# Framework for Malware Triggering Using Steganography
## 4 Evaluation
### Results and Analysis
#### 4.2.2 The Stego-Image Analysis  
A stego-image may host a malicious payload. In this paper, we chose the grayscale and color PNG images with sizes 205 KB and 3.22 KB, respectively, for performance analysis, as shown in Figure 8.  
For purposes of illustration, we injected the JavaScript code for window.alert (\"Hacked!!! !\") into an image. Figure 9 shows the original image, the encoded image that contains the geolocation and exploits code, and the polyglot image. It is difficult for the naked eye to distinguish between the original image, an encoded image, and a polyglot image. Figure 10 shows the image when loaded into a browser at the specified location, and the exploit was executed. However, if the W3C geolocation method is used to determine the target, a permission request to report the current location is displayed when an Internet user views the image, which would arouse the user's suspicion. Figure 8: Experiment images. (**a**) PNG image with size 205 KB; (**b**) PNG image with size 3.22 KB. Figure 10: Exploit triggered in Firefox browser. Figure 9: Original, Encoded, and Polyglot images in our experiments. (**a**) Original image; (**b**) Encoded image; (**c**) Polyglot image. When we examined the benign and malignant images in a hex editor, we could see the injected text, as we can see in Figures 11 and 12. As shown in Figure 12, there is a string in the polyglot images at a specific byte range. We performed an image analysis by calculating the Mean Square Error (MSE), Structured Similarity Index Measure (SSIM), and Peak Signal to Noise Ratio (PSNR), as reported in Table 15. Generally, the MSE is defined as the difference between the actual and the estimated values. It is used to calculate the average of the squares of the estimation errors or deviations [12; 36]. It is calculated as follows:  
\[\text{MSE}=1/(\text{m}\ \times\text{n})\sum_{\text{i}=0}^{\text{m}-1}\sum_{ \text{j}=0}^{\text{m}-1}\left[\text{I}(\text{i},\text{j})-\text{K}(\text{i}, \text{j})\right]^{2} \tag{1}\]  
where m and n are the pixel counts of the images, i and j are the current pixel values, I(i,j) is the original image, and K(i,j) is the image to be compared. Figure 11. The original image file structure is in hexadecimal view. Figure 12. The polyglot image file structure is in hexadecimal view. The SSIM is used to compare the similarity of two images. It is a metric that measures perceived variations or degradation in image quality caused by changes to the file structure [12; 37]. The SSIM metric is calculated using the following formula:  
\[\text{SSIM (x, y)}=\left(2\mu_{x}\mu_{y}+c_{1}\right)(2\alpha_{x}y+c_{2})/\left( \mu_{x}^{2}+\mu_{y}^{2}+c_{1}\right)\left(\sigma_{x}^{2}+\sigma_{y}^{2}+c_{2}\right) \tag{2}\]  
where x and y represent the window sizes of the images to be compared, \(\mu\) is the average of images x and y, \(\sigma^{2}\) is the variance of x and y, \(\sigma\) is the covariance of both images, and \(c_{1}\) and \(c_{2}\) are two variables to stabilize the division with the weak denominator. SSIM values range between 0 and 1; the closer the value to 1, the more similar the images are. The PSNR metric estimates image quality. For example, it can determine the distortion between the original and encoded images [38]. It is defined as follows:  
\[\text{PSNR}=20\log_{10}\left(\text{N}/\sqrt{\text{MSE}}\right) \tag{3}\]  
where N is the most difference between pixels in an image. The higher the PSNR value, the more similar the encoded image to the original image. It is measured in decibels (dB). As we can see in Figure 9, the results show that there is not much difference between the original and polyglot images. Table 15 shows the MSE, SSIM, and PSNR calculated between the original and encoded images and the size of the files. We noticed an increase in the size of the image files, as the size of the polyglot grayscale image increased by 3.90%, and the size of the color image increased by 303.72%.