SEEK (Steganalytic vidEo-rEsearch frameworK)

The proposed research project aims to discover whether videos uploaded and exchanged by terrorists and sympathizers contain hidden data, and to recover any such data if this was the case for gathering intelligence on their plans and operations.

For that, we will create a high performance and scalable video steganalysis tool called SEEK (Steganalytic vidEo rEsearch frameworK).

The tool will be at the core of a system capable of locating, collecting, analyzing, and sanitizing videos shared on the Internet by terrorists or their affiliates.

While primarily aimed at helping counter terrorism and law enforcement, with a primary objective of significantly enhancing UK security, the outcomes of the SEEK proposal will also benefit a number of other disciplines and activities.

We will contribute to the UK digital economy by improving the security of companies in general and video hosting or sharing sites in particular.

For instance, some of SEEKs outputs will directly help companies eliminate any hidden data in any video, and detect and stop data loss when video steganography is used by cyber criminals to exfiltrate stolen data stealthily, which is becoming an increasingly common practice.

SEEK also has some potential as a business venture expanding as steganalysis as a service (including analysis of other media), which could create jobs and bring unique technological expertise in the UK.

The results of the project will allow video providers (such as Youtube, Twitter, Facebook, etc.) to ensure their services are not being abused by terrorists or other criminals to communicate secretly. The recent case of the Hammertoss malware (that uses image steganography over Twitter) is a worrying example of what could be a trend in the future. Additionally, some of the outcomes of the project will decisively help organizations to detect video steganography in their networks, which is becoming one of the most threatening vectors for exfiltrating stolen data after a security breach. This could have a major impact on organisations dealing with large databases of private data, but also on their millions of customers. We will make sure that online video service providers and private organisations will have knowledge and access to the project results.

We will investigate the commercial exploitation of the research outcomes of the project, and study the possibility of creating a start-up company to offer consultancy. This will contribute to the creation of jobs and expertise. We plan the Public Sector and the Wider Public to benefit directly from an increased security level, thanks to our freely available, well documented, easy-to-use outputs. This approach would also suit most SMEs. But we also envisage large companies willing to have a more customized solution, closer to their specific needs and policies, and with particular targets regarding accuracy and throughput.

Law enforcement in general and counter-terrorist units in particular will benefit from our outputs. They will for the first time be able to detect terrorist and other cybercriminals communications using video steganography. This could also be valuable in the fight against paedophiles, which constitute the oldest well-known group of criminals employing steganography. Our findings could help to discover communication channels, forums, websites, accounts and users that have previously stayed under the radar.

We have prepared a set of activities aimed to maximize the impact in the general public. Our activities are focused on two goals: making science accessible to the general public and increasing societal awareness and interest in the area, attracting talent towards future careers in cybersecurity.

The proposed project will also stimulate academic research in steganalysis and build much needed expertise in the UK. We will additionally attract academic interest by developing a BOSS (Break Our Steganographic System) challenge. The challenge will take part as a side activity run in parallel with a security related conference. %Some related disciplines will clearly benefit from our developments, notably computer forensics and privacy.

This project will decisively contribute to the initial stages of a future UK hub on steganography and steganalysis in many ways, not least by creating expertise in the area, gaining both national and international visibility and recognition for our research groups and field, and by attracting talent to the area by means of the Lounge (see Pathways to Impact document). We will push forward the state of the art on the disciplines we will cover quite significantly, based on our novel computer forensics-based approach to steganalysis, and our strong focus on analysing real, practical tools -- the popular ones which have thousands of users, not limiting ourselves (though covering them as well) to purely academic or theoretical developments.