Cross-Algorithm Steganalysis via Dual-Domain Feature Fusion: A Hybrid Deep Learning Approach for Payload Detection

Cross-Algorithm Steganalysis via Dual-Domain Feature Fusion: A Hybrid Deep Learning Approach for Payload Detection | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article Cross-Algorithm Steganalysis via Dual-Domain Feature Fusion: A Hybrid Deep Learning Approach for Payload Detection Jayaprakash V, Hariharaviswanathan P, Anitha M This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8449298/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract Stegware refers to malware payloads concealed within benign multimedia files that exploit weaknesses in traditional detection systems. This paper presents a hybrid deep learning framework called Hybrid StegNetA, designed for payload centric steganalysis with enhanced cross algorithm generalization. Five baseline architectures including CNN, RNN, ResNet, GAN, and Autoencoder were comparatively evaluated on stego images generated via LSB Matching, DCT/DWT, and Spread Spectrum techniques. The proposed model integrates residual learning and frequency domain encoding to isolate embedding noise from semantic content. Experimental results on a balanced CIFAR based dataset demonstrate improved stability, achieving consistent AUC ranging from 0.50 to 0.54 and minimal cross family variance of 0.0012, significantly outperforming ResNet which exhibited a cross family variance of 0.0028. The model maintains robust detection capability across four distinct steganographic families: LSB1, LSB3, Pixel Pair Matching, and Parity encoding. These results confirm that dual domain feature fusion enhances algorithm invariant payload detection capability and establishes a foundation for generalized stegware interception in dynamic threat environments. Deep learning malware detection neural net- works steganalysis steganography stegware Figures Figure 1 Figure 2 Figure 3 Figure 4 I. INTRODUCTION The central challenge in digital security lies in the ongoing struggle between information hiding and information detection, represented by steganography and steganalysis. Through steganography, harmful data can be embedded inside everyday images shared online, making the hidden content difficult to identify. These concealed communication paths often escape detection by many cybersecurity methods, especially those relying on fixed rules or signature–based scanning. Stegware's stealthiness is accomplished using encoding techniques that modify an image's structure subtly and nonlinearly without changing how it looks. While transform domain techniques like discrete cosine transform or discrete wavelet transform embedding change frequency components to disguise data, LSB approaches subtly adjust pixel values within the spatial domain, producing changes that are typically invisible to human vision. Despite the differences in technique, the common objective is to maintain visual quality while distributing hidden information in a manner that is statistically undetectable. Many existing steganalysis models struggle to generalize because their performance is tied too closely to the embedding methods used during the training phase. Their accuracy drops significantly when facing low payload conditions or previously unseen algorithms. This limitation emphasizes the necessity for detection systems that can operate reliably across different embedding schemes. To address these challenges, a Hybrid Deep Learning Architecture is proposed. The model is designed to separate embedding noise from the original visual content through a dynamic multi stage framework. The system improves its capacity to identify a variety of dynamic concealment strategies by concentrating on the leftover artifacts brought about by steganographic operations. Experiments comparing the suggested architecture to industry-leading benchmark models show that it performs better, showing increased stability, enhanced robustness, and constant accuracy across a range of embedding techniques and payload intensities. This strategy provides a more thorough defense against stegware in contemporary cybersecurity settings. II. LITERATURE SURVEY Recent work by Alanoud m almhlbdi et al. aims to detect and classify LSB-based steganographic payloads in images [ 1 ]. It employs deep learning models, including CNN, CNN-GRU, CNN-LSTM, and ViT. Testing across 32,000 icon samples containing five distinct payload categories