This paper presents a hybrid approach for steganographic embedding and detecting information within audio and graphical containers, utilizing statistical analysis and neural networks. This study establishes the feasibility of employing auto-associative networks for steganographic synthesis and the Cumulative Sum (CUSUM) algorithm for identifying structural changes introduced by hidden content. A comparative analysis evaluates its effectiveness against other methods, including the Least Significant Bit (LSB) technique and the short-time Fourier Transform Combined with a Deep Neural Network (STFT-DNN). The findings demonstrate the superiority of the proposed hybrid architecture in terms of detection accuracy, Bit Error Rate (BER), and peak Signal-to-Noise Ratio (PSNR). Furthermore, the research investigates the efficacy of combined steganography analysis algorithms designed to operate under limited a priori information conditions and high container variability. The results underscore the significant potential of integrating machine learning and statistical modeling to develop intelligent digital security systems to counter hidden threats, protect copyright, and detect manipulative content in the contemporary information environment.
The rapid proliferation of digital technologies and the corresponding growth of multimedia content, particularly graphic and audio files, have escalated threats related to confidential information leakage, covert data exchange, and copyright infringement. In this context, steganographic methods, which involve embedding messages within digital media, are becoming critically important as tools for ensuring information security. Audio and graphic files serve as effective containers for hidden information due to their large capacity, inherent signal redundancy, and the insensitivity of human perception to minor distortions, facilitating the effective masking of embedded data.
However, traditional steganographic methods, such as least significant bit (LSB) substitution, discrete cosine transform (DCT), and discrete wavelet transform (DWT), exhibit limited resilience against modern steganalysis techniques. Moreover, classical statistical approaches are often insufficient for detecting complex or adaptive forms of hidden data, especially under conditions of active digital monitoring. In response to these limitations, current research is focused on developing hybrid methods that integrate statistical analysis with deep learning algorithms, such as autoencoders, convolutional neural networks (CNNs), recurrent neural networks (RNNs), and generative adversarial networks (GANs).
These intelligent models facilitate the creation of embedded structures that replicate the natural statistics of the host container, thus minimizing artifacts detectable by conventional steganalysis. Autoencoders, for instance, generate a latent representation of the message, allowing data to be embedded without significantly altering the signal. Similarly, Generative Adversarial Network (GAN) models can produce containers that carry hidden information and maintain a statistical distribution consistent with the original media. Conversely, modern steganalysis employs classifier ensembles, change-detection algorithms (e.g., PCA or SVM), and deep neural detectors. These detectors are trained on contrasting examples of authentic and steganographic files, enabling them to identify modified containers even when the embedded signal is faint.
In the context of digital censorship and evolving cyber threats, the primary requirements for effective steganographic systems include the undetectability of transmission, accuracy of message reconstruction, resilience to attacks and distortions (such as JPEG compression or noise), and adaptability to various media types. Integrating statistical estimation and neural network processing is pivotal for achieving a higher steganography analysis and synthesis standard. For instance, statistical indicators such as mean, variance, and correlation coefficients can be employed to assess the vulnerability of specific regions within an image or audio file to steganographic embedding [1, 2]. Concurrently, neural network components are utilized for the actual data insertion or detection, ensuring an optimal balance between embedding efficiency and imperceptibility [3, 4].
This study uses statistical and neural network algorithms to analyze modern hybrid methods for embedding and detecting hidden information within graphic and audio files. The primary focus is on intelligent models capable of robustly encoding hidden data, even when subjected to digital attacks or censorship filters. The paper proposes a steganographic system architecture comprising modules for statistical evaluation, neural network-based container generation, deviation analysis, and Explainable AI (XAI) for interpreting and identifying hidden features. The system was evaluated on open audio and graphic datasets, using PSNR, SSIM, BER, and AUC/ROC as performance metrics for steganalysis. The results demonstrate that these hybrid methods outperform traditional models in accuracy and detection resistance.
Consequently, integrating statistical and neural network algorithms for steganographic synthesis and analysis presents significant potential for developing flexible, adaptive, and reliable information protection systems in the rapidly evolving digital landscape. The applications for such systems extend beyond privacy protection to include digital watermarking, cybersecurity, anticensorship measures, and secure data storage.
