Steganalysis of LSB Image Steganography using Multiple ...

Souvik Bhattacharyya et al, Int. J. Comp. Tech. Appl., Vol 2 (4), 1069-1077 

ISSN:2229-6093 

Steganalysis of LSB Image Steganography using 

Multiple Regression and Auto Regressive (AR) 

Model 

Souvik Bhattacharyya 1 and Gautam Sanyal 2 

1 Department of Computer Science and Engineering, University Institute of Technology 

The University of Burdwan, West Bengal, India, e-mail: (souvik.bha@gmail.com) 

2 Department of Computer Science and Engineering, National Institute of Technologyy 

West Bengal,India, e-mail: (nitgsanyal@gmail.com) 

Abstract—The staggering growth in communication technology 

and usage of public domain channels (i.e. Internet) has greatly facilitated 

transfer of data. However, such open communication channels 

have greater vulnerability to security threats causing unauthorized 

information access. Traditionally, encryption is used to realize 

then communication security. However, important information is not 

protected once decoded. Steganography is the art and science of communicating 

in a way which hides the existence of the communication. 

Important information is firstly hidden in a host data, such as digital 

image, text, video or audio, etc, and then transmitted secretly to 

the receiver. Steganalysis is another important topic in information 

hiding which is the art of detecting the presence of steganography. In 

this paper a novel technique for the steganalysis of Image has been 

presented. The proposed technique uses an auto-regressive model to 

detect the presence of the hidden messages, as well as to estimate 

the relative length of the embedded messages.Various auto regressive 

parameters are used to classify cover image as well as stego image 

with the help of a SVM classifier. Multiple Regression analysis of 

the cover carrier along with the stego carrier has been carried out 

in order to find out the existence of the negligible amount of the 

secret message. Experimental results demonstrate the effectiveness 

and accuracy of the proposed technique. 

Keywords—Cover Image,Stego Image,Multi-Core,MPI. 

innocent ones. Its basic requirement is to determine accurately 

whether a secret message is hidden in the testing medium. 

Further requirements may include judging the type of the 

steganography, estimating the rough length of the message, 

or even extracting the hidden message. The challenge of steganalysis 

is that: Unlike cryptanalysis, where it is evident that 

intercepted encrypted data contains a message, steganalysis 

generally starts with several suspect information streams but 

uncertainty whether any of these contain hidden message. The 

steganalyst starts by reducing the set of suspect information 

streams to a subset of most likely altered information streams. 

This is usually done with statistical analysis using advanced 

statistics techniques. 

A block diagram of a generic image steganographic system 

is given in Fig. 1. 

I. INTRODUCTION 

To protect secret message from being stolen during transmission, 

there are two ways to solve this problem in general. 

One way is encryption, which refers to the process of encoding 

secret information in such a way that only the right 

person with a right key can decode and recover the original 

information successfully. Another way is steganography and 

this is a technique which hides secret information into a cover 

media or carrier so that it becomes unnoticed and less attractive.Capacity 

and invisibility are the benchmarks needed for 

data hiding techniques of steganography.A famous illustration 

of steganography is Simmons’ Prisoners’ Problem [27].For a 

more thorough knowledge of steganography methodology the 

reader may see [23], [29].Some Steganographic model with 

high security features has been presented in [1], [2] and [3], 

[21].Almost all digital file formats can be used for steganography, 

but the image and audio files are more suitable because 

of their high degree of redundancy [29]. 

Steganalysis, from an opponent’s perspective, is an art of 

deterring covert communications while avoiding affecting the 

IJCTA | JULY-AUGUST 2011 

Available online@www.ijcta.com 

Fig. 1. 

Generic form of Image Steganography 

A message is embedded in a digital image (cover image) 

through an embedding algorithm, with the help of a secret key. 

The resulting stego image is transmitted over a channel to the 

receiver where it is processed by the extraction algorithm using 

the same key. During transmission the stego image, it can be 

monitored by unauthenticated viewers who will only notice the 

transmission of an image without discovering the existence 

of the hidden message.In this work a specific image based 

steganographic method for gray level image has proposed. In 

this method instead of embedding the secret message into the 

cover image a mapping technique has been incorporated to 

generate the stego image. This method is capable of extracting 

the secret message without the presence of the cover image. 

Types of Attacks: Attacks and analysis on hidden information 

may take several forms: detecting, extracting, and disabling 

or destroying hidden information. An attack approach is 

1069

ISSN:2229-6093 


2 

dependent on what information is available to the steganalyst 

(the person who is attempting to detect steganography-based 

information streams). 

Fig. 2. 

Types of attack in Steganography System 

This paper has been organized as following sections: Section 

II describes Some Related Works on Image Steganography 

and Steganalysis. Section III deals with Regression Analysis 

Method,Section IV deals with Image Feature Extraction.Steganalysis 

Technique based on Regression analysis are 

discussed in Section V and Experimental results are shown 

in Section VI. Section VII contains the analysis of the results 

and Section IX draws the conclusion. 

