International Journal of Computer Science and Information Security (IJCSIS),

Vol. 18, No. 5, May 2020

Digital Steganography in Computer Forensics

#1 ∗2 #3
Nawal Alsaidi , Majda Alshareef , Afnan Alsulami ,Maram Alsafri #4 , Asia Aljahdali #5
College of Computer Science and Engineering, Cybersecurity Department
, University of Jeddah
Saudi Arabia
1
nrajealsaidi.stu@uj.edu.sa
2
malsharif0133@uj.edu.sa
3
aalsulami200@uj.edu.sa
4
malsafri0002.stu@uj.edu.sa
5
aoaljahdali@emory.eduu

Abstract—In this study, we present how digital steganography
can be analyzed in computer forensic. Computer forensics is a
scientific study of computers in a manner consistent with the
principles of the rules of evidence and court rules of procedure.
Steganography is a state of art that is used for hiding information
within different media. In this paper, we will discuss how the
criminal can use steganography to hide evidence and tracks, and
how the steganalysis for computer forensic can be done. There are
different types of steganography, such as image, text, video, and
audio steganography, all will be discussed in detail. The paper
will focus on how the investigator can detect the steganography in
all its forms using several techniques. The main goal of this paper
is to assist computer forensics investigators in knowing how the
criminals can conduct their crimes and obscure evidence from
computer systems using steganography techniques.
Index Terms—Steganography, Forensics, Detection
I. I NTRODUCTION
Computer forensics is a part of digital forensics science.
It depends on the extraction of evidence from the computer
and examined it to save, identify, retrieve, and analyze data
for investigations into cybercrime. The use of stored data in
networks to commit a criminal act is defined as a computer
crime. Advanced and new investigations methods are required
to deal with the increase in potential harm caused by computer
crimes [1]. A large part of the work of a computer forensic
expert entails being involved in the discovery of latent or
hidden data within computer systems. Steganography is one of
the hiding techniques that can be used. The computer forensic
process involves: collecting, analyzing, and displaying discov-
ered digital data. The term digital forensics refers to a type of
forensic science linked to computers to help judges identify
the perpetrator and the circumstances of the case. To enhance
the computer forensic environment, we are required to resolve
the issue of computer forensic examination tools and strategy.
Various types of hardware and software tools are available
for computer forensic. Steganalysis is the mechanism used to
detect steganography process [2]. This paper is organized as
follows: section 2 discusses steganalysis for computer forensic
investigation. Section 3, 4, 5, 6, and 7 describe the four types
of steganography and their techniques. Part 8 explores how
steganography can be detected for investigation purposes.
II. S TEGANALYSIS FOR C OMPUTER F ORENSIC
I NVESTIGATION
Computer crime and cybercrime are today’s significant
challenges. The perpetrator stores the document and details in
a register to make things identifiable impossible. And thus,
computer forensics is a criminal investigation that is done
within the institution that the suspect operates. In the analysis
of Steganography slack points, automated forensics is used. As
the remains of previous records, codes that can directly access
slack unallocated space can be written, the examiners become
acquainted with the knowledge that resides in the slack or
unallocated room. It is possible to hide tiny amounts of data
in unused file headers as well. Digital forensic experts research
network channels such as TCP/IP protocol because this sends
data that triggers offenses such as illicit messaging, theft,
manipulating electronic payments, gaming, and prostitution,
abuse, malware, pedophilia. Today’s technology is much more
sophisticated, which has both positive and negative effects.
The increased crime rate is one of the significant adverse
impacts of improved technology. This degree of criminality
is conducted using investigative analysis methods [3].
III. S TEGANOGRAPHY T YPES
Message and carrier are the two fundamental components
in steganography. The message is the embedded data, and the
carrier is the object that uses the word. The increased use
of modern communication has been growing recently, so it
requires to be more secure, especially on computer networks.
The variety of multimedia formats can include an image,
audio, video, and text, etc. As a result of that, these forms
have to be visible to human hiding, and the best solution is
steganography. Steganography types are image, text, audio,
and video. The central concept of Image Steganography is
the process of hiding the data within an image so that it
will be invisible to the eye in the original image. Taking
the cover object as an image to conceal the information,
and it depends on the quality of the pixels to hide the data.
In audio steganography, an audio file (such as WAV, AU,
and MP3) is used as a cover file to overlay the confidential
message with the help of the Human Hearing System (HAS).

54 https://sites.google.com/site/ijcsis/
ISSN 1947-5500
 International Journal of Computer Science and Information Security (IJCSIS),
Vol. 18, No. 5, May 2020
Video Steganography is a steganography extension of the
image. But as the video content is complex, the chances
of hidden information being detected are lower compared to
videos. Videos have new data hiding features, such as hiding
messages in components of the movement. The video file’s
audio components can also be used to hide data. In text files
steganography, the structure of text documents is identical to
what we observe. In contrast, other types of materials, such
as in the image, the formation of a document is different
from what we see. Therefore, in such reports, we can hide
information by making changes in the structure of the paper
without making a notable change in the target output [4].
