2009 International Conference on Electrical, Communications, and Computers
A Methodology of Steganalysis for Images
A. Hernandez-Chamorro, A. Espejel-Trujillo, J. Lopez-Hernandez,
M. Nakano-Miyatake, H. Perez-Meana
Section of Posgrate Studies and Research, ESIME CULHUACAN -IPN, Mexico D.F., Mexico
Phone +52 55 56562058
Abstract- This paper provides a comparison of some of the
steganalysis methods proposed in the literature, and using
these comparison results, a global steganalysis methodology is
proposed. The secret message detection capacities of these
steganalysis methods are evaluated using stegoimages
generated by typical data hiding algorithms. The evaluation of
steganalysis methods is realized in terms of false negative and
false positive error rates using 100 images. There isn’t any
steganalysis that can detect presence of secret message in all
type of stegoimages. Therefore, to realize a reliable analysis
about a suspicious image, several steganalysis methods must be
efficiently combined. In this paper, some considerations about
steganalysis are provided using the results obtained of the
comparison of steganalysis methods.
Keywords-steganalysis; steganography; false negative error;
stegoimage; data hiding.
I. ITRODUCTION
Steganography is a science or art of secret
communication and recently digital steganography has
become a hot research issue, due to the wide use of Internet
as popular communication media. The goal of digital
steganography is to conceal covert message in digital
material in totally innocent manner. Even though digital
images, audio files, video data and all types of digital files
can be considered as a cover material to conceal secret
information, in this paper, we consider only digital images
as cover material. After hiding a secret message into the
cover image, we get an image with secret message: so-called
stegoimage, which is transmitted to a receptor via popular
communication channels or put on some Internet web-site.
To design useful steganography algorithm, it is very
important that the stegoimage does not have any visual
artifact and it is statistically similar to natural images. If a
third party or observer has some suspicion over the
stegoimage, steganography algorithm becomes useless [1].
During the last decade, many steganographic algorithms for
digital images have been proposed [2-4]. On the other hand,
many steganalysis methods, whose goal is to analyze an
image to detect the presence of a hidden message in it, are
also proposed [5-7]. The image steganography algorithm
can be classified in two classes by its embedding domain:
spatial domain embedding method and frequency domain
embedding method. LSB embedding technique is one of the
popular spatial domain embedding techniques, which
978-0-7695-3587-6/09 $25.00 © 2009 IEEE
DOI 10.1109/CONIELECOMP.2009.42
Authorized licensed use limited to: M H Saboo Siddik College of Engineering. Downloaded on August 09,2010 at 09:16:26 UTC from IEEE Xplore. Restrictions apply.
E-mail: ciber_pink@hotmail.com
replaces least significant bits plane of the image by a secret
message or its encrypted version [8, 9]. The hiding capacity
of this technique is directly related with the image size.
Principal advantages of the LSB embedding technique are
simple implementation, imperceptibility of hidden message
to human visual system and high embedding rate of secret
data. Some public domain tools, such as S-tools, Invisible
Secret and J-Steg, use this technique. However the LSB
embedding technique is generally vulnerable to statistical
analysis.
Frequency domain embedding methods have some
advantages and disadvantages respect to spatial domain’s
one. Principal advantage is robustness against simple
statistical analysis such as those mentioned in [1] and [3],
and the principal disadvantage is the limitation of the
amount of embedded data. Recently, some steganalysis
methods that try to detect the presence of secret information
in stegoimages generated by frequency domain embedding
method have been proposed [6]. Many of these methods
extract some relevant features from an image in frequency
domain, and using these features, stegoimages are
discriminated from natural images. The extracted features
from the image are fed to a classifier such as neural
networks, Bayesian classifier, Support Vector Machine, etc.,
to determine if the image has secret message or not. Each
steganalysis method shows its efficiency for some types of
steganography or some types of images, however there isn’t
a reliable comparison between various steganalysis methods
from false negative and false positive error rates points of
view.
In this paper we present a comparison between three
steganalysis methods using 100 natural images and 500
stegoimages generated by five steganography methods: two
LSB embedding methods, two Discrete Cosine Transform
(DCT) domain embedding methods [10,11] and Bit Plane
Complexity Segmentation Steganography (BPCS) method
[4], [12,13]. Comparison results suggest us some
consideration about a global steganalysis methodology.
The remainder of this paper is organized as follows.
Section II briefly describes the steganography methods used
to generate stegoimages. In Section III, three steganalysis
methods are described. Section IV shows comparison
results of Steganalysis methods using the above mentioned
steganography algorithms and the some considerations
about efficient steganalysis methodology are provided.
Finally, the conclusions are summarized in Section V.
102
 stegoimage, therefore the histogram distribution only can
II. STEGANOGRAPHY METHODS not be used for this purpose. Zhang et al. proposed the
difference image histogram method [15], that generates a
In this section five data hiding methods that are used to difference image D, calculating the difference value
generate stegoimages are described. between two adjacent pixels of the image as given by

