Inter
national
J
our
nal
of
Inf
ormatics
and
Communication
T
echnology
(IJ-ICT)
V
ol.
10,
No.
3,
December
2021,
pp.
188
∼
197
ISSN:
2252-8776,
DOI:
10.11591/ijict.v10i3.pp188-197
❒
188
F
or
ensic
steganalysis
f
or
identication
of
steganograph
y
softwar
e
tools
using
multiple
f
ormat
image
S.
T
.
V
eena
1
,
S.
Ari
v
azhagan
2
1
Department
of
Computer
Science
and
Engineering,
Mepco
Schlenk
Engineering
Colle
ge,
T
amilnadu,
India
2
Department
of
Electronics
and
Communication
Engineering,
Mepco
Schlenk
Engineering
Colle
ge,
T
amilnadu,
India
Article
Inf
o
Article
history:
Recei
v
ed
May
15,
2021
Re
vised
Sep
20,
2021
Accepted
Oct
11,
2021
K
eyw
ords:
Clustering
Image
metadata
Signature
artef
act
Ste
g
anographic
softw
are
tool
Structural
ste
g
analysis
T
ar
geted
ste
g
analysis
Uni
v
ersal
image
ste
g
analysis
ABSTRA
CT
T
oday
man
y
ste
g
anographic
soft
w
are
tools
are
freely
a
v
ailable
on
the
Internet,
which
helps
e
v
en
callo
w
users
to
ha
v
e
co
v
ert
communication
through
digital
images.
T
ar
-
geted
structural
image
ste
g
analysers
identify
only
a
particular
ste
g
anographic
softw
are
tool
by
tracing
the
unique
ngerprint
left
in
the
ste
go
images
by
the
ste
g
anographic
process.
Image
ste
g
analysis
pro
v
es
to
be
a
tough
chal
lenging
task
if
the
process
is
blind
and
uni
v
ersal,
the
secret
payload
is
v
ery
less
and
the
co
v
er
image
is
in
lossless
compression
format.
A
payload
independent
uni
v
ersal
ste
g
analyser
which
identies
the
ste
g
anographic
softw
are
tools
by
e
xploiting
the
traces
of
artef
acts
left
in
the
image
and
in
its
metadata
for
v
e
dif
ferent
image
formats
is
proposed.
First,
the
artef
acts
in
image
metadata
are
identied
and
clustered
to
form
distinct
groups
by
e
xtended
K-means
clustering.
The
group
that
is
identical
to
the
co
v
er
is
further
processed
by
e
xtracting
the
artef
acts
in
the
image
data.
This
is
done
by
de
v
eloping
a
signature
of
the
ste
g
anographic
softw
are
tool
from
its
ste
go
images.
The
y
are
then
matched
for
ste
g
anographic
softw
are
tool
identication.
Thus,
the
ste
g
analys
er
successfully
iden-
ties
the
ste
go
images
in
v
e
di
f
ferent
image
formats,
out
of
which
four
are
lossless,
e
v
en
for
a
payload
of
1
byte.
Its
performance
is
also
compared
with
the
e
xis
ting
ste-
g
analyser
softw
are
tool.
This
is
an
open
access
article
under
the
CC
BY
-SA
license
.
Corresponding
A
uthor:
S.
T
.
V
eena
Department
of
Computer
Science
and
Engineering,
Mepco
Schlenk
Engineering
Colle
ge
Si
v
akasi,
T
amilnadu-626005,
India
Email:
v
eena
st@mepcoeng.ac.in
1.
INTR
ODUCTION
Image
ste
g
analysis
is
the
art
of
unco
v
ering
the
presence
of
secret
in
a
mundane
image.
The
d
i
gital
era
has
pro
vided
numerous
free
w
are
ste
g
anograph
y
tools
online
that
help
no
vice
users
to
embed
data
easily
without
an
y
prior
kno
wledge
of
ste
g
anographic
algorithms
[1]-[3].
This
mak
es
mask
ed
communication
as
a
piece
of
cak
e
to
e
v
en
an
ob
vious
illicit
user
.
A
simple
analysis
on
e
xisting
ste
g
anograph
y
tools
re
v
eals
the
f
act
that
most
of
them
use
lossless
24-bit
image
formats.
The
common
among
them
are
BMP
,
GIF
,
PNG
and
TIFF
formats.
Among
them,
BMP
im
age
format
is
the
most
widely
used,
because
it
pro
vides
a
lar
ge
area
of
hiding
(implying
lar
ge
payload)
with
less
probability
of
detection
(less
pix
el
change
rate)
in
spite
of
its
uncompressed
data.
The
los
sy
JPEG
images
are
least
preferre
d
because
these
image
types
are
easily
distorted
(lo
w
payload;
high
pix
el
change
rate)
and
detection
is
therefore
much
simpler
.
Thus,
in
general
ste
g
analysis
process
depends
on
co
v
er
image
format
and
payload.
Most
of
the
w
ork
carried
out
in
the
l
iterature
concentrates
on
the
nding
the
artef
acts
produced
by
the
J
ournal
homepage:
http://ijict.iaescor
e
.com
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Inf
&
Commun
T
echnol
ISSN:
2252-8776
❒
189
ste
g
anographic
algorithm
on
the
co
v
er
image
data
as
a
result
of
embedding.
Uni
v
ersal
ste
g
anographic
softw
are
tool
identication
is
scarcely
reported
in
current
literature.
This
is
because
e
v
ery
ste
g
anographic
softw
are
tool
has
an
underlying
algorithm
and
detection
of
algorithm
is
suf
cient
for
the
detection
of
co
v
er
or
ste
go
images.
Ho
we
v
er
,
a
good
deal
of
ste
g
anographic
softw
are
tool
uses
the
least
signicant
bit
(LSB)
encoding
though
it
is
simple
for
digital
image
ste
g
anograph
y
.