revealed that the recurrent-enhanced CNN variant achieved 0.98 classification accuracy. Results show resizing harms detection performance. A key limitation is restricted generalization to other steganography methods and datasets. Donghui Hu and his team proposed a coverless steganography approach built on DCGANs to generate images that inherently encode hidden data. [ 2 ]. It maps information into noise vectors, uses a trained generator to create stego images, and employs a CNN-based extractor for recovery. Experiments on CelebA and Food101 show high extraction accuracy and strong resistance to steganalysis. The study is constrained by imperfect recovery, small image size, and occasional unnatural outputs. Khan Farhan Rafat and collaborators introduced a reversible and more secure variation of LSB steganography [ 3 ]. It uses hashed-stegokey–driven random LSB modification, dual-copy embedding, channel permutation, and XOR-based reconstruction to ensure confidentiality and reversibility. Experiments on the SET12 grayscale dataset show high PSNR, strong imperceptibility, and resistance to steganalysis. Notable constraints are higher computational cost, reliance on grayscale images, and sensitivity to post-processing operations. Yongzhi wang explored embed data into videos so that the hidden information survives down sampling during thumbnail generation [ 4 ]. It uses adaptive block selection, motion-based embedding, and robust transform-domain modification. Experiments on large video sets show high payload recovery even after resizing and compression. Results indicate improved resilience compared to prior methods. Constraints include reduced capacity, higher computation, and weaker robustness under aggressive transcoding. Nandhini Subramanian and co-authors surveyed recent developments in spatial, transform-based, and deep learning image steganography [ 5 ]. It analyzes methods based on embedding strategy, robustness, and detectability. Using summarized findings from multiple datasets such as BOSSBase and ImageNet, the study highlights improvements in imperceptibility and security. Challenges include lack of standard evaluation benchmarks, inconsistent datasets across works, and limited focus on cross-domain generalization. Wen Juan and colleagues explored linguistic steganalysis through a model that merges semantic, lexical, and structural language cues [ 6 ]. It uses an attention-based neural architecture combining character-level, word-level, and sentence-level representations. Experiments on linguistic steganography datasets show high detection accuracy across multiple embedding schemes. Results outperform traditional statistical baselines. Reliance on sizable labeled corpora, susceptibility to hostile text rewriting, and diminished performance on low-resource languages are some of its drawbacks. Couple of authors aimed to improve JPEG steganalysis using a CNN that integrates non-linear pre-processing, channel-spatial attention, and spatial pyramid pooling [ 7 ]. It enhances weak stego signals in the spatial domain and extracts hierarchical discriminative features. Tests on standard JPEG datasets demonstrate superior detection accuracy compared to HuangNet and SRNet. This approach has a few drawbacks, including higher model complexity, dependence on decompression artifacts, and reduced effectiveness on unseen embedding schemes. A collaborative study to improve image steganography by enhancing embedding capacity and imperceptibility [ 8 ]. It employs a modified multiway pixel-value differencing (PVD) method using non–power-of-two quantization ranges and randomized bit embedding. Experiments on grayscale image datasets show higher embedding rates and good image quality undetectable by RS steganalysis. Results outperform existing multiway PVD methods. A few issues with this approach are higher computational complexity and limited validation on color images. Soumik Mondal et al. addressed develop a robust steganalysis framework using hybrid deep learning [ 9 ]. It integrates handcrafted features with a residual U-Net–based convolutional architecture named H-StegoNet. Experiments on BOSS and BOWS2 datasets demonstrate superior detection accuracy and reduced overfitting compared to prior models. Results validate strong generalization across payload variations. Limitations include the need for paired cover–stego data and heavy computational demands during training. Al-Rawashdeh investigated enhance the