machine-readable travel document (eMRTD) at automated border control gates. We extend the StirTrace framework for benchmarking FMF attacks by adding five issues: a novel three-fold definition for the quality of morphed images, a novel FMF realisation (combined morphing), a post-processing operation to simulate the digital image format used in eMRTD (passport scaling 15 kB), an automated face recognition system (VGG face descriptor) as additional means for biometric quality assessment and two feature spaces for FMF detection (keypoint features and fusion of keypoint and Benford features) as additional means for forensic quality assessment. We show that the impact of StirTrace post-processing operations on the biometric quality of morphed face images is negligible except for two noise operators and passport scaling 15 kB, the impact on the forensic quality depends on the type of post-processing, and the new FMF realisation outperforms the previously considered ones.}, language = {en} } @inproceedings{NeubertKraetzerDittmann2018, author = {Neubert, Tom and Kraetzer, Christian and Dittmann, Jana}, title = {Reducing the False Alarm Rate for Face Morph Detection by a Morph Pipeline Footprint Detector}, series = {Konferenz: 2018 26th European Signal Processing Conference (EUSIPCO), 2018/ Titel: 2018 26th European Signal Processing Conference (EUSIPCO)}, booktitle = {Konferenz: 2018 26th European Signal Processing Conference (EUSIPCO), 2018/ Titel: 2018 26th European Signal Processing Conference (EUSIPCO)}, publisher = {IEEE}, address = {Rome}, isbn = {978-90-827970-1-5}, doi = {10.23919/EUSIPCO.2018.8553067}, pages = {1002 -- 1006}, year = {2018}, language = {en} } @inproceedings{MakrushinNeubertDittmann2017, author = {Makrushin, Andrey and Neubert, Tom and Dittmann, Jana}, title = {Automatic Generation and Detection of Visually Faultless Facial Morphs}, series = {Konferenz: International Conference on Computer Vision Theory and Applications, 2017/ Titel: Proceedings of the 12th International Joint Conference on Computer Vision, Imaging and Computer Graphics Theory and Applications}, booktitle = {Konferenz: International Conference on Computer Vision Theory and Applications, 2017/ Titel: Proceedings of the 12th International Joint Conference on Computer Vision, Imaging and Computer Graphics Theory and Applications}, publisher = {SCITEPRESS - Science and Technology Publications}, address = {Porto, Portugal}, isbn = {978-989-758-225-7 978-989-758-226-4 978-989-758-227-1}, doi = {10.5220/0006131100390050}, pages = {39 -- 50}, year = {2017}, abstract = {This paper introduces an approach to automatic generation of visually faultless facial morphs along with a proposal on how such morphs can be automatically detected. It is endeavored that the created morphs cannot be recognized as such with the naked eye and a reference automatic face recognition (AFR) system produces high similarity scores while matching a morph against faces of persons who participated in morphing. Automatic generation of morphs allows for creating abundant experimental data, which is essential (i) for evaluating the performance of AFR systems to reject morphs and (ii) for training forensic systems to detect morphs. Our first experiment shows that human performance to distinguish between morphed and genuine face images is close to random guessing. In our second experiment, the reference AFR system has verified 11.78\% of morphs against any of genuine images at the decision threshold of 1\% false acceptance rate. These results indicate that facial morphing is a serious threat to access control systems aided by AFR and establish the need for morph detection approaches. Our third experiment shows that the distribution of Benford features extracted from quantized DCT coefficients of JPEG-compressed morphs is substantially different from that of genuine images enabling the automatic detection of morphs.