Continually refining and developing of new techniques that can evade detection and hide malicious activity create new challenges for security teams of government services as well as private corporations. Despite of development the advanced network security systems for early detection and preventing the sensitive information leakages, the task of reliable detection and destruction of hidden messages (stegodata) in cover files, such as digital images, does not have common solution yet. It has been proposed the effective algorithms for revealing the stegodata, embedded in cover images spatial or spectral domains according to widespread steganographic methods. These algorithms are based on comprehensive analysis of cover image noise components for disclosing the traces, left by message embedding. Recently proposed advanced embedding methods, i.e. multistage and multidomain algorithms, allow significantly weakening mentioned traces due to usage of several cover components for stego image forming. Therefore it is required modernization of known detection methods as well as new approaches development for high-accuracy revealing the stego data, embedded in various domain of cover image. The thesis is devoted to solving the theoretical and practical problem of reliable stego image detection irrespectively of cover image domains, where stegodata have been hidden. To deal with this challenge there was proposed to take into consideration not only cover noise component changes, caused by message hiding, but also alteration of images multilevel structure, includes textures, object's contours and intrinsic noise. For detection the mentioned alteration it was developed the multicomponent image model. Based on structural analysis methods - variogram, fluctuation and multifractal analysis - there were created the fast algorithms for estimation statistical, correlation and fractal characteristics of digital images as well as its components, corresponded to the textures, object's contours and intrinsic noise. Investigation of stego images, formed according to multistage and multidomain embedding methods, with usage of developed model and estimation algorithms revealed the significant distortion of correlation (N, S and R parameter, spectrum of generalized Hurst exponent) as well as fractal (width/spread of multifractal spectra) characteristic of cover image components, caused by message hiding. Integration of proposed digital image model and developed estimation algorithms gives opportunity to create the universal (blind) stegdetectors. Results of comparative analysis the known and developed stegdetector confirmed the high effectiveness of proposed solution in the most complicated cases - weak cover image payload (less than 10%) and low energy of hidden messages. For discerning the type of embedding method it was developed generalized (multiclass) stegdetector, which takes into account not only the magnitude of image statistical, correlation and fractal characteristic's changes by message embedding, but also the distortion patterns. It gives opportunity to determine the cover image transformation type as well as cover payload and embedded message energy. Results of evaluation the proposed multiclass stegdetector confirmed the high detection accuracy for wide range of embedding methods - probability of misclassification does not exceed 5% even in low cover payload case. Proposed detection methods and universal stegdetectors were integrated into software package, which can be used as part of modern intrusion detection systems as well as independent software product.
