Cryptography Reference
In-Depth Information
this topic offer mathematical guarantees that they are free from sta-
tistical or computational artifacts. Many of the automatic stega-
nographic programs introduce errors if they are used without care.
Many are very easy to detect if used without caution.
17.3 Typical Approaches
The basic approaches for steganalysis can be divided into these cat-
egories:
Visual or Aural Attacks
Some attacks strip away the significant parts
of the image in a way that lets a human try to search for visual
anomalies. One common test displays the least significant bits
of an image. Completely random noise often reveals the exis-
tence of a hidden message because imperfect cameras, scan-
ners, and other digitizers leave echoes of the large structure in
the least significant bits. (See Figures 9.1 and 9.2 for instance.)
The brain is also capable of picking up very subtle differences
in sound. Many audio watermark creators are thwarted by very
sensitive ears able to pick up differences. Preprocessing the file
to enhance parts of the signal makes their job easier.
Structural Attacks
The format of the data file often changes as hid-
den information is included. Often these changes can be boiled
down to an easily detectablepattern in the structure of the data.
In some cases, steganographic programs use slightly different
versions of the file format and this gives them away. In others,
they pad files or add extra information in another way.
Statistical Attacks
The patterns of pixels and their least significant
bits can often reveal the existence of a hidden message in the
statistical profile. The new data doesn't have the same statisti-
cal profile as the standard data is expected to have.
Of course, there is no reason to limit the approaches. Every stega-
nographic solution uses some pattern to encode information. Com-
plex computational schemes can be created for every algorithm to
match the structure. If the algorithm hides the information in the
relative levels of pairs of pixels, then an attack might compute the
statistical profile of pairs. If an algorithm hides data in the order of
certain elements, then one attack may check the statistical profile of
the orders.
There is no magic theoretical model for either steganalysis or an-
tisteganalysis. This is largely because theoretical models are always
