Now You See It

Mon, 04/30/2007 - 8:00pm
Bill Weaver, Ph.D.
Now You See It

Modern advances in steganalysis

The United States during the 1970s is often portrayed by archive footage of long gas lines, leisure suits and discotheques with flashing floors. While the mainstream
"Lightening Jars" — a JPEG carrier file containing an airport map1 
boomers were perfecting the use of cheesy pickup lines, others, including names like Bushnell, Gates, Jobs and Lucas, were quietly developing the digital information revolution. Even though their efforts were wildly public, the importance of their advances was often eclipsed by the short-term political or cultural story of the day. Thankfully, my personal recollection is not rife with polyester and hairspray, but with simpler things like elementary school, Star Wars and Pong. I especially recall my short-lived stint as a magician. Each appearance in the annual grade-school talent show would afford an opportunity to show off my most recent dazzling card and rope tricks. The thrill did not come from learning the mechanics of the trick, but from convincing the audience there was real magic in play. In addition to some fancy slight of hand, the real "trick" was in distracting audience attention to a grandiose, yet inconsequential movement while deftly pocketing a card or tucking a foam ball in the opposite hand.

The art of the feint has been in use for centuries but it is no less effective today. A common approach to making things disappear is to bury them under something obvious. In the case of hidden writing and messages, this technique is known as "steganography." The Greek prefix "stego-" causes stegosaurus to translate into "roof lizard," while the Greek prefix "stega-" leads steganography to translate into "covered-writing;" however, both prefixes appear to be used interchangeably as shorthand terms for steganographic products. Unlike cryptography wherein messages are specifically encoded by a private sequence of symbols, steganographic writing and images appear as they should, but are difficult to see at first glance. When hiding digital images, it is common to replace the least-significant bits (LSBs) of a cover image with the bits of a secret image. In the image entitled "Lightening Jars," the LSBs of each JPEG-encoded pixel have been replaced by those of embedded image of the Burlington, Vermont airport. The hidden image can be retrieved by processing the "stego-image" through a recovery algorithm.

Hiding messages in digital image, sound and video files is uncomplicated and can be achieved through the use of several free programs and Web applications. The difficult problem is one of detecting hidden images in publicly transmitted media, even though the method used to embed the images may be unknown. Termed "steganalysis," local, federal and military agencies are particularly interested in knowing when digital files contain covert, illegal information. Professor Jessica Fridrich and her research team at SUNY Binghamton are especially active in the area of digital forensics and steganalysis. A simple scanning method would be to process a suspect image through a group of known recovery algorithms. While this counter measure may have been successful in the early days of digital steganography, the "bad guys" quickly combined their efforts with cryptography to hide an encoded message that cannot be easily recovered without a secret passkey. The problem then shifted to one of establishing the presence of any hidden payload within a digital file that can be handed over for decryption. One approach to payload discovery is to analyze the LSBs of a digital image to determine how well they "belong" to the rest of the image. A very "busy" cover image containing intricate details and sharp-cornered objects would be expected to have a specific level of high spatial-frequency components located in the LSBs of its digital file. A hidden payload that did not share the same frequency distribution would appear out of place.

A close facsimile of the cover image's expected high-frequency distribution can be acquired through analysis of the next-to-least significant bits; however, the bad guys may have modified them as well. Emerging intelligent classification algorithms trained on collections of similar images can be taught to analyze the complete frequency spectrum for anomalous components. While this cat-and-mouse game of give-and-take leads to vigorous research in counter-countermeasures, a most elegant solution involves the universal deployment of steganography for the technique of "digital watermarking." In this process, encrypted information is intentionally embedded into digital files when they are created by the digital camera, camcorder, audio-recorder or imaging editing software. After the digital file has been distributed, steganalysis can be used to recover the watermark data to determine if the file has been altered. In addition to making the concealment of digital payloads extremely complicated, individual serial numbers can be included in the digital watermark to assist digital forensic investigators in cases involving terrorism, media piracy and child pornography.

Bill Weaver is an assistant professor in the Integrated Science, Business and Technology Program at La Salle University. He may be contacted at



Share this Story

You may login with either your assigned username or your e-mail address.
The password field is case sensitive.