This
mak
es
the
ste
g
anographic
softw
are
tool
identication
as
a
challenging
one,
since
the
method
of
st
e
g
anal
y
s
is
of
algorithm
found
in
literature
cannot
be
used
here
[4]-[15].
A
wide
range
of
simple
tar
geted
ste
g
anographic
softw
are
tool
identication
is
reported
in
literat
ure.
The
pioneer
w
ork
in
the
eld
reported
that
some
tools
lea
v
e
a
signature
which
can
be
e
xploited
to
identify
the
tool
and
ste
go-image
[16].
The
y
pro
v
ed
it
for
a
set
of
ste
g
anographic
softw
are
tools
(S-T
ools,
Syscop,
Man-
delSte
g,
etc)
which
used
palette
and
fractal
images.
W
estfeld
and
Ptzmann
[17]
used
the
tools
lik
e
EzSte
go
v2.0b3,
Jste
g
v4,
Ste
g
anos
v1.5,
and
S-T
ools
v4.0
for
detection
by
statistical
ste
g
analysis.
Pro
v
os
and
Hon-
e
yman
[18]
lat
er
de
v
eloped
Ste
gDetect
to
identify
ste
g
anographic
content
and
Ste
gBreak
to
launch
dictionary
attack
on
those
and
retrie
v
e
the
hidden
content
in
JPEG
images.
Geetha
et
al
.
[19]
identied
w
atermarking
and
ste
g
anographic
tools
using
an
genetic-X-means
classier
.
V
erma
et
al
.
[20]
proposed
a
ste
g
analysis
tech-
nique
on
the
basis
of
statistical
observ
ations
on
dif
ference
image
histograms
(DIH)
for
the
reliable
detection
of
classical
least
signicant
bit
(LSB)
ste
g
anograph
y
which
measured
the
weak
correlation
between
succes-
si
v
e
bit
planes
to
construct
a
classier
for
discrimination
between
ste
go-images
and
co
v
er
images.
Sloan
and
Hernandez-Castro
[21]
reported
the
identication
of
openpuf
f
in
video
ste
g
analysis.
All
these
were
tar
geted
(specic
to
single
tool)
and
required
patient
scrutin
y
of
the
images
manually
which
w
as
time
consuming
and
error
prone.
An
important
w
ork
in
this
eld
w
as
by
[22]
where
the
y
designed
a
fully
automated,
blind,
m
edia-type
agnostic
approach
to
ste
g
analysis
by
bitwise
analysis
of
header
data
and
generated
a
signature
for
each
tool.
Though
the
y
reported
their
w
ork
to
be
media-type
agnostic,
the
results
reported
were
based
on
se
v
en
tools
out
of
which
v
e
were
of
J
PEG
format,
one
in
MP3
format
and
one
in
GIF
format
tools
and
a
minimum
of
10
ste
go
images
of
each
tool
were
used
to
generate
the
signature
for
the
tool.
This
pro
vided
an
insight
into
w
orking
out
a
uni
v
ersal
ste
g
analyser
for
ste
g
anographic
softw
are
tool
identication
e
xploiting
both
artef
acts
in
the
image
data
and
its
metadata.
Almost
all
current
ste
g
analysers
require
at
least
a
little
kno
wledge
of
the
used
ste
g
anographic
softw
are
tools.
Feeding
the
information
may
be
a
mamm
oth
task
comparing
the
number
of
tools
a
v
ailable
[23].
So
a
payload
independent
uni
v
ersal
ste
g
analyser
is
proposed
that
initially
e
xploits
the
macroscopically
changing
elds
of
the
image
metadata
and
information
from
metadata
to
identify
the
tools
by
clustering.
This
helps
in
se
gre
g
ating
most
of
the
tools,
while
those
similar
to
co
v
er
are
further
processed.
This
is
done
by
forming
a
signature
from
ste
go
images
of
those
tools
from
artef
acts
present
in
their
image
data.
The
scope
of
the
proposed
uni
v
ersal
ste
g
analyser
is
limited
t
o
ste
go
tools
that
w
ork
in
these
v
e
image
formats
namely
BMP
,
GIF
,
PNG,
TIFF
and
JPEG.
The
structure
of
this
paper
is
as
follo
ws
:
Section
2.
describes
the
structure
of
the
Uni
v
ersal
ste
g
anal-
yser;
Section
3.
presents
the
ste
g
analysis
using
image
header;
Section
4.
e
xtends
the
ste
g
analysis
by
comparing
the
signature
generated
for
the
ste
g
anographic
softw
are
tool
in
image
data;
Section
5.
measures
and
e
v
aluates
the
technique
e
xperimentally;
Section
6.
concludes
the
w
ork,
and
is
follo
wed
by
appendices
and
references.
2.
PR
OPOSED
UNIVERSAL
STEGAN
AL
YSIS
The
ste
g
analysis
of
ste
go
images
from
dif
ferent
ste
g
anographic
softw
are
tools
is
done
in
tw
o
phases.
In
the
rst
phase,
the
ste
go
images
are
rst
distinguished
based
on
one
of
the
v
e
image
formats.
Then,
for
each
image
f
o
r
mat,
certain
elds
or
information
from
the
elds
of
the
header
data
are
e
xtracted.
These
features
are
then
subjected
to
unsupervised
clustering
by
means
of
e
xtended
K-Means.
Extended
K-Means
clustering
acts
as
pattern
matching
template
to
identify
dif
ferent
ste
g
anographic
softw
are
tools
uniquely
.
Though
this
initial
clustering
identies
most
of
the
ste
g
anographic
softw
are
t
ools,
it
lea
v
es
space
for
ste
g
analysis
of
ste
g
anographic
softw
are
tools
that
tak
e
care
of
not
disturbing
the
metadata
while
processing.
