Cryptography Reference
In-Depth Information
a particular set of stats and leave unchanged another particular set.
This work, however, needs a deeper understanding of how digital
cameras, cameras, and microphones convert our world into num-
bers.
In themeantime, the easiest way to slip by steganographic attacks
is to minimize the size of the embedded message. The smaller the
message, the fewer changes in the file and the slighter the distortion
in the statistics. In this realm, as in many others, the guiding rule is
“Don't get greedy.”
Mark Ettinger uses
game theory to model
the cat and mouse game
between hider and
attacker. [Ett98]
The Disguise
Data mimicry often fails to completely hide the exis-
tence of a message because efforts to blend the data often leave
other marks. Steganalysis often detects these patterns and re-
veals the existence of the message.
How Secure Is It?
Many of the early software packages for hiding in-
formationinthenoiseofanimageareofteneasytodetect.Im-
ages have more structure than we can easily describe mathe-
matically. In many cases, the cameras or scanners don't gen-
erate files with true noise in the least significant bit and this
means that any efforts to hide information there will be de-
feated.
Mehdi Kharrazi, Husrev T. Sencar and Nasir Memon built a
large collectionof test images and tested three detection schemes
against several embedding algorithms.[KSM06] They found that,
in general,
•
Comparing the correlation between the least significant
and the next-to-least significant bit planes is the most ef-
fective detector of pure or RAW images that haven't been
compressed with JPEG or another DCT-based compres-
sion scheme.
•
Artifacts from the cosine transform help many statistical
tools because they add a regularity that is distorted when
the message and all of its additional entropy are added to
the file. Steganography is easier to detect in files that have
been heavily compressed.
•
The cropping or realignment from Section 17.6.2 is gener-
ally the most accurate of the three on files that have some
JPEG compression in their history.
•
Recompressing JPEG files, especially after cropping, can
confound the detectors.
