89_数字取证高级技术：隐写术检测与数据隐藏识别实战指南——从LSB分析到统计异常的全面取证方法

# Linux系统
apt-get update
apt-get install stegdetect

# 从源码编译
git clone https://github.com/abeluck/stegdetect.git
cd stegdetect
./configure
make
make install

# 基本检测
stegdetect image.jpg

# 指定检测算法
stegdetect -t pbm,outguess,lsb,steghide image.jpg

# 设置敏感度(1-10)
stegdetect -s 9 image.jpg

# 批量检测
stegdetect *.jpg

image.jpg: outguess confidence=99%

# 启动StegSpy
stegspy

java -jar StegExpose.jar

# 查看完整元数据
exiftool suspicious.jpg

# 查找异常元数据
exiftool -a -u -g1 suspicious.jpg

# 安装
pip install stegdetectgui

# 启动
stegdetectgui

# 创建测试图像
convert -size 500x500 gradient:red-blue cover.jpg

# 使用steghide嵌入秘密信息
steghide embed -cf cover.jpg -ef secret.txt -p password

stegdetect -s 9 stego.jpg

stego.jpg: steghide confidence=97%

import cv2
import numpy as np
import matplotlib.pyplot as plt

# 读取图像
img = cv2.imread('stego.jpg')

# 提取LSB平面
def extract_lsb_plane(image):
    return image & 1

# 提取RGB各通道的LSB平面
lsb_planes = []
for i in range(3):
    lsb_plane = extract_lsb_plane(img[:,:,i])
    lsb_planes.append(lsb_plane)

# 显示LSB平面
plt.figure(figsize=(15, 5))
colors = ['R', 'G', 'B']
for i in range(3):
    plt.subplot(1, 3, i+1)
    plt.imshow(lsb_planes[i], cmap='gray')
    plt.title(f'LSB Plane {colors[i]}')
plt.show()

import cv2
import numpy as np

def chi_square_detection(image_path, alpha=0.05):
    # 读取图像
    img = cv2.imread(image_path, cv2.IMREAD_GRAYSCALE)
    
    # 计算卡方统计量
    hist = cv2.calcHist([img], [0], None, [256], [0, 256])
    chi_square = 0
    
    for i in range(0, 255, 2):
        if i + 1 < 256:
            sum_val = hist[i] + hist[i+1]
            if sum_val > 0:
                expected_even = sum_val / 2
                expected_odd = sum_val / 2
                chi_square += ((hist[i] - expected_even)**2 / expected_even) + ((hist[i+1] - expected_odd)**2 / expected_odd)
    
    # 自由度为127（256/2-1）
    df = 127
    
    # 临界值（近似，实际应查表）
    critical_value = 156.509  # 对应alpha=0.05
    
    return chi_square > critical_value

# 测试图像
is_stego = chi_square_detection('suspicious.jpg')
print(f"隐写检测结果: {'存在隐写' if is_stego else '未检测到隐写'}")

# 尝试使用steghide提取
steghide extract -sf suspicious.jpg -p ""

# 尝试使用outguess提取
outguess -r suspicious.jpg extracted.txt

# 使用Sonic Visualiser分析
sonic-visualiser suspicious.wav

import numpy as np
import scipy.io.wavfile as wav
import matplotlib.pyplot as plt

def audio_lsb_detection(wav_path):
    # 读取音频文件
    rate, data = wav.read(wav_path)
    
    # 提取LSB
    lsb = data & 1
    
    # 计算LSB变化率
    changes = np.sum(np.abs(np.diff(lsb)))
    change_rate = changes / len(lsb)
    
    # 绘制LSB分布图
    plt.figure(figsize=(10, 6))
    plt.subplot(2, 1, 1)
    plt.plot(data[:1000])
    plt.title('音频波形')
    plt.subplot(2, 1, 2)
    plt.plot(lsb[:1000])
    plt.title(f'LSB平面 (变化率: {change_rate:.6f})')
    plt.tight_layout()
    plt.show()
    
    # 变化率大于0.1通常表示存在隐写
    return change_rate > 0.1

# 检测音频隐写
has_stego = audio_lsb_detection('suspicious.wav')
print(f"音频隐写检测结果: {'存在隐写' if has_stego else '未检测到隐写'}")

# PDF隐写检测
pdf-parser --stats suspicious.pdf

# Office文档检测
officeparser suspicious.docx

# 分析网络流量
wireshark -r capture.pcap

# DNS隧道检测
dns-tunnel-detector -f capture.pcap

import numpy as np
from sklearn.model_selection import train_test_split
from sklearn.svm import SVC
from sklearn.metrics import classification_report
from skimage.feature import graycomatrix, graycoprops

def extract_features(image_path):
    # 读取图像
    img = cv2.imread(image_path, cv2.IMREAD_GRAYSCALE)
    
    # 计算灰度共生矩阵
    glcm = graycomatrix(img, [1], [0, np.pi/4, np.pi/2, 3*np.pi/4], symmetric=True, normed=True)
    
    # 提取纹理特征
    features = []
    for prop in ['contrast', 'dissimilarity', 'homogeneity', 'energy', 'correlation', 'ASM']:
        features.extend(graycoprops(glcm, prop).ravel())
    
    # 添加统计特征
    features.append(np.mean(img))
    features.append(np.std(img))
    features.append(np.median(img))
    
    return features

# 训练SVM分类器
def train_steg_detector(X_train, y_train):
    clf = SVC(kernel='rbf', C=1.0, gamma='scale')
    clf.fit(X_train, y_train)
    return clf

# 使用模型检测
clf = train_steg_detector(X_train, y_train)
prediction = clf.predict([extract_features('suspicious.jpg')])

import tensorflow as tf
from tensorflow.keras.models import Sequential
from tensorflow.keras.layers import Conv2D, MaxPooling2D, Flatten, Dense, Dropout

def create_steg_detector_model(input_shape):
    model = Sequential([
        Conv2D(32, (3, 3), activation='relu', input_shape=input_shape),
        MaxPooling2D((2, 2)),
        Conv2D(64, (3, 3), activation='relu'),
        MaxPooling2D((2, 2)),
        Conv2D(128, (3, 3), activation='relu'),
        MaxPooling2D((2, 2)),
        Flatten(),
        Dense(128, activation='relu'),
        Dropout(0.5),
        Dense(1, activation='sigmoid')
    ])
    
    model.compile(optimizer='adam',
                  loss='binary_crossentropy',
                  metrics=['accuracy'])
    
    return model

# 创建并训练模型
model = create_steg_detector_model((128, 128, 3))
model.fit(X_train, y_train, epochs=20, batch_size=32, validation_split=0.2)

# 预测
result = model.predict(np.expand_dims(preprocess_image('suspicious.jpg'), axis=0))
print(f"深度学习检测结果: {'存在隐写' if result > 0.5 else '未检测到隐写'} (置信度: {result[0][0]:.4f})")