In modern steganography research, deep learning methods are being actively implemented to
enhance information concealment and detection efficiency. Specifically, Pham Huu Quang et al. [
In 2019, Felix Kreuk et al. [
This study employed a comprehensive approach to the steganographic synthesis and analysis of hidden information within audio and graphic files, leveraging methods from mathematical statistics, probabilistic modeling, and decision theory. This framework facilitated the development of generalized mathematical models for embedding and detecting hidden messages. These models account for both the structural characteristics of the host container and the parameters of external influences, such as digital noise, distortions, and compression.
Artificial neural networks constitute the core of the software implementation, enabling automatic feature extraction and the adaptive processing of complex media signals. Specific network architectures were selected based on the media type: autoencoders were employed for steganographic data compression and recovery tasks; convolutional neural networks (CNNs) were utilized for graphic files, where preserving the spatial correlation of pixels is crucial; and recurrent neural networks (RNNs), particularly Long Short-Term Memory (LSTM) variants, were applied to audio signals, which are characterized by a sequential temporal structure.
All algorithms were implemented using object-oriented programming principles, ensuring a flexible and modular system design that facilitates code reusability and scalability. Comprehensive testing was conducted to validate the performance of the developed models. This evaluation included statistical assessment methods, such as error analysis and detection probability calculations, and simulation modeling within a variable digital environment. The simulations incorporated various real-world conditions, including the addition of noise, re-encoding, and truncation of media file fragments.
The experimental results confirmed that integrating statistical methods and neural network algorithms enables high-accuracy detection of hidden information, even in significant noise or aggressive digital interference with the host containers. Furthermore, this combined approach provides adaptability to various media data formats and types, a feature of critical importance in real-world applications such as digital watermarking, secure message storage, and covert data transmission under censorship or information blockade. 4.
As cyber threats escalate and digital communications face increasing scrutiny, steganography is
becoming an essential tool for covert data transmission. In contrast to cryptography, which
obscures the content of a message, steganography conceals the existence of the communication
itself, a critical feature for circumventing surveillance and censorship. Consequently, integrating
neural networks and statistical methods into steganographic systems is a rapidly advancing area of
research, significantly enhancing the efficiency of embedding and detecting information within
audio and graphical containers [
The paper presents a mathematical model of a stego system and discusses approaches to stego
synthesis and stego analysis, particularly using autoassociative, convolutional, and feed-forward
neural networks [
Fig. 1 shows the architecture of a two-component neural system for steganography: model (a)
implements the embedding of messages in a container vector with minimal distortion using a
twolayer auto-associative network [
In digital steganography, there is a growing interest in intelligent models that facilitate both
adequate concealment and accurate detection of information embedded within digital containers.
This encompasses steganographic synthesis (the embedding of hidden data) and steganalysis (the
detection of hidden content), which are increasingly implemented using artificial neural networks
of various architectures [
The effectiveness of embedding and recovering hidden data is quantified using several digital
signal quality metrics. The Peak Signal-to-Noise Ratio (PSNR) measures the degree of container
distortion after message embedding [
Fig. 2 illustrates the architecture of a neural network designed for the steganographic
embedding and subsequent analysis of audio and image files. The model comprises an input layer, a
hidden layer with g neurons, and an output layer that yields the modified container and the
recovered message. This core structure is augmented by several specialized modules: a steganalysis
module for performance evaluation using PSNR, SSIM, and BER metrics; a cryptographic module
responsible for encryption, key management, and integrity verification; and an Explainable AI
(XAI) module that utilizes methods such as SHAP and LIME for decision interpretation [
The signal supplied to the input of a neural network that implements steganographic
information synthesis (SIS) can be represented as a combined vector [
T y 1=( z 1 , z 2 , … , z n ,0 , … ,0 )T , y 2=( 0 , … ,0 , d 1 , … , d m )T , (2) (3) where d = { d 1 , … , d m } is a vector containing the elements of the message to be hidden.