imperceptibility, capacity, and robustness of image steganography [ 10 ]. It combines edge detection (Canny/Sobel) with a CNN-based embedding and extraction model to hide data in image edge regions. Experiments on Ting ImageNet, BOSSbase, and USC-SIPI datasets achieve PSNR up to 39.85 dB and SSIM up to 0.997, ensuring resistance to steganalysis. The work is subject to certain limitations such as high computational cost and dependence on edge-detection precision. Rini wisnu wardhani and collaborative researchers aims to advance steganalysis using a hybrid classical deep learning–quantum framework [ 11 ]. It integrates EfficientNet CNN with quantum convolutional neural networks for enhanced image classification accuracy. Experiments on the ALASKA2 dataset yield 97% detection accuracy, outperforming conventional deep learning models. Results highlight improved robustness and efficiency. Key drawbacks of the approach are reliance on quantum simulators, scalability issues, and restricted access to real quantum computing hardware. Jian Ye et al. aims to perform image steganalysis using a unified deep learning framework [ 12 ]. It introduces a CNN initialized with high-pass SRM filters and employs a truncated linear unit activation to capture weak stego signals. Experiments on the BOSSbase dataset show higher detection accuracy than SRM and maxSRMd2 models across multiple payloads. Results confirm CNN effectiveness for feature learning. Deployment barriers are high training complexity and limited adaptability to unseen schemes. III. DATASET DESCRIPTION The experimental framework utilized a subset of the CIFAR collection, specifically processing 60,000 RGB samples at 32×32 resolution. [ 13 ]. For this work, 50,000 images were used for training and 10,000 for testing. To create a controlled steganographic dataset, CIFAR-10 images as shown in Fig. 1 served as high-quality cover images, while stego images were generated using four embedding algorithms: Simple Spatial Domain LSB, Robust Spatial Variant LSB, Pixel Pair Matching (PPM) Adaptive Steganography, and Parity Encoding. Payloads were embedded at varying rates of 1, 0.3, and 0.25 bits per pixel to simulate real-world hiding scenarios with different data densities. A custom dataset, termed StegaCIFAR v1.0 [ 14 ], was developed to include both benign and malicious samples. The malicious samples consisted of simulated malware payloads designed solely for static detection experiments. These harmless scripts printed a payload banner and exited, ensuring complete safety and ethical compliance. The different version samples are shown in Fig. 2 . To maintain uniformity, the dataset was structured so that cover and stego samples were represented in equal proportions. Each steganographic algorithm contributed an equal number of samples to maintain algorithmic diversity. All images were standardized into a consistent format and verified for visual integrity using error and quality metrics, ensuring that the embedded payloads remained imperceptible to the human eye. This preprocessing pipeline produced a high-fidelity dataset with strong visual consistency and controlled embedding conditions. The resulting dataset enables cross-algorithm generalization and serves as a robust foundation for training and evaluating the proposed hybrid deep learning steganalysis model. IV. PROPOSED METHODOLOGY The proposed methodology integrates both spatial and frequency domain feature learning to enhance image steganalysis accuracy and generalization. The workflow and system architecture are designed to ensure modularity, reusability, and performance transparency. The overall process flow is illustrated in Fig. 4 , while the detailed system architecture is presented in Fig. 3 . The input pipeline processes CIFAR-10 imagery—60,000 samples at 32×32×3 RGB resolution divided into 50,000 training and 10,000 validation partitions.The dataset is normalized to the range [0, 1], divided into batches of 64, and shuffled for unbiased learning. Following data loading, the Preprocessing Module embeds hidden payloads into cover images using a Steganographic Encoder. Several embedding techniques, such as Least Significant Bit (LSB) and spatial variant algorithms, are used to simulate diverse steganographic conditions. To enhance model robustness, data augmentation (including rotation, flipping, and scaling) is performed. A Quality Validator ensures that augmented and encoded images maintain