II. RELATED WORKS ON IMAGE STEGANOGRAPHY AND 

STEGANALYSIS 

The various image steganographic techniques are: (i) Substitution 

technique in Spatial Domain: In this technique only 

the least significant bits of the cover object is replaced without 

modifying the complete cover object. It is a simplest method 

for data hiding but it is very weak in resisting even simple 

attacks such as compression, transforms, etc. (ii)Transform 

domain technique: The various transform domains techniques 

are Discrete Cosine Transform (DCT), Discrete Wavelet Transform 

(DWT) and Fast Fourier Transform (FFT) are used to 

hide information in transform coefficients of the cover images 

that makes much more robust to attacks such as compression, 

filtering, etc. (iii) Spread spectrum technique: The message 

is spread over a wide frequency bandwidth than the minimum 

required bandwidth to send the information. The SNR in every 

frequency band is small. Hence without destroying the cover 

image it is very difficult to remove message completely. (iv) 

Statistical technique: The cover is divided into blocks and the 

message bits are hidden in each block. The information is 

encoded by changing various numerical properties of cover 

image. The cover blocks remain unchanged if message block is 

zero. (v) Distortion technique: Information is stored by signal 

distortion. The encoder adds sequence of changes to the cover 

and the decoder checks for the various differences between 

the original cover and the distorted cover to recover the secret 

message. 

Image based Steganalysis: Steganalysis is the science of 

detecting hidden information. The main objective of Steganalysis 

is to break steganography and the detection of stego image 

is the goal of steganalysis. Almost all steganalysis algorithms 

rely on the Steganographic algorithms introducing statistical 

differences between cover and stego image. Steganalysis deals 



with three important categories: (a) Visual attacks: In these 

types of attacks with a assistance of a computer or through 

inspection with a naked eye it reveal the presence of hidden 

information, which helps to separate the image into bit planes 

for further more analysis. (b) Statistical attacks: These types 

of attacks are more powerful and successful, because they 

reveal the smallest alterations in an images statistical behavior. 

Statistical attacks can be further divided into (i) Passive attack 

and (ii) Active attack. Passive attacks involves with identifying 

presence or absence of a covert message or embedding algorithm 

used etc. Mean while active attacks is used to investigate 

embedded message length or hidden message location or secret 

key used in embedding. (c) Structural attacks: The format of 

the data files changes as the data to be hidden is embedded; 

identifying this characteristic structure changes can help us to 

find the presence of image. 

A. Types of Image Based Steganalysis 

Steganalysis can be regarded as a two-class pattern classification 

problem which aims to determine whether a testing 

medium is a cover medium or a stego one. A targeted 

steganalysis technique works on a specific type of stegosystem 

and sometimes limited on image format. By studying 

and analyzing the embedding algorithm, one can find image 

statistics that change after embedding. The results from most 

targeted steganalysis techniques are very accurate but on the 

other hand, the techniques are inflexible since most of the 

time there is no path to extend them to other embedding 

algorithms. Also, when a targeted steganalysis is successful, 

thus having a higher probability than random guessing, it helps 

the steganographic techniques to expand and become more 

secure. A blind steganalysis technique is designed to work on 

all types of embedding techniques and image formats. In a few 

words, a blind steganalysis algorithm ’learns’ the difference 

in the statistical properties of pure and stego images and 

distinguishes between them. The ’learning’ process is done 

by training the machine on a large image database. Blind 

techniques are usually less accurate than targeted ones, but 

a lot more expandable. Semi-blind steganalysis works on a 

specific range of different stego-systems. The range of the 

stego-systems can depend on the domain they embed on, i.e. 

spatial or transform. 

B. Some Specific Approaches of Image Based Steganalysis 

A specific steganalytic method often takes advantage of the 

insecure aspect of a steganographic algorithm. Some specific 

steganalytic methods for attacking the steganographic schemes 

are introduced in this section. 

Attacking LSB steganography: LSB steganography has 

been one of the most important spatial steganographic techniques. 

Accordingly, much work has been done on steganalyzing 

LSB steganography in the initial stage of the development 

of steganalysis. And many steganalytic methods toward LSB 

steganography have been proved most successful, such as Chisquare 

statistical attack [30], [25],RS analysis [16], sample pair 

analysis (SPA) analysis [26], weighted stego (WS) analysis [7], 

and structural steganalysis [20], [19], etc. 

1070


ISSN:2229-6093 

3 

Attacking LSB Matching Steganography: It may be noted 

that the equal trend of the frequency of occurrence of PoVs 

no longer exists for LSB matching steganography. Thus many 

steganalytic methods toward LSB steganography turn out to 

be invalid. LSB matching, or more general k steganography, 

may be modeled in the context of additive noise independent 

of the cover image. The effect of additive noise steganography 

to the image histogram is equivalent to a convolution of the 

histogram of the cover image and the stego-noise PMF. It may 

be analyzed more conveniently in the frequency domain [8]. 