}, language = {en} } @inproceedings{SeiboldHilsmannMakrushinetal.2019, author = {Seibold, Clemens and Hilsmann, Anna and Makrushin, Andrey and Kraetzer, Christian and Neubert, Tom and Dittmann, Jana and Eisert, Peter}, title = {Visual Feature Space Analyses of Face Morphing Detectors}, series = {Konferenz: 2019 IEEE International Workshop on Information Forensics and Security (WIFS), Delft, Netherlands, 2019/ Konferenztitel: 2019 IEEE International Workshop on Information Forensics and Security (WIFS)}, booktitle = {Konferenz: 2019 IEEE International Workshop on Information Forensics and Security (WIFS), Delft, Netherlands, 2019/ Konferenztitel: 2019 IEEE International Workshop on Information Forensics and Security (WIFS)}, publisher = {IEEE}, address = {Delft, Netherlands}, isbn = {978-1-72813-217-4}, doi = {10.1109/WIFS47025.2019.9034983}, pages = {1 -- 6}, year = {2019}, language = {en} } @inproceedings{MakrushinNeubertDittmann2019, author = {Makrushin, Andrey and Neubert, Tom and Dittmann, Jana}, title = {Humans Vs. Algorithms: Assessment of Security Risks Posed by Facial Morphing to Identity Verification at Border Control}, series = {Konferenz: 14th International Conference on Computer Vision Theory and Applications, Prague, Czech Republic, 2019/ Titel: Proceedings of the 14th International Joint Conference on Computer Vision, Imaging and Computer Graphics Theory and Applications}, booktitle = {Konferenz: 14th International Conference on Computer Vision Theory and Applications, Prague, Czech Republic, 2019/ Titel: Proceedings of the 14th International Joint Conference on Computer Vision, Imaging and Computer Graphics Theory and Applications}, publisher = {SCITEPRESS - Science and Technology Publications}, address = {Prague, Czech Republic}, isbn = {978-989-758-354-4}, doi = {10.5220/0007378905130520}, pages = {513 -- 520}, year = {2019}, language = {en} } @inproceedings{SoniNeubertDietrichetal.2023, author = {Soni, Jaykumar and Neubert, Tom and Dietrich, Benjamin and Vielhauer, Claus}, title = {Virtual Sessions for Forensic Analysis of Video Conferencing Systems: A Novel Methodology}, series = {Konferenz: IARIA SECURWARE 2023, the Seventeenth International Conference on Emerging Security Information, Systems and Technologies: Porto, Portugal}, booktitle = {Konferenz: IARIA SECURWARE 2023, the Seventeenth International Conference on Emerging Security Information, Systems and Technologies: Porto, Portugal}, publisher = {IARIA}, pages = {18 -- 20}, year = {2023}, language = {en} } @unpublished{WendzelCaviglioneMazurczyketal.2023, author = {Wendzel, Steffen and Caviglione, Luca and Mazurczyk, Wojciech and Mileva, Aleksandra and Dittmann, Jana and Kr{\"a}tzer, Christian and Lamsh{\"o}ft, Kevin and Vielhauer, Claus and Hartmann, Laura and Keller, J{\"o}rg and Neubert, Tom and Zillien, Sebastian}, title = {A Generic Taxonomy for Steganography Methods}, doi = {10.36227/techrxiv.20215373.v1}, year = {2023}, abstract = {A unified understanding of terms and their applicability is essential for every scientific discipline: steganography is no exception. Being divided into several domains (for instance, text steganography, digital media steganography, and network steganography), it is crucial to provide a unified terminology as well as a taxonomy that is not limited to some specific applications or areas. A prime attempt towards a unified understanding of terms was conducted in 2015 with the introduction of a pattern-based taxonomy for network steganography. Six years later, in 2021, the first work towards a pattern-based taxonomy for steganography was proposed. However, this initial attempt still faced several shortcomings, e.g., the lack of patterns for several steganography domains (the work mainly focused on network steganography and covert channels), various terminology issues, and the need of providing a tutorial on how the taxonomy can be used during engineering and scientific tasks, including the paper-writing process.

As the consortium who published this initial 2021-study on steganography patterns, in this paper we present the first comprehensive pattern-based taxonomy tailored to fit all known domains of steganography, including smaller and emerging areas, such as filesystem steganography and cyber-physical systems steganography. Besides, to make our contribution more effective and promote the use of the taxonomy to advance research on steganography, we also provide a thorough tutorial on its utilization.

Our pattern collection is available at https://patterns.ztt.hs-worms.de.

