That Stegdetect finds so many images that seem to have content hidden with JPHide does not indicate that there are many images that really contain hidden content. If there were hidden content, we would expect to find more areas in the image where the extended χ 2 -test shows a positive result. When analyzing the graph, we see only a few high probability spikes. Images with monotone backgrounds like the painting in Figure 14 are more likely to be false positives.
We find similar false positives when trying to detect content hidden with OutGuess. However, when analyzing the probability of embedding displayed next to the drawing, we do not see a plateau at the beginning, as we would expect had encrypted data been embedded. Stegdetect indicates that content has been hidden by JSteg. An example of a false positive is shown in Figure 13. We notice that there are special classes of images for which Stegdetect falsely indicates hidden content. Reducing it improves the “true positive” rate the best. As a result, the false positive rate is the dominating term in the denomiator. We assume that P ( S ), the percentage of images containing steganographic content, is low in comparison to P ( D |¬ S ), the percentage of false positives. There are two possible approaches: decreasing the false negative rate or decreasing the false positive rate. To improve the efficiency of our detection system,we need to increase the “true positive” rate. P ( D | S ) is the probability that we detect an image that has steganographic content and P ( D |¬ S ) the false positive rate. ( S ) is the probability of steganographic content in images and P ( ¬ S ) its complement.
0 kommentar(er)
