Translator Disclaimer
15 February 2006 Application of conditional entropy measures to steganalysis
Author Affiliations +
Proceedings Volume 6072, Security, Steganography, and Watermarking of Multimedia Contents VIII; 607204 (2006)
Event: Electronic Imaging 2006, 2006, San Jose, California, United States
Many commercial steganographic programs use least significant bit (LSB) embedding techniques to hide data in 24-bit color images. We present the results from a new steganalysis algorithm that uses a variety of entropy and conditional entropy features of various image bitplanes to detect the presence of LSB hiding. Our technique uses a Support Vector Machine (SVM) for bivariate classification. We use the SVMLight implementation due to Joachims (available at A novel Genetic Algorithm (GA) approach was used to optimize the feature set used by the classifier. Results include correct identification rates as high as >98% and false positive rates as low as <2%. We have applied using the staganography programs stegHide and Hide4PGP. The hiding algorithms are capable of both sequential and distributed LSB embedding. The image library consisted of 40,000 digital images of varying size and content, which form a diverse test set. Training sets consisted of as many as 34,000 images, half "clean" and the other half a disjoint set containing embedded data. The hidden data consisted of files with various sizes and various information densities, ranging from very low average entropy (e.g., standard word processing or spreadsheet files) to very high entropy (compressed data). The testing phase used a similarly prepared set, disjoint from the training data. Our work includes comparisons with current state-of-the-art techniques, and a detailed study of how results depend on training set size and feature sets used.
© (2006) COPYRIGHT Society of Photo-Optical Instrumentation Engineers (SPIE). Downloading of the abstract is permitted for personal use only.
John Marsh, Timothy Knapik, Ephraim Lo, and Chad Heitzenrater "Application of conditional entropy measures to steganalysis", Proc. SPIE 6072, Security, Steganography, and Watermarking of Multimedia Contents VIII, 607204 (15 February 2006);

Back to Top