A. LSB embedding Method D (i, j ) = I (i + 1, j ) − I (i, j ) (1)

LSB embedding method is one of the most popular
steganography methods due to its simplicity, high
Three difference images Dh , D f , Dg of a suspicious image,
embedding capacity and high imperceptibility of secret
message. In the LSB embedding method, image is the image with flipped LSB and the image with LSB
decomposed in bits planes (8 bits planes for 8 bits gray scale replaced by zero are calculated by (7). Histograms of these
images and 24 bits planes for color images), and its least difference images are calculated and demoted by
significant bits (LSB) plane is replaced by secret message. H = {hi i = −255...255} , F = { fi i = −255...255} and
Generally secret message is encrypted by any encryption
algorithm before its embedding. Here two public domain G = { gi i = −255...255} , respectively. Zhang et al. observed
steganographic tools based on LSB embedding method: S- that these histograms are related with each other when the
tools and Invisible Secret which are described in [14]. image doesn’t contain any hidden message, however if the
image contains some secret message in its LSB plane, the
B. DCT Domain Embedding Method relationship of these three histogram is broken. The
In the DCT Domain embedding method, firstly the relationships between these three histograms are described
cover image is transformed by DCT and then the embedding by fig. 1.
process is performed in the DCT coefficients instead of in
the image pixels. The principal advantage of this method is
that it is more secure than the LSB embedding method
against many statistic analyses; however the embedding
capacity of the secret message is limited by imperceptibility
constrains. In this paper two data hiding methods, Huang’s
data hiding method and Piva’s data hiding method, are used
to generate stegoimages. The details of Huang’s and Piva’s
data hiding methods are in [10,11]
Fig.1 Transition values a2i ,2i −1, a2i ,2i , a2i ,2i +1 from G to H and F.
C. Bit-Plane Complexity Segmentation Steganography
Bit-Plane Complexity Segmentation Steganography In the fig.1, a2i ,2i −1, a2i ,2i , a2i ,2i +1 are the values of transition
(BPCS) is similar to the LSB embedding method. In BPCS,
the image is segmented in blocks of 8x8 pixels, and each from histogram G to H, and from G to F. Using these
block is decomposed in bit-planes (for 8 bits gray scale values, following three values are calculated as follows.
image, 8 bit-planes are decomposed). In each segmented
bit-plane its complexity is analyzed. If the complexity of a αi = (a2i+2,2i+1)/(a2i,2i+1)
segmented bit-plane is higher than a predetermined βi = (a2i+2,2i+3)/(a2i,2i−1) (2)
threshold, this segmented bit-plane is replaced by the secret
message [12]. Therefore in BPCS, depending on its
γi =(g2i )/(g2i+2)
complexity and the secret message is embedded in any bit-
planes, not only in the LSB plane. If the image contains some secret message, (3) is satisfied
for all values of i =-255…255.
III. STEGANALYSIS METHODS
αi ≈ 1 (3)
In this section, three steganalysis methods: difference
image histogram method, closest color pair method and
features extraction method, are described.
and for natural images, (4) is satisfied.
A. Difference Image Histogram Method
The histogram distribution may be used to discriminate αi ≈ γ i (4)
stegoimages from natural images. However the variation of
the distribution between different types of images is bigger
than the variation between a natural image and its

