Projects Details

Acronym: UNCOVER
Title: Development of an efficient steganalysis framework for uncovering hidden data in digital media
Duration: 01.05.2021 – 30.04.2024
Topic: SU-FCT02-2020
Call: Technologies to enhance the fight against crime and terrorism
Funding: H2020 - Research and Innovation Action (RIA)
GA Number: 101021687
CORDIS: CORDIS Project Profile

Project Background

In recent years, the criminal use of information hiding techniques (i.e., steganography) in digital media such as images, video, audio and text files has been increasing rapidly. An important reason for this is that many steganographic tools have been made available as program source code packages. Consequently, perpetrators can easily selectively pick, adapt and combine information hiding tools for their criminal activities.

Due to the availabbility of tools, we are observing a significant increase in the use of steganographic methods in typical areas such as cybercrime and malware attacks and campaigns as well as beyond. In preparation of UNCOVER, an initial survey of the Criminal Use of Information Hiding (CUIng) initiative on the Europol Platform for Experts (EPE) reveals that evidence of steganography and related principles has been found in a wide variety of types of crime including child pornography, industrial espionage, criminal attacks on enterprises, credit card fraud and skimming, system intrusion, and backdoor injection and delivery methods.

However, steganographic methods and technologies are a major challenge for Law Enforcement Agencies (LEAs) due to a lack of resources and procedures for investigations or structured operations. These problems are amplified by the increasing amount of digital evidence that LEAs and judicial partners have to handle. UNCOVER therefore aims to address these issues and to further develop steganographic tools in order to establish a tailored toolkit for LEAs.

Project Objectives

Objective 1
Conduct a detailed analysis about the various aspects of the needs and requirements of LEAs for detecting and investigating steganography.
Objective 2
Consolidate relevant information about existing steganographic tools and centralise this information in an intuitive database for LEAs.
Objective 3
Improve existing methods for operational steganalysis in digital media workflows.
Objective 4
Implement a flexible online-platform by combining the micro-service architecture with REST- APIs for supporting interoperability.
Objective 5
Demonstrate the steganographic detection capabilities with realistic test cases and scenarios delivered by the LEAs.
Objective 6
Analyse the requirements in order to make the obtained results admissible in European court rules.
Objective 7
Provide a comprehensive training program for LEAs and forensic institutes by providing in-house training.
Objective 8
Validate the project results with practitioners, disseminate the outcomes, and prepare an exploitation plan.

Project Methodology

UNCOVER aims at developing a comprehensive approach to digital media steganalysis taking into account the requirements of the participating LEAs in every step. The methodological framework encompasses the following main steps: (1) Analysis of existing steganographic tools, (2) Development, training and theoretical validation of state-of-the-art detectors and tools, (3) Integration of tools into a user-friendly platform, (4) Field validation of UNCOVER solutions, and (5) Continuous feedback cycle.

Project Impacts

IMPACT 1

The LEAs and forensics institutes have the ability to detect and extract information hidden in different types of digital media.

IMPACT 2

The UNCOVER tools will make the work of the LEAs and forensics institutes more efficient by speeding-up the processing time and the reliability (detection error rate).

IMPACT 3

UNCOVER will establish a network for cooperation, raising awareness, tracking progress, sharing information, working jointly, and training of the staff.

IMPACT 4

UNCOVER will contribute to the reduction or prevention of threats emanating from criminals and terrorists using steganography.

IMPACT 5

UNCOVER will work towards a harmonisation of information formats at international level, the improved cross-border acceptance and an exchange of court-proof evidence.