IV. I MAGE S TEGANOGRAPHY
Images are the most common cover objects used for
steganography. An image is a collection of numbers that con-
stitute different light intensities in different areas of the picture.
Images consist of pixels that may describe a representation
form of a grid and individual points. Also, these pixels are
visualized row horizontally by row to form an image, and
each pixel uses 8 bits, which is called a bit depth. The term
bit depth can describe the number of bits in a color scheme,
too. This means that every 8 bits are used to describe the color
of each pixel. Information hiding through the use of secret
messages within entire pixels of images is a standard technique
to spread an image over the World Wide Web. Criminals tend
to hide a message inside an image invisibly, which cannot be
seen by the human visual system. So, one way of unearthing
hidden information within the image can be done by changing
the entire properties of the images’ pixels by using some
techniques to make it visible to the human vision [5].
A. Image Steganography Techniques
To extract the embedded information, we need to understand
the techniques and algorithms that hide the secret message.
For forensic investigators, retrieving the secrecy of the data is
challenging and depends on the availability of the information
to the investigators. There are several techniques used to
hide information in images, including the least significant bit,
Transform Domain, and Masking and Filtering techniques [6].
Fig. 1. General Techniques Applied in Image Steganography [?].
55
1) LSB Technique: In image steganography, the first tech-
nique is called the least significant bit (LSB) and defined as
the substitution of single LSB with the bit pattern, so the bits
are embedded in the image’s data, which are called pixels.
These changes are likely to be invisible to the human visual
system (HVS). The embedded algorithm of LSB steganog-
raphy is based on the following formula: Yi = 2| x21 | + mi ,
where mi is the i-th message bit, xi is the i-th selected
pixel value before embedding, and yi is the i-th selected
pixel value after embedding. Let Px (x = 0), Px (x = 1) refers
to the distribution of the least significant bits of the cover
image, and Pm (m = 0), Pm (m = 1) refer to the distribution
of the secret binary message bits. To keep the secrecy of
the message, we encrypt the message before embedding, as
the average of the distribution message which is equal to
Pm (m = 0) ∼ = Pm (m = 1) ∼ = 21 . Also, the cover image and
the message will be calculated independently by using this
equation:
P P P
P+ 1 = Px (x = 0), P0 = 1 − , P− 1 = Px (x = 1) (1)
2 2 2
Where P is the embedding rate, measured in bits per pixel
(bpp). When applying this embedding technique, it is possible
to elicit the embedded message from the selected pixels in the
LSBs technique [7].
2) Transform Domain Technique: Transform technique,
also called frequency technique, embeds the message by
modifying coefficients to perform transformation domain
technique. Several algorithms are used with these techniques
in image steganography, and it is designed to transfer images
to its frequency domain. This section will discuss the most
widely used algorithms, Discrete Cosine Transform (DCT)
and Discrete Wavelet Transform (DWT).
Discrete Cosine Transform (DCT), the primary role of the
Discrete Cosine Transform (DCT) is to convert the pixels in
image representation into a frequency of 8 X 8 pixels blocks
and transform these pixels blocks into 64 DCT. The Inverse
Discrete Cosine Transform (IDCT) is applied to the 8 X 8
DCT coefficient blocks. The bottom algorithms are how we
can apply DCT n image steganography. To implant a secret
text message within an image, the following algorithm is used:
1) Study cover image.
2) Study secret message and transform the message in
binary form.
3) The cover image is divided into 8x8 blocks of pixels.
4) Operating from left to right and top to bottom for
subtracting 128 in each block of a pixel.
5) DCT is performed on each block of the pixel.
6) Compressing each block by using the quantization table.
7) Compute LSB of each DC coefficient and swap with
each bit of secret message.
8) Create stego image.
9) Evaluate the Peak Signal to Noise Ratio (PSNR), Mean
Square Error (MSE) of the stego image.
https://sites.google.com/site/ijcsis/
ISSN 1947-5500
 International Journal of Computer Science and Information Security (IJCSIS),
Vol. 18, No. 5, May 2020
To regain a secret text message, the computer forensic inves-
tigator can perform the following steps:
1) Study of stego image.
2) Stego image is divide into 8x8 blocks of pixels.
3) Functioning from left to right, top to bottom subtracts
128 in each block of pixels.
4) DCT is performed on each block.
5) Compressing each block by using the quantization table.
6) Analyse LSB of each DC coefficient.
7) Get back and translate each 8 bit into character [8].
Discrete Wavelet Transform (DWT), DWT is a mathemat-
ical function, which can transform the partitions which have
the high-frequency and low-frequency information on a pixel
by pixel. It is preferred than DCT because it can deal with
different levels of the image. In DWT image steganography
can be applied using the following algorithm: The criminal can
implant a secret text message by using the following algorithm:
1) Study the cover image and secret text message, which
is to be concealed in the cover image.
