Attribute Permutation Steganography Detection using Attribute Position Changes Count

An approach to detecting the presence of HTML Attribute Permutation Steganography (APS) is proposed and founded on the idea of using a classification (prediction) model. To this end a position changes count metric, the Attribute Position Changes Count (APCC), is presented with which to capture attribute ordering information. The main advantage offered by the APCC metric, unlike other APS detection metrics, which tend to use average values, is that it captures the full range of attribute position changes. A second advantage is that it can be readily used to define a feature space from which feature vectors can be generated which in turn can be used to generate a steganography classification model. With a combination of three most known attribute permutation steganography algorithms and three well known classifiers APCC showed high performance in each case compared with alternative attribute detection approaches. In terms of AUC metric APCC achieved best eight out of nine cases and in terms of ACC metric APCC produced best seven out of nine cases. The reported evaluation demonstrates that the APCC APS detection can be successfully employed to detect hidden messages embedded in WWW pages using APS, outperforming a number of alternative approaches.