103

Authorized licensed use limited to: M H Saboo Siddik College of Engineering. Downloaded on August 09,2010 at 09:16:26 UTC from IEEE Xplore. Restrictions apply.
 This method can be applied directly to grayscale images, but
for color images, some considerations must be taken
account.
B. Closest Color Pair Method
Fridrich et al. observed that the number of close color
pairs is increased considerably when an image has a secret
message embedded in its LSB plane, and they proposed a
steganalysis method for LSB embedding technique using a
ratio between the number of closest color pair and all pairs
of colors of the image [5]. In this method, the number of all
color pairs existing in an image and the number of close
color pairs within all existing color pairs are computed.
Then on purpose, a LSB embedding steganography
algorithm is applied to the image, and also number of
existing color pairs and close color pairs are computed. The
condition of close color pair
( C1 = [ R1 , G1 , B1 ] , C2 = [ R2 , G2 , B2 ]) is given by
( R1 − R2 )2 + ( G1 − G2 )2 + ( B1 − B2 )2 ≤ 3
The ratios R and R’ between the number of close color pair
and the number of all color pairs is calculated for the image
under analysis and its steganography version as
P P'
R= R' =
⎛U ⎞ ⎛U ' ⎞
⎜⎜ ⎟⎟ ⎜⎜ ⎟⎟
⎝2 ⎠ ⎝2 ⎠
where P and P’ are the number of close color pairs, and U
and U’ are number of all color pairs in the image and its
steganography version, respectively. If (7) is satisfied, the
image can be considered as natural image, otherwise the
image contains some secret message.
R Owing to the de-correlation capability of the discrete
≥ Th
R'
Fridrich et al. proposed, after exhaustive proves, that a
suitable threshold value Th is 1.1.
C. Features Extraction Method
Recently the DCT domain embedding methods were
proposed instead of LSB embedding method. The
efficiency of two steganalysis methods mentioned above for
LSB embedding method is shown, but there are not
information about the efficiency to detect the DCT domain-
based embedding method. The feature extraction method
proposed by [6] extracts 39 features, which are used to
classify images as natural images or stegoimages.
In this section, we describe the features based on
statistical moments of wavelets characteristic function for
the steganalysis.
Authorized licensed use limited to: M H Saboo Siddik College of Engineering. Downloaded on August 09,2010 at 09:16:26 UTC from IEEE Xplore. Restrictions apply.
1) De-correlation of wavelet transform: The
histograms of all wavelet subbands only reflect the
statistical distribution of coefficients in the subband, but it
doesn’t reflect the correlation of the coefficients within this
subband. The wavelet transform is well known for its
capability of multi-resolution decomposition and
coefficients de-correlation. It is known that for discrete
wavelet transform, different high frequency subbands within
one level will be uncorrelated to each other. The features
extracted from one high frequency subband are thus
uncorrelated to that extracted from another high frequency
subband at the same level. Therefore, features from different
dimensions most likely uncorrelated to each other. From this
point of view, this multi-dimensional feature vector will be
suitable to represent the image for steganalysis purpose.
2) Characteristic Function and Its Statistical
Moments: The data hiding process can be modelled as an
additive signal, which is independent to the cover-image;
this signal is added to the cover media, as proposed in [16].
(5) It is well known that the effect of the additive signal on the
image is equivalent to a convolution of two probability
density functions (PDFs). According to [17], one
interpretation of the characteristic function (CF) is that it is
complex conjugate of Fourier transform of the PDF. We can
consider the PDF as the normalized version of a histogram,
(6) in this case the image histogram and the subbands
coefficients histogram. The CF is defined as:
N −1 −
2πjxfi
H ( f i ) = DFT (h[x ]) = ∑ h[x ]e N
(8)
x =0
where H(fi) is the equal to CF, DFT(h[x]) is the Discrete
Fourier Transform of the histogram, N is the total number of
points in the horizontal axis of the histogram, fi is frequency
component.
(7) wavelet transform (DWT), the coefficients of different
subbands at the level, we can assume independence to each
other. Therefore, the features generated from different
wavelet subbands at the same level are independent to each
other as well. This property is desirable for steganalysis.
Therefore, in [18] is proposed to use the statistical
moments of the characteristic functions of wavelet subbands
as futures for steganalysis. The n-th statistical moment of a
CF is defined as follows
N /2
∑f
j =1
j
n
H( fj)
Mn = N /2
(9)
∑ H( f
j =1
j )
where ‫׀‬H(fi) ‫ ׀‬is the magnitude of the CF component at
frequency fi, N is the total number of points in the horizontal
104
 axis of the histogram. The zero frequency component of the steganalysis algorithm detects the presence of some secret
CF is excluded from the calculation of moments because it message, when the image does not contain any message.
represents only the summation of all components in the The meanings of symbols used in the table I are shown
discrete histogram. For an image, the zero frequency by table II.
component is the total number of pixel, while for a wavelet
subband, it is the total number of the coefficients in the
subband. In either case, it does not change during the data Table I False Negative And False Positive Error Rate (%)
hiding process. In order to get the feature, the subbands
decomposed by Haar wavelets until three levels were used. Data Hiding
DH CC FE
Therefore, there are 12 subbands, denoted by LL1,HL1, Methods
LH1, HH1, LL2, HL2, LH2, HH2, LL3, HL3, LH3, HH3. FN FN FN
The first three moments for each of subbands and the test S-tool 0 0 2
image, denoted by LL0, result a vector with 39 features.
IS 0 0 2

