Steganalysis of Inactive Voice-Over-IP Frames Based on Poker Test

This paper concentrates on the detection of steganography in inactive frames of low bit rate audio streams in Voice over Internet Protocol (VoIP) scenarios. Both theoretical and experimental analyses demonstrate that the distribution of 0 and 1 in encoding parameter bits becomes symmetric after a steganographic process. Moreover, this symmetry affects the frequency of each subsequence of parameter bits, and accordingly changes the poker test statistical features of encoding parameter bits. Employing the poker test statistics of each type of encoding parameter bits as detection features, we present a steganalysis method based on a support vector machine. We evaluate the proposed method with a large quantity of speech samples encoded by G.723.1 and compare it with the entropy test. The experimental results show that the proposed method is effective, and largely outperforms the entropy test in any cases