In the case of hiding a complete message, which forms a data sequence d ( p ), p =1 , … , P , each of
its elements corresponds to a separate fragment of the container described by the vector z ( p ),
where p =1 , … , P [
The neural network is trained using a back-propagation algorithm to minimize the Mean
Squared Error (MSE) between the original message and the reconstructed data extracted from the
modified container. This approach provides practical steganographic synthesis, especially in
processing audio signals and graphic files with high dimensionality and complex structure [
However, modern steganalysis can detect even minor deviations in the statistical characteristics of the signal resulting from modifications during embedding. In particular, analyzing residual noise, spectral density, and local entropy allows you to form features sensitive to hidden content. Neural network steganalysers trained on a large number of examples of both clean and modified containers demonstrate a high ability to classify such embeddings. In this regard, testing for resistance to such attacks is necessary to evaluate the effectiveness of any steganography method.
To analyze the regularities of the steganographic information synthesis (SIS) process, within the
framework of the proposed approach, a statistical model of the container is considered, according
to which each fragment of the container is considered as a realization of a random vector z , with
zero mathematical expectation and a known correlation operator [
E [z ]=0 , E [z z T ]= Rz .
The elements of the sequence of the embedded message d are modeled as independent realizations of a binary random variable d i, which does not depend on the container z and has an equal probability distribution:
P ( d i =1 )=0.5 , P ( d i =−1 )=0.5 , E [d i ]=0 , E [d i2]=σ 2d =1. (5)
The statistical representation of the container z and the message d allows us to estimate the
effect of the embedded information on the signal distribution, which is critical for imperceptible
embedding without significantly changing the correlation characteristics [
The neural network is trained on a set of realizations of the input vector: y ( p )=( z ( p )
d ( p ) ) , p =1 , … , P , by minimizing the mean square functional of the recovery error:
E = 1 P
∑ ( y ( p )−W 2 W 1 y ( p ) )T ( y ( p )−W 2 W 1 y ( p ) ) ,
P p=1
(4)
(6)
(7)
where W 1 and W 2 weight matrices of the neural network [
The neural network for SIS functions as an intelligent encoder that learns to embed the message
d ( p ) into the structure of the container z ( p ) with minimal distortion and ensuring reliable
extraction [
The auto-associative architecture minimizes distortion and residual traces, preserving the
features of the container and balancing between secrecy and quality [
However, these properties make a container (a multimedia file containing hidden information) vulnerable to deep steganalysis, detecting hidden messages by analyzing statistical and structural changes in data. Such analysis focuses on detecting minor changes resulting from steganographic embedding, even if they are subtle visually or acoustically, but manifest themselves in highdimensional feature spaces (i.e., in many statistical signal characteristics).
For this purpose, spectral filtering methods are used (analysis of the frequency components of the signal, for example, using a discrete cosine or Fourier transform), PCA (Principal Component Analysis), which allows to detect changes in the internal structure of data by reducing their dimensionality, and anomaly detection methods (i.e., algorithms that look for unusual or atypical deviations from the expected behavior of data).
Particular attention is paid to changes in the distributions of auto-encoder residuals, which are the differences between the input and the reconstructed signal in an auto-encoder (a neural network that learns to compress and reconstruct data). If these residuals show systematic deviations, it can serve as an indicator of hidden content.
Thus, even if masking (i.e., hiding information) is performed using an auto-associative architecture (an auto-encoder that learns to reproduce itself), it still needs to be tested for resistance to modern steganalysis algorithms—otherwise, there is a risk of detecting a hidden message even in a complex multimedia environment.
As a result of the theoretical analysis, the following statement has been proved: the
transformation performed by a linear two-layer auto-associative neural network (Fig. 1a) trained
according to the criterion of minimizing the mean square error is equivalent to the use of a linear
operator [
W = Ryn Ry+n =W 2 W 1 , (8) where Ryn is the singular (degenerate) matrix formed based on the sample covariance matrix between the input data y ( p ), Ry+n is its pseudo-inverse matrix in the Moore-Penrose sense, q is the number of neurons in the hidden layer, m +n −q is the number of discarded (zeroed) eigenvalues in the diagonalization process.
Thus, the neural network implements the optimal linear mapping with compression, preserving
the statistically significant components of the vector y , which includes the container z and the
message d [
The neural network (Fig. 1a) is fed with test signals that model hypothetical states of a hidden
message [
The output of the neural network generates vectors y + and y –, which can be represented as: where m± is the mathematical expectation (average values) of the useful signal that corresponds to the hypotheses about the value of the hidden bit.
