Detection of stegosystems using block ciphers for encryption of the embedded messages

We consider firstly stegosystems in which the embedded messages are encrypted preliminary by any block cipher in a codebook mode. Detection of stegosystems presence is performed if the number of the repeated extracted blocks exceeds of some given threshold. Experiments demonstrate that if the embedding data are meaningful text and extraction algorithm is known for the attacker, then a distinguishing between stego and cover objects occur very reliable even for matrix embedding with very small rate. If the embedding data are known for attacker then it is used attack based on a calculation of mutual information between message and the encrypted data with application of k-nearest neighbor distance. Experiments show that for not very strong ciphers with block length at most 32 bits this attack is successful.