The
ste
go
images
from
these
ste
g
anographic
softw
are
tools
resemble
co
v
er
images
and
are
placed
in
the
cluster
as
that
of
the
co
v
er
.
The
second
phase
of
ste
g
analysis
starts
by
taking
these
clusters.
As
a
prerequisite
for
this
phase,
a
signature
is
generated
for
each
tool
from
t
he
artef
acts
in
image
data.
This
signature
is
compared
ag
ainst
the
si
g
na
ture
found
in
the
s
te
go
images
of
the
cluster
.
If
a
signature
match
is
found,
then
the
tool
is
identied.
The
block
diagram
of
the
proposed
ste
g
analyser
is
gi
v
en
in
Figure
1.
F
or
ensic
ste
ganalysis
for
identication
of
ste
gano
gr
aphy
softwar
e
tools
using
...
(S.
T
.
V
eena)
Evaluation Warning : The document was created with Spire.PDF for Python.
190
❒
ISSN:
2252-8776
Figure
1.
Block
diagram
of
the
proposed
ste
g
analyser
3.
STEGAN
AL
YSIS
USING
IMA
GE
HEADER
AR
TEF
A
CTS
A
great
portion
of
literature
in
digital
image
forensic
e
xploit
header
data
for
v
arious
purposes
[24].
Here
it
is
used
for
ste
g
analysis
of
ste
g
anographic
softw
are
tools.
3.1.
Fields
consider
ed
in
each
image
f
ormat
As
mentioned
earlier
the
ste
g
analyser
is
to
e
xploit
the
vulnerable
elds
of
image
header
to
identify
the
tool.
The
elds
that
may
lead
to
identication
of
the
tools
are
detailed
for
each
format
[25]-[29].
3.1.1.
BMP
image
f
ormat
The
BMP
images
ha
v
e
a
x
ed
byte
format.
The
elds-bits
per
pix
el,
image
data
padding
(last
tw
o
bytes
of
4
bytes
of
SizeofBitmap
eld)
horizontal
resolution,
V
ertical
resolution
is
used
since
most
ste
g
anographic
softw
are
tool
modify
them.
In
addition,
the
actual
size
of
BMP
le
deri
v
ed
from
t
h
e
elds
is
used.
Thus,
these
v
e
elds
form
features
that
are
used
for
identifying
tool
in
BMP
images.
3.1.2.
GIF
image
f
ormat
There
are
tw
o
v
ersion
formats
in
GIF;
87a
and
89a.
The
trailer
eld
is
used
to
nd
camouage
ste
g
anographic
softw
are
tools
that
do
not
mak
e
a
single
change
in
image
b
ut
insert
the
secret
data
after
the
image
data.
The
v
ersion
eld
in
le
header
,
the
pack
ed
eld
of
the
global
colour
table
in
logical
screen
descriptor
and
the
pack
ed
eld
of
the
local
image
descriptor
which
has
the
image
and
colour
table
data
information
are
also
used.
Presence
of
graphic
control,
com
ment
and
plain
te
xt
e
xtension
block,
size
of
global
and
local
colour
table
are
also
unique
features
to
identify
tool.
Thus,
these
elds
form
the
features
to
identify
tools
in
GIF
format.
3.1.3.
JPEG
image
f
ormat
The
JPEG
format
is
dependent
on
the
quality
f
actor
of
the
JPEG
compression
and
thus
can
be
used
to
distinguish
not
only
tools
b
ut
also
algorithms.
The
elds
that
are
e
xploited
are
as
follo
ws:
JFIF
v
ersion,
density
unit
eld
in
JFIF
header
,
presence
of
data
after
last
end
of
image
(EOI)
mark
er
,
presence
of
comment
mark
er
(COM),
quantisation
table
length
and
location
of
Huf
fman
table.
These
six
information
from
header
form
the
JPEG
feature
v
ector
.
3.2.
PNG
image
f
ormat
The
PNG
le
format
supports
a
number
of
chunks
which
help
in
tool
identication.
The
presence
of
auxiliary
chunk
types
lik
e
time-time
of
last
modication,
te
xt-e
xtensions
and
their
c
yclic
redundanc
y
check
(CRC)
are
used
to
cluster
tools.
End
of
le
is
check
ed
with
IEND
chunk
eld.
Thus,
the
feature
v
ector
for
PNG
format
is
tak
en
from
these
elds.
Int
J
Inf
&
Commun
T
echnol,
V
ol.
10,
No.
3,
December
2021
:
188
–
197
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Inf
&
Commun
T
echnol
ISSN:
2252-8776
❒
191
3.2.1.
TIFF
image
f
ormat
The
TIFF
is
supported
by
data
in
tw
o
ordering:
little
endian
and
big
endian,
which
forms
the
rst
feature.
Here
ag
ain
presence
of
additional
tags
lik
e
artist,
cop
yright,
hostcomputer
,
mak
e,
model,
softw
are
or
datetime
indicate
a
tool.
Presence
of
Ne
w
SubFileT
ype
or
SubFileT
ype
T
ag
can
account
for
signicant
tool
identication.
In
addition,
the
elds
lik
e
Number
of
tags
in
image
le
directory
,
Number
of
StripOf
fset,
and
information
deri
v
ed
from
Ro
wsPerStrip,
StripOf
fsets,
StripByteCounts
and
DataT
ype
elds
to
indicate
data
embedded
at
End
of
image
are
e
xploited
as
features
for
TIFF
images.
3.3.
Clustering
algorithm
When
the
labels
of
the
gi
v
en
data
are
unkno
wn,
unsupervised
learning
tak
es
place
through
clus
tering.
One
simple
form
of
clustering
the
gi
v
en
information
is
K-Means
clustering.
This
clustering
requires
number
of
cluster
(K)
as
input.
The
pro
vision
of
number
of
clusters
is
not
possible
in
a
practical
scenario.
