1. University of Palestine University of Palestine Eng. Wisam Zaqoot Eng. Wisam Zaqoot May 2011 May 2011 Steganalysis ITSS 4201 Internet Insurance and Information Hiding

2. Steganalysis Definition Searching for the existence of hidden messages or Stego-content in a given medium. Stego-only: only stego-medium is available for analysis Stego-only: only stego-medium is available for analysis Known cover: both original cover media and stego- media are used Known cover: both original cover media and stego- media are used Known message: hidden message is revealed to facilitate review of media in preparation for future attacks Known message: hidden message is revealed to facilitate review of media in preparation for future attacks

3. Goals Passive Steganalysis Passive Steganalysis  Detect the presence or absence of a hidden message Active Steganalysis Active Steganalysis  Estimate the message length and location  Determine the algorithm/Stego tool  Estimate the Secret Key in embedding  Extract the message

4. Types of Steganalysis  Universal Steganalysis  Steganalysis techniques designed for a specific steganography algorithm

5. Universal Steganalysis Techniques Techniques which are independent of the embedding technique Techniques which are independent of the embedding technique One approach – identify certain image features that reflect hidden message presence. One approach – identify certain image features that reflect hidden message presence. Two steps: Two steps:  Extract ‘ good ’ features  Finding strong classification algorithms

6. Steganalysis in Practice Techniques designed for a specific steganography algorithm Techniques designed for a specific steganography algorithm  Good detection accuracy for the specific technique Universal Steganalysis techniques Universal Steganalysis techniques  Less accurate in detection  Usable on new embedding techniques

7. Supervised learning based Steganalysis Supervised learning methods construct a classifier to differentiate between stego and non-stego images using training examples. Supervised learning methods construct a classifier to differentiate between stego and non-stego images using training examples. Some features are first extracted and given as training inputs to a learning machine. These examples include both stego as well as non-stego examples. Some features are first extracted and given as training inputs to a learning machine. These examples include both stego as well as non-stego examples. The learning classifier iteratively updates its classification rule based on its prediction and the ground truth. Upon convergence the final stego classifier is obtained. The learning classifier iteratively updates its classification rule based on its prediction and the ground truth. Upon convergence the final stego classifier is obtained.

8. Blind Identification based Steganalysis This method can be clearly understood by the following block diagram: Hence, by estimating the transformation A & its inverse the secret message can be obtained.

9. Statistical detection based Steganalysis Here 3 cases arise: a) For completely known statistics case, the parametric models for stego-image & cover image. b) For partially known statistics case, the parametric probability models are available, but not the exact parameter models. These parameters are estimated. c) For completely unknown case, Bayesian prior models are assumed and detectors are developed.

10. Universal Steganalysis Techniques Techniques which are independent of the embedding technique Techniques which are independent of the embedding technique Identify certain image features that reflect hidden message presence. Identify certain image features that reflect hidden message presence. Two problems: Two problems: Calculate features which are sensitive to the embedding process Calculate features which are sensitive to the embedding process Finding strong classification algorithms which are able to classify the images using the calculated features Finding strong classification algorithms which are able to classify the images using the calculated features

11. On-line Sources Stego-Tools: Stego-Tools: Lots of freeware (and commercial) tools for hiding information in text, audio, video, and image files Lots of freeware (and commercial) tools for hiding information in text, audio, video, and image files Famous Stego-tools for image – Famous Stego-tools for image – Outguess+, F5+, S-Tools, etc,. Outguess+, F5+, S-Tools, etc,. Helpful Steganalysis programs Helpful Steganalysis programs WinHex-www.winhex.com WinHex-www.winhex.com Hiderman Hiderman Stegspy Stegspy Etc.. Etc..