Steganalysis of Stegostorage Library

Abstract

AbstractThe main goal of this research is the detection of the secret messages hidden in JPEG files, which were embedded by StegoStorage library. This tool allows the user to embed any type of information into a folder of images. Sequential, pseudo-random or Hamming code-based embedding into the least significant bit (LSB) of DCT coefficients is possible. It is possible to choose what fraction of capacity of the cover files are filled.The aim of this contribution is to test the statistical LSB embedding model (modified weighted-stego analysis) for all modes of embedding which StegoStorage library offers, and for all cover files’ capacities, respectively. Another goal is to implement a more appropriate type of steganalytic attack for Hamming codes and test it. For this purpose, the RS (Regular/Singular) steganalysis was selected.The detectability of the LSB embedding model of sequential embedding is possible if the cover files are filled to at least one percent of capacity. In the case of pseudo-random embedding, the secret message can be detected if the cover files are filled to at least 10% of their capacity. Hamming codes were undetectable using this type of an attack.In the case of attack by RS steganalysis, another situation arose. When sequential or pseudo-random embeddings were used, the results indicated the detectability was possible if the cover files were filled up at least 5 percent of capacity. The capacity filling of 5 percent corresponds to 2.5 percent of DCT coefficient changes from the original media in the case of sequential embedding. This value, 2.5%, is the threshold for the utilization of Hamming codes, too. Therefore, Hamming codes (7, 4), (15, 11) and (32, 26) indicated the detectability, because they exceeded that limit.