}, language = {en} } @article{LamshoeftNeubertHielscheretal.2022, author = {Lamsh{\"o}ft, Kevin and Neubert, Tom and Hielscher, Jonas and Vielhauer, Claus}, title = {Knock, knock, log: Threat analysis, detection \& mitigation of covert channels in syslog using port scans as cover}, series = {Forensic Science International: Digital Investigation}, volume = {40}, journal = {Forensic Science International: Digital Investigation}, publisher = {Elsevier}, issn = {2666-2817}, doi = {10.1016/j.fsidi.2022.301335}, year = {2022}, language = {en} } @inproceedings{LamshoeftNeubertKraetzeretal.2021, author = {Lamsh{\"o}ft, Kevin and Neubert, Tom and Kr{\"a}tzer, Christian and Vielhauer, Claus and Dittmann, Jana}, title = {Information Hiding in Cyber Physical Systems: Challenges for Embedding, Retrieval and Detection using Sensor Data of the SWAT Dataset}, series = {IH\&MMSec '21: Proceedings of the ACM Workshop on Information Hiding and Multimedia Security; Virtual Event Belgium, June 22 - 25, 2021}, booktitle = {IH\&MMSec '21: Proceedings of the ACM Workshop on Information Hiding and Multimedia Security; Virtual Event Belgium, June 22 - 25, 2021}, publisher = {ACM}, address = {New York}, isbn = {978-1-4503-8295-3}, doi = {10.1145/3437880.3460413}, pages = {113 -- 124}, year = {2021}, language = {en} } @inproceedings{WendzelCaviglioneMazurczyketal.2021, author = {Wendzel, Steffen and Caviglione, Luca and Mazurczyk, Wojciech and Mileva, Aleksandra and Dittmann, Jana and Kr{\"a}tzer, Christian and Lamsh{\"o}ft, Kevin and Vielhauer, Claus and Hartmann, Laura and Keller, J{\"o}rg and Neubert, Tom}, title = {A Revised Taxonomy of Steganography Embedding Patterns}, series = {Konferenz: ARES 2021: The 16th International Conference on Availability, Reliability and Security, Vienna Austria, 2021/ Konferenzband: Proc. of the 16th International Conference on Availability, Reliability and Security (ARES'21), August 17--20, 2021, Vienna, Austria}, booktitle = {Konferenz: ARES 2021: The 16th International Conference on Availability, Reliability and Security, Vienna Austria, 2021/ Konferenzband: Proc. of the 16th International Conference on Availability, Reliability and Security (ARES'21), August 17--20, 2021, Vienna, Austria}, publisher = {ACM}, address = {Vienna Austria}, isbn = {978-1-4503-9051-4}, doi = {10.1145/3465481.3470069}, pages = {1 -- 12}, year = {2021}, abstract = {Steganography embraces several hiding techniques which spawn across multiple domains. However, the related terminology is not unified among the different domains, such as digital media steganography, text steganography, cyber-physical systems steganography, network steganography (network covert channels), local covert channels, and out-of-band covert channels. To cope with this, a prime attempt has been done in 2015, with the introduction of the so-called hiding patterns, which allow to describe hiding techniques in a more abstract manner. Despite significant enhancements, the main limitation of such a taxonomy is that it only considers the case of network steganography. Therefore, this paper reviews both the terminology and the taxonomy of hiding patterns as to make them more general. Specifically, hiding patterns are split into those that describe the embedding and the representation of hidden data within the cover object. As a first research action, we focus on embedding hiding patterns and we show how they can be applied to multiple domains of steganography instead of being limited to the network scenario. Additionally, we exemplify representation patterns using network steganography.}, language = {en} } @inproceedings{KevinHildebrandtAltschaffeletal.2022, author = {Kevin, Lamsh{\"o}ft and Hildebrandt, Mario and Altschaffel, Robert and Keil, Oliver and Hempel, Ivo and Dittmann, Jana and Neubert, Tom and Vielhauer, Claus}, title = {Resilience against and detection of information hiding in nuclear instrumentation and control systems within the scope of NSS 17-T}, series = {Kerntechnik 2022, Leipzig, 21. - 22. Juni 2022}, booktitle = {Kerntechnik 2022, Leipzig, 21. - 22. Juni 2022}, publisher = {INFORUM Verlags- und Verwaltungsgesellschaft mbH}, address = {Berlin}, pages = {6}, year = {2022}, language = {en} } @inproceedings{NeubertCaballeroMorcilloVielhauer2022, author = {Neubert, Tom and Caballero Morcillo, Antonio Jos{\´e} and Vielhauer, Claus}, title = {Improving Performance of Machine Learning based Detection of Network Steganography in Industrial Control Systems}, series = {ARES 2022: The 17th International Conference on Availability, Reliability and Security Vienna Austria August 23 - 26, 2022}, booktitle = {ARES 2022: The 17th International Conference on Availability, Reliability and Security Vienna Austria August 23 - 26, 2022}, publisher = {Association for Computing Machinery}, address = {New York, NY}, doi = {10.1145/3538969.3544427}, pages = {1 -- 8}, year = {2022}, language = {en} } @inproceedings{NeubertVielhauerKraetzer2021, author = {Neubert, Tom and Vielhauer, Claus and Kraetzer, Christian}, title = {Artificial Steganographic Network Data Generation Concept and Evaluation of Detection Approaches to secure Industrial Control Systems against Steganographic Attacks}, series = {ARES 2021: The 16th International Conference on Availability, Reliability and Security, August 2021}, booktitle = {ARES 