*4.4. Results*

To provide an overview of multilayer steganalysis method performance, we measured the processing time for the methods applied in each layer as well as the total processing time required by our method. Each measurement was performed using the methodology described in Section 4.1.

As shown in Table 2, an increased ratio of retransmissions in the network causes an increase in processing time despite the chosen method(s). Processing time increases significantly for lower layers of steganalysis methods, including raw data steganalysis.


**Table 2.** Steganalysis performance.

In Figure 7, we show the steganalysis time for raw data steganalysis in the retransmission ratio domain. As the chart shows, an increase in the network retransmission ratio causes an increase in the processing time; this increase can be approximated by a linear function. Given that raw data steganalysis for RSTEG means storing, iterating, and comparing retransmitted segments with the original ones, the substantial near-linear increase in processing time is fully legitimate.

**Figure 7.** Raw Data Steganalysis time.

In Figure 8, we show the steganalysis time for the first-layer steganalysis in the retransmission ratio domain, which also includes raw data steganalysis for selected tra ffic. For RSTEG application, the method directs TCP segments belonging to connections that qualified as outliers for further raw data steganalysis, which means payload comparison.

The results also show an increase that can be approximated by a linear function, which makes sense because of the significant overhead required for processing separate connections, anomaly detection, and the potentially higher number of segments directed to lower-layer steganalysis.

In Figure 9, we show the steganalysis time for second-layer steganalysis in the retransmission ratio domain. Second-layer steganalysis involves selectively directing network tra ffic to first-layer steganalysis as well as raw data steganalysis. In our application, the method analyzes the retransmission ratio in the context of an individual network device, then directs outlier devices to the method that analyzes network connections and directs outlier tra ffic to payload comparison for retransmitted segments (raw data steganalysis).

**Figure 8.** First-layer Steganalysis time.

**Figure 9.** Second-layer steganalysis time.

The results show a non-linear increase in processing time, which can be closely approximated by a third-order polynomial function. Given that the method operates on the highest layer of aggregated metadata, a non-linear increase in processing time is justified. The second-layer method brings the most substantial gain in steganalysis, with an increasing retransmission ratio in our case.

The percentage gain in processing time when multilayer detection is applied is shown in Figure 10 and Table 3. The results show a significant performance gain for higher-layer detection methods (as expected). However, the gain slightly decreases in comparison to the lowest retransmission ratio applied (1%). This is a result of method selection algorithm overhead and aggregation of required metrics.


**Table 3.** Steganalysis performance gain.

**Figure 10.** Steganalysis performance gain.