2) Transform the secret text message into binary. 2D-Haar
transform performs on the cover image.
3) Find coefficients’ filtering of the cover image in the
horizontal and vertical direction. Attach cover image
with data bits for DWT coefficients.
4) Get the target image.
5) Determine the stego image by calculating the Mean
Square Error (MSE) and Peak Signal to Noise Ratio
(PSNR).
To facilitate the process to regain a secret text message for the
investigators, they can use the following algorithm:
1) Study the stego image.
2) Find out the horizontal and vertical filtering coefficients
of the cover image. Retrieve the secret message bit by
bit and recompose the cover image.
3) Translate data into the message vector. Differentiate it
with the original message [8].
3) Masking and Filtering Technique: Masking and Filtering
techniques are based on image analysis and marking an image,
which hides the information to make a watermarking. Making
a watermark can be done by modifying the luminance of
parts of the picture. It makes the changes in visible properties
of images, but the criminal will follow some algorithm to
make this changes invisible to the human eyes. The criminals
need to search for significant areas to embed the data in
this area. After that, they will look for the integral parts of
the cover image to integrate the secret data by using some
mathematical expressions to select the pixels. Usually, this
method is restricted to a 24-bit image. Image processing, such
as compression and cropping, is more potent in masking and
filtering than in LSB modification because it is adequate to
use a compression algorithm in JPEG [9].
V. AUDIO S TEGANOGRAPHY
The widespread of audio signals presence as information
vectors has resulted to the importance of using audio files
56
in hiding data. Most steganalysis efforts intense into digital
images leaving audio steganalysis relatively unexplored. Al-
though the audio files are eligible to carry hidden information
because of their availability and popularity, using audio files
for data hiding is especially challenging because of the sen-
sitivity of the human auditory system (HAS). HAS still allow
for common alterations in small differential ranges. More-
over, listeners, in most cases, would ignore some common
environmental distortions. Criminals utilize these audio signals
properties in carrying hidden data [10].
A. Audio Steganography Techniques
Generally, concealing information progress rely on two
steps. Firstly, selecting the redundant bits in the sound file.
Secondly, include confidential data by replacing these extra
bits with the message bits. In this section, we will focus on
three techniques of audio steganography: ”Phase Encoding,
Spread Spectrum, and Echo Data Hiding.” Other methods,
LSB Coding and Parity Coding that were discussed in image
steganography, can also be used in audio steganography.
1) Phase Encoding Technique: Sound phase components
are not sensitive to the human ear as clutter. On that fact, Phase
coding is dependable. This complex with a low data transfer
rate method depends on choosing the phase ingredients within
the original speech spectrum and then replacing the elements
with the data to be hidden. The subsequent parts stage is then
adjusted. This adjusting purpose is to maintain the relative
phase between the segments. This method, compared to other
data masking techniques, is resistant to signal distortion [11],
[12]. The authors in [13] applied multi-band phase modulation
to add data into phase ingredients. These inaudible phase
modifications obtained by modifying phase ingredients in the
cover sound and should remain small to ensure a hearing loss.
The quantitative index modulation (QIM) method is used on
phase components. Based on replacing the phase value by the
nearest x point (to hide bit 1) or the nearest o point (to hide
bit 0) in the unit circuit as figure 2. To include one bit in the
phase sequence, segmental patterns are defined to represent
the value of bit 1 and the value of bit 0. For example, for
a sequence of 4 coefficient, we can specify the model A: (x
oxo), and type B: (0 xox) to represent bit I. 0. To hide a bit,
we need to modify 8 to comply with pattern A or B [11].
2) Spread Spectrum Technique: This technique resembles
the LSB technique, which spreads the message bits randomly
over the entire audio file. But Spread Spectrum Technique tries
to spread the encrypted data over the available frequencies
as much as possible. It propagates the message along the
frequency spectrum of the audio file. The spread spectrum
method uses a symbol that is not based on the original signal.
This method allows the reception of the signal even if there
is interference on some frequencies. It provides a moderate
data transfer rate while maintaining a high level of durability
but exposing noise in an audio file. The propagation spectrum
consists of two types: frequency hopping propagation spectrum
and direct spread spectrum expansion. The concealment of
audio information can be used in both cases. In the case of
https://sites.google.com/site/ijcsis/
ISSN 1947-5500
 International Journal of Computer Science and Information Security (IJCSIS),
Vol. 18, No. 5, May 2020
Fig. 2. Phase Encoding Technique [11]
frequency hopping, the frequency spectrum of the audio signal
can be changed to quickly jump between frequencies [15]. The
direct sequence spread spectrum (DSSS) propagates a secret
signal by multiplying it with the slide and then modifying the
message with a false random signal that resembles the cover
sound. MP3 and WAV signals are used to hide confidential
information in the DSSS method [11]. Criminals exploit the
advantages of spread spectrum technique that provides better
durability. Consequently, using SS algorithms to hide audio
evidence caused broad concern that leads investigators to
take action according to detect the hidden spread spectrum
effectively and verifying the reliability of the secret signal
existing [14].