Next, to assess the impact on the structure of the container, we analyze the covariance matrix of the output signal (only the first n components corresponding to the container vector z ), when a random vector y x =( z 1 , z 2 , … , z n ,0 )T is applied. To do this, the matrix is calculated: ~ R =W 2 W 1 Ry W 1T W 2T , z =α m++( 1−α ) m–+η , where Ry is the covariance matrix of the input signal. The block part ⋀ z, is extracted from it, which corresponds to the submatrix for the container.
As a result, the output signal can be represented as:
where α =1 for d =1, α =0 for d =−1, and η is a fluctuating noise that models the residual content
of the container [
To recover the hidden bits, it is necessary to perform a binary classification: to determine which class a vector z belongs to based on the mathematical expectations m+ and m–, in the presence of noise with a known covariance matrix ⋀ z. The neural network identifies the message bits by comparing the signal with the typical built-in states.
In steganalysis, the classification task is reduced to the implementation of an ML equation
(maximum likelihood rule) that formalizes the optimal solution: to determine whether the
container contains a “+1” or “–1” bit. A neural network trained on the differences between m+ and
–
m , acts as a stego-decoder. To do this, we use a network (Fig. 1b) that implements ML
classification. With Gaussian noise, the solution is as follows:
(10)
(11)
where R is the noise covariance matrix [
The expression determines the error probability when recovering the bits of a hidden message:
P err= P ( H 1 )+ P ( H 2 )=1−Φ ( α ) , α =0.5 ∙ ( m+−m– )T R−1 ( m+−m– ) ,
(13)
where Φ ( α ) is the probability function of the standard normal distribution [
The probability of erroneous bit recognition, as defined by Eq. (13), serves as a key indicator of decoding accuracy under conditions of uncertainty. Minimizing this probability indicates highquality embedding and robust resilience to attacks, even when an adversary possesses partial knowledge of the container or the embedding methodology. Utilizing a linear neural network reduces the embedded message’s amplitude relative to the training phase, thereby minimizing container distortion without sacrificing decoding accuracy—a critical factor for ensuring stealth.
To evaluate the system’s robustness, a series of typical steganalysis attacks was modeled,
including the introduction of noise, signal clipping, spectral modifications, and compression.
Experiments simulating an active adversary with knowledge of the embedding technique
confirmed the system’s high level of imperceptibility when the decoder is configured correctly.
Attacks employing alternative network architectures proved ineffective, primarily due to the
challenges of data sampling and the extensive training time required, which significantly
complicates reverse engineering efforts [
For stable model training and high accuracy, preliminary signal normalization is recommended.
High-resolution and lossless formats, such as BMP, TIFF, and PNG for graphics, and WAV or FLAC
for audio, are ideally suited for this purpose. In an experiment using 24-bit PNG images, a linear
neural network achieved a bandwidth of 0.3 bits per pixel while maintaining a PSNR greater than
50 dB, a visually imperceptible distortion level [
Fig. 3 illustrates the logical framework for evaluating the robustness of a neural network-based steganography method. The process commences with selecting a host container (either an audio or image file) into which the neural network embeds data. Subsequently, the system is subjected to simulated steganalysis attacks, including introducing noise, cropping, and compression, as well as modeling the actions of an active adversary. Following an attempted decoding of the embedded data, the accuracy and throughput of the system are evaluated. Its parameters are systematically adjusted if the attack fails to disrupt the message. The influence of the embedded signal’s amplitude is also analyzed, and the entire procedure is iterated for various container types to ensure comprehensive validation.
Fig. 4 illustrates the architecture of a system designed for steganographic synthesis and analysis using neural networks. It comprises distinct modules for container formation, data embedding, attack simulation, message decoding, and performance evaluation. The neural network training module is a key component that adapts the system to the specific media type being processed (audio or graphics). The interaction between these modules facilitates a comprehensive testing cycle to evaluate the system’s robustness against various steganalysis attacks.
Fig. 5 illustrates the sequence of operations within the steganographic experiment, detailing the interaction logic among the system’s modules. The process begins with the researcher defining the experimental parameters, after which a host container (audio or graphic) is prepared and the message is embedded. Subsequently, the container is subjected to simulated steganalysis attacks, such as the introduction of noise, cropping, and compression. The decoding module then attempts to extract the embedded data. Finally, key performance metrics—accuracy, PSNR, and efficiency— are automatically recorded and compiled into a report for subsequent analysis.
