I encourage anyone interested in this to read about Peter Wayner's Mimic Functions.[1]
From the abstract:
A mimic function changes a file A so it assumes the statistical
properties of another file B. That is, if p(t,A) is the
probability of some substring t occuring in A, then a mimic
function f, recodes A so that p(t,f(A)) approximates p(t,B) for
all strings t of length less than some n. This paper describes
the algorithm for computing mimic functions and compares the
algorithm with its functional inverse, Huffman coding. It also
provides a description of more robust mimic functions which can
be defined using context-free grammars.
Using mimic functions, one could mimic spam or any other text (or non-text, for that matter) corpus.
The two main challenges are deciding which statistical properties one wants to mimic (for an adversarial steganalyst's mind is not always readily available for perusal) and then actually mimicking them. In other words, it's easier said than done.
From the abstract:
Using mimic functions, one could mimic spam or any other text (or non-text, for that matter) corpus.The two main challenges are deciding which statistical properties one wants to mimic (for an adversarial steganalyst's mind is not always readily available for perusal) and then actually mimicking them. In other words, it's easier said than done.
[1] - http://www.nic.funet.fi/pub/crypt/old/mimic/mimic.text