Support of Forensic Attribution by Visualizing Textual Embeddings of Stegomalware

The goal of this work is to support forensic procedures and models in attribution by demonstrating how the categorization and characterization of attackers or attacker groups, who use steganographic text channels to embed stegomalware, can be effectively supported through the visualization of embeddings.The rapid advancements in artificial intelligence are expected to significantly simplify and enhance the use of covert channels in text, making the visualization of embeddings an essential and indispensable component.Only by effectively detecting and clearly presenting steganographic embeddings can the characterization and categorization of such activities be performed meaningfully and accurately.To achieve this, embeddings from various steganographic algorithms were analyzed, and requirements for their visualization were developed.These requirements emphasize clarity, interpretability, and measurable outcomes.Based on these criteria, the visualization methods for different steganographic techniques were optimized to ensure that embeddings are not only easily recognizable but also straightforward to interpret.This process also highlights the importance of making such visualizations accessible and applicable in practical forensic scenarios.As a result, this research presents a specialized tool capable of detecting embeddings across multiple algorithms and displaying them in an interpretable and understandable way.This tool simplifies the analysis of texts containing steganographic embeddings.In some cases, the tool even makes it possible to visualize the embeddings in the first place.It further facilitates the characterization and categorization of attackers and their strategies, thereby contributing to more effective attribution in the context of cyber forensics.