Chapter 1 STEGANOGRAPHY DETECTION USING MULTI-CLASS CLASSIFICATION

Several steganography tools are freely available over the Internet, ranging from straight forward least significant embedding to complex transform domain encrypted algorithms within digital images. Given the number of tools available, the digital forensics investigator must not only determine that an image contains embedded hidden information but the method used during the embedding process, also know as detecting a stego fingerprint. The determination of the embedding method is the first step in extracting the hidden information. This paper focuses on identifying the stego fingerprint within jpeg images. The classes of methods targeted are F5, JSteg, Model Based, OutGuess, and StegHide. Each of these embedding methods presents different challenges when attempting to extract the hidden information because each of them embed data in dramatically different ways. The embedding methods are separated by using features developed from sets of stego images developed with the mentioned embedding methods as training data for a multiclass support vector machine classifier. For new images, the image features are calculated and evaluated based on their associated label to the most similar class, i.e. clean or embedding method feature space. Results from the SVM demonstrate that, in the worst case scenario, it is possible to separate the embedding methods by 87.0%.