We propose a model of an integral classifier in order to solve the problem of binary steganalysis by means of machine-learning tools more efficiently. The problem of binary steganalysis consists in recognizing whether a given container is empty or contains a certain payload embedded via a certain steganographic algorithm. In steganalysis, such problem is often solved using such machine-learning techniques as the support vector machine and the ensemble classifier. Instead of using a single classifier (as it is done now) which is intended to make an ultimate decision about whether the container is empty or not, the proposed in this paper integral classifier consists of several classifiers and works in such a way that each of them processes only those containers which satisfy a certain condition. Within the proposed model, we develop a compression-based integral classifier which works as follows. The training set of classifiers is splitted into several subsets according to the containers compression rate; then a corresponding number of classifiers are trained, but each classifier is injected only with an ascribed subset. The testing containers are distributed between the classifiers (also according to their compression rate) and the decision about the certain container is made by the chosen classifier. In order to demonstrate the power of the integral classifier, we performed some experiments using the famous de-facto standard images database BOSSbase 1.01 as a source of the containers along with contemporary content-adaptive embedding algorithms HUGO, WOW and S-UNIWARD. Comparison with state-of-the-art results (obtained for the single support vector machine and the ensemble classifier) demonstrated that, depending on the case, the integral classifier allows to decrease the detection error by 0.05-0.16.

We introduce a new approach to steganalysis called "the tentative filtering" and consisting in inserting an additional filtering phase before the final classification in order to select those containers where stego-information can be reliably detected. The size of this "good" subset of containers can be considered as an additional characteristic of the detector. We introduce three methods for implementing the tentative filtering: the naive method, the simple classification, and the combined classification. The experiments demonstrate that it is possible to select about 35% of BOSSbase v1.01 images, for which HUGO 0.4 bpp is detected with the error less than 0.003, while the error over the whole set is 0.141. It is also demonstrated that it is possible to select about 5% images, for which HUGO 0.1 bpp is detected with the error less than 0.05, while the whole set gives the error 0.37 (which is not quite a reliable detection).

Efficient statistical tests, e.g. recently suggested “Book Stack” test, are successfully applied to detect deviations from randomness in bit sequences generated by stream ciphers such as RC4 and ZK-Crypt, as well as by block cipher RC6 (with reduced number of rounds). In case of RC6 a key recovery attack is also mounted. The essence of the tests is briefly described. The experiments data are provided.

The algorithms submitted to the ECRYPT Stream Cipher Project (eSTREAM) were tested using the recently suggested statistical test named “Book Stack”. All the ciphers except ZK-Crypt have passed the tests. The paper briefly describes the essence of the test. Computer implementation of the test in C++ language is supplied.

We address the problem of detecting deviations of binary sequence from randomness,which is very important for random number (RNG) and pseudorandom number generators (PRNG). Namely, we consider a null hypothesis H0 that a given bit sequence is generated by Bernoulli source with equal probabilities of 0 and 1 and the alternative hypothesis H1 that the sequence is generated by a stationary and ergodic source which differs from the source under H0. We show that data compression methods can be used as a basis for such testing and describe two new tests for randomness, which are based on ideas of universal coding. Known statistical tests and suggested ones are applied for testing PRNGs. Those experiments show that the power of the new tests is greater than of many known algorithms.

A new attack (called “gradient statistical”) on block ciphers is suggested and experimentally investigated. We demonstrate the possibility of applying it to ciphers for which no attacks are known except for the exhaustive key search.

We suggest and experimentally investigate a method to construct forecasting algorithms based on data compression methods (or the so-called archivers). By the example of predicting currency exchange rates we show that the precision of thus obtained predictions is relatively high.

In this paper, we show that a universal code is used for randomness testing. In contrast to known methods, the suggested approach gives a possibility to make a test for randomness, basing on any lossless data compression method even if a distribution law of the codeword lengths is not known. Secondly, we describe two new tests, conceptually connected with universal codes