Cryptography Reference
In-Depth Information
randomness in the sample is measured with this equation:
χ
2
=
(
e
i
− E
(
e
i
))
2
.
E
(
e
i
)
High scores indicate an nonrandom condition— one that was
probably part of an original picture or sound file created by an
imperfect set of sensors. Low scores indicate a high degree of
randomness— something that is often connected with encrypted
hidden information.
The
χ
2
test can be applied to any part of the file. The least sig-
nificant bits can be analyzed by looking at two events,
e
0
,when
the least significant bit is zero, and
e
1
, when the bit is one. A low
score means the bits occur with close to equal probability, while a
higher one means that one bit outnumbers the other. In this case,
E
5
.
A better solution is to create four events that look at the pattern of
neighboring least significant bits. Natural images often leave neigh-
boring bits set to the same value. Files with hidden information have
neighbors that are often different.
Event bit neighbor bit
e
0
0 0
e
1
0 1
e
2
1 0
e
3
1 1
Files with a high amount of hidden information will usually have
low scores in this
(
e
0
)=
E
(
e
1
)=
.
χ
2
test. More natural, undoctored images often
have higher scores, as Figures 17.1 and 17.2 indicate.
Neil Johnson, Sushil Jajodia, Jessica J. Fridrich, Rui Du, and Meng
Long report that measuring the number of close colors is a good sta-
tistical test for detecting images with data hidden in the least signif-
icant bits. A pair of close colors differs by no more than one unit in
each of the red, green and blue components. Naturally constructed
files have fewer close pairs than ones with extra inserted data. This
is especially true if the image was stored at one time by a lossy com-
pression mechanism like JPEG. Testing for the number of close pairs
is an excellent indicator. [JJ98a, JJ98b, FDL00, Mae98]
These tests will often do a good job of identifying basic least-
significant bit stegangraphy. More complicated mechanisms for hid-
ing data, however, would avoid this test and require one tuned to the
algorithm at hand. Imagine the sender was hiding information by
choosing pairs of pixels and occasionally swapping them to encode
either a zero or a one. The overall distribution of colors and their
Section 13.7 describes
how to hide
information in the
sorted order of pixels.
least significant bits would not be changed in the process. Swapping
doesn't change the statistical profile of the least significant bits.
