Obfuscation and the steganographic active warden model
Farid E Ahmed, Patricia A. Lafferty · 2008
In recent years, the use of steganography, or “covered writing,” has become increasingly prevalent on the Internet. Steganography detection is an important research topic, but all detection methods have weaknesses. A certain quantity of steganographic information is required to make detection likely. A single bit hidden in a picture most likely will not be identified. The only way to defend against steganography is to take a proactive approach and change the imperceptible parts of the multimedia. No literature to date addresses how best to accomplish this for images. Information hiding researchers assert that the JPEG encoding process removes steganography from images. The reader is given proof that this assertion is false. An image set modified with several steganographic applications was tested against image noise reduction processing techniques. Using an original set of metrics, experimentation reveals the degree of success for each image processing technique under test for steganography removal, or what is named stego scrubbing. The effectiveness of the scrubbing techniques varied by the image domain utilized for steganographic embedding. The best scrubber for the spatial domain differed from the most effective frequency domain solution. The best general scrubbing solutions discovered involve combining several single processing actions by image averaging, a strategy used in the field of image restoration for noise removal. This discovery is put into use by incorporating this steganographic removal technique into an existing, open source mail server, where image attachments are scrubbed as an email enters or exits the server. While this mail server is not the perfect solution for every situation, it has utility for small, protected networks where individuals are freely permitted to communicate openly, but where covert communications would be most likely utilized to convey privileged information, and thus should be thwarted. This research identifies and defines a new subfield of information hiding research. A comprehensive scrubbing framework is developed. Metrics are defined for the purpose of accurately evaluating the success of the scrubbing techniques developed. The results of the research are put into practical use by their inclusion in a prototype mail server with scrubbing functionality.