Attacking Stochastic Modulation Steganography: In [11] 

it has shown that the horizontal pixel difference histogram of 

a natural image can be modeled as a generalized Gaussian 

distribution (GGD). However, as stated in stochastic modulation 

steganography adds stego-noise with a specific probability 

distribution into the cover image to embed secret message 

bits. The embedding effect of adding stego-noise may disturb 

the distribution of the cover natural image. A quantitative 

approach to steganalyse stochastic modulation steganography 

was presented in [15], [10]. 

Attacking the BPCS Steganography: In BPCS steganography, 

the binary patterns of data-blocks are random and it 

is observed that the complexities of the data-blocks follow 

a Gaussian distribution with the mean value at 0.5 [22]. For 

some high significant bit-planes (e.g., the most significant bitplane 

to the 5th significant bit-plane) in a cover image, the 

binary patterns of the image blocks are not random and thus 

the complexities of the image blocks do not follow a Gaussian 

distribution. 

Attacking the Prediction Error Based Steganography: 

If there is no special scheme to prevent Wendy retrieving the 

correct prediction values, it is quite easy for Wendy to detect 

the steganographic method which utilizes prediction errors for 

hiding data, such as PVD steganography. Zhang et al.[33] 

proposed a method for attacking PVD steganography based 

on observing the histogram of the prediction errors. 

Attacking the MBNS Steganography: It’s hard to observe 

any abnormality between a cover image and its MBNS stego 

image through the histogram of pixel values and the histogram 

of pixel prediction errors. In [4] the authors observed and 

illustrated that given any base value, more small symbols are 

generated than large symbols in the process of converting 

binary data to symbols. Since the remainders of the division of 

pixel values by bases are equal to the symbols, the conditional 

probability P D|B can be used to discriminate the cover 

images and stego images, where B and D denote the random 

variable of the base and the remainder, respectively. 

Attacking QIM/DM: The issue in steganalysis of QIM/DM 

has been formulated into two sub-issues by Sullivan et al [18]. 

One is to distinguish the standard QIM stego objects from 

the plain-quantized (quantization without message embedding) 

cover objects. Another is to differentiate the DM stego objects 

from the unquantized cover objects. 

Attacking the F5 Algorithm: Some crucial characteristics 

of the histogram of DCT coefficients, such as the monotonicity 

and the symmetry, are preserved by the F5 algorithm. But F5 

does modify the shape of the histogram of DCT coefficients. 

This drawback is employed by Fridrich et al.[14] to launch an 



attack against F5. 

Attacking OutGuess: OutGuess preserves the shape of the 

histogram of DCT coefficients and thus it may not be easy to 

employ a quantitative steganalyzer to attack OutGuess with the 

statistics of DCT coefficients as that in attacking F5. Fridrich 

et al. [13] found a new path to detect OutGuess quantitatively 

by measuring the discontinuity along the boundaries of 8x8 

JPEG grid. A spatial statistical feature, named blockiness, for 

an image has been proposed. It is observed that the blockiness 

linearly increases with the number of altered DCT coefficients. 

Suppose that some data are embedded into an input image. If 

the input image is innocent, the change rate of the blockiness 

between the input image and the embedded one will be large. 

If the input image already contains some data, the change rate 

will be smaller. The change rate of the blockiness can be used 

to estimate the embedding rate. 

Attacking MB:MB steganography uses a generalized 

Cauchy distribution model to control the data embedding 

operation. Therefore, the histogram of the DCT coefficients 

will fit the generalized Cauchy distribution well in a stego 

image. Bohme and Westfeld [5] observed that the histogram 

of the DCT coefficients in a natural image is not always 

conforming the distribution. There exist more outlier high 

precision bins in the histogram in a cover image than in a 

stego image. Judging from the number of outlier bins, cover 

images and stego images can be differentiated. 

Attacking YASS: The locations of the H-blocks of YASS 

are determined by a key, which is not available to Wendy. 

Therefore, it may not be straightforward for Wendy to observe 

the embedding artifacts. Li et al. [4] proposed a method for 

attacking the YASS. 

C. Universal Approaches 

Unlike specific steganalytic methods which require knowing 

the details of the targeted steganographic methods, universal 

steganalysis [31] requires less or even no such priori information. 

A universal steganalytic approach usually takes a learning 

based strategy which involves a training stage and a testing 

stage. The process is illustrated in Figure below. 

Fig. 3. 

Universal approaches of Steganalysis 

During the process, a feature extraction step is used in 

both training and testing stage. Its function is to map an 

input image from a high-dimensional image space to a lowdimensional 

feature space. The aim of the training stage is 

1071


ISSN:2229-6093 

4 

to obtain a trained classifier. Many effective classifiers, such 

as Fisher linear discriminant (FLD), support vector machine 

(SVM), neural network (NN), etc., can be selected. Decision 

boundaries are formed by the classifier to separate the feature 

space into positive regions and negative regions with the help 

of the feature vectors extracted from the training images. In the 

testing stage, with the trained classifier that has the decision 

boundaries, an image under question is classified according 

to its feature vector’s domination in the feature space. If 

the feature vector locates in a region where the classifier is 

labeled as positive, the testing image is classified as a positive 

class (stego image). Otherwise, it is classified as a negative 

class (cover image). In the following, some typical universal 

steganalytic features has been discussed. 