IV. RESULTS BPCS 91 100 24

Huang 90 100 6
To evaluate the three steganalysis methods mentioned Piva 84 100 6
above, 100 color images of 128x128 pixels and their
steganography versions generated by using the five FP FP FP
steganography methods described above are used. Some of Natural 93 0 22
the natural images and stegoimages used for the evaluation
are shown in Fig. 2 and Fig. 3, respectively.
Table II. Meanings of symbols used in Table I.
Symbol Meaning
DH Difference Image Histogram Steganalysis [16]
CC Close Color Steganalysis [5]
FE Feature Extraction Steganalysis [6]
S-tool S-tool Steganography [15]
IS Invisible Secret Steganography [15]
BPCS Bit-Plane Complexity Segmentation Steganography [13]
Huang DCT based Data hiding method by Huang [11]
Fig. 2 Some of the natural images used for evaluation. Piva DCT based Data hiding method by Piva [12]
FN False Negative Error Rates
FP False Positive Error Rates

In Table I, we can observe that the steganalysis methods

Fig.3 Some of stegoimage used for evaluation.
The table I shows the evaluation results of three
steganalysis methods using natural images and stegoimages
generated by the five data hiding methods. The evaluation is
performed in terms of false negative error rates and false
positive error rates. False negative error is an error in which
the steganalysis algorithm cannot detect the presence of a
hidden message, when the image really contains some secret
message, while the false positive error is an error that
DH and CC are efficient to detect the presence of hidden
message in stegoimages generated by LSB embedding
steganography methods, such as S-tool and Invisible
Secrets, but when stegoimages are generated by BPCS
method and DCT domain embedding methods, these are
considered as natural images. For that reason it is necessary
to use another method such as FE steganalysis method, This
method can detect the stegoimages generated by BCPS
method and DCT domain embedding methods with much
smaller false negative and false positive error rates.
Considering that many steganography methods are based on
LSB embedding, CC steganalysis method can be used
efficiently if the suspicious image is color image, if the
image is grayscale image, DH method can be used. After the
image is analyzed by CC method or DH method, if the
image is considered as natural one, furthermore FE

