Keywords

1 Introduction

Nowadays steganography is widely used for hide information transferring and hidden messaging. Therefore, while solving problems of the informational security, steganography is being increasingly used by secret agencies, criminal groups and terroristic organizations.

One of the most widespread types of steganography containers is a digital image. Digital images make up a large percentage of the Internet data traffic allows using them as a channel for hidden information transfer with significant throughput and great secrecy.

There is a large number of free software for LSB image steganography. There are two relevant steganography resistance approaches: passive and active.

In the simplest case, the procedure of passive steganography resistance reduces to the problem of binary classification. A tested container should be classified as either original (clear) image or steganogram. It’s a main goal quantitative steganalytic algorithms are widely used for. For digital images and LSB steganography, the result of algorithm execution is the estimate of the number of changed pixels in the tested image.

2 Purpose

The main purpose of this paper is the estimation of efficiency of modern steganographic algorithms when resisting LSB steganography with small payload rates. Results illustrate the lower bounds of payload, when the classification accuracy falls dramatically. In the case of such payloads the effective resistance is practically impossible. This lower bound can be used to determine the value of maximal throughput of steganography channel, considering existing abilities of passive resistance.

3 Method of Experiment

The tested image is being selected from a test set. Then LSB bit is being inverted for a fixed number of pixels. In this way, the apply steganography effect is simulated. Payload is measured as a percentage of maximum value for the tested image. Maximum payload of the image is the total amount of pixels in the image. Payload varies in the range of 1−6 %, basing on the stated error of evaluated steganalytic algorithms, roughly estimated at 2 %. Modified image is being tested with steganalytic algorithm. The result of the estimation is a number of pixels affected with steganographic embedding.

The following steganalytic algorithms have been evaluated:

  • RS-analysis (RS) [1];

  • Sample pair analysis (SP) [2];

  • Difference image histogram (DIH) [3];

  • Triples analysis (TR) [4];

  • Weighted stego-image (WSI) [5].

Test set consists of three grayscale image collections:

  • Collection 1–3126 images with resolution from 392 × 550 to 5184 × 3456 [9];

  • Collection 2–5214 images with resolution from 1339 × 1357 to 5100 × 4026 [10];

  • Collection 3–30682 images with resolution from 700 × 500 to 1300 × 734 [11].

Collections are public and include a great number of images with wide range of characteristics and features.

The pixels’ coordinates are pseudo-randomly selected, with uniform distribution.

4 Evaluation Procedure

As noted above, the procedure of passive steganography resistance reduces to the problem of binary classification. Then the classification sets are represented as

$$ Y = \{ - 1, + 1\} , $$
(1)

and classifier is represented as follows:

$$ a(x) = sign[f(x,w) - w_{0} ] , $$
(2)

where x is a random object, \( f(x, w) \) is a classifying function (steganalytic algorithm), w is a parameters vector (the amount of flipped pixels), \( w_{0} \) is a threshold.

In this case, the steganalytic algorithm acts as a classifier, and the classification procedure is done by comparing result of algorithm execution and some threshold.

The distinction surface is defined as follow:

$$ f(x,w) = w_{0} . $$
(3)

The choice of a threshold value \( w_{0} \) is a difficult task, since it directly affects the probabilities of both true positive and false positive detection. Too small value may result in high probability of both false classifications. In practice, it will result in clear images classified as stego images. Too great value will enlarge the probability of false negative classification.

True positive classification rate (TPR) is defined as follows:

$$ TPR\left( {a, X^{m} } \right) = \frac{{\mathop \sum \nolimits_{i = 1}^{m} \left[ {a(x_{i} ) = + 1} \right][y_{i} = + 1]}}{{\mathop \sum \nolimits_{i = 1}^{m} [y_{i} = + 1]}} , $$
(4)

where

$$ X^{m} = \left( {x_{1} , \ldots x_{m} } \right) $$
(5)

is a sample, \( y_{1} , \ldots ,y_{m} \) are classification sets of the sample.

False positive classification rate (FPR) is defined as follows:

$$ FPR(a, X^{m} ) = \frac{{\mathop \sum \nolimits_{i = 1}^{m} \left[ {a(x_{i} ) = + 1} \right][y_{i} = - 1]}}{{\mathop \sum \nolimits_{i = 1}^{m} [y_{i} = - 1]}} . $$
(6)

The ratio of these two values affects classification quality, and, consequently, the practical efficiency of passive resistance. The ideal classifier has \( TPR = 1 \) and \( FPR = 0. \)

ROC curves illustrate the ratio, for greater clarity [6].

The set of ROC curves for different evaluated algorithms for the same experiment conditions sets makes possible the comparative evaluation of their efficiency.

5 Results

The graph shows ROC curves (Fig. 1) for all evaluated algorithms and the same ROC curves for different payload rates. The same experimental results for distinct image collections are stated in Table 1.

Fig. 1
figure 1

ROC curves for the evaluated algorithms

Full size image
Table 1 False positive rate for TPR at 97.5 %
Full size table

6 Findings

Modern quantitative statistical steganalytic algorithms show close accuracy of estimation. Passive steganorgaphy resistance based of them provides comparable classification quality and makes their practical efficiency very similar.

The classification quality falls significantly for steganogram with payload rates, greater than 5 %.

The tested image resolution has significant impact on the classification quality. So, for the images of Collection 2, with resolution as minimum as 1339 × 1357, the false classification rate is almost 10 times less than for Collections 1 and 3, with minimal image resolutions of 392 × 550 and 700 × 500, respectively (see Table 1).

7 Conclusion

Steganalysis based on modern quantitative statistical steganalytic algorithms have an ability to provide effective passive LSB steganography resistance against steganograms with payload value greater than 5 %. Using payload value less than that threshold reduces passive resistance efficiency dramatically. The passive resistance is ineffective against LSB steganography with payload rate less than 1 % for the image with resolutions not exceeding the resolution of modern displays.

The small image with resolution 600 × 400 pixels, used as a stego image with payload rate of 1−2 % is practically undetectable by modern quantitative steganalytic algorithms. In the same time, such payload rate makes possible to embed 5−10 KB of data. Taking into account the possibility of preliminary compression of embedded data and the usage of matrix embedding [7], the evaluated algorithms need further improvements.