Measures for classification and detection in steganalysis

Still and multi-media images are subject to transformations for compression, steganographic embedding and digital watermarking. In a major program of activities we are engaged in the modeling, design and analysis of digital content. Statistical and pattern classification techniques should be combined with understanding of run length, transform coding techniques, and also encryption techniques.

💡 Research Summary

The paper addresses the problem of detecting hidden information in digital media, focusing on the widely used Least Significant Bit (LSB) steganographic embedding. It proposes two complementary families of detection measures: a set of nine statistical descriptors derived from the raw bit‑string of a file (µ₁–µ₉) and a wavelet‑domain analysis based on second‑level Haar sub‑bands.

The statistical descriptors are defined as follows. µ₁ is a weighted sum of the range of k‑gram frequencies, capturing the variability of short patterns; µ₂ aggregates run‑lengths of consecutive 0s and 1s; µ₃ measures byte‑wise Hamming‑weight transitions, which tend to be larger for non‑random (i.e., embedded) data; µ₄ is the root‑mean‑square of the discrete Fourier transform of the autocorrelation function of the bit sequence, reflecting spectral flatness; µ₅ is obtained by applying an 8×8 Hadamard transform to an 8‑bit vector (or pixel value); µ₆–µ₉ are weighted entropy terms for 1‑gram through 4‑gram symbol probabilities, with experimentally tuned weights to amplify discriminative range. Together these nine values form a 9‑dimensional feature vector µ ∈ ℝ⁹, which is zero‑mean and unit‑variance normalized before being fed to a Support Vector Machine (SVM) with a Gaussian kernel.

The authors train the SVM on a dataset comprising 30 different file types (JPEG, BMP/PNM, ZIP, GZ, TEXT, PS, PDF, and “other”) using 2000 words (≈8000 bytes) per file for each class. Testing on 180 files yields an overall classification accuracy of 82.22 %, with a confusion matrix showing near‑perfect diagonal entries for most classes. This demonstrates that the statistical feature set can reliably differentiate both file format and the presence of LSB embedding.

To capture spatial correlations that are not evident in a linear bit‑stream, the second part of the work analyses images in the wavelet domain. The authors use a two‑level Haar decomposition, focusing on the LL sub‑band where most image energy resides. For each 4×4 block they compute the LL, LH, HL, and HH coefficients as simple averages of pixel values. Given an original image Sₖ with k % LSB embedding and a further “forced” embedding of i % (producing Sₖᵢ), they define three quantities: X₀ counts the number of blocks where any pixel changed; X₁ is the sum of absolute pixel differences; X₂ is the total absolute difference across the block. A normalized measure η = X₀·500 / (image size) and the signal‑to‑noise ratio Γₖᵢᴡ of the LL sub‑band are introduced. The authors analytically prove that η increases monotonically with the forced embedding i and decreases slightly with the initial embedding k, while Γₖᵢᴡ grows with k. These relationships are derived from a probabilistic model of LSB flips within a block.

Empirical validation uses two steganographic tools: Hide4PGP and a custom “CSA‑Tool” that mimics the behavior of commercial steganography software. Experiments span k = 0, 10, 20, 30, 40, 50 % and i = 10…100 % in steps of 10 %. Plots of η versus i for each k show the predicted monotonic rise, and η versus k at a fixed i = 20 % exhibits the expected decline. The trends are consistent across both tools, although the CSA‑Tool’s stronger random number generator yields slightly smaller separations. The authors argue that η, even at low forced embedding levels (≈20 %), provides a reliable indicator of the hidden payload magnitude, complementing the statistical SVM approach.

In conclusion, the paper demonstrates that combining bit‑level statistical descriptors with wavelet‑domain measures yields a robust steganalysis framework. The statistical features enable multi‑class discrimination of file types and detection of LSB embedding, while the wavelet‑based η and Γ metrics capture subtle spatial perturbations caused by embedding, improving sensitivity especially at low embedding rates. Limitations include a relatively small and homogeneous dataset and the lack of tests under compression, color‑space conversion, or additive noise. Future work is suggested to expand the dataset, evaluate robustness under common image processing operations, and compare the proposed handcrafted features with deep‑learning approaches.