  Mp3 is a very popular audio format and hence it can be a good host for
carrying hidden messages. Therefore, different steganography methods have been
proposed for mp3 hosts. But, current literature has only focused on
steganalysis of mp3stego. In this paper we mention some of the limitations of
mp3stego and argue that UnderMp3Cover (Ump3c) does not have those limitations.
Ump3c makes subtle changes only to the global gain of bitstream and keeps the
rest of bitstream intact. Therefore, its detection is much harder than
mp3stego. To address this, joint distributions between global gain and other
fields of mp3 bit stream are used. The changes are detected by measuring the
mutual information from those joint distributions. Furthermore, we show that
different mp3 encoders have dissimilar performances. Consequently, a novel
multi-layer architecture for steganalysis of Ump3c is proposed. In this manner,
the first layer detects the encoder and the second layer performs the
steganalysis job. One of advantages of this architecture is that feature
extraction and feature selection can be optimized for each encoder separately.
We show this multi-layer architecture outperforms the conventional single-layer
methods. Comparing results of the proposed method with other works shows an
improvement of 20.4% in the accuracy of steganalysis.
