Steganalysis

<h2 id="overview">Overview</h2>
<p>The goal of steganalysis is to identify suspected packages, determine whether or not they have a payload encoded into them, and, if possible, recover that payload.  
</p><p>Unlike cryptanalysis, in which intercepted data contains a message (though that message is <a href="/facts/Encrypted/16q29Fdv">encrypted</a>), steganalysis generally starts with a pile of suspect data files, but little information about which of the files, if any, contain a payload.  The steganalyst is usually something of a forensic statistician, and must start by reducing this set of data files (which is often quite large; in many cases, it may be the entire set of files on a computer) to the subset most likely to have been altered.
</p>
<h2 id="basic-techniques">Basic techniques</h2>
<p>The problem is generally handled with statistical analysis.  A set of unmodified files of the same type, and ideally from the same source (for example, the same model of digital camera, or if possible, the <i>same</i> digital camera; digital audio from a CD MP3 files have been "ripped" from; etc.) as the set being inspected, are analyzed for various statistics.  Some of these are as simple as spectrum analysis, but since most image and audio files these days are compressed with <a href="/facts/Lossy_compression/jHW7DDv3">lossy compression</a> algorithms, such as <a href="/facts/JPEG/HQ8QS3uB">JPEG</a> and <a href="/facts/MP3/yrBpxUSD">MP3</a>, they also attempt to look for inconsistencies in the way this data has been compressed.  For example, a common artifact in JPEG compression is "edge ringing", where high-frequency components (such as the high-contrast edges of black text on a white background) distort neighboring pixels.  This distortion is predictable, and simple steganographic encoding algorithms will produce artifacts that are detectably unlikely.
</p><p>One case where detection of suspect files is straightforward is when the original, unmodified carrier is available for comparison.  Comparing the package against the original file will yield the differences caused by encoding the payload—and, thus, the payload can be extracted.
</p>
<h2 id="advanced-techniques">Advanced techniques</h2>
<h3>Noise floor consistency analysis</h3>
<p>In some cases, such as when only a single image is available, more complicated analysis techniques may be required.  In general, steganography attempts to make distortion to the carrier indistinguishable from the carrier's <a href="/facts/Noise_floor/upf5bAvq">noise floor</a>.  In practice, however, this is often improperly simplified to deciding to make the modifications to the carrier resemble <a href="/facts/White_noise/wJ0SR21n">white noise</a> as closely as possible, rather than analyzing, modeling, and then consistently emulating the actual noise characteristics of the carrier.  In particular, many simple steganographic systems simply modify the <a href="/facts/Least_significant_bit/94h4P3qr">least-significant bit</a> (LSB) of a sample; this causes the modified samples to have not only different noise profiles than unmodified samples, but also for their LSBs to have different noise profiles than could be expected from analysis of their higher-order bits, which will still show some amount of noise.  Such LSB-only modification can be detected with appropriate algorithms, in some cases detecting encoding densities as low as 1% with reasonable reliability.<a class="footnote-ref" id="fnref:1" href="#fn:1"><sup>1</sup></a>
</p>
<h2 id="further-complications">Further complications</h2>
<h3>Encrypted payloads</h3>
<p>Detecting a probable steganographic payload is often only part of the problem, as the payload may have been encrypted first.  Encrypting the payload is not always done solely to make recovery of the payload more difficult.  Most strong <a href="/facts/Cipher/eJnuftYe">ciphers</a> have the desirable property of making the payload appear indistinguishable from uniformly-distributed noise, which can make detection efforts more difficult, and save the steganographic encoding technique the trouble of having to distribute the signal energy evenly (but see above concerning errors emulating the native noise of the carrier).
</p>
<h3>Barrage noise</h3>
<p>If inspection of a storage device is considered very likely, the steganographer may attempt to barrage a potential analyst with, effectively, <a href="/facts/Misinformation/L8N5r8np">misinformation</a>. This may be a large set of files encoded with anything from random data, to white noise, to meaningless drivel, to deliberately misleading information. The encoding density on these files may be slightly higher than the "real" ones; likewise, the possible use of multiple algorithms of varying detectability should be considered. The steganalyst may be forced into checking these decoys first, potentially wasting significant time and computing resources. The downside to this technique is it makes it much more obvious that steganographic software was available, and was used.
</p>
<h2 id="conclusions-and-further-action">Conclusions and further action</h2>
<p>Obtaining a <a href="/facts/Warrant_(law)/FFF844gM">warrant</a> or taking other actions based solely on steganalytic evidence is a very dicey proposition unless a payload has been completely recovered <i>and decrypted</i>, because otherwise all the analyst has is a statistic indicating that a file <i>may</i> have been modified, and that modification <i>may</i> have been the result of steganographic encoding.  Because this is likely to frequently be the case, steganalytic suspicions will often have to be backed up with other investigative techniques.
</p>
<h2 id="see-also">See also</h2>