Image Quality Feature: Steganographic schemes may 

more or less cause some forms of degradation to the image. 

Objective image quality measures (IQMs) are quantitative 

metrics based on image features for gauging the distortion. The 

statistical evidence left by steganography may be captured by 

a group of IQMs and then exploited for detection [12]. In order 

to seek specific quality measures that are sensitive, consistent 

and monotonic to steganographic artifacts and distortions, the 

analysis of variance (ANOVA) technique is exploited and the 

ranking of the goodness of the metrics is done according to the 

F-score in the ANOVA tests. And the identified metrics can 

be defined as feature sets to distinguish between cover images 

and stego images. Calibration Based Feature: Fridrich et al. 

[6] applied the feature-based classification together with the 

concept of calibration to devise a blind detector specific to 

JPEG images. Here the calibration means that some parameters 

of the cover image may be approximately recovered by using 

the stego image as side information. As a result, the calibration 

process increases the features’ sensitivity to the embedding 

modifications while suppressing image-to-image variations. 

Applying calibration to the Markov process based features 

described in [32] and reducing their dimension, Pevny et al. 

merged the resulting feature sets to produce a 274-dimensional 

feature vector [24]. The new feature set is then used to 

construct a multi-classifier capable of assigning stego images 

to six popular steganographic algorithms. 

Moment Based Feature: The impact of steganography to 

a cover image can be regarded as introducing some stegonoise. 

As noise is added, some statistics of the image may be 

changed. It is effective to observe these changes in wavelet 

domain. Lyu and Farid [28] used the assumption that the 

PDF of the wavelet sub band coefficients and that of the 

prediction error of the sub band coefficients would change after 

data embedding. In ref. [9], a 3-level wavelet decomposition, 

the first four PDF moments, i.e., mean, variance, skewness, 

and kurtosis, of the sub band coefficients at each high-pass 

orientation (horizontal, vertical and diagonal direction) of each 

level are taken into consideration as one set of features. The 

same kinds of PDF moments of the difference between the 

logarithm of the sub band coefficients and the logarithm of the 

coefficients’ cross-sub band linear predictions at each highpass 

orientation of each level are computed as another set 

of features. These two kinds of features provide satisfactory 

results when the embedding rate is high. 



Correlation Based Feature: Data embedding may disturb 

the local correlation in an image. Here the correlation is mainly 

referred to the inter-pixel dependency for a spatial image, and 

the intra-block or inter-block DCT coefficient dependency for 

a JPEG image. Sullivan et al. [17] modeled the inter-pixel 

dependency by Markov chain and depicted it by a gray-level 

co-occurrence matrix (GLCM) in practice. 

III. REGRESSION ANALYSIS METHOD 

In statistics, regression analysis includes any techniques for 

modeling and analyzing several variables, when the focus is 

on the relationship between a dependent variable and one 

or more independent variables. More specifically, regression 

analysis helps one understand how the typical value of the 

dependent variable changes when any one of the independent 

variables is varied, while the other independent variables are 

held fixed. In all cases, the estimation target is a function 

of the independent variables called the regression function. 

In regression analysis, it is also of interest to characterize 

the variation of the dependent variable around the regression 

function, which can be described by a probability distribution. 

Regression analysis is widely used for prediction and 

forecasting, where its use has substantial overlap with the 

field of machine learning. Regression analysis is also used to 

understand which among the independent variables are related 

to the dependent variable, and to explore the forms of these 

relationships. In restricted circumstances, regression analysis 

can be used to infer causal relationships between the independent 

and dependent variables. A large body of techniques for 

carrying out regression analysis has been developed. Familiar 

methods such as linear regression and ordinary least squares 

regression are parametric, in that the regression function is 

defined in terms of a finite number of unknown parameters that 

are estimated from the data. Nonparametric regression refers 

to techniques that allow the regression function to lie in a 

specified set of functions, which may be infinite-dimensional. 

The performance of regression analysis methods in practice 

depends on the form of the data-generating process, and how 

it relates to the regression approach being used. Since the 

true form of the data-generating process is in general not 

known, regression analysis often depends to some extent on 

making assumptions about this process. These assumptions 

are sometimes (but not always) testable if a large amount of 

data is available. Regression models for prediction are often 

useful even when the assumptions are moderately violated, 

although they may not perform optimally. However, in many 

applications, especially with small effects or questions of 

causality based on observational data, regression methods give 

misleading results. 

Regression models:Regression models involve the following 

variables 

• The unknown parameters denoted as β this may be a 

scalar or a vector. 

• The independent variables X. 

• The dependent variable Y. 

In various fields of application, different terminologies 

are used in place of dependent and independent variables. 

