Effect of different coding patterns on compressed frequency domain based universal JPEG steganalysis

Current steganalytic schemes for JPEG steganography are in favor of extracting features in DCT (Discrete Cosine Transform) domain and/or spatial domain. A recently proposed compressed frequency domain based universal steganalytic algorithm [21] showed concern over the statistics of Huffman compressed stream. The authors claimed that it was very effective in detecting stego images embedded by JPEG steganographic tools, including JPHide, F5 and OutGuess. Even though only several bytes were embedded, the scheme was still able to work, thus demonstrating astonishing steganalysis capability. By carefully controlled studies on the factors which may have impact on the new steganalytic method, we find out the truly cause of the powerfulness of this "payload-independent" steganalyzer. Experimental results reveal that different coding patterns used in cover and stego images, rather than the Avalanche Criterion [24] explained by its authors, have led to great detection efficiency. When the same coding pattern is employed in both cover and stego images, the performance of the newly devised steganalyzer has greatly dropped. Implication from this paper is that we should ensure the difference between the cover and stego images is only caused by data embedding itself in steganography and steganalysis.