This study introduces a hybrid algorithm for detecting steganographic embeddings, which
combines the neural network-based reconstruction of a container’s inherent statistical structure
with the parametric monitoring of any resulting changes [
Theoretical studies prove the convergence of the network weights, which guarantees the
accuracy of the forecast and the formation of a profile of normal behavior [
In the context of steganography, detecting the fact of embedding hidden information is
formalized to fix the moment of statistical imbalance in the analyzed digital sequence [
Contemporary research, particularly the work of Michel Basseville and Alexander Tartakovsky
[
The formula for the accumulated statistics is as follows: where [ x ]+=max ( 0 , x ), g t is the value of CUSUM at step t , h is the threshold for deciding whether there are changes in the model, t a is the moment of fixing the imbalance, na is the number of steps from the last reset of g t to fixation.
The threshold h ( t ) is determined dynamically: h ( t )=C + ln ln ( t )+2 ln ( ln ln ( t ) ) , (16) where C is an empirically selected constant that considers the trade-off between sensitivity and false alarms.
In the context of steganalysis, the cumulative sum (CUSUM) algorithm is utilized to monitor the
statistical stability of a digital signal [
The work of the neural network algorithm for detecting steganographic embedding includes
three main stages [
In steganalysis, even a simple neural network can detect hidden embeddings effectively [
The input influence matrix is defined as [
Y = { y 1 , y 2 , … , y N −S } , y i =( s i , s i+1 , … , s i+S −1 ) , (14) (15) (17) where S is the length of the sliding window, si is the signal values can be either primary data (pixels, samples) or secondary features (histograms, entropy, etc.).
The output of the neural network is a vector of predicted values, which is described by a vector
autoregressive (VAR) equation of the following form:
where t =S , S +1 , … , N and W j are the weighting matrices of the neural network that realize the
passage of the input signal y t − j, A is the vector of bias in the neurons, ηt is the vector of prediction
error, with a mathematical expectation of zero and an unknown covariance matrix Rη. The
parameters W j and A are determined in the process of training the neural network on the
reference set. In the context of steganography, this equation allows modeling the expected
behavior of a digital container without embedded data, creating a reference predictive model [
To detect steganographic embedding, we analyze the root mean square error of predicting the
vector y t based on a neural network trained on “clean” containers. A sudden increase in this error
signals the possible insertion of hidden information, which is recorded using the cumulative sum
statistic [
Fig. 6 outlines the process for detecting steganographic embeddings within audio or image files using a neural network. Initially, the network is trained on a dataset of unmodified (“clean”) containers to establish a baseline model of their natural statistical properties. Subsequently, a new container is analyzed using a sliding window methodology. An input vector is formed within each window, the network predicts the subsequent signal element, and the root mean square error between the expected and actual values is computed. The cumulative sum (CUSUM) algorithm is activated if this prediction error exceeds a predetermined threshold. The CUSUM algorithm then accumulates these errors to identify statistically significant deviations, thereby signaling a potential hidden embedding.
Fig. 7 illustrates the mean square error (MSE) dynamics generated by the neural network’s signal prediction. For the initial 50 samples, corresponding to the unmodified portion of the container, the MSE remains consistently low. However, immediately after the point of steganographic embedding, a sharp increase in the MSE is observed. This spike signifies a change in the signal’s statistical properties and is registered as an indicator of steganographic modification.
The comparative evaluation is conducted under the key assumption that none of the methods possesses a priori information regarding the concealment technique. This condition ensures an objective assessment of the versatility and effectiveness of the hybrid NN+CUSUM approach in detecting the presence of steganography, regardless of its specific implementation. Within this framework, steganalysis is predicated on analyzing statistical deviations from the original signal’s properties, which are recorded using the cumulative sum algorithm—a sensitive tool for change detection. When combined with a neural network that establishes an adaptive baseline profile of normal signal behavior, this methodology facilitates the detection of even subtle embeddings. This hybrid approach minimizes false positive and false negative rates when identifying hidden content. Notably, testing on independent datasets has demonstrated superior performance in scenarios where the type of steganographic method or its parameters is available.
The proposed method achieves superior performance, demonstrating the highest accuracy (93.8%), the lowest bit error rate (1.5%), and the highest peak signal-to-noise ratio (PSNR) of 50.2 dB. These results confirm the hybrid system’s superiority over traditional and contemporary methods.
