sibsutisВестник СибГУТИThe Herald of the Siberian State University of Telecommunications and Information Science1998-6920СибГУТИsibsutis-723Research ArticleСтатьиЭффективный метод стегоанализа исполняемых файлов, базирующийся на коде ХаффманаEffective method of steganalysis of executable files based on Huffman codeНечтаИ. В.NechtaI. ..noemail@neicon.ruСибГУТИ. Ассистент кафедры прикладной математики и кибернетикиRussian Federation201006022023044754Copyright © Нечта И.В., 20232023Нечта И.В.Nechta I...Данная работа распространяется под лицензией Creative Commons Attribution 4.0.This work is licensed under a Creative Commons Attribution 4.0 License.https://vestnik.sibsutis.ru/jour/article/view/723

В статье предлагается эффективный метод обнаружения внедрения информации в специальные байты выравнивания секций файлов формата Portable Executable. При стегоанализе используются различия статистических свойств кода и встраиваемого «скрытого» сообщения. Экспериментально получены данные о высокой вероятности обнаружения внедрённого сообщения.

Methods of data hiding in executable files (programs) are considered. Steganalysis of method which uses blank spaces in executable files is carried out. It is shown experimentally that the hidden data are detected with high confidence.

СтеганографиястегоанализPortable ExecutableReferencesHamilton J., Danicic S. An Evaluation of Static Java Bytecode Watermarking // ICCSA'10 "The World Congress on Engineering and Computer Science". San Francisco. 2010.Hamilton J., Danicic S. An Evaluation of Static Java Bytecode Watermarking // ICCSA'10 "The World Congress on Engineering and Computer Science". San Francisco. 2010.Нечта И.В., Фионов А.Н. Цифровые водяные знаки в программах на СС++ // Материалы XI международной научно-практической конференции "Информационная безопасность" Таганрог: Изд. ТТИ ЮФУ. 2010. Ч. 3. С. 108-113.Нечта И.В., Фионов А.Н. Цифровые водяные знаки в программах на СС++ // Материалы XI международной научно-практической конференции "Информационная безопасность" Таганрог: Изд. ТТИ ЮФУ. 2010. Ч. 3. С. 108-113.Davidson R., Myhrvold N. Method and system for generating and auditing a signature for a computer program // US Patent 5559884. 1996.Davidson R., Myhrvold N. Method and system for generating and auditing a signature for a computer program // US Patent 5559884. 1996.El-Khalil R., Keromytis A. Hydan: hiding information in program binaries // VI International Conference "Information and Communications Security". Berlin: Springer. 2004. V. 3269. P. 187-199.El-Khalil R., Keromytis A. Hydan: hiding information in program binaries // VI International Conference "Information and Communications Security". Berlin: Springer. 2004. V. 3269. P. 187-199.Blascol J., Hernandez-Castol J. Steganalysis of Hydan // IFIP Advances in Information and Communication Technology. 2009. V. 297/2009, P. 132-142.Blascol J., Hernandez-Castol J. Steganalysis of Hydan // IFIP Advances in Information and Communication Technology. 2009. V. 297/2009, P. 132-142.Hattanda K., Ichikawa S. The Evaluation of Davidson's Digital Signature Scheme // I EICE transactions on Fundamentals of Electronics, Communications and Computer Sciences. 2004. V. E87-A. №.1. P. 224-225.Hattanda K., Ichikawa S. The Evaluation of Davidson's Digital Signature Scheme // I EICE transactions on Fundamentals of Electronics, Communications and Computer Sciences. 2004. V. E87-A. №.1. P. 224-225.Naji A., Teddy S. Algorithms to Watermark Software Through Register Allocation // Lecture Notes in Computer Science, 2006. V. 3919/2006, P. 180-191.Naji A., Teddy S. Algorithms to Watermark Software Through Register Allocation // Lecture Notes in Computer Science, 2006. V. 3919/2006, P. 180-191.Нечта И.В. Стеганография в файлах формата Portable Executable // Вестник СибГУТИ. 2009. №1. С. 85-89.Нечта И.В. Стеганография в файлах формата Portable Executable // Вестник СибГУТИ. 2009. №1. С. 85-89.Naji A., Teddy S. New Approach of Hidden Data in the portable Executable File without Change the Size of Carrier File Using Statistical Technique // International Journal of Computer Science and Network Security. 2009. V. 9. № 7. P. 218-224.Naji A., Teddy S. New Approach of Hidden Data in the portable Executable File without Change the Size of Carrier File Using Statistical Technique // International Journal of Computer Science and Network Security. 2009. V. 9. № 7. P. 218-224.Zaidan A., Zaidan B., Jalab H. A. A New System for Hiding Data within (Unused Area Two + Image Page) of Portable Executable File using Statistical Technique and Advance Encryption Standard // International Journal of Computer Science and Network Security. 2010. V. 2. № 2.Zaidan A., Zaidan B., Jalab H. A. A New System for Hiding Data within (Unused Area Two + Image Page) of Portable Executable File using Statistical Technique and Advance Encryption Standard // International Journal of Computer Science and Network Security. 2010. V. 2. № 2.Shin D., Kim Y., Byun K., Lee S. Data Hiding in Windows Executable Files // Australian Digital Forensics Conference. 2008. P. 51.Shin D., Kim Y., Byun K., Lee S. Data Hiding in Windows Executable Files // Australian Digital Forensics Conference. 2008. P. 51.Pietrek M. Peering Inside the PE: A Tour of the Win32 Portable Executable File Format // URL: http://msdn.microsoft.com/enus/magazine/cc301805.aspx (дата обращения: 01.11.2010).Pietrek M. Peering Inside the PE: A Tour of the Win32 Portable Executable File Format // URL: http://msdn.microsoft.com/enus/magazine/cc301805.aspx (дата обращения: 01.11.2010).Ryabko B., Monarev V. Using information theory approach to randomness testing // Journal of Statistical Planning and Inference. 2005. V. 133, №1. P. 95-110.Ryabko B., Monarev V. Using information theory approach to randomness testing // Journal of Statistical Planning and Inference. 2005. V. 133, №1. P. 95-110.Ryabko B., Monarev V. Experimental investigation of forecasting methods based on data compression algorithms // Problems of Information Transmission. 2005. V. 41, № 1. P. 65-69.Ryabko B., Monarev V. Experimental investigation of forecasting methods based on data compression algorithms // Problems of Information Transmission. 2005. V. 41, № 1. P. 65-69.Ryabko B., Astola J. Universal codes as a basis for time series testing // Statistical Methodology. 2006. V. 3. P. 375-397.Ryabko B., Astola J. Universal codes as a basis for time series testing // Statistical Methodology. 2006. V. 3. P. 375-397.Ryabko B., Astola J. Universal codes as a basis for nonparametric testing of serial independence for time series // Journal of Statistical Planning and Inference. 2006. V. 136, № 12. P. 4119-4128.Ryabko B., Astola J. Universal codes as a basis for nonparametric testing of serial independence for time series // Journal of Statistical Planning and Inference. 2006. V. 136, № 12. P. 4119-4128.Ryabko B. Compression-based methods for nonparametric density estimation, on-line prediction, regression and classification for time series // 2008 IEEE Information Theory Workshop. Porto, Portugal. 2008.Ryabko B. Compression-based methods for nonparametric density estimation, on-line prediction, regression and classification for time series // 2008 IEEE Information Theory Workshop. Porto, Portugal. 2008.

The authors declare that there are no conflicts of interest present.