An Intelligent Forensic Framework for Hybrid Crypto Steganographic Image Analysis

Abstract

Hybrid crypto-steganography involves embedding a hidden message within random voice, which is often encrypted, making it very hard to detect without analysing the second-order statistics of the image’s pixels or known tool signatures. This paper presents a multi-modal forensic steganalysis framework, that systematically reveals the subtle artefacts created by the encrypt-then-hide pipeline. The framework extracts twenty-six features, classified in five complementary forensic domains: pixel-domain regularities features, colour channel cross-correlation features, the Laplacian noise-residual moments, Grey-Level Co-occurrence Matrix texture descriptors and, for the first time in an open source detector, explicit encryption block signatures features including 128-bit windowed LSB entropy and autocorrelation at the AES block boundary. A self-calibrating anomaly detector calculates the mean absolute Z-score of those signals relative to a ”clean” reference baseline, yielding an easy-to-explain suspicion score, without requiring Labeled data or pre-trained models. The system is coded and tested in Python with a benchmark of clean and OpenStego created stego images with AES encrypted payload. Experimental results show that the framework can effectively detect stego images that are missed by existing tools using a single domain, such as StegExpose or StegSpy, while having a low false positive rate for clean images. The output is transparent and includes a complete feature set which allows forensic examiners to recognize the grounds for suspicion in the material, and in doing so, much of the gap between academic steganalysis and practical digital investigation is bridged. To the best of the authors’ knowledge, the proposed framework is the first publicly available tool dedicated to detecting hybrid cryptographic steganographic embedding in a unique manner by combining some new image statistics with some encryption aware new features.