Figure 8 presents a comparative analysis of five steganalysis methods across three key performance metrics: detection accuracy (%), bit error rate (BER, %), and peak signal-to-noise ratio (PSNR, dB). The proposed hybrid method, which integrates a neural network with the CUSUM algorithm, exhibits the highest detection accuracy (93.8%), the lowest BER (1.5%), and a superior PSNR of 50.2 dB. In contrast, the classical Least Significant Bit (LSB) method yields markedly inferior results, while other modern approaches, including StegoHound and the STFT-based DNN, demonstrate comparatively lower efficacy. These findings underscore the advantages of integrating statistical analysis with neural networks for developing robust and covert steganographic systems.
1 ∑i ε 2t , j .
MSE t = l j =1 g t =( 0 , g t −1+ MSE t − μ 0−δ ) , where y t −i is the input vector, W i is the neural network weight matrices, A is the shift vector, S is the sliding window length.
After the model is formed, the current value is predicted and the error is calculated:
These values are fed into the CUSUM algorithm, which accumulates deviation statistics using
the formula [
A violation is recorded if the accumulated statistics exceed the threshold g t ≥ h. (21) (22) The start and end of exposure are recorded under the following conditions: t start=arg g t >0 , t end =arg g t =0. (23)
To enhance the effectiveness of the analysis, secondary characteristics can be used, in particular, the, χ 2 is test for analyzing lower bits: where O i is the number of observations, E i are expected values.
False alarm probability assessment:
, P FA ( h )= P ( g t ≥ h ∨ H 0 ) .
E [τ −t 0 ∨ τ >t 0 ]→ min , (24) (25) (26) where τ is the moment of fixation, t 0 is the actual start time of the steganographic impact.
The proposed model demonstrates high accuracy in detecting and localizing hidden information, effectively adapting to conditions of a priori uncertainty. The model facilitates the precise identification of embedding boundaries by integrating neural network processing with classical statistical control. Formalized quality metrics, including delay time and false alarm probability, validate its suitability for implementation in real-world steganographic systems.
This paper details the architecture and implementation of a software framework for embedding and detecting hidden information within graphic and audio containers. The core of the system, implemented in C++, integrates classical steganographic methods with proprietary algorithms to form a multi-layered system for steganography, steganalysis, and neural network modeling. Particular attention is given to the steganalysis module, which employs a hybrid feature set comprising spectral coefficients, residual noise patterns, and neural network activations. This approach enables the system to detect hidden information even when sophisticated concealment techniques are used to preserve high visual or acoustic fidelity. Furthermore, integrating a trained neural network facilitates the dynamic adaptation of detection thresholds according to the container type and level of distortion. This methodology demonstrates high efficacy in test scenarios and is suitable for the automated verification of multimedia content integrity.
The analytical component of this framework is based on the combined application of statistical and structural steganalysis methods. It integrates several techniques, including detecting autoregressive model imbalances, comparing file service block signatures, and using the χ² (chisquared) criterion for analyzing the least significant bits of graphic and audio signals. Support for various formats, including BMP, PNG, GIF, JPEG, MP3, WAV, HTML, and TXT, ensures its versatility. A key feature of this approach is integrating these classical methods with a multilayer perceptron (MLP), which performs signal prediction and anomaly detection.
To support model training independently of external machine learning frameworks, a proprietary library was developed that enables the creation and training of MLPs, featuring flexible parameterization and an adaptive gradient descent algorithm.
To validate its effectiveness, modules were developed to simulate standard concealment techniques, including least significant bit (LSB) modification, pseudo-random data dispersion, context-aware embedding, and variable embedding densities. In experiments conducted on BMP files with embedding densities up to 25%, a detection accuracy exceeding 90% was achieved, with a Type II error rate below 1%. Integrating statistical and neural network approaches enabled the detection of even randomly distributed embedded data. Furthermore, the CUSUM algorithm identifies the onset and duration of statistical violations, thereby accurately localizing the embedded segments. This research culminates in an autonomous system capable of detecting hidden messages in digital media without prior knowledge of the embedding algorithm. Its efficacy has been confirmed across various graphic and audio file formats, and the system’s architecture is extensible for future applications in reverse analysis and digital forensics.
