Steganalysis: Detecting Hidden Messages

The most basic steganalysis technique is simply looking closely at a suspicious image. Zooming in to the pixel level and examining regions of uniform colour can reveal block artefacts or noise patterns inconsistent with the image content. Converting to greyscale, adjusting contrast, and examining colour histograms can expose anomalies that suggest steganographic embedding has occurred in specific regions.

The chi-square test is a classical statistical test for LSB steganography. Natural images have characteristic distributions of colour values where adjacent even-odd value pairs occur with similar frequency. LSB embedding changes odd values to even or vice versa, creating detectable imbalances in these pairs. The chi-square statistic measures the deviation from expected pair frequencies and rises significantly when embedding is detected.

Sample pair analysis is a more sophisticated LSB detector that estimates the embedded message length, not just whether embedding occurred. It counts the transitions between neighbouring pixel value pairs and models how those counts change with different amounts of embedded data. By fitting the observed counts to the model, an analyst can estimate what fraction of the carrier capacity has been used.

Image quality metrics like PSNR (Peak Signal-to-Noise Ratio) and SSIM (Structural Similarity Index) compare a suspicious image to an assumed clean reference or to a statistical model of natural images. Very high PSNR suggests minimal modification; anomalously even noise distribution across the image (rather than concentrated in complex regions) suggests systematic LSB manipulation rather than natural camera noise.

RS analysis divides image pixels into groups and classifies them as Regular, Singular, or Unusable based on how their smoothness measure changes when the LSBs are flipped. In natural images the proportion of Regular groups slightly exceeds Singular groups. LSB embedding equalises these proportions in a predictable way. Measuring R and S values before and after LSB flipping provides a robust detector that estimates embedding rate.

Targeted steganalysis is designed to detect a specific steganography tool or algorithm by exploiting its particular statistical signature. Blind steganalysis, also called universal steganalysis, attempts to detect any hidden content without knowing which tool was used. Blind methods typically extract hundreds of statistical features from the image and use machine learning classifiers trained on known clean and stego images.

Modern steganalysis uses convolutional neural networks trained on large datasets of clean and stego images. The CNN learns to identify the subtle second-order statistical differences introduced by steganographic embedding. Models like SRNet and Yedroudj-Net achieve very high detection rates against current steganography tools, even at low embedding rates of 0.1 bits per pixel. The arms race between embedding and detection continues.

StegExpose is an open-source batch steganalysis tool that runs multiple detection algorithms on a set of images and combines the scores. It implements chi-square, RS analysis, primary sets, and sample pair analysis, producing a combined probability score. Security teams use it to scan large image repositories for potential data exfiltration. It is effective against common tools like Steghide, OpenStego, and Outguess.

Many steganography tools leave characteristic artefacts beyond statistical anomalies. Steghide, for example, produces a specific pattern in the first few bytes of modified WAV files. OpenPuff modifies the file header in a recognisable way. These tool signatures allow forensic software to identify not just that steganography was used, but which specific tool was employed, which helps guide the extraction attempt.

Unexpectedly large files for their content type can indicate hidden payload. A PNG screenshot that is twice the expected file size for its dimensions may contain a hidden archive. Comparing actual file sizes against expected sizes based on dimensions, colour depth, and compression settings provides a quick triage method for identifying suspicious files before performing detailed steganalysis.

Digital forensics investigations look for signs of steganography tool installation or use, not just the carrier files themselves. Browser history showing visits to steganography software download pages, installed applications like OpenStego, and temporary files from steganographic operations can all be forensic indicators. Registry entries on Windows may log recently opened files that were used as carriers or sources of hidden data.

Which steganalysis technique estimates the amount of hidden data by modelling how pixel pair transition counts change with embedding rate?

Steganalysis ranges from visual inspection to sophisticated machine learning classifiers. Chi-square and RS analysis are classical statistical detectors for LSB embedding. Sample pair analysis estimates the embedding rate. Machine learning CNNs achieve high detection rates against modern tools. StegExpose combines multiple tests for batch scanning. Tool signatures and file size anomalies provide additional forensic indicators beyond pure statistical analysis.