So
an
e
xtension
to
the
K-Means
is
made
by
repeating
with
the
K-Means
algorithm
with
increasing
cluster
numbers
until
the
distance
of
each
sa
mple
to
its
centroid
is
zero.
Thus,
the
optimal
number
of
clusters
is
determined.
The
pseudo
code
for
the
algorithm
is
gi
v
en
as
belo
w:
Algorithm
e
xtended
KMeans
Input
-
Features
and
Number
of
Samples
Output
-
Optimized
Number
of
clusters
COUNT
and
the
Clusters,
CLUST
FOR
COUNT
=
1
to
Number
of
samples
•
Let
Kmeans
clust
ering
of
COUNT
clusters
based
on
city
block
distance
with
5
cross
v
alidation
be
CLUST
•
Let
the
within
clus
ter
distance
of
each
cluster
in
CLUST
be
DIST
•
IF
DIST
is
equal
to
ze
ro
for
all
clusters
–
The
optimal
clusters
and
their
number
are
found
in
CLUST
and
COUNT
respecti
v
ely;
EXIT
•
ELSE
Continue
W
ithin
cluster
distance
of
cluster
is
zero
means
e
xact
mat
ch.
Thus,
the
algorithm
helps
in
i
d
e
ntifying
the
e
xact
tool’
s
header
signature
which
is
later
correlated
with
the
tool.
4.
STEGAN
AL
YSIS
BY
AR
TEF
A
CTS
IN
IMA
GE
D
A
T
A
The
ste
go
images
of
the
ste
g
anographic
softw
are
tool
that
do
not
modify
the
header
or
the
m
etadata
of
the
co
v
er
image
cannot
be
detected
by
the
abo
v
e
process.
In
order
to
identify
those
ste
go
images
and
to
ultimately
re
v
eal
the
tool,
the
artef
acts
left
by
t
he
ste
g
anographic
softw
are
tool
in
image
data
is
considered.
The
metadata
(ste
go
k
e
y)
about
the
ste
g
anographic
process
is
in
some
w
ay
hidden
inside
the
image
data
[16].
The
f
act
is
that
the
metadata
is
either
hidden
sequentially
in
the
start
or
at
the
end
of
the
image
le
or
randomly
.
Ev
en
though
the
metadat
a
may
v
ary
in
byte
le
v
el,
it
is
found
that
at
bit
le
v
el,
things
do
not
change
[22].
Things
may
be
either
the
bit
or
its
position.
This
is
generated
as
a
signature
of
the
tool
by
e
xamining
its
ste
go
image
data
in
bit
le
v
el.
The
signature
is
generated
from
either
rst
100
pix
els
or
the
last
100
pix
els
depending
on
the
tool
and
sa
v
ed
in
si
gnature
library
.
This
signature
is
compared
with
the
bits
of
the
ste
go
image
to
be
tested.
A
match
implies
the
tool
being
used.
The
characteristic
signature
of
WB
Ste
go
tool
as
an
a
v
erage
of
last
30
pix
els
o
v
er
50
images
is
sho
wn
in
Figure
2.
(a)
(b)
Figure
2.
A
v
erage
signature
found
in
the
last
30
pix
els
of
50
randomly
selected
BMP
images,
(a)
WB
ste
go
BMP
images,
(b)
Co
v
er
BMP
images
F
or
ensic
ste
ganalysis
for
identication
of
ste
gano
gr
aphy
softwar
e
tools
using
...
(S.
T
.
V
eena)
Evaluation Warning : The document was created with Spire.PDF for Python.
192
❒
ISSN:
2252-8776
Thus
an
automated
approach
for
uni
v
ersal
ste
g
analysis
of
softw
are
tool
is
done
by
tracing
the
artef
act
left
by
the
tool
in
both
the
image
header
and
its
data.
5.
EXPERIMENT
AL
RESUL
TS
AND
DISCUSSION
No
benchmark
ste
g
anographic
tools
e
xists
for
ste
g
analysis.
So
to
create
a
repository
of
ste
go
images,
ste
g
anographic
softw
are
tools
are
do
wnloaded
from
sites
referred
in
[23]
using
images
from
sources
Bossbase,
McGill
databases.
T
able
1
lists
the
dif
ferent
ste
g
anographic
softw
are
tools
used.
T
able
1.
List
of
ste
g
anographic
softw
are
tools
used
with
supporting
image
format
SNo
Ste
g
anographic
softw
are
tool
(v
ersion)
Supporting
image
formats
1
2pix
v1.1
(2P)
BMP
2
BlindSide
v0.9b
(BS)
BMP
3
DeEgger
Embedder
v1.3.6
(DE)
BMP
,
GIF
,
JPEG,
PNG,
TIFF
4
F5
(F)
JPEG
5
File
in
File
(Fi)
BMP
6
Gifshuf
e
(GS)
GIF
7
Hermatic
system
Ste
gPNG
trail
v
ersion
11.01
(hs)
BMP
,
PNG
8
Hide
&
Re
v
eal
v1.7.0
(hi)
BMP
,
PNG,
TIFF
9
Hide
in
Picture
v2.1
(HI)
BMP
,GIF
10
Image
Hide
v2.0
(IH)
BMP
,
PNG
11
Image
Protector
v3.6
(IP)
BMP
12
In
visible
Secrets
trail
v
ersion4.0
(IS)
BMP
,
JPEG,
PNG
13
JHide
v1.0.0
(JH)
BMP
,
PNG,
TIFF
14
JPHSwin
V0.5
(JP)
JPEG
15
nsF5
(ns)
JPEG
16
Open
Puf
f
v4.00
(OP)
BMP
,
JPEG,
PNG
17
Our
Secret
v2.5
(OS)
BMP
,
GIF
,
JPEG,
PNG,
TIFF
18
Outguess
v0.2
(O)
JPEG
19
Secret
Layer
v
.2.8.1
(SL)
BMP
,JPEG,
PNG
20
Silent
Eye
v0.4.1
(SE)
BMP
,
JPEG
21
SSuite
Piscel
(SP)
BMP
,
PNG
22
Ste
g
anole
v1.0
(SF)
BMP
23
Ste
ghide
v0.5-win32
(sh)
BMP
,
JPEG
24
S-T
ools
v4.0
(ST)
BMP
,GIF
25
Ste
g
anograph
y
T
ool
(imgAuthServ
er)
(I)
PNG
26
The
Secret
Code
Break
er
Ste
g
anograph
y
program
v1.2
(5)
BMP
27
Third
Eye
v1.0
(TE)
BMP
,
GIF
28
T
rojan
v1.0
(T)
BMP
,
PNG,
TIFF
29
V
eneer
(V)
BMP
,
GIF
,
JPEG,
PNG,
TIFF
30
Wb
-
Ste
go
v4.3
(WS)
BMP
31
Xiao
v2.6.1
(X)
BMP
F
or
co
v
er
images,
both
images
from
clean
source
and
internet
are
e
xploited.
