Steganalysis
Definition
The forensic discipline of detecting the presence of hidden data in a carrier file. Steganalysis uses statistical tests (chi-squared, RS analysis, sample pair analysis) and machine-learning classifiers trained on clean and stego media.
- Field
- Digital and multimedia forensics
- Goal
- Detect presence of hidden data in a carrier file
- Statistical tests
- Chi-squared, RS analysis, sample pair analysis
- Modern approach
- Machine-learning classifiers trained on clean vs stego media
Common questions
Does steganalysis recover the hidden message itself?+
Usually not on its own. Detection tests establish that a file statistically deviates from what an unmodified carrier would look like, which flags it as a candidate. Extracting the payload is a separate step that often needs the specific embedding tool or a key.
Why do chi-squared and RS analysis work on files that look visually unchanged?+
Common embedding methods like LSB substitution alter pixel or sample values in statistically predictable ways even though the change is invisible to the eye. These tests measure whether the distribution of least-significant bits departs from what natural image or audio noise would produce.
Related terms
- Blind Steganalysis
- Detection without prior knowledge of the embedding algorithm. A classifier trained on images with and without payloads generalises across multiple tools.
- Cover Medium
- The original, unmodified carrier file (image, audio, video, or document) into which secret data will be embedded. The cover medium is chosen...
- DCT Coefficient Embedding
- A steganographic technique that hides data in the quantised discrete cosine transform coefficients of a JPEG image after compression. Because the embedding...
- Embedding Rate
- The payload size divided by the carrier capacity, usually expressed as bits per pixel. Detection difficulty decreases sharply at low embedding rates...
- False Positive Rate (FPR)
- The proportion of true non-matches (or true negatives) that a classification method declares as matches (or positives). Also called the type I...
- LSB Substitution
- Least-significant-bit substitution: the lowest-order bit of each sample value (pixel colour channel or audio sample) is overwritten with one bit of the...
- Rich Model Steganalysis (SRM)
- A feature-extraction approach that computes hundreds of statistical features from pixel-residual co-occurrence matrices and feeds them to an ensemble classifier such as...
- Spread-Spectrum Embedding
- A technique that distributes the energy of the hidden message across many frequency components at very low amplitude, similar to a wideband...
- Stego Object
- The modified carrier file containing the embedded secret data. A stego object should be visually or audibly indistinguishable from the cover medium,...
- Targeted Steganalysis
- Detection methods designed against a specific steganography tool or algorithm. Effective when the tool is known but fails against novel or unknown...
Explained in these topics
- Steganalysis: Statistical Detection MethodsThe detection of steganographic content in carrier files, using statistical, machine-learning, or tool-signature methods to determine whether a file has been m...
- Steganography Principles and Common Carrier Formats