# A False Negative Study of the Steganalysis Tool Stegdetect
## 2 Related Work  
In terms of information hiding, steganography and watermarking are interconnected [12]. Although they share some technical traits, the largest difference is their purpose of use. The former is aimed at engaging in secret communication while the latter is for verifying the identity and authenticity of the owner. Ref. [12; 13] argue that imperceptibility, robustness, and payload capacity are parameters of steganography. Compared to this, watermarking concerns the most whether it is robust in order to avoid watermarks being removed or replaced. These parameters can be referred to distinguish it from watermarking and cryptography as well as to compare various types of steganography techniques. There are two groups of people who use steganographic techniques. A steganographer uses analysis tools to reassure whether a steganographic process has been successful, and thus the message is undetectable or unreadable [14]. On the opposite side, a stegoanalyst attempts to detect and read stego-messages. In either way, steganalysis involves two stages: (1) identifying the existence of steganographic messages and (2) reading the embedded message [15]. Various digital steganography methods have been developed in recent years. One commonality is that all methods is based on the fundamental concept that secret messages are embedded in a cover medium to create an output, a stego-file. There are a wide range of steganograpy techniques depending on a type of a cover medium (e.g., text, image, video and audio). It has been an ongoing debate whether steganography is used by terrorists or criminals [16], scanned a couple of million images and identified 20,000 suspicious images using 'Stegdetect' [11]. Although no hidden messages were identified in the research, we cannot categorically conclude that steganography was not misused by malicious actors. Before making the conclusion, available tools should be examined whether they are reliable or not. Therefore it is of importance to check their reliability. However, there have been few research on this. Detection of steganographic messages does not necessarily have to reveal the hidden content, but merely detecting their presence can carry significant implications in that this can draw unwanted attention from opposite parties. As such, the precision of the detection algorithm is one of its important attributes. This presents a crucial implication to digital forensic analysts. [PERSON]. [17] defined digital forensic as the approved method used to preserve, collect, validate, identify, analyse, interpret evidence obtained for a digital investigation. In the digital communication era, any sort of criminal investigations are bound to involve digital devices. To establish facts in a court, digital data stored on devices such as computers and smartphones have to be investigated by a forensics analyst. As malicious actors are equipped with state-of-the-art technologies, forensic analysts have tried to keep pace with them. According to [18], in digital crime there are different methods used by an analyst during their investigation. These methods throughout the investigation must be done in a forensically sound manner. Ref. [19] noted that an investigation is successful and acceptable if the evidence obtained from the original source is not altered in any way. Morever, to raise criminal arrests and convictions, forensic analysts need to ponder over how to reduce the false negative ratio of a tool. If the false negative ratio is high, this indicates that there is a high possibility that a stego-file is not detected, failing to weed out criminals. In this respect, this study aims to investigate the false negative rates of a steganalysis tool, Stegdetect, in order to examine whether this is a reliable tool for digital forensic analysts. This paper complements an earlier study on the false positive rates for Stegdetect carried out in [10]. There are many tools currently in the market for exposing hidden content in images. StegExpose [20; 21] is an open-source Java-based steganalysis tool.