McGill
Image
database
[30]
which
pro
v
es
a
challenging
co
v
er
source
for
ste
g
analysis
is
tak
en
for
clean
images.
Thus,
the
co
v
er
image
database
consists
of
1000
ima
ges
with
random
500
from
each
source.
The
y
are
basically
either
tif
f
or
bmp
format
images.
The
y
are
resized
to
512
×
512
for
simplicity
.
The
co
v
er
images
are
then
con
v
erted
to
v
e
image
formats
namely
BMP
,
TIFF
,
PNG,
GIF
and
JPEG.
F
or
JPEG
images,
100%
compression
ratio
is
used.
A
random
100
images
from
the
co
v
er
source
is
chosen
for
each
ste
g
anographic
softw
are
tool
to
mak
e
the
ste
go
images
for
each
format.
Thus,
a
total
of
6,500
(25
×
100
BMP
,
7
×
100
GIF
,
12
×
100
JPEG,
13
×
100
PNG,
6
×
100
TIFF)
ste
go
images
are
created.
The
secret
data
is
random
data
ranging
from
1
byte
to
maximum
possible
payload
by
the
tool.
100
random
co
v
er
images
(CO)
for
each
format
is
also
tak
en
(though
a
single
co
v
er
image
is
enough).
The
e
xperiment
is
carried
out
on
the
set
up
database.
The
results
of
rst
phase
of
ste
g
analysis
are
sho
wn
in
Figure
3.
Int
J
Inf
&
Commun
T
echnol,
V
ol.
10,
No.
3,
December
2021
:
188
–
197
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Inf
&
Commun
T
echnol
ISSN:
2252-8776
❒
193
(a)
(b)
(c)
(d)
(e)
Figure
3.
Scatter
plot
of
clustering
information
from
header
data
in
v
arious
image
formats,
(a)
PNG
format,
(b)
GIF
format,
(c)
TIFF
format,
(d)
JPEG
format,
(e)
BMP
format
F
or
ensic
ste
ganalysis
for
identication
of
ste
gano
gr
aphy
softwar
e
tools
using
...
(S.
T
.
V
eena)
Evaluation Warning : The document was created with Spire.PDF for Python.
194
❒
ISSN:
2252-8776
In
this
phase,
it
is
noted
that
the
ste
g
anographic
softw
are
tool
(DE,V
,OS)
that
hide
data
at
the
end
of
image
le
are
all
clustered
in
separate
group
and
are
identied
re
g
ardless
of
formats.
Softw
are
specic
to
format
(GS,
IP
,
WB,
BS)
are
lar
gely
dif
cult
to
ident
ify
,
since
care
is
tak
en
by
tool
to
lea
v
e
no
trace
in
header
data.
In
ste
g
anographic
softw
are
tool
that
support
more
than
one
format,
at
least
one
format
is
insecure
(HR,
HI,
IS,
ST
,
JH,
OP
,
SL).
Only
one
system
(hs)
that
supports
multiple
format
is
not
detectable
in
an
y
of
the
formats.
Also,
it
is
v
eried
that
of
all
formats,
identication
of
tool
is
v
ery
dif
cult
in
BMP
because
of
its
simple
and
short
header
,
other
formats
ha
v
e
lar
ge
information
in
header
which
in
turn
leads
to
loopholes
or
vulnerability
.
F
or
the
second
phase,
those
images
that
resemble
co
v
er
(st
e
g
o
images
clustered
along
with
co
v
er)
are
fed
as
the
input
to
the
ste
g
analyser
and
the
results
are
tab
ulated
as
in
T
able
2.
It
can
be
seen
from
T
able
2
that
almost
all
ste
g
anographic
softw
are
tools
store
their
metadata
in
the
image
data.
And
the
signature
of
each
tool
is
unique
with
no
tw
o
tools
ha
ving
same
signature.
Also,
this
signature
is
present
independent
of
image
format.
Ho
we
v
er
,
this
phenomenon
w
as
absent
in
GIF
format
which
may
lik
ely
be
due
to
the
f
act
that
GIF
formats
alter
palette
rather
than
data.
Rarely
some
tools
lik
e
BS,
HI
and
ST
handle
it.
Either
the
y
do
not
store
meta
data
in
its
image
or
the
y
are
stored
randomly
.
T
able
2.
