Quantitative steganalysis of digital images: estimating the secret message length

Abstract

The objective of steganalysis is to detect messages hidden in cover objects, such as digital images. In practice, the steganalyst is frequently interested in more than whether or not a secret message is present. The ultimate goal is to extract and decipher the secret message. However, in the absence of the knowledge of the stego technique and the stego and cipher keys, this task may be extremely time consuming or completely infeasible. Therefore, any additional information, such as the message length or its approximate placement in image features, could prove very valuable to the analyst. In this paper, we present general principles for developing steganalytic methods that can accurately estimate the number of changes to the cover image imposed during embedding. Using those principles, we show how to estimate the secret message length for the most common embedding archetypes, including the F5 and OutGuess algorithms for JPEG, EzStego algorithm with random straddling for palette images, and the classical LSB embedding with random straddling for uncompressed image formats. The paper concludes with an outline of ideas for future research such as estimating the steganographic capacity of embedding algorithms. Basics of steganography and steganalysisThe purpose of steganography is to communicate information in a stealth manner so that anyone who inspects the messages being exchanged cannot collect enough evidence that the messages hide additional secret data. As opposed to cryptography that makes the communication unintelligible to those who do not know the proper cipher keys, steganography makes the communication inconspicuous or invisible. An old example of steganography is writing messages between the lines of an ordinary letter using invisible ink. Another simple technique is to use tiny markers (pinholes) to mark letters in a text. A very well-written historical perspective on steganography can be found in [20]. In today's digital world, invisible ink and paper have been replaced by much more versatile and practical covers for hiding messages -digital documents, images, video, and audio files. All electronic documents containing perceptually irrelevant or redundant information provide a good environment for steganographic communication. The object that holds the secret information is called the cover object. After a secret message has been hidden in the cover, the cover object becomes the stego object.

Feature-Based Steganalysis for JPEG Images and Its Implications for Future Design of Steganographic Schemes

“…One can think of the cropped /recompressed image as an approximation to the cover image or as a sideinformation. The use of the calibrated image as a side-information has proven very useful for design of very accurate targeted steganalytic methods in the past [6].…”

“…In other words, the set of stego-images should have the same statistical properties as the set of cover-images. If there exists an algorithm that can guess whether or not a given image contains a secret message with a success rate better than random guessing, the steganographic scheme is easily detectable [10] using a single scalar feature -the calibrated spatial blockiness [6]. This suggests that it should be possible to construct a very powerful feature-based detector (blind on the class of JPEG images) if we used calibrated features computed directly in the DCT domain rather than from a somewhat arbitrary wavelet decomposition.…”

A Steganographic Method for Digital Images Robust to RS Steganalysis

“…The RS steganalysis method uses a discrimination function and a flipping operation to identify three types of pixel groups -Regular (R), Singular (S) and Unchanged (U) -depending on how the flipping changes the value of the discrimination function [8]. The size of the group of pixels and the corresponding flipping mask M is initially established.…”

“…In typical images, applying the LSB flipping mask to the pixels in the group will more frequently lead in an increase in the discrimination function, rather than a decrease, and thus the total number of regular groups in an image will be larger than singular groups. The randomisation of the LSB plane forces these differences to zero, as the length of the embedded message increases [8].…”

“…The relative number of R and S groups is counted for the original image, and for the flipped version of that image (with the LSB off all pixels flipped). These will result in four points for the so-called RS diagram, which are used to estimate the value of p. A detailed description of the RS steganalysis can be found in [8]. For greyscale images, the RS steganalysis method can separate cover images from stego images with a 10% embedded message [8].…”