In this paper we analyse Stegdetect, one of the well-known image steganalysis tools, to study its false positive ratio. In doing so, we process more than 40,000 image files randomly downloaded from the internet using Google images, together with 25,000 images from the ASIRRA (Animal Species Image Recognition for Restricting Access) public corpus. The aim of this study is to help digital forensic analysts aiming to study a large number of image files during an investigation. The results obtained shows that the ratio of false positive generated by Stegdetect depends highly on setting the sensitivity value, and it is generally quite high. This should inform the forensic expert and help to better interpret results, particularly false positives. Additionally, we have provided a detailed statistical analysis for the obtained results to study the difference in 'difference in detection' between selected groups, close groups and different groups, of images. This method can be applied to any other steganalysis tools, which gives the analyst a better understanding of the results, especially when he has no prior information about the false positive ratio of the selected tool.

This paper proposes a new method of 2LSB embedding steganography in still images. The proposed method considers a single mismatch in each 2LSB embedding between the 2LSB of the pixel value and the 2-bits of the secret message, while the 2LSB replacement overwrites the 2LSB of the image's pixel value with 2-bits of the secret message. The number of bit-changes needed for the proposed method is 0.375 bits from the 2LSBs of the cover image, and is much less than the 2LSB replacement which is 0.5 bits. It also reduces the effect of 2LSB embedding pattern of change, which results in lower probability of detection by 44% according to experimental results.

In this paper, we propose an extended pairs of values analysis to detect and estimate the amount of secret messages embedded with 2LSB replacement in digital images based on chi-square attack and regularity rate in pixel values. The detection process is separated from the estimation of the hidden message length, as it is the main requirement of any steganalysis method. Hence, the detection process acts as a discrete classifier, which classifies a given set of images into stego and clean classes. The method can accurately detect 2LSB replacement even when the message length is about 10% of the total capacity, it also reaches its best performance with an accuracy of higher than 0.96 and a true positive rate of more than 0.997 when the amount of data are 20% to 100% of the total capacity. However, the method puts no assumptions neither on the image nor the secret message, as it tested with two sets of 3000 images, compressed and uncompressed, embedded with a random message for each case. This method of detection could also be used as an automated tool to analyse a bulk of images for hidden contents, which could be used by digital forensics analysts in their investigation process.

This paper proposes a modification to the Extended Pairs of Values (EPoV) method of 2LSB steganalysis in digital still images. In EPoV, the detection and the estimation of the hidden message length were performed in two separate processes as it considered the automated detection. However, the new proposed method uses the standard deviation of the EPoV to measure the amount of distortion in the stego image made by the embedding process using 2LSB replacement, which is directly proportional with the embedding rate. It is shown that it can accurately estimate the length of the hidden message and outperform the other methods of the targeted 2LSB steganalysis in the literature. The proposed method is also more consistent with the steganalysis methods in the literature by giving the amount of difference to the expected clean image. According to the experimental results, based on analysing 3000 nevercompressed images, the proposed method is more accurate than the current targeted 2LSB steganalysis methods for low embedding rates.