Experimental
results
for
signature
matching
in
image
data
of
dif
ferent
ste
g
analyser
tools
S.No
Image
format
T
ool
Signature
length
(in
bits)
and
location
A
v
erage
signature
match
in
%
T
rue
positi
v
e
F
alse
positi
v
e
1
BMP
5
14
T
op
100
0
2
BS
No
signature
0
0
3
HI
No
signature
0
0
4
IH
145
T
op
100
0
5
IP
83
T
op
100
0
6
IS
101
T
op
100
0
7
JH
58
Bottom
100
0
8
OP
24
Bottom
100
0
9
ST
No
signature
0
0
10
WS
284
Bottom
100
0
11
hi
260
T
op
100
0
12
hs
39
Bottom
100
0
13
sh
132
Bottom
100
0.7
14
GIF
GS
100
15
JPEG
O
60
Bottom
100
0
16
OP
72
Bottom
100
0.25
17
SL
67
Bottom
100
0.25
18
sh
99
Bottom
100
0.75
19
PNG
JH
60
Bottom
100
0
20
hi
173
T
op
100
0
21
hs
20
Bottom
100
0
Comparison
of
this
ste
g
analyser
is
done
with
e
xisting
free
w
are
ste
g
analyser
namely
Ste
gSp
y
v2.1
[31],
Ste
gSecret
also
kno
wn
as
XSte
gSecretBeta
v0.1
[32],
Ste
gExpose
[33].
Ste
gSp
y
claims
to
identify
the
follo
wing
programs:
Hiderman,
hide
and
seek,
mask
er
,
JPe
gX
and
In
visible
Secrets.
F
ollo
wing
are
the
tech-
niques
and
tools
identied
by
Ste
gSecret
(PNG
&
TIFF
formats
not
supported)
:
T
ools
-
Camouage
V1.2.1,
inThePicture
v2,
JPEGXv2.1.1,
pretty
good
en
v
elope
PGE)
v1.0,
appendX
v
less
than
4,
Ste
g
anograph
y
v1.6.5,
inPlainV
ie
w
,
DataStash
v1.5
and
dataStealth
v1.0.
T
echniques
-
EOF
techniques,
V
isual
Attacks,
ChiSquare
Attack
and
RS
Attack.
Sequential
and
Pseudorandom
LSBs,
uses
BD
AS
v0.1
(ste
g
anograph
y
tools
ngerprint
DataBase)
to
detect
more
t
han
40
ste
g
anograph
y
tools.
Ste
gExpose
(TIFF
format
not
supported)
is
statistical
tool
for
identifying
LSB
embedding
in
images.
It
emplo
ys
ChiSquare
attack,
RS
attack
and
primary
set
attacks
to
identify
tool.
These
tools
are
used
ag
ainst
generic
co
v
er
,
ste
go
classicati
on
on
the
set
up
database.
The
results
are
noted
in
T
able
3.
Int
J
Inf
&
Commun
T
echnol,
V
ol.
10,
No.
3,
December
2021
:
188
–
197
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Inf
&
Commun
T
echnol
ISSN:
2252-8776
❒
195
T
able
3.
Percentage
of
ste
go
images
identied
by
dif
ferent
ste
g
analyser
tools
Ste
g
ano
Ste
g
Ste
g
Ste
g
Proposed
graphic
tool
e
xpose
secret
sp
y
ste
g
analyser
BMP
image
format
2P
30
0
30
100
BS
0
0
5
0
DE
20
100
50
100
Fi
10
100
90
100
hs
100
0
90
100
hi
0
0
60
100
HI
20
0
90
0
IH
10
0
70
100
IS
100
0
30
100
IP
10
0
60
100
JH
0
0
60
100
OP
70
0
50
100
OS
10
100
30
100
SL
40
0
40
100
SE
40
0
50
100
SP
0
0
40
100
SF
0
100
70
100
sh
0
0
50
100
ST
0
0
40
0
5
0
0
60
100
TE
0
10
50
100
T
10
0
70
100
V
0
100
50
100
WS
10
0
40
100
X
0
70
40
100
GIF
image
format
DE
0
0
10
100
GS
0
0
0
0
HI
0
0
0
100
OS
10
100
20
100
ST
0
0
0
100
TE
0
0
40
100
V
10
100
20
100
Ste
g
ano
Ste
g
Ste
g
Ste
g
Proposed
graphic
tool
e
xpose
secret
sp
y
ste
g
analyser
JPEG
Image
format
DE
10
100
10
100
F5
0
0
0
100
IS
10
0
10
100
JP
20
0
0
100
ns
10
0
0
100
OP
0
0
10
100
OS
10
100
0
100
O
10
0
0
100
SL
20
0
10
100
SE
0
0
0
100
sh
10
0
10
100
V
0
100
0
100
PNG
image
format
DE
0
0
50
100
hs
100
0
10
100
hi
60
0
20
100
IH
0
0
20
100
IS
0
0
30
100
JH
0
0
20
100
OP
0
0
40
100
OS
0
0
10
100
SL
50
0
40
100
SP
50
0
10
100
I
10
0
0
100
T
0
0
0
100
V
0
0
60
100
TIFF
image
format
DE
0
0
70
100
hi
0
0
70
100
JH
0
0
70
100
OS
0
0
80
100
T
0
0
50
100
V
0
0
70
100
6.
CONCLUSION
In
almost
all
the
formats,
the
identication
of
tool
by
its
ste
go
image
independent
of
payload
is
a
major
contrib
ution
of
the
proposed
ste
g
analyser
o
v
er
the
statistical
ste
g
analyser
which
nds
detection
of
ste
go
images
with
payload
less
than
5%
of
the
maximum
capacity
as
an
arduous
task.
The
other
f
acts
that
can
be
concluded
from
the
e
xperimentation
are
almost
all
tools
lea
v
e
a
t
race
in
either
the
header
or
the
data
of
the
ste
go
image.
BMP
format
has
the
least
vulnerable
header
of
all
image
formats
and
size
of
secret
payload
is
irrele
v
ant
because
it
is
not
related
to
the
image
statistics
b
ut
to
the
tool
signature.