3) Echo Hiding Technique: The data is hidden by en-
tering the echo of the original signal and then changing
three variables of the echo: initial amplitude, decay rate, and
displacement. If only one echo is produced from the original
signal, only one piece of information can be encoded. Human
perception is exploited by inserting echo to parts of the audio
signal cover. All variables must take their values under the
hearing threshold of the human ear so that no echo is detected.
The parameter offset is varied and represents the message to
be encoded. The offset value is binary zero, while the other
offset value is binary. The original signal is decomposed into
blocks before the encoding proceedings start. Then, segments
are combined when the coding process is stopped. Thus, the
final signal is obtained [11]. This technique has features that
make the ability to detect the additional data existence by HAS
not easy — drawback: less secure method and low capacity
of embedding [15].
VI. V IDEO S TEGANOGRAPHY
This is a technique in which digital video format is used
to hide data. A video file that collects different image frames
is used as the carrier to cover the data. Generally, discrete
cosine transformation (DCT) is used because human eyes do
not understand it. Different types of formats used in video
steganography include H.264, Mp4, MPEG, AVI. The basic
block diagram is given in Figure 3.
Necessary steps performed in the video steganography are
as follows:
57
Fig. 3. Basic Block Diagram for Video Steganography [16].
1) Select a particular video in which we want to embed the
data.
2) Divide the video into small frames.
3) Choose a particular structure in which we wish to our
secret data to be inserted.
4) The secret key is positioned for embedding with that
specific frame, and then the stego video is sent to the
sender.
The reverse of this process is performed for the extraction
of the video. By selecting a particular frame with a secret
key in the extracting block, we can generate our video for
the extraction [17]. there is several techniques and their
combinations used in the video steganography, see Figure 4,
we will focus on three of them.
Fig. 4. Types of Video Steganography [17].
A. Video Steganography Techniques
1) Substitution Based Technique: Secret data are combined
with redundant cover data in these strategies. The Least Signif-
icant Bit (LSB) method, Bit Plane Complexity Segmentation
(BPCS), Triway Pixel Value Differentiation (TPVD), etc. [18]
are various types of substitution-based techniques. LSB is the
newest strategy focused on the replacement. This operates by
swapping certain pixel LSBs from the cover image with the
secret message bits [18]. This system offers high potential
for embedding but is vulnerable to attacks. BPCS (Bit Plane
Complexity Segmentation) is used to separate an image/frame
into planes of parts through binary digits. It takes all pieces
of a prominent location and produces a portion of a plane.
In the bit planes, the intensity of each area is determined
after the picture is decomposed into bit planes. The hidden
data then substitute the noise-like regions to reduce output
degradation [18]. TPVD (Tri-way Pixel Value Differentiation
Method) offers further hiding power by integrating secret data
in lateral, vertical, and diagonal edges. This is a revised PVD
https://sites.google.com/site/ijcsis/
ISSN 1947-5500
 International Journal of Computer Science and Information Security (IJCSIS),
Vol. 18, No. 5, May 2020

(Pixel Value Differentiation Method) version in which the A. Text Steganography Techniques
adjacent pixel difference value hides secret data. There are
Nowadays, computer systems have simplified hiding in-
three types of differential values: lower limits, higher limits,
formation in texts. Consequently, the range of using hidden
and widths. To insert data into compressed MPEG images,
information in the text has also developed. Text steganography
Sherly et al. in [19] uses TPVD.
is broadly classified into three types- format-based, random,
2) Transform Domain Technique: The main drawback to and applied math generations and Linguistic methodology.
techniques based on substitution is that these techniques are
1) Format-based Technique: It is used to alter the format
not capable of addressing any modification in the source of
of the cover-text to cover knowledge. They are not doing any
the cover, which involves compression, format change, etc.
modification to word or sentence. It typically modifies the
and an attacker can quickly destroy the embedded data using
present text to cover the stenographic text. A format-based
these techniques. Transform domain techniques are therefore
text steganography method is an open space method [20].
applied, providing more robustness and perceptual clarity to
Examples of such technique are line shifting and word shifting.
the stego-objects produced. In these methods, hidden data
In line shifting technique, the length of every code word which
is stored through transformed coefficients, and the changed
will be hidden is reduced, the examination of the method that
coefficients are translated back to the original shape of the
shifted each line; however, the amount will still be massive.
sheet. For example, Discrete Fourier Transformation (DFT),
As an instance, having a page with forty lines, that’s 220 =
Discrete Cosine Transform (DCT) and Discrete Wavelet Trans-
one, 048, 576 distinct code words per page, see Figure 5.
form (DWT). All these processes are used for image and video
In word shifting technique, the information is hidden by
compression methods. The significant advantage of DWT is
shifting the words horizontally or by changing the distance
a quick resolution. In other words, it gathers frequency and
between the words, see Figure 6.
position data [18]. They are using 8X8 block DCT in DCT
to transform secret message and video frame coverage. Using
multidimensional lattices, the hidden message coefficients are
quantified and encoded and then integrated into the DCT
coefficients of the cover frame [17].
