Improved Detection of LSB Steganography in Grayscale Images

Abstract

Abstract. We consider methods for answering reliably the question of whether an image contains hidden data; the focus is on grayscale bitmap images and simple LSB steganography. Using a distributed computation network and a library of over 30,000 images we have been carefully evaluating the reliability of various steganalysis methods. The results suggest a number of improvements to the standard techiques, with particular benefits gained by not attempting to estimate the hidden message length. Extensive experimentation shows that the improved methods allow reliable detection of LSB steganography with between 2 and 6 times smaller embedded messages.

Steganalysis of LSB matching in grayscale images

“…Even scanned images that have never been subject to JPEG compression, which are usually very noisy and difficult to predict, tend to have this property (we observed a correlation coefficient of 0.9737 from a set of 3000 images never subject to JPEG compression). 2 We conclude that, for images without hidden data (2) Second, although the LSB matching process does introduce noise into the downsampled cover image and consequently reduces the COM of the HCF, we have observed that it does so to a lesser extent than in the full-sized images, i.e.,…”

“…Because the eye cannot detect the very small perturbations it introduces into an image and because it is extremely simple to implement, 1 LSB methods are commonly used among the many free steganography tools available on the internet. There are two types of LSB steganography: LSB replacement can be uncovered relatively easily and is thoroughly examined in [2]- [4], but fewer and weaker detectors have been proposed for LSB matching. It is the latter we consider here, in the particular case when the covers are grayscale images.…”

“…The distinction is in the asymmetries inherent in LSB replacement-a cover pixel with an even value might be left alone or might be incremented by one but never decremented; the converse is true for odd-valued cover pixels. The detectors of [2]- [4] are exploiting this asymmetry, which is not induced by LSB matching. Indeed, these detectors are completely ineffective in exposing LSB matching.…”

Double Phase Modular Steganography Using Error Images of Lossy Wavelet Transforms

“…Numbers 5 and 1 are again converted using those pixels with their corresponding Base greater than or equal to 2. Thus, 5 is represented as (12) 4,3 . Numbers 1 and 2 have to be embedded in two different ways, as stated in Phase 2.…”

“…(LSBM) [3] applies minor changes after LSB replacement, because it randomly increments or decrements the LSB of a pixel according to a pseudo random number generator (PRNG), if the secret bit does not match the pixel's LSB. Unlike LSB replacement and LSBM, which deal with the pixel values independently, LSB matching revisited (LSBMR) [4] modifies the LSBM algorithm in such a way that the choice of incrementing or decrementing the pixel value is no longer random.…”