SteganalysisBy Om ShivamBtech CSE+LLB(Hons) Cyber LAW

4th year

University of petroleum and energy studies

Image Steganalysis

Algorithm are two types:-

(1) Specific

For the specific type of stegnographic algorithm.

(2) Generic

This is the valid for all type of stegnographic algorithm.

Specific Image Steganalysis Algorithm

Image steganography algorithms are more often based on embeddingmechanism called least significant bit (LSB) embedding

Each pixel is represented as 24-Bitmap value composed of 3 byterepresenting the R,G and B values for the three primary colors red, greenand blue respectively.

Higher RGB values for pixel implies lager intensity for instance , a pixel prepresented as FF FF FF16 as it is composed of all these primary color so thisis white.

In we make use of LSB as there is minor change in pixels which is notperceptible of human eye like FE FE FE16 would make color darker by the1/256 factor.

Several Formats

(1) GIF (Graphic interface formats)

(2) BMP( Bitmap)

(3) JPEG(Joint photographic Exchange Group)

Each formate behaves differently when a message is embedded in it.

Palette Image Steganalysis

It is for the primary used for the GIF images

Gif property

It support 8 bit pixel of the color of the pixel referenced from the palettetable of up to 256 distinct colors mapped to the 24 bit RGB color space.

What are changes happens in Steganography?

• Message embedding brings great change in the palette color of the pixels.

How Steganalysis applies to GIF?

The Steganalysis of a gif stego image is conducted by performing a statisticalanalysis of the palette table vis-à-vis the image and the detection is made whenwhen there is an appreciable change in entropy ( a measure of the variation in thein the palette colors) the change in entropy is maximal when the embeddedmessage is of maximum length.

Raw image Steganalysis

It is basically used for BMP images that are characterized by a loseless LSBplanes.

Here LSB embedding on image causes flipping of the grey scale values.

The embedding of the hidden message is going to result in the average offrequency occurrence of the pixel with two Grey scale values.

For ex:- One image has 20 pixel with one grey scale values and other 40pixel with the other grey scale value. The pixel around to be 30 pixel.

Steganalysis of BMP

Dumitrescu proposed the algorithm, algorithm assumes that an image to bemade up of horizontally adjacent pixels and classifies the set of all such pixelpairs(a,b) into four subsets depending on whether a and b are odd and even.

whether a<b, a>b , or a=b

What happens when the BMP image is embedded?

The pixel values get modified when the message embedding is done in theLSB planes leading to the membership modification across the four subsets.The statistical analyses on the change in the membership of the pixels in thestego image leads to the detection of the length of the hidden message.

For JPEG formats

Two well known steganography algorithm for hidden secret messages in jpeg images are

1. F5 algorithm

2. Outguess algorithm

F5 Algorithm

It uses matrix embedding to embed bits in the DCT( Discrete Cosine Transform)coefficients in order to minimize the number of changes to a message.

F5 mutates the histogram of DCT coefficients.

Frendrich proposes a technique for unaltered histogram to find the number ofchanges and length of secret message.

The process involves cropping the images into four column and then applyingquantization table to recompress the image. The resulting DCT will image close otthe original one.

Frendrich also proposed for the outguess algorithm

What outguess algorithm do

It is basically in random walk embed the message bits in the LSB of some of theDCT coefficients

The other DCT Coefficients are then adjusted to keep the original histogram intact.

Here the nature of the discontinues in the DCT coefficients is widelyemployed to gauge the size of hidden message.

Generic image Steganalysis Algorithm

Here we focus on the features that are monotonic and changes statisticallyas a result of message embedding.

Avivas use a set of image quality metrics(IQM) to develop a discriminatoralgorithm that differentiates cover image from stego images.

Here it is rather for analysing the image quality and performance of thealgorithm it is used for the Steganalysis.

The ANOVA( Analysis of the variance is used to test to rank the IQM basedon their F scores and identify the embedding message.

The main motive of employing this method is to detect the distortion atdifferent level of sensitivity

For example

The means square values for the human visual system (HVS) weighted errors demonstrate more sensitivity to pure blur

While the gradient measure responds to change in the texture and image periphery.

Avicas proposes another approach that analyses the seventh and eight bit of the planes of an image measure their binary similarity

Audio steganography algorithm

1. Low bit encoding

2. Phase coding

3. Spread spectrum coding

4. Echo data hiding

Low bit encoding

Here the secret message is embedded on the least significant bits of each sample.

Phase coding

It is based on the facts that the phase component of sounds are not as perceptible to the human ears as noise is

This lead to the inaudible encoding in terms of signal to perceived noise ratio and the secret message is send in the audio signal.

Spread Spectrum coding

Ss randomly spread the bits of secret data message across the frequency spectrum of the audio signal.

Echo hiding

Echo into the discrete audio signal

Here for successful hiding three parameters of the echo need to be altered

Amplitude, decay rate and delay time(off set) from the original signal

Audio Steganalysis algorithm

Zeng proposed algorithm to detect the phase coding steganography based on the analysis of phase discontinues and to detect echo stegnogarph based on the statistical moments of peak frequency

A statistical analysis of the phase difference in each audio segment can be used to monitor the change

Video Steganalysis

This technique applies to frame to frame budia created framework based on Steganalysis of Gaussian spread spectrum

These are two essential blocks

(1) Water marking attack stage to eliminate the cover media from possibly watermarked stego media.

(2) A pattern recognition stage for the detection of stegnographic activity.