1072


ISSN:2229-6093 

5 

A regression model relates Y to a function of X and β. 

Y = F (X, β) The approximation is usually formalized as 

E(Y |X) = f(X, β). To carry out regression analysis, the form 

of the function f must be specified. Sometimes the form of this 

function is based on knowledge about the relationship between 

Y and X that does not rely on the data. If no such knowledge 

is available, a flexible or convenient form for f is chosen. 

A. Linear regression 

In linear regression, the model specification is that the dependent 

variable, y i is a linear combination of the parameters 

(but need not be linear in the independent variables). For 

example, in simple linear regression for modeling n data points 

there is one independent variable: x i , and two parameters, β 0 

and β 1 : 

y i = β 0 + β 1 x i + ɛ i , i = 1, 2, . . . , n. (1) 

In multiple linear regression, there are several independent 

variables or functions of independent variables. For example, 

adding a term in x i 2 to the preceding regression gives 

parabola: 

1) Calculation of the AR parameters: There are many ways 

to estimate the coefficients: the OLS procedure, method of 

moments (through Yule Walker equations). The AR(p) model 

is given by the equation 

p∑ 

X t = ϕ i X t−i + ε t (5) 

i=1 

It is based on parameters where i = 1, ..., p. There is a direct 

correspondence between these parameters and the covariance 

function of the process, and this correspondence can be 

inverted to determine the parameters from the autocorrelation 

function (which is itself obtained from the covariances). This 

is done using the Yule-Walker equations. 

Yule-Walker equations: The Yule-Walker equations are the 

following set of equations 

p∑ 

γ m = ϕ k γ m−k + σεδ 2 m,0 (6) 

k=1 

where m = 0, ... , p, yielding p + 1 equations. γ m is the 

autocorrelation function of X, δ ɛ is the standard deviation 

of the input noise process, and δ m , 0 is the Kronecker delta 

function. Because the last part of the equation is non-zero only 

if m = 0, the equation is usually solved by representing it as 

a matrix for m > 0, thus getting equation solving all ϕ . 

y i = β 0 + β 1 x i + β 2 x i 2 + ɛ i , i = 1, 2, . . . , n. (2) 

This is still linear regression; although the expression on 

the right hand side is quadratic in the independent variable 

x i , it is linear in the parameters β 0 , β 1 and β 2 . In both 

cases epsilon i is an error term and the subscript i indexes 

a particular observation. Given a random sample from the 

population, we estimate the population parameters and obtain 

the sample linear regression model: 

ŷ i = ˆβ 0 + β ˆ 1 x i (3) 

The residual e i = y i −ŷ i is the difference between the value 

of the dependent variable predicted by the model ŷ i and the 

true value of the dependent variable y i . 

B. Auto Regressive(AR) 

In statistics and signal processing, an autoregressive (AR) 

model is a type of random process which is often used to 

model and predict various types of natural phenomena. The 

autoregressive model is one of a group of linear prediction 

formulas that attempt to predict an output of a system based 

on the previous outputs. The notation AR(p) indicates an 

autoregressive model of order p. The AR(p) model is defined 

as 

p∑ 

X t = c + ϕ i X t−i + ε t (4) 

i=1 

where ϕ 1 ,......,ϕ p are the parameters of the model, c is a 

constant (often omitted for simplicity) and ε t is white noise. 



For m = 0 we have γ 0 = ∑ p 

k=1 ϕ kγ −k + σ 2 ε which allows 

us to solve σ 2 ε. 

The above equations (the Yule-Walker equations) provide 

one route to estimating the parameters of an AR(p) model, by 

replacing the theoretical covariances with estimated values. 

One way of specifying the estimated covariances is equivalent 

to a calculation using least squares regression of values X t on 

the p previous values of the same series. 

IV. IMAGE FEATURE EXTRACTION 

To construct the features of both cover and stego or suspicious 

images various auto regressive statistics of the image 

series has been used,namely AR(1) coefficients,Std error,Rsquared 

values,S.E.of regression,t-statistics.AR(1) coefficients 

are the auto regression coefficients of AR model of order 1 

For example an order 1 AR analysis gives a coefficient of 

0.941872, this is not totally surprising as it is saying that by 

only looking at one term in the series the next term in the 

series is probably almost the same, i.e.: x t+1 = 0.941872∗x t . 

Std Error is the Error of the estimate between original and the 

predicted one. 

In statistics, the coefficient of determination R 2 is used in 

the context of statistical models whose main purpose is the 

prediction of future outcomes on the basis of other related 

information. It is the proportion of variability in a data set 

that is accounted for by the statistical model. It provides a 

1073


ISSN:2229-6093 

6 

measure of how well future outcomes are likely to be predicted 

by the model.The t statistic is a measure of how extreme 

a statistical estimate is. This statistic can be computed by 

subtracting the hypothesized value from the statistical estimate 

and then dividing by the estimated standard error. In many, 

but not all situation, the hypothesized value would be zero.An 

indication is that the hypothesized value is reasonable when 

the t-statistic is close to zero. Alternately, it an be concluded 

the hypothesized value is not large enough when the t-statistic 

is large positive. Finally, it can be said that the hypothesized 

value is too large when the t-statistic is large 

V. STEGANALYSIS TECHNIQUE BASED ON REGRESSION 

ANALYSIS 

The Steganalysis technique proposed here to test the presence 

of the hidden message is the combination of multiple 

regression analysis based on the cover data and stego data 

series and the AR modeling of the suspicious data for the 

estimation of the presence of the secret message as well as 

the predictive size of the hidden message. 

