# A False Negative Study of the Steganalysis Tool Stegdetect
## 1 Introduction  
In recent times, the rapid growth in computer technology has become core in our lives. The technological advancement such as Cloud computing, Internet of Things, and social media platforms has brought about efficiency, effectiveness, and convenience to both individual and organisational users. However, there is a downside to all this. There are more and more tools on the market today, and the tools created by advanced technology will become more and more difficult to control. Enterprises must increase investment and introduce new defense solutions to deal with them. This all has provided a new type of risk and threats. Due to an increasing reliance upon devices those users are exposed to various Cyber security risks [1]. In particular, individuals as well as organisations which essentially value information secrecy and privacy were greatly concerned about how to secure their data. Information hiding has become a pivotal characteristic of digital society. Against this backdrop, several methods such as steganography and cryptography with complex algorithms have been developed to secure information privacy [2]. Cryptography is intended to conceal the content of messages via data encryption or scrambling, but it cannot hide their existence [3]. In contrast, steganography hides the very existence of secret information while being communicated in cover media files [2; 3; 4; 5]. If successful, it attracts no suspicion at all of the presence of such secret information from the point of view of an external observer. This is the main reason why steganography in recent times has received much attention amongst security research. In addtion, steganography has found other uses, such as copyright and e-document forging prevention [6], secret image transfers over Clouds [7] and protection of private health records [8], amongst others. The problem of detecting hidden content was first formulated in a clear manner by [PERSON] [9], who modelled the problem as two prisoners attempting to communicated in a covert manner secretmessages related to the plan of escape from the prison, whilst the warden would inspect every message communicated. If suspecting that hidden content was included in a message, the warden would then destroy the message and send the two prisoners into solitary confinement. This is known as the prisoners problem. In fact, there are a lot of real life applications of steganography in politics, diplomacy, and the military [3]. In hiding information using a steganographic procedure, one needs both an embedding algorithm, which takes as input a cover media file in which the secret data message will be embedded resulting in a stego-file. On the other end, one needs a detection algorithm that identifies the stego-file with an affirmation of the existence of the secret message and an extraction algorithm to extract the secret message from the stego-file. This method used in extracting and detecting steganographic activities in any stego-file is called steganalysis. However, similar to any other numerical analysis, steganalysis can have false results, which can be divided into false positive, where an image is clean but it is flagged by the analysis tool as being loaded with a secret message, and false negative, where an image is loaded with a secret message but it is flagged by the analysis tool as being clean. Previously, in [10], we presented a false positive rate study of the well-known image analysis tool, StegDetect [11]. In this paper, we continue the false rates study of StegDetect by investigating the rate of false negative cases that the tool exhibits. Understanding the rate of false negatives is equally as important as it demonstrates the rate at which the tool fails in detecting hidden content, something that has implications for security and privacy. The rest of the paper is organised as follows. In Section 2, we discuss related work in current literature. In Section 3, we give an overview of the methodology we used to conduct our research, and describe the datasets used for the analysis.