3) Adaptive Technique: Also known as ”Masking” or
”Statistics-conscious embedding,” operate on the cover’s nu- Fig. 5. Line shifting technique [20].
merical features until modifying the secret data. This helps
to identify the most active regions identified as Resource
Regions (ROI) where secret data can be stored. Then, the
cover is modified in compliance with certain requirements in
this phase, and then classified data is contained in it. Various
attributes can be used in video streams to build adaptive
techniques [18].
Fig. 6. An Example of Word Shifting Technique [21].

VII. T EXT S TEGANOGRAPHY

This section demonstrates one of the steganography meth-
ods, which is the text steganography. This method is consid-
ered one of the oldest techniques in steganography as well as
the most difficult one, for the reason of the lack of redundant
information in a text file. In executing steganography, the pri-
mary purpose is to hide the undercover info media. Therefore,
the outsiders may not notice the information contained in
the said frame where this reflects the significant difference
among steganography and other methods of hidden exchange
of information. This part explains text steganography in detail.
Since it emphasizes on masking secret messages inside a
cover medium, the most vital property of cover medium is
that the quantity of knowledge that may be kept within it
while not ever-changing its remarkable features. There are
several techniques with which to hide, analyze, and recover
that hidden information. Because of the variations between
languages, no single process is used for activity data in texts of
various styles. In the following section, some of the techniques
are mentioned briefly [20].
2) Linguistic methods: The linguistic method considers the
linguistic properties of the text to modify it. The technique
uses the linguistic structure of the message as a place to hide
information. It is complicated with creating changes to a cover
text to plant data in such a way that the changes don’t lead
to ungrammatical or unnatural text. The syntactic method and
semantic method are types of linguistic steganography. Fre-
quently used linguistic designs as an area for privet messages.
In truth, steganography proficiency will be hidden inside the
syntactical structure itself [21].
Lexical Steganography, this technique uses certain words
from the text, which are selected, then their synonyms are
identified. After that, the terms along with their synonyms are
used to hide the secret message in the text, and the alternative
of the word to be chosen from the list of synonyms would
rely on secret bits; it used synonym replacement by using a
synonym. Huffman Compression first compresses the privet
text to be secreted. In [22], Brecht Wyseur, Karel Wouters,
and Bart Prenee proposed linguistic steganography based on
word substitution over an IRC channel. The generation of the

58 https://sites.google.com/site/ijcsis/
ISSN 1947-5500
 International Journal of Computer Science and Information Security (IJCSIS),
Vol. 18, No. 5, May 2020
Fig. 7. Syntactic Rules [23].
word substitution table is based on a session key and used
synonyms from a public thesaurus.
Syntactic Steganography, in this method, the use of the
word context-free grammars (CFG) is widespread. It is a tree
structure that may be used for concealing the bits wherever
the left branch represents ’0’ and right branch corresponds to
’1’. However, this method is less advantageous to use. It is
so maybe because the small rules that cause the text to repeat
themselves a great deal and also the text are unflawed, hence,
leading to a scarcity of linguistics structure [23], Figure 7
shows an example of syntactic rules.
VIII. D ETECTION S TEGANOGRAPHY
To improve computer forensic, investigators need to follow
some techniques to reveal the secret message. In this section,
we will describe how the investigators can detect this embed-
ded message in each type of steganography.
A. Detection Techniques for Image Steganography
Basically, the investigator can detect the secret message
in image steganography by decompressing the JPEG stego
image. For all stenographic techniques, there is no accurate
recipe to find the secret message, but in this section, we will
provide general methods the investigators can use. In computer
forensic, the investigator analyzes the length of the embedded
secret message to predict the changes. For JPEG images, it
may be possible to have a picture with macroscopic properties
from the stego image that is similar to the cover JPEG image.
By decompressing the stego image to 4 pixels through the
use of the quantization table, the investigator could get the
microscopic properties [24]. In this section, we will describe
two detection algorithms F5 and OutGuess.
1) F5 Algorithm: This algorithm uses subtraction or matrix
format technique to predict the length of the embedded secret
message. This algorithm is the most accurate one to find the
length. The central concept that the investigator can do in this
algorithm is to replace the least significant bit (LSB) of the
DCT coefficient by using the following algorithm [24].
2) OutGuess Algorithm: The outGuess algorithm is de-
signed by Provos to counter the statistical Chi-square attack.