Let C and S be the series modeling the distribution of the 

cover and stego image pixels, a multiple regression analysis 

can be done in order to express S (dependent variable) as a 

function of the cover data C (independent variable) can be 

modeled as multiple regression model S = I + a ∗ C where I 

is the constant and a is the regression coefficient. 

In order to measures of the strength of association of 

the model the four regression statistics namely Multiple R,R 

Square ,Adjusted R square and standard error needs to be 

computed. 

It has been seen from the experiments that multiple 

regression model between two same series namely a and b 

can be expressed as b = (0) + (1) ∗ a and the model summary 

are as follows 

Regression Statistics Value(in percentage) 

R-Square 100% 

R-Square Adjusted 100% 

S (Root Mean Square Error) 0% 

The value of the regression statistics changes with the 

introduction of impurity in one of the series. 

Steganalysis approach has been designed here based on the 

above mentioned fact considering cover image data as the 

independent data series and stego image data as the dependent 

series data. From the experimental results it can be shown that 

with the introduction of secret message/increasing length of 

the secret message those regression statistics changes. Hence 

it an be hypothesize that regression analysis between the cover 

data and stego data will cluster differently for clean and stegoimages. 

This is the basis of proposed steganalyzer that aims 

to classify images as original and suspicious.AR modeling is 

done in order to estimate the strength of the association among 

the variables of a series .It can be seen that with the increasing 

in the message length the AR parameters changes drastically. 

The steganalysis system works in in four stages: Regression 

based feature generation, feature selection, SVM classifier 



Fig. 4. 

Block diagram of proposed steganalysis system 

selection and training, and finally, steganalysis i.e. detection 

of the suspicious image. The first three steps were performed 

using only the training set. The final step was performed on 

the test collection to generate the submitted results. 

VI. EXPERIMENTAL RESULTS 

The steganalyzer has been designed based on a training set 

and using various image steganographic tools. The steganographic 

tools used here Steganos [12] and S-Tools [13] since 

these were among the most popular and cited tools in the 

literature. In the experiments 10 images were used for training 

and 10 images for testing. After applying LSB replacement 

algorithm for embedding secret message into the cover image 

with the embedding ratio of p= 0,0.01,0.02,...,0.1 with 1% 

in increments and from 10% to100% respectively with 10% 

increments ,various stego images has been created. Multiple 

Regression analysis and AR(1) modeling has been used to 

estimate the various regression statistics of those stego images. 

This steganalyzer can predicted the approximate area of the 

hidden message as well as the embedding message length can 

also be predicted on the basis of those regression statistics. 

Fig. 5. 

AR(1) coefficient of Lena as Cover Image 

Fig 5 shows the AR(1) statistics of the original Lena image 

and Fig 6 shows the changes AR(1) statistics of that same 

1074


ISSN:2229-6093 

7 

Fig. 6. AR(1) coefficient of Lena having Insertion rate 0.01 

image after embedding 0.01% of data .The Figure 7 shows the 

AR(1) statistics of the Lena image with different embedding 

rate. Multiple regression statistics of the Lena image has been 

shown in figure 8. 

Fig. 8. Multiple Regression statistics of the Lena image with different 

embedding rate 

Fig. 7. 

AR(1) statistics of the Lena image with different embedding rate 

From figure 7 and 8 it can be seen that with the introduction 

of small message AR (1) statistics and multiple regression 

statistics both changes drastically. To build the classes of cover 

images, multiple regression statistics and AR (1) statistics of 

10 natural (cover) images (Lena, Pepper etc) are inserted in 

the database. Next step is to produce stego images with those 

natural images with random bits and different rates in another 

database. Natural images database with multiple regression 

statistics are used for training set from which the classifiers are 

tuned. With help of this an incoming image can be classified 

as stego or natural image. 

Fig 9 below shows the AR(1) statistics of the original 

segmented Lena image and Fig 10 shows the changes AR(1) 

statistics of those segmented block of the image after embedding 

0.01% of data .From these two figure it can be seen 

that AR(1) parameters has changed in block 1 and 2 with the 

introduction of data where as block 3 and block 4 parameters 

are remain un-changed.Thus it can be concluded that secret 

data has been embedded in block 1 and block 2 portion of the 

cover image. 

Next step is to predict the length of the hidden message. The 

classifier is trained with the AR (1) statistics of the natural 

Fig. 9. 

Fig. 10. 