2021: The 16th International Conference on Availability, Reliability and Security, August 2021}, doi = {10.1145/3465481.3470073}, pages = {1 -- 9}, year = {2021}, language = {en} } @inproceedings{HildebrandtLamshoeftDittmannetal.2020, author = {Hildebrandt, Mario and Lamsh{\"o}ft, Kevin and Dittmann, Jana and Neubert, Tom and Vielhauer, Claus}, title = {Information Hiding in Industrial Control Systems: An OPC UA based Supply Chain Attack and its Detection}, series = {Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security (IH\&MMSec'20), June 22-24, 2020, Denver, CO, USA}, booktitle = {Proceedings of the 2020 ACM Workshop on Information Hiding and Multimedia Security (IH\&MMSec'20), June 22-24, 2020, Denver, CO, USA}, publisher = {The Association for Computing Machinery}, address = {New York}, doi = {10.1145/3369412}, pages = {115 -- 120}, year = {2020}, language = {en} } @article{NeubertVielhauer2020, author = {Neubert, Tom and Vielhauer, Claus}, title = {Kill Chain Attack Modelling for Hidden Channel Attack Scenarios in Industrial Control Systems}, series = {IFAC-PapersOnLine}, journal = {IFAC-PapersOnLine}, publisher = {Elsevier}, issn = {24058963}, doi = {10.1016/j.ifacol.2020.12.246}, pages = {11074 -- 11080}, year = {2020}, language = {en} } @inproceedings{HildebrandtAltschaffelLamshoeftetal.2020, author = {Hildebrandt, Mario and Altschaffel, Robert and Lamsh{\"o}ft, Kevin and Lange, Mathias and Szemkus, Martin and Neubert, Tom and Vielhauer, Claus and Ding, Yongjian and Dittmann, Jana}, title = {Threat Analysis of Steganographic and Covert Communication in Nuclear I\&C Systems}, series = {Konferenz: International Conference on Nuclear Security: Sustaining and Strengthening Efforts (ICONS), Vienna, Austria, 2020/ Konferenzband: International Conference on Nuclear Security: Sustaining and Strengthening Efforts}, booktitle = {Konferenz: International Conference on Nuclear Security: Sustaining and Strengthening Efforts (ICONS), Vienna, Austria, 2020/ Konferenzband: International Conference on Nuclear Security: Sustaining and Strengthening Efforts}, publisher = {IAEA}, address = {Vienna, Austria}, pages = {14}, year = {2020}, abstract = {Steganographic and covert communication is increasingly used for hiding attacks. Often information hiding is used by attackers in advanced persistent threats in order to operate without being noticed. Attackers might use it to hide data exfiltration or control channels for persistent malware. The paper analyzes potential threats to operational technology by investigating different communication protocols towards their suitability as cover channels. Using a generalized network architecture model and the communication flows of nuclear power plants, the attack potential using information hiding is exemplary assessed. An example for a supply chain attack for command injection is given on the foundation of the OPC UA protocol and an off-theshelf programmable logic controller. Subsequently, recommendations for a strategic and operational preparation for operators towards the prevention and detection of information hiding attacks are derived.}, language = {en} } @article{NeubertSchuelerUllrichetal.2025, author = {Neubert, Tom and Schueler, Eric and Ullrich, Henning and Buxhoidt, Laura and Vielhauer, Claus}, title = {Extended Analysis, Detection and Attribution of Steganographic Embedding Methods in Network Data of Industrial Controls Systems}, series = {International Journal on Advances in Security}, volume = {18}, journal = {International Journal on Advances in Security}, number = {1\&2}, publisher = {IARIA}, pages = {112 -- 122}, year = {2025}, abstract = {Since the last decade, it is well known that Industrial Control Systems (ICS) are under attack and attackers nowadays increasingly use stealthy malware (i.e., stegomalware) imple- mented by steganographic embedding methods to in- and exfil- trate hidden information. Unfortunately, current mechanisms to distinguish between network steganographic embedding methods and embedded message types need improvement for a potential attribution of attackers. For the analysis of steganographic em- bedding methods which are utilized in stealthy malware, the work presented in this paper builds upon a state-of-the-art analysis testbed proposed earlier, which is recapitulated here. It offers the opportunity to analyze network steganographic embedding methods in ICS to elaborate methods to detect and distinguish between them to gain forensic information for attribution of potential attackers and their methods. In this work, we introduce a novel machine learning based approach to distinguish between five selected embedding methods and two embedded message types. We use the analysis testbed to evaluate and determine the accuracy of the novel approach compared to a state-of-the-art approach. In our extensive evaluation, our novel approach has shown to be able to distinguish between network steganographic embedding methods with an average accuracy of 85.7\%, which is an improvement in comparison to the state-of-the-art by +5.9\% and enables a more accurate attribution of attackers. Additionally, the novel approach is able to improve the accuracy of distinction between embedding method and embedded message type by +9.3\% in comparison to the evaluated state-of-the-art approach.}, language = {en} }