perceptual fidelity. This module guarantees a consistent, high-quality input set for the subsequent stages of analysis. The frequency-domain extractor captures spectral patterns that change when hidden information is embedded into the image. [ 15 ]. A Transform Module, implemented using NumPy or SciPy, applies the Discrete Cosine Transform (DCT) to isolate frequency coefficients. This operation highlights subtle distortions in the spectral domain that arise from steganographic operations. Subsequently, an Autoencoder Network, designed using Keras or PyTorch, learns compressed latent representations of these transformed coefficients. The autoencoder captures deviations in frequency distributions that differentiate stego images from natural covers. This component enhances the model’s sensitivity to frequency-domain irregularities that often remain undetected by spatial filters. At the same time, the spatial feature module analyzes fine-grained pixel patterns to detect irregularities caused by embedding. [ 16 ]. A Convolutional Neural Network (CNN) architecture, implemented in PyTorch or TensorFlow, is used to extract spatial features through a sequence of convolutional and pooling layers. These layers detect structural and textural inconsistencies, such as noise residuals or pixel anomalies, introduced embedding. The CNN thereby provides spatial context that complements the frequency-based representations, forming a dual-domain feature learning framework. Outputs from both feature extractors are integrated in the Feature Fusion Module through a Concatenation Layer that merges spatial and frequency features into a unified vector. This fused representation captures both global spectral behavior and localized spatial distortions. A Dense Neural Network then processes the concatenated features to perform discriminative learning. The Classification Module uses a Sigmoid-activated Output Layer to perform binary classification between cover and stego images. Training is optimized using the Adam Optimizer with binary cross-entropy loss, ensuring efficient gradient propagation and stable convergence. The modular classification design allows for flexible substitution of layers or optimization algorithms in future enhancements. The Evaluation Module quantifies the effectiveness of the proposed framework using standard metrics such as Accuracy, F1-Score, and AUC-ROC. To assess generalization, Cross-Family Variance is measured, indicating robustness against varying embedding families and payload rates. Comparative analysis is conducted against baseline models including CNN, ResNet, RNN, GAN-Discriminator, and standalone Autoencoder architectures. The proposed hybrid design demonstrates improved detection performance and reduced variance across multiple embedding techniques. framework illustrating the sequential process from preprocessing and feature extraction to classification and evaluation. framework illustrating the sequential process from preprocessing and feature extraction to classification and evaluation. V. RESULT AND ANALYSIS The ability of the suggested Hybrid StegNetA model to identify embedded payloads produced by various steganographic techniques was thoroughly tested using the StegaCIFAR v1.0 dataset. The dataset had equal amounts of stego and clean images produced with different payload rates of 1, 0.3, and 0.25 bits per pixel using four embedding families: LSB-1, LSB-3, Pixel Pair Matching (PPM), and Parity Encoding. Five well-known deep learning baselines—CNN, ResNet, RNN, GAN-D, and Autoencoder—were used to compare the model's performance using three main metrics: accuracy, F1-Score, and Area Under the ROC Curve (AUC). TABLE I Comparison of Model Performance (Accuracy / F1 Score / AUC) Across Stegware Families The comparative performance summary is presented in Table I, which demonstrates that Hybrid StegNetA maintained stable performance across all four stego families. While some baseline models (notably ResNet and CNN) showed slightly higher F1-scores for specific algorithms such as LSB-1, their performance fluctuated significantly when tested against other embedding methods[ 17 ]. In contrast, the proposed model-maintained AUC scores between 0.50 and 0.54, showing little variation across multiple embedding methods. This consistency reflects the model’s enhanced cross-algorithm generalization and confirms its ability to learn algorithm-invariant features rather than overfitting to the