AR Series of LENA 

Residual Plot of LENA 



1075


ISSN:2229-6093 

8 

rate as follows 

Fig. 11. 

AR(1) parameters in different segment of Lena as Cover Image 

Fig. 14. 

Prediction of Embedding Capacity 

Fig. 12. AR(1) parameters in different segment of Lena as with embedding 

rate 0.01 percent 

images in order to form a relation between the embedding 

capacity and AR(1) statistics.The classifier is trained with the 

AR (1) statistics of the natural images in order to form a 

relation between the embedding capacity and various AR(1) 

statistics. Insertion rate can be computed from the AR(1) 

statistics using Multiple Regression analysis.Insertion Rate 

(IR) can be calculated from eqn given below. 

From the above table it can be concluded that insertion rate 

can be predicted with an average error rate of 30-35 %.Thus 

we can say embedding length of the secret message can be 

successfully predicted 65-70% with this steganalyzer. 

A comparision has been done with the proposed method 

along with the BSM,FBS and WBS algorithms.It can be seen 

that the proposed method has a good performance in terms of 

detection rate and prediction of the message length. 

IR = (−5390.1) + (5302.1) ∗ AR(1)Coeff 

+(124397) ∗ Std.Error 

+(0.007858) ∗ R.SquaredV alue. (7) 

Embedding capacity can be predicted based on the insertion 

Fig. 15. 

Comparison with other method 

Fig. 13. 

Detection rate of the classifier at various embedding rate 



VII. CONCLUSION 

In this paper a new approach of LSB steganalysis is 

proposed.In this method auto regression as well as multiple 

regression parameter has been used for steganalysis. This 

algorithm not only detect the presence of the hidden message 

but can also be able to predict the length of the secret message.This 

method is also capable of finding the approximate 

hidden area of the secret message. This new proposed method 

is a good steganalysis algorithm that is useful for both cases 

gray-scale and color images which is one of the superiority 

factor of the proposed method in comparison with the some 

other existing methods that are efficient either for gray-scale 

or color image. 

1076


ISSN:2229-6093 

9 

REFERENCES 

[1] Souvik Bhattacharyya. and Gautam Sanyal. Study of secure steganography 

model. In Proceedings of International Conference on AdvancedComputing 

and Communication Technologies (ICACCT-2008), 

Panipath,India, 2008. 

[2] Souvik Bhattacharyya. and Gautam Sanyal. An image based steganography 

model for promoting global cyber security. In Proceedings of 

International Conference on Systemics, Cybernetics and Informatics, 

Hyderabad,India, 2009. 

[3] Souvik Bhattacharyya. and Gautam Sanyal. Implementation and design 

of an image based steganographic model. In Proceedings of IEEE 

International Advance Computing Conference, Patiala ,India, 2009. 

[4] Yanmei Fang Bin Li and Jiwu Huang. Steganalysis of multiple-base 

notational system steganography. IEEE Signal Processing Letters., 

15:493-496, 2008. 

[5] R. Bohme and A. Westfeld. Breaking cauchy model-based jpeg 

steganography with first order statistics. In In Proceedings of the 9th 

European Symposium On Research in Computer Security, volume 3193 

of LNCS, pages 125-140. Springer., 2004. 

[6] J. Fridrich. Feature-based steganalysis for jpeg images and its implications 

for future design of steganographic schemes. In In Proceedings 

of the 6th Information Hiding Workshop, volume 3200 of LNCS, pages 

67-81. Springer., 2004. 

[7] J. Fridrich and M. Goljan. On estimation of secret message length in 

lsb steganography in spatial domain. In IS&T/SPIE Electronic Imaging: 

Security, Steganography, and Watermarking of Multimedia Contents VI, 

5306,pages 23-34, 2004. 

[8] J. Harmsen and W. Pearlman. Steganalysis of additive noise modelable 

information hiding. In IS&T/SPIE Electronic Imaging: Security, 

Steganography, and Watermarking of Multimedia Contents V, 

5020,pages 131-142, 2003. 

[9] J. Harmsen and W. Pearlman. Steganalysis of additive noise modelable 

information hiding. In In IS&T/SPIE Electronic Imaging: Security, 

Steganography, and Watermarking of Multimedia Contents V, volume 

5020, pages 131-142. SPIE., 2003. 

[10] J. H. He and J. W. Huang. Steganalysis of stochastic modulation 

steganography. Science in China Series: F-Information Sciences, 

49(3):273-285, 2006. 

[11] Jinggang Huang and David Mumford. Statistics of natural images and 

models. In In Proceedings of IEEE Computer Society Conference on 

Computer Vision and Pattern Recognition, volume 1, pages 541-547, 

1999, 1999. 

[12] N. Memon I. Avcibas and B. Sankur. Steganalysis using image quality 

metrics. Signal Processing., IEEE Transactions on Image Processing, 

12(2):221-229, 2003. 

[13] M. Goljan J. Fridrich and D. Hogea. Attacking the outguess. In In 

Proceedings of 2002 ACM Workshop on Multimedia and Security,ACM 

Press., 2002. 