It shows that the investigator can detect the stego image by
using a pseudo-random number generator. Also, it depends on
replacing the least significant bit (LSB) of the DCT coeffi-
cient. OutGuess selects the histogram of the DCT coefficient
randomly to match the cover and stego histogram. Following
the next algorithm will allow the investigator to detect the
stego image [24], see Figure 9.
59
Fig. 8. F5 Algorithm [24].
Fig. 9. OutGuess Algorithm [24].
B. Detection Techniques for Audio Steganography
Audio forensics analysis is a complex science. The im-
plementation of audio forensic has led to a successful case
investigation. Available audio tampering on markets makes
the authenticity of audio file detection vital, which in turn
results in the critical role of audio forensics crime investigating
and exposure. Detecting mechanism of the hidden information
existing in audio files refers to Steganalysis. The Electronic
Network Frequency (ENF) is one of the recordings of forensic
analysis methods. It relies on the traces of the ENF existing
in the record [25]. Based on the way phase coding method
works by substituting the phase of a first audio segment
with a reference data phase to be hidden, which adjudicates
the alteration of phase difference because of the extrinsic
continuities corruption of unwrapped phase in each section.
Therefore, each segment has a different statistical analysis and
can be used in monitoring the change, classify the embedded
signal, and clean signal. De facto Phase steganalysis is one of
the most challenging in computer forensics fields. However,
investigators can implement phase steganalysis by dividing
each audio signal into segments with a given length and
then perform the following steps. First, they use Fast Fourier
Transform (FFT) that allows viewing the spectrum content of
an audio signal of a particular segment to drive the phase
differential spectra from unwrapped phases of each audio
sample. Second, five statistical characteristics of the phase
difference for steganalysis are derived. These characteristics
are essential because they compress each spectrum informa-
https://sites.google.com/site/ijcsis/
ISSN 1947-5500
 International Journal of Computer Science and Information Security (IJCSIS),
Vol. 18, No. 5, May 2020
tion and monitor the change of phase difference: variance,
skewness, kurtosis, median, and mean absolute deviation.
Finally, they can utilize the support vector machine SVM
classifier for classification [26]. Considering that the Spread
Spectrum technique is an adding noise process, detection can
be achieved using vector extraction and classifier technology
in the computer forensics field. According to [27], wavelength
analysis is used to separate the audio signal into several frames
and obtain detailed information to extract feature vectors.
Initially, the threshold value is determined by compressing
the signal wavelength coefficient to eliminate interference and
then obtain de-noise by the wavelet coefficient to reconstruct
the signal. In each frame, the mean difference between signal
with and without de-noising composite the feature vectors.
Finally, as in the phase decoding algorithm, classify the Signal
Attribute using SVM based on the audio signal feature vectors.
Investigators in the field of computer forensic can benefit
from the proposed algorithm by the authors in [28] that are
based on extracting a short window from the audio signal
and calculating the moments of high-frequency peak center
using the support vector machine. Then, they analyze the
statistics of the peak frequencies [29]. In [28], the proposed
steganalysis algorithm is designed for a typical echo coding
algorithm. Taking advantage of the features of this echo hiding
technology, which hides information in the host audio without
any unique key, so that anyone can discover the message
included in the audio signal.
C. Detection Techniques for Video Steganography
D. Video Detection Exploring the Temporal Correlation be-
tween Frames
Budia et al. in [30] suggests a visual steganalysis strat-
egy using the redundant knowledge existing in the tempo-
ral domain as a barrier to secret messages found in the
steganography of the distributed spectrum. Based on linear
collaboration methods, their analysis is useful in finding,
with good precision, secret watermarks with low energy. The
simulation findings further show the supremacy of the time-
based approaches in finding the hidden message over strictly
spatial methods [18].
E. Video Detection based on Spatial and Temporal Prediction
For the MPEG video coding standard, Pankajakshan and
Ho suggest a video steganalysis scheme [31] in which a
given frame is predicted using motion compensation from
its neighboring reference frames. The MPEG coding scheme
supports two types of predicted structures: the P-frames (the
reference frame uses a single past frame) and the B-frames
(using past frames and future frames as frames of reference).
The probability error frames (PEFs) referring to the P and B-
frames will then be coded using the techniques of transform
coding. The PEFs display spatiotemporal similarity between
the frames next to them. Using the 3-level DWT (Discrete
Wavelet Transform) process, the PEFs of a test video signal
is decomposed, and the first three moments of characteristic
functions (CFs) are measured in each sub-band. The resulting
60
attribute vectors are fed to train a classifier of patterns to
differentiate between stego and non-stego images [32].
F. Detection Techniques for Text Steganography
When covering and changing techniques in the text to hide
some classified information or make the entire text confiden-
tial, these methods make some attackers analyze the text or
use some linguistic and semantic steganography to discover
the original text using text-stego to detect the computer crime.
