Network Stegoinsider Detection

Abstract

The number of crimes committed by insiders has increased dramatically over the past 10 years. Insiders use various technologies, including steganography, to bypass security measures and steal confidential information. In this paper, we analyse the methods that can be used to identify the steganographic channel and steganographic insider, such as Shannon information entropy method, Kolmogorov-Smirnov method, probability distribution variance comparison method, machine learning method and neural network method. Based on these methods, some programs were written to identify steganographic channels in the network. Each of the methods was tested on real enterprise traffic. As a result it is possible to say whether these methods are suitable for use in the enterprise network or nor.