An Improved Sample Pairs Method for Detection of LSB Embedding

A Fusion of Maximum Likelihood and Structural Steganalysis

“…Further application, to large groups of pixels and replacement of two bit planes, can be found in [6,7]. A key novelty is the principle of least-squares [3], which defines the closest cover fit to be when the features' sum-square deviation (from an ideal) is minimized.…”

“…In this section we consider the features used by the detectors known as Sample Pairs (SPA) [2,3] or Couples [5] (other possibilities will be examined in later sections).…”

“…The cover model in [2,3] is |E m | = |O m |, although only odd indices can be used for steganalysis.…”

“…We suppose that the LSB of each sample is flipped, independently, with probability p 2 -this corresponds to embedding a payload (uncorrelated with the cover) of length pN by randomized LSB replacement, or perhaps the embedding of a longer payload when LSB flipping is used as part of a source coding scheme [14] (of course the estimator will be truly for twice the number of flipped pixels, regardless of the connection this has with payload size; it could be nothing else). Under this embedding operation each quartet of trace subsets O 2m−1 , E 2m , O 2m , E 2m+1 undergoes permutation, with probabilities determined by p. We will not repeat that analysis, since it can be found in much of the other steganography literature including [2,3,5].…”

“…The structural detectors, which include (in increasing order of complexity) [1][2][3][4][5][6][7], are easily the most sensitive. But their exposition can become complex, and the methods themselves are often based on dubious statistical principles (for example, assuming that all observations of random variables equal the expectation).…”