statistical artifacts of any single embedding scheme. To measure how consistently the model performed across different algorithms, the Cross-Family Variance (CFV) metric was computed. [ 18 ]. Hybrid StegNetA recorded a CFV of 0.0012, substantially lower than ResNet’s 0.0028, confirming superior robustness and uniformity in classification behavior. This low variance indicates that the hybrid feature fusion effectively minimizes algorithm bias, leading to reliable payload detection in diverse steganographic environments. Visualization through t-SNE projections further reinforced this observation. The fused latent representation from the hybrid model exhibited distinct clustering between clean and stego samples, even when the payloads originated from different embedding algorithms. The frequency-domain autoencoder efficiently captured high-frequency perturbations, while the CNN backbone emphasized spatial noise residuals, producing complementary representations that improved discriminability. Hybrid StegNetA's AUC stability and low CFV make it evident that the model prioritizes consistency and adaptability, which are crucial qualities for real-world deployment where unknown or low-payload stego techniques may appear, even though its raw accuracy values seemed moderate when compared to some baselines. The findings support the theory that dual-domain feature fusion improves payload detection performance and robustness to algorithmic changes, indicating that the suggested framework is a viable option for universal stegware interception. VI. CONCLUSION The proposed model Hybrid StegNetA, a hybrid deep learning architecture that integrates spatial-domain convolutional encoding and frequency-domain autoencoding for enhanced cross-algorithm steganalysis. The model is designed to fuse texture-level perturbations with spectral residuals to achieve improved payload detection consistency across diverse embedding algorithms. Preliminary evaluations indicate that the proposed framework can achieve stable performance, with AUC values between 0.50–0.54 and a Cross-Family Variance of 0.0012, suggesting its strong potential for algorithm-invariant behavior compared to existing deep architectures such as ResNet and GAN-based discriminators. Future work will focus on developing and extending the proposed framework in three key directions. First, dynamic payload localization using attention-guided saliency mechanisms will be implemented to identify the specific regions of embedding, improving model interpretability. Second, the architecture will be extended for cross-modal steganalysis, enabling its application to multimedia formats such as audio and video through temporal or 3D convolutional modeling. Third, adversarial training and regularization will be incorporated to enhance robustness against adaptive stegware that leverages generative models to bypass static detection. These developments will transform the proposed concept into a fully functional and scalable steganalysis system capable of serving as a dependable defense layer in modern cybersecurity environments. Declarations Author Contribution H.P. conceived the research idea, designed the methodology, implemented the proposed Hybrid StegNetA model, conducted experiments, analyzed the results, and wrote the manuscript. H.P. also reviewed and approved the final version of the manuscript. Data Availability The datasets used in this study are based on the publicly available CIFAR image dataset. Stego images were generated using standard steganographic methods. The data supporting the findings of this study are available from the corresponding author upon reasonable request. References Almhlbdi, Alanoud & Altowairqi, Norah & Alshutayri, Areej & Qarout, Rehab. (2025). Deep Learning-Based Multi-Class Detection of LSB Steganography in Digital Images.. IEEE Access. PP. 1-1. 