Steganalysis

A foundational detection method that compares the observed frequency distribution of pixel values or transform coefficients against the theoretically expected distribution of an unaltered carrier.

• Mechanism: Calculates the chi-square statistic to measure the goodness-of-fit between the empirical histogram and the expected distribution. A high chi-square value indicates a statistically significant deviation, flagging potential embedding.
• Target: Most effective against sequential LSB replacement steganography, where the act of overwriting the least significant bit forces pairs of values (PoVs) to converge, creating a detectable statistical imbalance.
• Limitation: Easily defeated by randomized embedding paths or content-adaptive algorithms that preserve the global histogram.

A universal blind steganalysis approach that computes a massive, high-dimensional feature vector from diverse noise residuals to train an ensemble classifier.

• Spatial Rich Model (SRM): Constructs 34,671 features by applying linear and non-linear high-pass filters to extract various noise components, then computing co-occurrence matrices that capture local dependencies between neighboring residual samples.
• Ensemble Classifier: Uses a Fisher Linear Discriminant trained on random subspaces of the SRM feature set, providing low computational complexity while maintaining high detection accuracy across unknown embedding algorithms.
• Advantage: Does not require prior knowledge of the specific steganographic algorithm used, making it robust against novel or proprietary embedding methods.

A technique that estimates the cover image's original statistics by re-compressing the suspect image, then comparing the two to isolate embedding artifacts from scene content.

• Process: The suspect JPEG is decompressed, cropped by 4 pixels in each direction, and re-compressed with the same quantization table. This calibrated reference approximates the statistical properties of the original cover before embedding.
• Feature Extraction: Differences in DCT coefficient histograms and block-wise co-occurrence matrices between the suspect and calibrated images reveal the subtle perturbations introduced by steganographic embedding in the quantized DCT domain.
• Key Algorithms: Forms the basis of the JPEG Rich Model (JRM) and the CC-PEV feature set, which are highly effective against modern JPEG steganography tools like J-UNIWARD.

Identifies steganography by detecting violations of the known structural constraints and format specifications of the carrier file type.

• File Format Parsing: Examines whether data is appended after the End-of-Image (EOI) marker in JPEGs or hidden in unused chunks of the PNG specification, such as ancillary tEXt or iTXt chunks.
• Palette Analysis: For indexed images (GIF, PNG-8), detects embedding by analyzing the frequency and ordering of color palette entries. Steganography often introduces near-duplicate colors or reorders the palette to encode data in the LSB of pixel indices.
• LSB Steganography Signatures: Detects the specific byte patterns and padding sequences left by common tools like Steghide or OpenStego in the carrier file's metadata or comment fields.

Employs convolutional neural networks to automatically learn hierarchical representations of steganographic noise directly from raw data, bypassing handcrafted feature engineering.

• Architectures: Networks like SRNet and Zhu-Net use specialized layers with fixed high-pass filters in the first layer to suppress image content and amplify the low-amplitude stego noise signal.
• Advantage over Rich Models: Deep learning models can learn complex, non-linear dependencies and embedding artifacts that are not captured by co-occurrence-based features, achieving state-of-the-art detection rates against content-adaptive steganography.
• Challenge: Requires large, carefully curated datasets and is susceptible to cover-source mismatch, where a model trained on images from one camera performs poorly on images from another.

A quantitative steganalysis technique that estimates the number and spatial location of modified pixels or coefficients, moving beyond binary classification to precise tampering localization.

• Quantitative Steganalysis: Uses regression models trained on SRM features or deep learning activation maps to predict the embedding rate (bits per pixel or bits per non-zero AC DCT coefficient) in local regions of the image.
• Spatial Localization: Generates a heatmap indicating the probability that each pixel or 8x8 block contains embedded data. This is critical for forensic investigators who need to know where the hidden payload resides, not just if it exists.
• Application: Essential for extracting the hidden message by identifying the correct sequence of modified elements, which is a prerequisite for any subsequent cryptanalysis of the embedded ciphertext.

The primary mathematical foundation for modern steganalysis. This technique transforms a carrier file (image, audio) from its spatial or time representation into the frequency domain using Discrete Cosine Transform (DCT) or Fast Fourier Transform (FFT). Steganographic embedding often disturbs the natural high-frequency coefficients, creating detectable statistical anomalies invisible to the naked eye. By analyzing histograms of quantized DCT coefficients, analysts can detect even low-payload LSB matching or F5 algorithm insertions.

A machine-learning-driven approach that moves beyond simple histogram analysis. Spatial Rich Models (SRM) compute a high-dimensional set of noise residuals by applying diverse linear and non-linear filters. The co-occurrence matrices of these residuals are then used to train an ensemble classifier. This method is highly effective against adaptive steganography techniques like HUGO or WOW, which attempt to minimize distortion by embedding in textured, noisy regions while preserving the carrier's statistical model.

Modern architectures like Xu-Net and Yedroudj-Net use convolutional neural networks to automatically learn hierarchical feature representations for detection. Unlike hand-crafted Rich Models, these networks incorporate high-pass filtering in their first layer to suppress image content and amplify the subtle stego noise introduced during embedding. This approach has proven superior for detecting content-adaptive schemes, as the network learns to identify the complex, non-linear relationships between embedding probabilities and local pixel neighborhoods.

A targeted steganalysis objective that goes beyond binary classification. Instead of simply determining if a file contains hidden data, this technique aims to identify the specific pixels or coefficients modified during embedding. By analyzing the embedding probability map, forensic analysts can localize the secret message. This is critical for quantitative steganalysis, where the goal is to estimate the length of the hidden payload, often by detecting the statistical saturation of the least significant bit planes.

A complementary approach that bypasses pixel-level statistics. This method examines the file's structural integrity for signs of post-processing caused by steganographic tools. Key indicators include:

• Mismatched headers: A JPEG file with a thumbnail that has a different quantization table.
• Trailing data: Appended bytes after the End-of-Image (EOI) marker.
• Palette anomalies: Unnatural ordering or near-duplicate colors in indexed images (GIF/PNG) used to hide data via palette-based embedding.

A universal technique used when the original 'cover' file is unavailable. Calibration involves creating a proxy for the original by re-compressing or down-sampling the suspect image to erase potential stego noise. The statistical features of the suspect image are then compared against this calibrated reference. A significant divergence in features like the blockiness metric or co-occurrence matrices strongly indicates the presence of hidden data, enabling blind steganalysis without prior knowledge of the embedding algorithm.