# Detecting steganography by analysing non-significant data entropy?

I am not thinking only steganography in images, I think it is also possible to encode data for example into the length of spaces of a clear html text.

I suspect, the steganography changes (elevates) the entropy of the non-significant part of the messages.

But:

1. How to detect in the general case, what is "non-significant"?
2. Sometimes the hidden content has also a low entropy, while "clean" content can have also high.

For (1): Afaik, it is impossible, the only possibility would be to use some application-level decoding and interpretation.

For (2): I think, there is (should be) some type of correlation between the entropy (complexity) of non-significant part and the significant part of the carrier content, too. Some type of uncommon deviation could be maybe detected.

Does such technique, algorithm already exist?

• I don't think what you are asking is possible in general. A good steganographic algorithm could make the hidden content have similar entropy as the "empty" non-significant content, simply by compressing and/or expanding the stored data.
– otus
Sep 12 '15 at 18:42
• @otus 1) That is right, but some other parameters could be maybe also examined in this case. 2) Even if the problem can't be solved perfectly, some type of "theoretical optimum" could exist with a partial solution. Sep 12 '15 at 19:33
• I have another idea: somehow to measure correlations between the significant and non-significant parts of the message. Sep 16 '15 at 3:23

• Re. "Entropy is not complexity". The quintessential definition of entropy is complexity for the bulk of science. The entire 2nd law revolves around that and even shares a similar formula measuring it. It also underpins the basis of compressibility theory which is recognised by NIST in multiple randomness tests. One day, we're going to have to sort this out and come up with a correct definition, perhaps using Kolmogorov/algorithmic complexity. It cannot be right that $H(\pi)$ changes depending on a priori /posteriori knowledge. There shouldn't be an epistemological distinction. Jul 21 '19 at 4:47