<ul><li><a href="/facts/Audio_watermark_detection/dr5IXn7p">Audio watermark detection</a></li>
<li><a href="/facts/BPCS-Steganography/XCMQgkVz">BPCS-Steganography</a></li>
<li><a href="/facts/Computer_forensics/g59dDNYz">Computer forensics</a></li>
<li><a href="/facts/Covert_channel/Hoxzd5oM">Covert channel</a></li>
<li><a href="/facts/Cryptography/e94PEVau">Cryptography</a></li>
<li><a href="/facts/Data_compression/gMFuY4FT">Data compression</a></li>
<li><a href="/facts/Steganographic_file_system/ja9IP50E">Steganographic file system</a></li>
<li><a href="/facts/Steganography/RGLdKYcE">Steganography</a></li>
<li><a href="/facts/Steganography_tools/soNYDEme">Steganography tools</a></li></ul>

<h2 id="bibliography">Bibliography</h2>
<ul><li>Geetha, S; Siva S.Sivatha Sindhu (October 2009). "Blind image steganalysis based on content independent statistical measures maximizing the specificity and sensitivity of the system". <i>Computers and Security</i>. Elsevier, Science Direct. 28 (7): 683–697. <a href="/facts/Doi_(identifier)/muM9Etpq">doi</a>:<a href="https://doi.org/10.1016%2Fj.cose.2009.03.006">10.1016/j.cose.2009.03.006</a>.</li>
<li>Geetha, S; Dr. N. Kamaraj (July 2010). "Evolving decision tree rule based system for audio stego anomalies detection based on Hausdorff distance statistics". <i>Information Sciences</i>. Elsevier, Science Direct. 180 (13): 2540–2559. <a href="/facts/Doi_(identifier)/muM9Etpq">doi</a>:<a href="https://doi.org/10.1016%2Fj.ins.2010.02.024">10.1016/j.ins.2010.02.024</a>.</li></ul>
<h2 id="external-links">External links</h2>
<ul><li><a href="http://www.jjtc.com/Steganalysis">Steganalysis</a> research and papers by <a href="http://www.jjtc.com">Neil F. Johnson</a> addressing attacks against <a href="http://www.jjtc.com/Steganography">Steganography and Watermarking</a>, and Countermeasures to these attacks.</li>
<li><a href="http://isis.poly.edu/projects/stego/">Research Group</a> <a href="https://web.archive.org/web/20160816184035/http://isis.poly.edu/projects/stego/">Archived</a> 2016-08-16 at the <a href="/facts/Wayback_Machine/nmQ3a6JC">Wayback Machine</a>.  Ongoing research in Steganalysis.</li>
<li><a href="http://www.krenn.nl/univ/cry/steg/">Steganography - Implementation and detection</a> Short introduction on steganography, discussing several information sources in which information can be stored</li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>Patent No. 6,831,991, Reliable detection of LSB steganography in color and grayscale images; Fridrich, Jessica, et al., issued December 14th, 2004.  (This invention was made with Government support under F30602-00-1-0521 and F49620-01-1-0123 from the U.S. Air Force. The Government has certain rights in the invention.) <a href="http://patft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.htm&r=1&f=G&l=50&s1=6831991.PN.&OS=PN/6831991&RS=PN/6831991" target="_blank">http://patft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO1&Sect2=HITOFF&d=PALL&p=1&u=%2Fnetahtml%2FPTO%2Fsrchnum.htm&r=1&f=G&l=50&s1=6831991.PN.&OS=PN/6831991&RS=PN/6831991</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
</ol>

Steganalysis open-in-new

Steganalysis