Detecting LSB Steganography in Color and Gray-Scale Images

reliable and accurate method for detecting least significant bit (LSB) nonsequential embedding in digital images. The secret message length is derived by inspecting the lossless capacity in the LSB and shifted LSB plane. An upper bound of 0.005 bits per pixel was experimentally determined for safe LSB embedding. S teganography is the art of secret communication. Its purpose is to hide the presence of communication, as opposed to cryptography, which aims to make communication unintelligible to those who don’t possess the right keys.1 We can use digital images, videos, sound files, and other computer files that contain perceptually irrelevant or redundant information as covers or carriers to hide secret messages. After embedding a secret message into the cover image, we obtain a so-called stegoimage. It’s important that the stego-image doesn’t contain any detectable artifacts due to message embedding. A third party could use such artifacts as an indication that a secret message is present. Once a third party can reliably identify which images contain secret messages, the steganographic tool becomes useless. Obviously, the less information we embed into the cover image, the smaller the probability of introducing detectable artifacts by the embedding process. Another important factor is the choice of the cover image. The selection is at the discretion of the person who sends the message. Images with a low number of colors, computer art, and images with unique semantic content (such as fonts) should be avoided as cover images. Some steganographic experts recommend grayscale images as the best cover images.2 They recommend uncompressed scans of photographs or images obtained with a digital camera containing a high number of colors and consider them safe for steganography. In previous work,3 we’ve shown that images stored previously in the JPEG format are a poor choice for cover images. This is because the quantization introduced by JPEG compression can serve as a watermark or unique fingerprint, and you can detect even small modifications of the cover image by inspecting the compatibility of the stego-image with the JPEG format. In Fridrich et al.,4 we developed a steganographic method for detecting LSB embedding in 24-bit color images—the Raw Quick Pairs (RQP) method. We based it on analyzing close pairs of colors created by LSB embedding. It works reasonably well as long as the number of unique colors in the cover image is less than 30 percent of the number of pixels. The RQP method can only provide a rough estimate of the size of the secret message. The results become progressively unreliable once the number of unique colors exceeds about 50 percent of the number of pixels. This frequently happens for high resolution raw scans and images taken with digital cameras stored in an uncompressed format. Another disadvantage of the RQP method is that it can’t be applied to grayscale images. Pfitzmann and Westfeld5 introduced a method based on statistical analysis of pairs of values (PoVs) exchanged during message embedding. Pairs of colors that differ in the LSB only, for example, could form these PoVs. This method provides reliable results when we know the message placement (such as sequential). However, we can only detect randomly scattered messages with this method when the message length becomes comparable with the number of pixels in the image. Johnson and Jajodia6,7 pointed out that steganographic methods for palette images that preprocess the palette before embedding are very vulnerable. Several steganographic programs create clusters of close palette colors that can be swapped for each other to embed message bits. These programs decrease the color depth and then expand it to 256 by making small perturbations to the colors. This preprocessing, however, will create suspicious pairs (clusters) of colors that others can detect easily.