The growing interest in Voice over Internet Protocol (VoIP) communications increased the fear that criminal and terrorist groups are switching to this technology to coordinate their operations. VoIP services that cannot be monitored and lawfully intercepted may be used to perform illegal activity. Converged networks are vulnerable to steganographic attacks due to their high bandwidth usage. This feature provides a way to embed hidden messages in either the VoIP signaling or media streams making steganalysis harder to accomplish. This paper discusses a systematic approach to analyze steganography in VoIP using misuse patterns [Pel09]. Misuse patterns describe, from the point of view of the attacker, how a type of information misuse is performed, analyzes the ways of stopping the attack, and considers how to trace the attack once it has happened. The pattern also attempts to correlate events with specific parts of the system. We will use these semiformal models as a method to improve the detection of embedded hidden messages in IP telephony.