The graph in Fig. 9 presents the results of an experimental study on the dependence of steganographic detection effectiveness on the threshold value, h, in the CUSUM algorithm. The data illustrate that as h increases, the False Negative Rate decreases significantly; however, beyond a certain point, this is accompanied by a gradual increase in the False Positive Rate. The highest detection accuracy is achieved when an optimal balance is struck between these two error rates, which guides the selection of the ideal threshold, h, for the steganalysis system.
Fig. 10 presents a data flow diagram (DFD) illustrating a steganographic system that integrates a neural network with the cumulative sum (CUSUM) algorithm for detecting hidden information within digital containers. The process is initiated when a user uploads a container to the “Analyze Container” module, which passes the data to the “Predict Signal” block. The neural network then computes the prediction error between the expected and actual signal values. These errors are subsequently analyzed by the “Compute CUSUM Statistics” module to identify statistically significant deviations.
Subsequently, the Decision Module determines the presence of hidden data; the outcome is recorded in the Result Log and conveyed to the user. Additionally, the system utilizes a reference database of unmodified containers (the Clean Container Database) and an “Embed Hidden Data” module to simulate various embedding scenarios. This architecture supports a comprehensive operational cycle, from generating steganographic containers to detecting hidden content, and is adaptable to audio and graphic data.
During steganalysis, the system compares the characteristics of the container under investigation with baseline statistics from the Clean Container Database, a process that enables the detection of even minimal deviations. A multifactorial analysis is conducted to enhance accuracy, incorporating prediction residuals, spectral features, and neural network responses obtained during the modeling phase.
The final determination by the Decision Module is based on an integrated metric that aggregates the outputs from multiple detection algorithms. Consequently, the system provides highly accurate detection of hidden information, independent of the specific steganography algorithm.
The results of this study confirm the high efficacy of a hybrid approach for steganographic embedding and detection. This approach integrates neural network modeling with a statistical change-detection algorithm, specifically the Cumulative Sum (CUSUM) method. This synergy allows the system to account for the deep structural features of the media container, as modeled by the artificial neural network, while simultaneously identifying anomalous deviations through the statistical accumulation of probabilistic features. Compared to traditional methods such as Least Significant Bit (LSB) substitution, chi-squared (χ²) analysis, or simple histogram comparison, the proposed system demonstrates markedly superior performance. This is evident in its enhanced accuracy of hidden message detection and improved key quality metrics, including a lower Bit Error Rate (BER) and a higher Peak Signal-to-Noise Ratio (PSNR).
The proposed hybrid scheme, which integrates auto-associative neural networks for constructing an adaptive latent embedding space with the CUSUM algorithm for detecting deviations in temporal or spatial signal structures, demonstrated superior performance over other contemporary methods. These include the Short-Time Fourier Transform with Deep Neural Network (STFT-DNN) approach and StegoHound, a prominent image steganalysis system. Key advantages of this integrated methodology include the high-fidelity preservation of the host container, robustness against common attacks such as JPEG compression and noise addition, and enhanced adaptability achieved through a flexible embedding process that conforms to the container’s intrinsic characteristics.
A key innovation of this work is the integration of Explainable Artificial Intelligence (XAI) mechanisms, specifically through the application of tools such as SHAP (SHapley Additive exPlanations) and LIME (Local Interpretable Model-agnostic Explanations). This integration enables the system to automatically detect hidden messages and provide visual interpretations for its classification decisions, thereby significantly enhancing the model’s transparency. This feature is particularly valuable in fields such as digital forensics, where evidence-based explanations for system outputs are a critical requirement.
The developed architecture is modular and scalable, allowing for adaptation to various multimedia container formats—including PNG, JPEG, WAV, MP3, and FLAC—and resilience against different types of interference, such as noise attacks, re-encoding, clipping, and signal transformations. The flexibility of this implementation facilitates the independent updating of system components, enabling changes to the embedding strategy, the integration of new detector types, or connection with real-time stream processing tools.
