A Method Based on Feature Matching to Identify Steganography Software

Reliable identification of steganography software is an important research direction of steganography forensics, how to identify the steganography software based on the characteristics of steganography algorithm is the difficulty in the research of identifying the steganography software. In this paper, based on the principles of LSB Steganography algorithm (include LSB Replacement and LSB Matching), we propose an approach to identify steganography software by Feature Matching. First, we take the process of change operations to the pixels in the LSB steganography algorithm as Core Instructions which are taken as the feature of the software, and we have analyzed the implementation of Core Instructions in a variety of typical steganography software based on LSB Steganography algorithm, then build the corresponding feature for each of implementations. And then we would determine whether the software is a LSB steganography software according to the existence of codes matched with the feature. The experimental results show that the method in this paper can reliably identify a variety of common steganography software based on LSB Steganography algorithm.