10.1109/ACCESS.2025.3628784. Hu, D., Wang, L., Jiang, W., Zheng, S., & Li, B. (2018). A novel image steganography method via deep convolutional generative adversarial networks. IEEE access, 6, 38303-38314. Rafat, K. F., & Sajjad, S. M. (2024). Advancing reversible LSB steganography: Addressing imperfections and embracing pioneering techniques for enhanced security. IEEE Access. Wang, Y. (2024). Hiding Data within Thumbnail Videos: An Adaptive Downsampling-Resilient Video Steganography Method. IEEE Access, 12, 52963-52977. Subramanian, N., Elharrouss, O., Al-Maadeed, S., & Bouridane, A. (2021). Image steganography: A review of the recent advances. IEEE access, 9, 23409-23423. Wen, J., Deng, Y., Peng, W., & Xue, Y. (2023). Linguistic steganalysis via fusing multi-granularity attentional text features. Chinese Journal of Electronics, 32(1), 76-84. Liu, Q., Ni, J., & Jian, M. (2022, July). Effective JPEG steganalysis using non-linear pre-processing and residual channel-spatial attention. In 2022 IEEE International Conference on Multimedia and Expo (ICME) (pp. 1-6). IEEE. Wu, D. C., Shih, Z. N., & Wu, J. H. (2021). Modified multiway pixel-value differencing methods based on general quantization ranges for image steganography. IEEE Access, 10, 8824-8839. Mondal, S., Ling, Y. S., & Ambikapathi, A. (2021, July). H-stegonet: A hybrid deep learning framework for robust steganalysis. In 2021 IEEE International Conference on Multimedia and Expo (ICME) (pp. 1-6). IEEE Computer Society. Al-Rawashdeh, R., Rahman, M. M., & Niazi, M. (2025). Robust Image Steganography Approach based on Edge Detection Combined with CNN Algorithm. IEEE Access. Wardhani, R. W., Putranto, D. S. C., Ji, J., & Kim, H. (2024). Toward hybrid classical deep learning-quantum methods for steganalysis. IEEE Access, 12, 45238-45252. Ye, J., Ni, J., & Yi, Y. (2017). Deep learning hierarchical representations for imagesteganalysis. IEEE Transactions on Information Forensics and Security, 12(11), 2545-2557. CIFAR-10 and CIFAR-100 datasets. (n.d.). https://www.cs.toronto.edu/~kriz/cifar.html HARIHARAVISWANATHAN P (2025). StegaCIFAR v1.0. IEEE Dataport. https://dx.doi.org/10.21227/c42w-8x53 Li, L., & Wu, J. (2024). Common feature enhancement extraction-based unsupervised adversarial deep transfer learning: A frequency security assessment method for variable renewable energy power systems. CSEE Journal of Power and Energy Systems. He, J., Su, N., He, G., Liao, Y., Yan, Y., Fu, S., ... & Feng, S. (2025). JRVSNet: Joint Representation of Visual and Scattering Features for Ship Detection in Complex-Valued SAR Images. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing. A. Pai, “12 Types of Neural Networks in Deep Learning,” Analytics Vidhya, Feb. 2020. Accessed: May 8, 2025. [Online]. Available: https://www.analyticsvidhya.com/blog/2020/02/cnn-vs-rnn-vs-mlp-analyzing-3-types-of-neural-networks-in-deep-learning/ Dmitriev, A., Trofimov, I., Burnaev, E., & Barannikov, S. (2025). Topological alternatives for Precision and Recall in generative models. IEEE Access. Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8449298","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":566329488,"identity":"2c49c0e1-6967-4e09-a976-733681e31267","order_by":0,"name":"Jayaprakash V","email":"","orcid":"","institution":"Rajalakshmi Engineering College","correspondingAuthor":false,"prefix":"","firstName":"Jayaprakash","middleName":"","lastName":"V","suffix":""},{"id":566329489,"identity":"ce288c95-05ed-456e-8e99-4ccaf14691cc","order_by":1,"name":"Hariharaviswanathan P","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABM0lEQVRIie3QMUvDQBTA8XccXJeDru+Q1q9w5aBkiParJATOpYijg0NESJZQ15RCP0M+QiCYLhXXFgfbxU3IJBlEvQNBhIQ6CubP3XDwfhw8gK6uP1i/dx3XnsRhvxcCIDjmcgAPgIT2NCSSIsfqwlUiyS3Bw0RutCfSSvvZxrPvLwLQMm/Lp1JxWSjYvuwr5wqPxe39XbYDd5DlNNo1CBKuZWDIkCzOFGKJowWea/OjVllOYtlAKElkYX+hRxoQGZIl8rEhhW9IhA2EUT66McSPRElrfMfJsr+25KOVcMYCkkrtJ8gYigj9BUwtyVsJclpCJV2FXDNHzDCYp5bIQM2LZjJ52kfgveFwsirpI766J+nDerytL08Hs1X83ER+7uJ7wq6KHpo3keoXQ11dXV3/r09WGWbm5RisjQAAAABJRU5ErkJggg==","orcid":"","institution":"Rajalakshmi Engineering College","correspondingAuthor":true,"prefix":"","firstName":"Hariharaviswanathan","middleName":"","lastName":"P","suffix":""},{"id":566329490,"identity":"5f0e8133-57e4-4824-891d-ddad9bcdca13","order_by":2,"name":"Anitha M","email":"","orcid":"","institution":"Rajalakshmi Engineering College","correspondingAuthor":false,"prefix":"","firstName":"Anitha","middleName":"","lastName":"M","suffix":""}],"badges":[],"createdAt":"2025-12-25 13:23:30","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8449298/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8449298/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":99622248,"identity":"ea8489bd-35e2-49b3-bbde-61dba665e423","added_by":"auto","created_at":"2026-01-06 14:29:46","extension":"png","order_by":1,"title":"Figure 1","display":"","copyAsset":false,"role":"figure","size":907270,"visible":true,"origin":"","legend":"\u003cp\u003eCIFAR 10 and 100 dataset\u003c/p\u003e","description":"","filename":"1.png","url":"https://assets-eu.researchsquare.com/files/rs-8449298/v1/8627fc1536dd46c3756305c9.png"},{"id":99622245,"identity":"684437d3-a6cd-41a0-8a3a-f416c2d8ca83","added_by":"auto","created_at":"2026-01-06 14:29:45","extension":"png","order_by":2,"title":"Figure 2","display":"","copyAsset":false,"role":"figure","size":241352,"visible":true,"origin":"","legend":"\u003cp\u003eSample Stegoimages after preprocessing of CIFAR 10 and 100 dataset.