[14] M. Goljan J. Fridrich and D. Hogea. Steganalysis of jpeg images: 

Breaking the f5 algorithm. In In Proceedings of the 5th Information 

Hiding Workshop., volume Volume 2578 of LNCS, pages 310-323. 

Springer., 2002. 

[15] J. W. Huang J. H. He and G. P. Qiu. A new approach to estimating 

hidden message length in stochastic modulation steganography. In In 

Proceedings of the 4th Internation Workshop on Digital Watermarking, 

volume 3710 of LNCS, pages 1-14. Springer, 2005, 2005. 

[16] Miroslav Goljan Jessica Fridrich and Rui Du. Reliable detection of 

lsb steganography in color and grayscale images. In In Proceedings 

of 2001 ACM workshop on Multimedia and security: new challenges, 

pages 27-30. ACM Press, 2001. 

[17] S. Chandrasekaran K. Sullivan, U. Madhow and B. S. Manjunath. 

Steganalysis for markov cover data with applications to images. In IEEE 

Transactions on Information Forensics and Security, 1(2):275-287, 2006. 

[18] U. Madhow S. Chandrasekaran K. Sullivan, Z. Bi and B. S. Manjunath. 

Steganalysis of quantization index modulation data hiding.steganalysis 

of multiple-base notational system steganography. In In Proceedings 

of 2004 IEEE International Conference on Image Processing., volume 

2:1165-1168, 2004. 

[19] A. D. Ker. A general framework for the structural steganalysis of lsb 

replacement. In In Proceedings of the 7th Information Hiding Workshop, 

volume 3727 of LNCS, pages 296-311. Springer, 2005. 

[20] D. Ker. Fourth-order structural steganalysis and analysis of cover assumptions. 

In IS&T/SPIE Electronic Imaging: Security, Steganography, 

and Watermarking of Multimedia Contents VIII, 6072,pages 1-14, 2006. 



[21] Souvik Bhattacharyya.Avinash Prasad Kshitij and Gautam Sanyal. A 

novel approach to develop a secure image based steganographic model 

using integer wavelet transform. In Proceedings of International 

Conference on Recent Trends in Information, Telecommunication and 

Computing (ITC 2010). 

[22] H. Noda M. Niimi, R. O. Eason and E. Kawaguchi. Intensity histogram 

steganalysis in bpcs steganography. In IS&T/SPIE Electronic Imaging: 

Security, Steganography, and Watermarking of Multimedia Contents III, 

4314,pages 555-564, 2001. 

[23] N.F.Johnson. and S. Jajodia. Steganography: seeing the unseen. IEEE 

Computer, 16:26–34, 1998. 

[24] Tomas Pevny and Jessica Fridrich. Merging markov and dct features 

for multi-class jpeg steganalysis. In In Proceedings of SPIE: Electronic 

Imaging, Security, Steganography, and Watermarking of Multimedia 

Contents IX, volume 6505, pages 3-14. SPIE., 2007. 

[25] Niels Provos and Peter Honeyman. Detecting steganographic content 

on the internet. In Proceedings of NDSS’02: Network and Distributed 

System Security Symposium,Pages 1-13,Internet Society, 2002. 

[26] X. L. Wu S. Dumitrescu and Z. Wang. Detection of lsb steganography 

via sample pair analysis. In IEEE Transactions on Signal 

Processing51(7):1995-2007, 2003, 2003. 

[27] Gustavus J. Simmons. The prisoners’ problem and the subliminal 

channel. Proceedings of CRYPTO., 83:51–67, 1984. 

[28] Lyu Siwei and H. Farid. Detecting hidden message using higher-order 

statistics and support vector machines. In In Proceedings of the 5th 

Information Hiding Workshop, volume 2578 of LNCS, pages 131-142. 

Springer, 2002, 2002. 

[29] JHP Eloff. T Mrkel. and MS Olivier. An overview of image steganography. 

In Proceedings of the fifth annual Information Security South 

Africa Conference., 2005. 

[30] A. Westfeld and A. Pftzmann. Attacks on steganographic systems - 

breaking the steganographic utilities ezstego, jsteg, steganos, and s-toolsand 

some lessons learned. 

[31] P.Wang X. Y. Luo, D. S.Wang and F. L. Liu. A review on blind detection 

for image steganography. Signal Processing., 88(9):2138-2157, 2008. 

[32] C. Chen Y. Q. Shi and W. Chen. A morkov process based approach 

to effective attacking jpeg steganography. In In Proceedings of the 8th 

Information Hiding Workshop, volume 4437 of LNCS, pages 249-264. 

Springer., 2006. 

[33] X. P. Zhang and S. Z. Wang. Vulnerability of pixel-value differencing 

steganography to histogram analysis and modification for enhanced 

security. Pattern Recognition Letters., 25(3):331-339, 2004. 

1077

Steganalysis of LSB Image Steganography using Multiple ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?