Steganalysis is to analyze stego-text to detect or extract secret
messages [23]. Therefore, algorithms must be chosen that are
difficult to interpret or detect and which cannot be known
if the aggressors have altered them. Usually, steganalysis
sends out messages that are worthless or of importance to
solicit, discover as much information as possible, and discover
changes to them. Steganalysis is generally considered to be
successful when the existence of a message is detected [33].
In this section, we will mention the method of detection
algorithms based on font formatting. First, we will compile
the texts to see the original text from the text that we changed,
and We can use finding a vector machine, which has the
outstanding performance of classification [34], [35], as the
classifier. SVM has been extensively used, and it has delivered
a state-of-the-art performance in steganalysis of image and
video [36]. We will make SVM categorized for each font
feature. Note that they are two groups, plain text, and stego
text.
General Steganalysis rule for text steganography sup-
ported font format Algorithm.
Input: Font attributes and the corresponding classifiers.
Output: The designations of attributes that contain information
and the total unseen information length.
1) Initialize the unseen information length cj = 0 and
marker variable Tj = F alse(0 ≤ j < m);
2) Traverse each font attribute of all characters in the text,
and extract values of separately m font attributes;
3) For each attribute, create the characteristic vector ac-
cording to the values;
4) For each non-empty characteristic vector, use the trained
classifier Mj (0 ≤ j < m) to identify whether there
is embedded information or not. If unseen information
was found, set Tj = T rue and estimate the unseen
information length jc for attribute j;
5) If Tj = T rue, output the name of attribute j and the
value of jc , and compute the over-all unseen information
length.
https://sites.google.com/site/ijcsis/
ISSN 1947-5500
 International Journal of Computer Science and Information Security (IJCSIS),
Vol. 18, No. 5, May 2020
IX. C ONCLUSION
Steganography is used to hide confidential data in cover
media. Thus, the hidden data is resistant to external attacks
and does not express the possibility of contact between the
two parties. Several types of cover source can be used such
as image, audio, video and text. The main objective of this
paper is to identify various techniques that are reliable and
have the capability improvement with a minimal loss in stego
file quality. In this paper, we have provided the whole picture
of steganography. We have explained several techniques for
each steganography type. For computer forensic investigation,
digital steganalysis is very useful. Thus, we have investigated
the function of steganalysis.
R EFERENCES
[1] Hasan, Raza, Salman Mahmood, and Akshyadeep Raghav. ”Overview
of Computer Forensics tools.” Proceedings of 2012 UKACC International
Conference on Control. IEEE, 2012.
[2] Sarage, Govind Namedorao. ”Study of Various Techniques of Steganog-
raphy and Steganalysis.” International Journal of Advanced Research in
Computer Science 5.6 (2014).
[3] Ćosić, Jasmin, and Miroslav Bača. ”STEGANOGRAPHY AND ITS
IMPLICATION OF FORENSIC INVESTIGATION.” Infoteh 2010. 2010.
[4] Hariri, Mehdi, Ronak Karimi, and Masoud Nosrati. ”An introduction to
steganography methods.” World Applied Programming 1.3 (2011): 191-
195.
[5] Morkel, Tayana, Jan HP Eloff, and Martin S. Olivier. ”An overview of
image steganography.” ISSA. 2005.
[6] Yari, Imrana Abdullahi, and Shahrzad Zargari. ”An overview and com-
puter forensic challenges in image steganography.” 2017 IEEE International
Conference on Internet of Things (iThings) and IEEE Green Computing
and Communications (GreenCom) and IEEE Cyber, Physical and Social
Computing (CPSCom) and IEEE Smart Data (SmartData). IEEE, 2017.
[7] Hamid, Nagham, et al. ”Image steganography techniques: an overview.”
International Journal of Computer Science and Security (IJCSS) 6.3 (2012):
168-187.
[8] Sharma, Sudhanshi, and Umesh Kumar. ”Review of Transform Domain
Techniques for Image Steganography.” International Journal of Science and
Research 2.2 (2015): 1.
[9] Amin, Muhalim Mohamed, et al. ”Information hiding using steganogra-
phy.” 4th National Conference of Telecommunication Technology, 2003.
NCTT 2003 Proceedings.. IEEE, 2003.
[10] Djebbar, Fatiha, et al. ”Comparative study of digital audio steganography
techniques.” EURASIP Journal on Audio, Speech, and Music Processing
2012.1 (2012): 25.
[11] Djebbar, Fatiha, et al. ”A view on latest audio steganography tech-
niques.” 2011 International Conference on Innovations in Information
Technology. IEEE, 2011.
61
[12] Kekre, H. B., et al. ”Information hiding in audio signals.” International
Journal of Computer Applications 7.9 (2010): 14-19.
[13] Gang, Litao, Ali N. Akansu, and Mahalingam Ramkumar. ”MP3 re-
sistant oblivious steganography.” 2001 IEEE International Conference
on Acoustics, Speech, and Signal Processing. Proceedings (Cat. No.
