# A False Negative Study of the Steganalysis Tool Stegdetect
## 4 Results
\begin{table}
\begin{tabular}{l l l l l l l} \hline
**Sensitivity** & **False Negative** & **Likely False** & **jphide(*)** & **jphide(**)** & **jphide(***)** & **OTHER** \\
**Value** & & **Positive (Skipped)** & & & & **-ALG** \\ \hline
0.1 & 90.67\% & 4.67\% & 0.00\% & 0.00\% & 0.00\% & 0.67\% \\
0.3 & 90.67\% & 4.67\% & 0.00\% & 0.00\% & 0.00\% & 0.67\% \\
0.5 & 89.33\% & 4.67\% & 1.33\% & 0.00\% & 0.00\% & 0.67\% \\
0.7 & 87.33\% & 4.67\% & 3.33\% & 0.00\% & 0.00\% & 0.67\% \\
1.5 & 84.67\% & 4.67\% & 2.67\% & 2.00\% & 1.33\% & 0.67\% \\
3.4 & 74.67\% & 4.67\% & 9.33\% & 1.33\% & 5.33\% & 0.67\% \\
5.2 & 33.33\% & 4.67\% & 41.33\% & 9.33\% & 6.67\% & 0.67\% \\
7.3 & 30.00\% & 4.67\% & 7.33\% & 40.00\% & 13.33\% & 0.67\% \\
10.0 & 29.33\% & 4.67\% & 4.00\% & 41.33\% & 16.00\% & 0.67\% \\ \hline \end{tabular}
\end{table} 
Table 6: Results of 150 images from google image database (SAFE OFF) with different sensitivity values. Figure 10: Changes in the jphide rate with different sensitivities for google image database (SAFE ON). The final phase, analysis the overall false negative ratio of the tool, this is to help forensic analyst during an investigation by providing accurate statistics of stegdetect false negative ratio, because in the court of law the forensic analyst must prove beyond every reasonable doubt that the results of the tool can be relied upon as evidence. This analysis was done using the results from all the different image databases, note that all the images had different properties, because there were some that had been manipulated with dotted at a quality of 75 and there were those that were untouched. The overall false negative results for all the different images it is very high between (0.1 and 3.4) but had a quick fall between (5.2 and 10.0), and as the false negative results drop the confidence in detecting jphide (\", \", \") increases, this is an important information for the analyst investigating images from different sources. Especially noting that false negative ratio of the tool and how the higher the sensitivity between (5.2 and 10.0) influences the results of bulk images under investigation. Table 7 shows all the false negative values for the different datasets used. Figure 13 below present the overall false negative ratio which was very high, but there is very important information about the graph the forensic analyst need to know. We set our acceptable false negative ratio to be 21%, which intersect with the mean of all the false negative at some point on the sensitivity. All the different image at 5.2 sensitivity had a quick fall in the false negative ratio but with a continuous increase in the sensitivity gave a stable and slow decline in the false negative ratio. Figure 11: Overall false negative rate of google image database (SAFE OFF) with different sensitivity values. Figure 12: Changes in the jphide rate with different sensitivities for google image database (SAFE OFF). Note, with our acceptable 21% false negative its correspondent sensitivity is 6.2. This will inform the analyst on the kind of sensitivity they can use depending on their acceptable false negative ratio during an investigation. During the analysis, the following observations were noted,  
1. Between (0.1 and 5.0) the tool seem not to be very sensitivity in detecting steganographic method in images. 2. Between (6.2 and 10.0) the analyst is likely to get a more accurate and a more reliable, which give a low false negative result. In this case, there is a likelihood that the tool runs slow because its become very sensitive in detecting steganographic methods in JPEG images. * In terms of the algorithms behind StegDetect, these are not known as they are not published by the developers of the tool, therefore, our understanding of the behaviour of the tool remains at the level of black box testing. We consider this to a certain extent sufficient from the perspective of the end users community.