Detecting Steganography
The Detect workflow provides a lightweight heuristic analysis for images and WAV files. It is designed to: 1. search for a Stegodon header
2. compute LSB-based statistics
3. estimate a rough suspicion level
Important Limitation
Detection is heuristic.
A positive finding is not absolute proof, and a low suspicion score does not prove a file is clean.
Detection Workflow
- Choose an image or WAV file.
- Click Run analysis.
- Review the findings and bar indicators.
Detection Outputs
Stegodon reports:
- file type
- whether a Stegodon header was found
- LSB statistical values
- an overall suspicion label
Possible labels are:
- Low
- Medium
- High
Header Discovery
Before running heuristics, Stegodon attempts to find a valid Stegodon header.
If a header is found, the file is very likely a Stegodon carrier.
If no header is found, the file may still contain hidden data created by other tools or methods.
Image Detection
For images, Stegodon computes:
- per-channel LSB chi-square p-values for R, G, and B
- a pairs-of-values heuristic
- an overall suspicion estimate
LSB chi-square p-values
The code compares even and odd histogram counts across each color channel.
Higher p-values can indicate a flatter LSB distribution, which may be consistent with LSB replacement.
Pairs-of-values heuristic
The detector measures how equalized neighboring value pairs become:
(0,1)(2,3)(4,5)- and so on
A more equalized distribution can be a sign of LSB embedding.
WAV Detection
For WAV files, Stegodon computes:
- a chi-square p-value based on zero/one LSB counts
- a transition-based proxy heuristic
- an overall suspicion estimate
The transition-based measure is a rough signal and should be treated as heuristic only.
How Suspicion Scores Are Combined
Images
Stegodon combines:
- average per-channel uniformity
- pairs-of-values score
Approximate weighting:
- 60% uniformity
- 40% pairs-of-values
WAV
Stegodon combines:
- uniformity score
- transition-based proxy
Approximate weighting:
- 60% uniformity
- 40% proxy
When Detection Works Best
Detection tends to work best on:
- lossless image formats such as PNG
- unedited carriers
- PCM WAV audio
- files using simple LSB replacement patterns
When Detection Is Less Reliable
Detection becomes noisier or less useful on:
- JPEG images
- heavily edited images
- recompressed or normalized audio
- very small payloads
- randomized payload placement
- unusual carrier content
Interpreting Results
Header found
This is the strongest signal that a Stegodon payload exists.
High suspicion without header
This can mean:
- another LSB-based method was used
- the file has unusual statistical properties
- the file has been modified
- the heuristic produced a false positive
Low suspicion
This does not prove absence of steganography.
Recommended Usage
Use Detect as an initial screening tool, not as a final forensic conclusion.
If you need certainty, combine detection with:
- controlled extraction attempts
- known workflow validation
- file provenance analysis
- deeper forensic inspection
Updated 7 days ago