01CH37221). Vol. 3. IEEE, 2001.
[14] Zeng, Wei, Ruimin Hu, and Haojun Ai. ”Audio steganalysis of spread
spectrum information hiding based on statistical moment and distance
metric.” Multimedia Tools and Applications 55.3 (2011): 525-556.
[15] Tanwar, Rohit, and Monika Bisla. ”Audio steganography.” 2014 Interna-
tional Conference on Reliability Optimization and Information Technology
(ICROIT). IEEE, 2014.
[16] Bodhak, V., and L. Gunjal. ”Improved protection in video Steganography
using DCT & LSB” international journal of engineering and innovative
technology (IJEIT) vol. 1, issue 4.” (2012).
[17] Sadek, Mennatallah M., Amal S. Khalifa, and Mostafa GM Mostafa.
”Video steganography: a comprehensive review.” Multimedia tools and
applications 74.17 (2015): 7063-7094.
[18] Thakur, Abhinav, Harbinder Singh, and Shikha Sharda. ”Different
Techniques of Image and Video Steganography: A Review.” International
Journal of Electronics and Electrical Engineering 2.
[19] Sherly, A. P., and P. P. Amritha. ”A compressed video steganography
using TPVD.” International Journal of Database Management Systems
(IJDMS) 2.3 (2010): 67-80.
[20] Bender, Walter, et al. ”Techniques for data hiding.” IBM systems journal
35.3.4 (1996): 313-336.
[21] Niimi, Michiharu, et al. ”A framework of text-based steganography using
sd-form semantics model.” Pacific Rim Workshop on Digital Steganogra-
phy 2003. 2003.
[22] Wai, Ei Nyein Chan, and May Aye Khine. ”Syntactic bank-based
linguistic steganography approach.” 2011 International Conference on
Information Communication and Management IPCSIT. Vol. 16. 2011.
[23] Bennett, Krista. ”Linguistic steganography: Survey, analysis, and robust-
ness concerns for hiding information in text.” (2004).
[24] Sujatha, V. ”Empirical analysis on steganography using JSteg, Outguess
0.1 and F5 algorithms.” IJARCA 3.1 (2015): 20-28.
[25] Zakariah, Mohammed, Muhammad Khurram Khan, and Hafiz Malik.
”Digital multimedia audio forensics: past, present and future.” Multimedia
tools and applications 77.1 (2018): 1009-1040.
[26] Zeng, Wei, Haojun Ai, and Ruimin Hu. ”A novel steganalysis algorithm
of phase coding in audio signal.” Sixth International Conference on
Advanced Language Processing and Web Information Technology (ALPIT
2007). IEEE, 2007.
[27] Gao, S., et al. ”A detection algorithm of audio spread spectrum data
hiding.” 2008 4th International Conference on Wireless Communications,
Networking and Mobile Computing. IEEE, 2008.
[28] Zeng, Wei, Haojun Ai, and Ruimin Hu. ”An algorithm of echo steganaly-
sis based on power cepstrum and pattern classification.” 2008 International
Conference on Audio, Language and Image Processing. IEEE, 2008.
[29] Meghanathan, Natarajan, and Lopamudra Nayak. ”Steganalysis algo-
rithms for detecting the hidden information in image, audio and video
cover media.” international journal of Network Security & Its application
(IJNSA) 2.1 (2010): 43-55.
[30] Budhia, Udit, Deepa Kundur, and Takis Zourntos. ”Digital video ste-
ganalysis exploiting statistical visibility in the temporal domain.” IEEE
Transactions on Information Forensics and Security 1.4 (2006): 502-516.
[31] Pankajakshan, Vinod, and Anthony TS Ho. ”Improving video ste-
ganalysis using temporal correlation.” Third International Conference on
Intelligent Information Hiding and Multimedia Signal Processing (IIH-
MSP 2007). Vol. 1. IEEE, 2007.
[32] Wang, Yao, Jörn Ostermann, and Ya-Qin Zhang. ”Video processing and
communications.” Progressive 1 (2002): 12.
[33] Petitcolas, Fabien AP, Ross J. Anderson, and Markus G.
Kuhn.”Information hiding-a survey.” Proceedings of the IEEE 87.7
(1999): 1062-1078.
[34] Vapnik, Vladimir, and Vlamimir Vapnik. ”Statistical learning theory.”
(1998).
[35] Cortes, Corinna, and Vladimir Vapnik. ”Support-vector networks.” Ma-
chine learning 20.3 (1995): 273-297.
[36] Ozer, Hamza, et al. ”Steganalysis of audio based on audio quality
metrics.” Security and Watermarking of Multimedia Contents V. Vol. 5020.
International Society for Optics and Photonics, 2003.
https://sites.google.com/site/ijcsis/
ISSN 1947-5500