Application of conditional entropy measures to steganalysis
John A. Marsh, Timothy Knapik, Ephraim Lo, Chad Heitzenrater · Proceedings of SPIE, the International Society for Optical Engineering/Proceedings of SPIE · 2006
Many commercial steganographic programs use least significant bit (LSB) embedding techniques to hide data in 24-bit color images. We present the results from a new steganalysis algorithm that uses a variety of entropy and conditional entropy features of various image bitplanes to detect the presence of LSB hiding. Our technique uses a Support Vector Machine (SVM) for bivariate classification. We use the SVMLight implementation due to Joachims (available at http://svmlight.joachims.org/). A novel Genetic Algorithm (GA) approach was used to optimize the feature set used by the classifier. Results include correct identification rates as high as >98% and false positive rates as low as <2%. We have applied using the staganography programs stegHide and Hide4PGP. The hiding algorithms are capable of both sequential and distributed LSB embedding. The image library consisted of 40,000 digital images of varying size and content, which form a diverse test set. Training sets consisted of as many as 34,000 images, half "clean" and the other half a disjoint set containing embedded data. The hidden data consisted of files with various sizes and various information densities, ranging from very low average entropy (e.g., standard word processing or spreadsheet files) to very high entropy (compressed data). The testing phase used a similarly prepared set, disjoint from the training data. Our work includes comparisons with current state-of-the-art techniques, and a detailed study of how results depend on training set size and feature sets used.