steganalysis is the study of detecting messages hidden using steganography; this is analogous to cryptanalysis applied to cryptography. == overview == the goal of steganalysis is to identify suspected packages, determine whether or not they have a payload encoded into them, and, if possible, recover that payload. unlike cryptanalysis, where it is obvious that intercepted data contains a message (though that message is encrypted), steganalysis generally starts with a pile of suspect data files, but little information about which of the files, if any, contain a payload. the steganalyst is usually something of a forensic statistician, and must start by reducing this set of data files (which is often quite large; in many cases, it may be the entire set of files on a computer) to the subset most likely to have been altered. all of the methods of detection described herein are defeated if the unmodified file is used to encrypt/decrypt a file. this may be accomplished by bitwise manipulation of the file using a digital mask to generate the cyphertext. . an example of this method is described in a self-published science fiction novel. in that example a file is encrypted using a 1949 photo from a digital archive of national geographic magazine."timelines", by bob blink, amazon kindle, page 189 == basic techniques == the problem is generally handled with statistical analysis. a set of unmodified files of the same type, and ideally from the same source (for example, the same model of digital camera, or if possible, the same digital camera; digital audio from a cd mp3 files have been "ripped" from; etc.) as the set being inspected, are analyzed for various statistics. some of these are as simple as spectrum analysis, but since most image and audio files these days are compressed with lossy compression algorithms, such as jpeg and mp3, they also attempt to look for inconsistencies in the way this data has been compressed. for example, a common artifact in jpeg compression is "edge ringing", where high-frequency components (such as the high-contrast edges of black text on a white background) distort neighboring pixels. this distortion is predictable, and simple steganographic encoding algorithms will produce artifacts that are detectably unlikely. one case where detection of suspect files is straightforward is when the original, unmodified carrier is available for comparison. comparing the package against the original file will yield the differences caused by encoding the payloadâand, thus, the payload can be extracted. == advanced techniques == === noise floor consistency analysis === in some cases, such as when only a single image is available, more complicated analysis techniques may be required. in general, steganography attempts to make distortion to the carrier indistinguishable from the carrier's noise floor. in practice, however, this is often improperly simplified to deciding to mak
Cryptographic_attacks Steganography