Nevertheless, several limitations must be considered for practical implementation. These include the significant computational load imposed on processors and graphics accelerators, particularly during the model training phase, and the system’s sensitivity to the quality of the input data. Specifically, data artifacts, unstable sampling, or unrepresentative examples can adversely affect detection accuracy. Therefore, future work will focus on expanding the system to incorporate transfer learning, enabling the reuse of pre-trained models in novel contexts, and integrating federated learning to enhance data confidentiality and facilitate distributed model training without centralized data collection.
The primary advantage of the proposed method is its adaptability to diverse digital environments. This quality ensures the adequate concealment of transmitted information, high detection accuracy, configurational flexibility for various containers, and the capacity for selflearning and automatic adaptation. These characteristics provide a foundation for developing a new generation of steganographic systems capable of operating within a highly dynamic digital environment characterized by an escalating number of attacks and a growing demand for solution transparency.
This paper proposes a steganographic embedding method that integrates neural network modeling with statistical monitoring. A multilayer perceptron architecture was selected as the optimal framework for concealing and detecting information, based on its balance of accuracy, adaptability, and noise immunity. A statistical embedding model was developed that considers key container characteristics - such as type, bit depth, and signal distribution—with BMP, PNG, and WAV formats identified as optimal for achieving the best performance. A steganalysis module was implemented to evaluate the method’s effectiveness by comparing the characteristics of original and modified containers. Specifically, this module analyzes spectral features, residual noise patterns, and histogram alterations that indicate a potential embedding. The neural network model adapts to these statistical changes by learning to differentiate between typical and anomalous signal variations. This integrated approach ensures high accuracy in detecting hidden information, even within complex multimedia environments. The convergence of the neural network’s weight coefficients during the approximation of autoregressive models is established, ensuring the creation of a baseline profile for normal signal behavior. A hybrid detection algorithm is proposed, which integrates neural network-based prediction with cumulative sum (CUSUM) statistics, enabling the precise identification of an embedding’s onset and duration. This approach allows for detecting hidden information by analyzing deviations between the predicted and actual signal values, without prior knowledge of the specific steganography method employed. The CUSUM algorithm effectively identifies the cumulative signal structure changes characteristic of steganographic modification. When combined with an adaptive neural network, this technique facilitates the detection of the concealment itself and the estimation of its temporal or spatial localization within the data.
A software framework was developed using the Borland C++Builder 6.0 environment to implement this method. This system supports the processing of graphic and audio files, accommodates various embedding schemes (including LSB and hybrid approaches), and integrates statistical and neural network algorithms. In experiments conducted on BMP files with an embedding density of 25%, the system achieved a detection accuracy exceeding 90% with an error rate of less than 1%.
The proposed method demonstrates high efficacy in detecting hidden data and is well-suited for applications in digital forensics, multimedia stream protection, and content integrity verification. Future development will focus on integrating deep learning architectures, support for additional formats, and incorporating Explainable AI (XAI) to interpret detected anomalies. This will facilitate the creation of transparent steganalysis systems, wherein model decisions are justifiable through key signal features. The integration of deep convolutional or recurrent neural networks will enhance the capability for real-time detection of hidden content in streaming data. Furthermore, extending support to modern formats such as HEIF, FLAC, and WebP will broaden the method’s applicability in contemporary media environments. Consequently, this approach has the potential to form the basis for a new generation of adaptive digital security systems characterized by a high degree of trustworthiness and automation.
While preparing this work, the authors used the AI programs Grammarly Pro to correct text grammar and Strike Plagiarism to search for possible plagiarism. After using this tool, the authors reviewed and edited the content as needed and took full responsibility for the publication’s content. [1] B. Zhurakovskyi, et al., Processing and analyzing images based on a neural network, in:
Cybersecurity Providing in Information and Telecommunication Systems, 3654, 2024, 125–136. [2] V. Dudykevych, et al., Detecting deepfake modifications of biometric images using neural networks, in: Cybersecurity Providing in Information and Telecommunication Systems (CPITS), 3654, 2024 391–397. [3] B. Bebeshko, et al., Application of game theory, fuzzy logic and neural networks for assessing risks and forecasting rates of digital currency, J. Theor Appl. Inf. Technol. 100(24) (2022) 7390– 7404. [4] K. Khorolska, et al., Application of a convolutional neural network with a module of elementary graphic primitive classifiers in the problems of recognition of drawing documentation and transformation of 2D to 3D models, J. Theor. Appl. Inf. Technol. 100(24) (2022) 7426–7437.