Thus,
this
uni
v
ersal
blind
structural
ste
g
analyser
is
capable
of
identifying
tools
which
lea
v
e
their
trace
in
the
ste
go
images
irrespecti
v
e
of
the
size
of
secret
payload.
Con
v
ersely
,
this
means
that
this
method
will
not
operate
at
all
ag
ainst
implementations
of
algorithms
that
do
not
produce
characteristic
irre
gula
rities
in
their
header
(simple
LSB
batchwise
processing)
or
store
their
metadata
in
the
image
BS.
Ho
we
v
er
,
at
lar
ge,
a
match
ag
ainst
a
ste
go
signature
can
pro
vide
a
useful
indication
that
a
particular
tool
may
ha
v
e
been
us
ed
and
consequently
an
indication
that
the
le
may
contain
ste
g
anograph
y
.
Also,
this
ste
g
analyser
produces
a
100%
match
for
a
tool
irrespecti
v
e
of
payload
which
cannot
be
the
case
for
other
statistical
ste
g
analyser
.
So
such
uni
v
ersal
structural
ste
g
analysers
can
ef
fecti
v
ely
be
deplo
yed
as
the
pre
mechanisms
to
the
e
xisting
ste
g
analysis
techniques
and
help
to
impro
v
e
o
v
erall
accurac
y
.
REFERENCES
[1]
N.
F
.
Johnson
and
S.
Jajodia,
”Exploring
ste
g
anograph
y:
Seeing
the
unseen,
”
in
Computer
,
v
ol.
31,
no.
2,
pp.
26-34,
Feb
.
1998,
doi:
10.1109/MC.1998.4655281.
[2]
”Ste
g
anograph
yonline”,
[Online].
A
v
ailable:
https://stylesuxx.github
.io/ste
g
anograph
y/.
F
or
ensic
ste
ganalysis
for
identication
of
ste
gano
gr
aphy
softwar
e
tools
using
...
(S.
T
.
V
eena)
Evaluation Warning : The document was created with Spire.PDF for Python.
196
❒
ISSN:
2252-8776
[3]
”Man
ytools”,
[Online].
A
v
ailable:
https://man
ytools.or
g/hack
er
-tools/ste
g
anograph
y-encode-te
xt-into-
image/.
[4]
J.
Fridrich,
M.
Goljan
and
R.
Du,
”Reliable
detection
of
LSB
ste
g
anograph
y
in
color
and
grayscale
im-
ages,
”
MM&Sec
’01:
Proceedings
of
the
2001
w
orkshop
on
Multimedia
and
security:
ne
w
challenges
,
2001,
pp.
27-30,
doi:
10.1145/1232454.1232466.
[5]
J.
Fridrich,
M.
Goljan
and
Rui
Du,
”Detecting
LSB
ste
g
anograph
y
in
color
,
and
gray-scale
images,
”
in
IEEE
MultiMedia
,
v
ol.
8,
no.
4,
pp.
22-28,
Oct.-Dec.
2001,
doi:
10.1109/93.959097.
[6]
A.
W
estfeld,
”F5—A
Ste
g
anographic
Algorithm,
”
in
Information
Hiding
,
v
ol.
2137,
2001,
doi:
10.1007/3-
540-45496-9
21.
[7]
T
ao
Zhang
and
Xijian
Ping,
”Reliable
detection
of
LSB
ste
g
anograph
y
based
on
the
dif
ference
image
histogram,
”
2003
IEEE
International
Conference
on
Acoustics,
Speech,
and
Signal
Processing,
2003.
Proceedings.
(ICASSP
’03).
,
2003,
pp.
III-545,
doi:
10.1109/ICASSP
.2003.1199532.
[8]
S.
Dumitrescu,
Xiaolin
W
u
and
Zhe
W
ang,
”Detection
of
LSB
ste
g
anograph
y
via
sample
pair
anal-
ysis,
”
in
IEEE
T
ransactions
on
Signal
Processing
,
v
ol.
51,
no.
7,
pp.
1995-2007,
July
2003,
doi:
10.1109/TSP
.2003.812753.
[9]
A.
D.
K
er
,
”Ste
g
analysis
of
LSB
matching
in
grayscale
images,
”
in
IEEE
Signal
Processing
Letters
,
v
ol.
12,
no.
6,
pp.
441-444,
June
2005,
doi:
10.1109/LSP
.2005.847889.
[10]
S.
L
yu
and
H.
F
arid,
”Ste
g
analysis
using
higher
-order
image
statistics,
”
in
IEEE
T
ransactions
on
Informa-
tion
F
orensics
and
Security
,
v
ol.
1,
no.
1,
pp.
111-119,
March
2006,
doi:
10.1109/TIFS.2005.863485.
[11]
B.
Li,
J.
Huang
and
Y
.
Q.
Shi,
”Ste
g
analysis
of
Y
ASS,
”
in
IEEE
T
ransactions
on
Information
F
orensics
and
Security
,
v
ol.
4,
no.
3,
pp.
369-382,
Sept.
2009,
doi:
10.1109/TIFS.2009.2025841.
[12]
J.
Fridrich,
J.
K
odo
vsk
´
y,
V
.
Holub,
and
M.
Goljan,
”Breaking
HUGO
–
The
Process
Disco
v
ery
,
”
in
Infor
-
mation
Hiding
,
v
ol.
6985,
2011,
doi:
10.1007/978-3-642-24178-9
7.
[13]
K.
Karampidis,
E.
Ka
v
allieratou
and
G.
P
apadourakis,
”A
re
vie
w
of
image
ste
g
analysis
tech-
niques
for
digital
forensics,
”
Journal
of
Information
Security
and
Applications
,
v
ol.
40,
2018,
doi:
10.1016/j.jisa.2018.04.005.
[14]
S.
Chutani
and
A.
Go
yal,
”A
re
vie
w
of
forensic
approaches
to
digital
image
Ste
g
analysis,
”
Multimedia
T
ools
and
Applications
,
v
ol.
