On Viable Statistical Metrics for Re-Embedding Network Steganalysis

Network steganalyses attempt to uncover hidden messages (steganograms) in network flows. These techniques are binary in that they classify if a flow contains steganograms or not. Moreover, most of these techniques assume the availability flows that do not contain any steganograms as baselines for comparison, an assumption that is hard to hold. A re-embedding steganalysis does not require any baseline, and moreover, it can not only detect the presence of steganograms but also estimate the amount of steganograms. Being able to estimate the amount of steganograms allows a network forensic expert to judge the damage caused by these hidden messages. This paper addresses the question of what statistical metrics might apply for effective re-embedding steganalysis of network traces. It presents an empirical comparison of several statistical metrics in the light of their effectiveness in re-embedding steganalysis.