105

Authorized licensed use limited to: M H Saboo Siddik College of Engineering. Downloaded on August 09,2010 at 09:16:26 UTC from IEEE Xplore. Restrictions apply.
 steganalysis method can be applied to the image to reduce [15] T. Zhang, X. Ping,"A new approach to reliable detection of LSB
global false negative error rates. steganography in natural images" Signal Processing, vol. 83, no. 10,
pp. 2085-2093, 2003.
[16] K. Sullivan, U. Madhow, S. Chandrasekaran, and B. S. Manjunath,
V. CONCLUSION “Steganalysis of Spread Spectrum Data Hiding Exploiting Cover
Memory," the International Society for Optical Engineering,
In this paper, a performance comparison results of three Electronic Imaging, San Jose, CA, USA, 2005.
[17] A. Leon-Garcia, Probability and random processes for electrical
steganalysis methods, using 100 natural images and 500 engineering, 2nd edition, reading, MA: Addison-Wesley Publishing
stegoimage generated by five steganography methods, are Company, 1994.
presented. To perform a reliable analysis about a suspicious [18]G. Xuan, Y. Q. Shi, D. Zou, J. Gao, C. Yang, Z. Zhabg, P. Chai, W.
image, several steganalysis methods must be combined. Chen, C. Chen, “Steganalysis based on multiple features formed by
statistical moments of wavelet characteristic Functions," IH 2005
The comparison results suggest us some steganalysis LNCS 3727, pp. 262-277, Springer-Verlag Berlin Heidelberg 2005.
methodology that can be followed. DH and CC steganalysis
methods can be used to detect the presence of the hidden
message of stegoimages generated by LSB embedding
steganography, such as S-tools and Invisible Secret. About
the images considered as natural images, after DH and CC
steganalysis, furthermore FE steganalysis method is applied
to detect stegoimages generated by DCT embedding
methods or BPCS method. Also more reliable steganalysis
method for frequency domain embedding steganography
must be developed and analyzed.

VI. REFERENCES

[1] J. Fridrich, M. Goljan and R. Du, ”Detecting LSB Steganography in

Color and Gray Scale Image”, IEEE Multimedia, vol.8, no. 4, pp. 22-
28, 2001
[2] Q. Cheng and T. Huang, “An Additive Approach to Transform-
domain Information Hiding and Optimum Detection Structure”,
IEEE Trans. on Image Processing, vol. 12, no. 2, pp. 221-229, 2003.
[3] L. Marvel, C. Boncelet and C. Retter, “Spread Spectrum Image
Steganography”, IEEE Trans on Image Processing, vol. 8, no. 8,
pp.1075-1083, 1999.
[4] H. Noda, J. Spaulding, M. Shirazi, M. Niimi and E. Kawaguchi,
“BPCS” Steganography Combined with JPEG2000 Compression”,
Proceedings of Pacific Rim Workshop on Digital Steganography , pp.
98-107, 2002.
[5] J. Fridrich, R. Du and M. Long, “Steganalysis of LSB Encoding
in Color Images” , in IEEE Int. Conf. on Multimedia and Expo, 2000,
1279-1282.
[6] J. Lopez R. Martinez, M. Nakano, K. Yamaguchi, “Detection of
BPCS-Steganography using SMWCF Steganalysis and SMV”, Proc.
of IEEE Int. Symp. on Information Theory, 2008.
[7] A. D. Ker, “Steganalysis of LSB Matching in Grayscale Images”,
IEEE Signal Processing Letters, vol. 12, no. 6, pp. 441-444, 2006.
[8] W. Lie and L. Chang, “Data Hiding in images with adaptive numbers
of least significant bits based on human visual system”, in Proc.
IEEE Int. Conf. Image Processing, pp. 286-290, 1999.
[9] T. Chen, C. Chang and M. Hwang, “A Virtual Image Cryptosystem
based upon Vector Quantization”, IEEE Trans. on Image Processing,
vol.7, no.10, pp. 1485-1488, 1998.
[10] J. Huang and Y. Shi, “Adaptive image watermarking scheme based
on visual masking”, Elect. Lett., vol. 34, no. 8, pp. 748-750,1998.
[11] A. Piva, M. Barni, F. Bartolini and V. Capellini, “DCT-Based
watermark recovering without restoring to the uncorrupted original
image”, in Proc. of IEEE ICIP, pp. 520-523, 1997.
[12] M. Niimi, H. Noda and E. Kawaguchi, “A steganography based on
region segmentation by using Complexity Measure”, Trans on IEICE
vol. J81,D-II, pp. 1132-1140, 1998.
[13] S. Torres, M. Nakano and H. Perez, “An Image Steganography
System based on BPCS and IWT”, Random Fields Modeling and
Processing in Inhomogeneous Media, RFMPIM.
[14] http://hodime.earthlink.net/~emilbra/stego/softwarewindows.html

106

Authorized licensed use limited to: M H Saboo Siddik College of Engineering. Downloaded on August 09,2010 at 09:16:26 UTC from IEEE Xplore. Restrictions apply.