Baseic Steganalysis for the Digital Media Forensics Examiner

Abstract

This chapter focuses on the development of digital forensic steganalysis tools/methods through analysis and evaluation of the most popular “sample pair” steganalysis techniques—the key concept in cyber crime—for the digital media forensics examiner, specializing in the analysis, identification, and interpretation of concealed digital evidence. Success and proper implementation of a digital forensic steganalysis system is dependent of several necessary steps. The basic steps are to describe and implement a new generation of steganalysis systems applicable for various embedding methods in order to allow efficient, accurate, low-cost, and fast digital forensic analysis; and to make these methods applicable for automatic detection of steganographic information within noisy network environments while striving to provide a satisfactory performance in comparison with present technology. All efforts will allow the final goal to be reached which is the development of a digital forensic steganalysis system to aid law enforcement agencies involved in the field of cyber crime investigation. The presented techniques will be based on the statistics of sample pairs (the basic unit), rather than individual samples, which are very sensitive to least significant bit embedding. Particularly, in this chapter we discuss the process and necessary considerations inherent in the development of steganalysis methods applied for problems of reliable detection, estimation length, and localization of hidden data within various forms/models of digital images.