Deep Learning-based Automatic Speech Recognition (ASR) models are very successful, but hard to interpret. To gain a better understanding of how Artificial Neural Networks (ANNs) accomplish their tasks, several introspection methods have been proposed. However, established introspection techniques are mostly designed for computer vision tasks and rely on the data being visually interpretable, which limits their usefulness for understanding speech recognition models. To overcome this limitation, we developed a novel neuroscience-inspired technique for visualizing and understanding ANNs, called Saliency-Adjusted Neuron Activation Profiles (SNAPs). SNAPs are a flexible framework to analyze and visualize Deep Neural Networks that does not depend on visually interpretable data. In this work, we demonstrate how to utilize SNAPs for understanding fully-convolutional ASR models. This includes visualizing acoustic concepts learned by the model and the comparative analysis of their representations in the model layers.

Stego-malware is a current trend of cyber-criminals to work as unobtrusively as possible in target systems. Common covers are image data but also audio data is plausible. In this paper three exemplary selected MP3 steganography tools (MP3Stego, MP3Stegz and Stegonaut) are forensically investigated to enhance knowledge on how steganographic algorithms can be identified and attributed in a malware scenario. Our study is driven by known steganalysis artefacts and source code analysis. To perform a structured analysis we follow the European Network of Forensic Science Institutes (ENFSI) guidelines for audio authenticity analysis and derive a trace map with meta data and content data from a systematic file structure analysis. From our findings summarised in the trace map, we derive detection patterns to identify the used steganography tool with an embedding algorithm signature. Furthermore, we discuss how known malformed actions from a code book (known malware dictionary) can be attributed with a side-informed capacity analysis and attribution. From the pattern we formulate YARA rules for the configuration of corresponding detectors.