Known-stego Attack in Steganalysis

Defeating Anti-Forensics Techniques
Answer Correct answer: C — Original and stego-object are available and the steganography algorithm is known.

In Steganalysis, which of the following describes a Known-stego attack?

  1. The hidden message and the corresponding stego-image are known
  2. During the communication process, active attackers can change cover
  3. Original and stego-object are available and the steganography algorithm is known Correct Answer
  4. Only the steganography medium is available for analysis

Community Votes

C
50%
A
50%

50% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The exam tests the distinction between attack models in steganalysis; the common trap is confusing 'known-stego' (where the algorithm is known) with 'chosen-stego' or simply having access to the message.

This question defines a Known-stego attack in steganalysis, where the analyst possesses both the original cover object and the stego-object to analyze the embedding method. It establishes that option C is the correct answer based on standard forensics definitions.

Many learners select A, incorrectly believing that knowing the hidden message is the primary requirement for a known-stego attack, whereas the definition focuses on the availability of the objects and the algorithm.

Community Discussion (4 comments)

044f354 👍 1 Selected: A
Answer: A. The hidden message and the corresponding stego-image are known Explanation: A. The hidden message and the corresponding stego-image are known: Correct – Known-stego attack requires both the stego-image and the hidden message. B. During the communication process, active attackers can change cover: Incorrect – Describes active attacks, not known-stego. C. Original and stego-object are available and the steganography algorithm is known: Incorrect – Describes a chosen-stego attack. D. Only the steganography medium is available for analysis: Incorrect – Describes a blind or stego-only attack.
aqeel1506 👍 1
The correct answer is A. The hidden message and the corresponding stego-image are known. In Steganalysis, a Known-stego attack is a scenario where the analyst has access to both the hidden message (the secret information) and the corresponding stego-image (the image with the hidden message). This allows the analyst to compare the two and potentially identify the steganography method used. Here's a brief overview of the other options: B. This describes an Active attack, where the attacker can modify the cover object (e.g., image) during communication. C. This describes a Known-cover attack, where the original cover object and the stego-object are available, and the steganography algorithm is known. D. This describes a Blind attack, where only the steganography medium (e.g., image) is available for analysis, without any knowledge of the hidden message or cover object.
Elb 👍 1 Selected: C
The attacker knows the steganography algorithm as well as original and stego-object.
Elb 👍 1
Known-stego Attack In this attack, the attacker knows the steganography algorithm as well as original and stego-object. Therefore, the attacker can extract the hidden information using the information at hand.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

A Known-stego attack occurs when the analyst has access to the original cover object, the resulting stego-object, and crucially, knowledge of the steganography algorithm used. This allows for precise analysis of how the data was embedded. Option C accurately reflects this scenario by stating that the original and stego-object are available and the algorithm is known.

Why the Other Options Are Wrong

Option A describes a scenario where the hidden message is known, which is more akin to a chosen-message or specific extraction context but doesn't define the 'known-stego' model itself as comprehensively as C. Option B describes an active attack modifying the cover, which is unrelated to the static analysis of known parameters. Option D represents a blind attack where only the stego-medium is present, lacking the necessary context for a known-stego classification.

Community Comment Notes

The community is divided, with some users arguing for A because they associate 'known' with the message content. However, expert consensus and forensic literature prioritize the algorithm and object pair. As one commenter noted, "The attacker knows the steganography algorithm as well as original and stego-object," which aligns with option C.

Exam Strategy

When studying steganalysis attacks, focus on the specific assets available to the attacker: the cover, the stego, the message, and the algorithm. Memorize which combination defines each attack type (Blind, Known-Cover, Known-Stego).

Frequently Asked Questions

What is the difference between Known-stego and Blind steganalysis?

In Known-stego, the analyst has the original cover, stego object, and algorithm. In Blind steganalysis, only the stego object is available, requiring detection without prior knowledge.

Why isn't knowing the hidden message enough for Known-stego?

Knowing the message alone doesn't reveal the embedding technique. Known-stego specifically requires knowledge of the algorithm used to embed the data into the cover object.

More 312-49v10 FAQ →

Related Analysis

Files stored in the Recycle Bin in its physical location are

A-Grade

A Computer Hacking Forensics Investigator (CHFI) has been as

S-Grade

What operating system would respond to the following command

S-Grade

← Back to 312-49v10 Study Guide