78,
pp.
18169–18204,
2014,
doi:
10.1007/s11042-019-7217-0.
[15]
O.
I.
Al-Sanjary
,
O.
Ahmed
Ibrahim
and
K.
Sathasi
v
em,
”A
Ne
w
Approach
to
Optimum
Ste
g
anographic
Algorithm
for
Secure
Image,
”
2020
IEEE
International
Conference
on
Automatic
Control
and
Intelligent
Systems
(I2CA
CIS)
,
2020,
pp.
97-102,
doi:
10.1109/I2CA
CIS49202.2020.9140186.
[16]
N.
F
.
Johnson
and
S.
Jajodia,
”Ste
g
analysis
of
Images
Created
Using
Current
Ste
g
anograph
y
Softw
are,
”
in
Information
Hiding
,
v
ol.
1525,
1998,
doi:
10.1007/3-540-49380-8
19.
[17]
A.
W
estfeld
and
A.
Ptzmann,
”Attacks
on
Ste
g
anographic
Systems,
”
in
Information
Hiding
,
v
ol.
1768,
2000,
doi:
10.1007/10719724
5.
[18]
N.
Pro
v
os
and
P
.
Hone
yman,
”Detecting
Ste
g
anographic
Content
on
the
Internet,
”
NDSS
Symposium
2002
,
2002.
[19]
S.
Geetha,
S.
S.
S
indhu
and
N.
Kamaraj,
”Detection
of
ste
go
anomalies
in
images
e
xploiting
the
content
independent
statistical
footprints
of
the
ste
g
anograms,
”
informatica
,
v
ol.
33,
no.
1,
2009.
[20]
S.
V
erma,
S.
Sood
and
S.
K.
Ranade,
”Rele
v
ance
of
Ste
g
analysis
using
DIH
on
LSB
Ste
g
anograph
y
,
”
International
Journal
of
Adv
anced
Research
in
Computer
Science
and
Softw
are
Engineering
,
v
ol.
4,
no.
2,
pp.
835-838,
2014.
[21]
T
.
Sloan
and
J.
Hernandez-Castro,
”Ste
g
analysis
of
OpenPuf
f
through
atomic
concatenation
of
MP4
ags,
”
Digital
In
v
estig
ation
,
v
ol.
13,
pp.
15-21,
2015,
doi:
10.1016/j.diin.2015.02.002.
[22]
G.
Bell
and
Y
.
Lee,
”A
Method
for
Automatic
Identication
of
Signatures
of
Ste
g
anograph
y
Softw
are,
”
in
IEEE
T
ransactions
on
Information
F
orensics
and
Security
,
v
ol.
5,
no.
2,
pp.
354-358,
June
2010,
doi:
10.1109/TIFS.2010.2046985.
[23]
”Ste
g
anograph
y
Softw
are,
”
2015.
[Online].
A
v
ailable:
http://www
.jjtc.com/Ste
g
anograph
y/tools.html.
[24]
P
.
Alv
arez,
”Using
Extended
File
Information
(EXIF
)
File
Headers
in
Digital
Evidence
Analysis,
”
Inter
-
national
Journal
of
Digital
Evidence
,
v
ol.
2,
no.
3,
pp.
1-5,
2004.
[25]
H.
S.
Hussain,
R.
Din,
M.
H.
Ali,
M.
H.
and
N.
Balqis,
”‘The
Embedding
Performance
of
Ste
gSVM
Model
in
Image
Ste
g
anograph
y
,
”
Indonesian
J
ournal
of
Electrical
Engineering
and
Computer
Science
(IJEECS)
,
v
ol.
12,
no.
1,
pp.
233-238,
2018,
doi:
10.11591/ijeecs.v12.i1.pp233-238.
[26]
B.
A.
Sultan
and
L.
E.
Geor
ge,
”Color
image
compression
based
on
spatial
and
magnitude
signal
de-
Int
J
Inf
&
Commun
T
echnol,
V
ol.
10,
No.
3,
December
2021
:
188
–
197
Evaluation Warning : The document was created with Spire.PDF for Python.
Int
J
Inf
&
Commun
T
echnol
ISSN:
2252-8776
❒
197
composition,
”
International
Journal
of
Electrical
and
Computer
Engineering
(IJECE)
,
v
ol.
11,
no.
5,
pp.
4069-4081,
2021,
doi:
10.11591/ijece.v11i5.pp4069-4081.
[27]
w3consortium,
”PNG
Specication:
File
Structure,
”
[Online].
A
v
ailable:
http://www
.w3.or
g/TR/PNG-
Structure.html.
[28]
w3consortium,
”“GIF87a
Specication,
”
[Online].
A
v
ailable:
http://www
.w3.or
g/Graphics/GIF/spec-
gif87.txt.
[29]
w3consortium,
”GIF89a
Specication,
”
[Online].
A
v
ailable:
http://www
.w3.or
g/Graphics/GIF/spec-
gif89a.txt.
[30]
”Original
McGill
Colour
Image
Database,
”
[Online].
A
v
ailable:
http://tabby
.vision.mcgill.ca/.
[31]
”Sp
yHunter
,
”
[Online].
A
v
ailable:
http://www
.sp
y-hunter
.com/ste
gsp
ydo
wnload.htm.
[32]
”Ste
gSecret.
A
simple
ste
g
analysis
tool,
”
[Online].
A
v
ailable:
http://ste
gsecret.sourcefor
ge.net/.
[33]
”Ste
gExpose,
”
[Online].
A
v
ailable:
https://github
.com/b3dk7/Ste
gExpose.
F
or
ensic
ste
ganalysis
for
identication
of
ste
gano
gr
aphy
softwar
e
tools
using
...
(S.
T
.
V
eena)
Evaluation Warning : The document was created with Spire.PDF for Python.