\u003c/p\u003e","description":"","filename":"2.png","url":"https://assets-eu.researchsquare.com/files/rs-8449298/v1/04f930ec291f463870f71dbd.png"},{"id":99794777,"identity":"56e67eba-db84-446e-abf0-4a8ae54c7af7","added_by":"auto","created_at":"2026-01-08 13:36:14","extension":"png","order_by":3,"title":"Figure 3","display":"","copyAsset":false,"role":"figure","size":188977,"visible":true,"origin":"","legend":"\u003cp\u003eFlow diagram of the proposed image steganalysis\u003c/p\u003e","description":"","filename":"3.png","url":"https://assets-eu.researchsquare.com/files/rs-8449298/v1/020070d34d9cfc7aa0150d6e.png"},{"id":99794744,"identity":"8f807d59-99b3-47c9-bee0-4b6f6e87a960","added_by":"auto","created_at":"2026-01-08 13:36:09","extension":"png","order_by":4,"title":"Figure 4","display":"","copyAsset":false,"role":"figure","size":97057,"visible":true,"origin":"","legend":"\u003cp\u003eFlow diagram of the proposed image steganalysis\u003c/p\u003e","description":"","filename":"4.png","url":"https://assets-eu.researchsquare.com/files/rs-8449298/v1/685a3e7034b950db62c3ccd9.png"},{"id":99804265,"identity":"64eb53b6-0de4-43dd-9a34-fe4686b7811f","added_by":"auto","created_at":"2026-01-08 14:12:50","extension":"pdf","order_by":0,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":2312341,"visible":true,"origin":"","legend":"","description":"","filename":"manuscript.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8449298/v1/2cdc1143-6bff-4f61-a396-7684f1db1057.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Cross-Algorithm Steganalysis via Dual-Domain Feature Fusion: A Hybrid Deep Learning Approach for Payload Detection","fulltext":[{"header":"I.\tINTRODUCTION","content":"\u003cp\u003eThe central challenge in digital security lies in the ongoing struggle between information hiding and information detection, represented by steganography and steganalysis. Through steganography, harmful data can be embedded inside everyday images shared online, making the hidden content difficult to identify. These concealed communication paths often escape detection by many cybersecurity methods, especially those relying on fixed rules or signature\u0026ndash;based scanning.\u003c/p\u003e \u003cp\u003eStegware's stealthiness is accomplished using encoding techniques that modify an image's structure subtly and nonlinearly without changing how it looks. While transform domain techniques like discrete cosine transform or discrete wavelet transform embedding change frequency components to disguise data, LSB approaches subtly adjust pixel values within the spatial domain, producing changes that are typically invisible to human vision. Despite the differences in technique, the common objective is to maintain visual quality while distributing hidden information in a manner that is statistically undetectable.\u003c/p\u003e \u003cp\u003eMany existing steganalysis models struggle to generalize because their performance is tied too closely to the embedding methods used during the training phase. Their accuracy drops significantly when facing low payload conditions or previously unseen algorithms. This limitation emphasizes the necessity for detection systems that can operate reliably across different embedding schemes.\u003c/p\u003e \u003cp\u003eTo address these challenges, a Hybrid Deep Learning Architecture is proposed. The model is designed to separate embedding noise from the original visual content through a dynamic multi stage framework. The system improves its capacity to identify a variety of dynamic concealment strategies by concentrating on the leftover artifacts brought about by steganographic operations. Experiments comparing the suggested architecture to industry-leading benchmark models show that it performs better, showing increased stability, enhanced robustness, and constant accuracy across a range of embedding techniques and payload intensities. This strategy provides a more thorough defense against stegware in contemporary cybersecurity settings.\u003c/p\u003e"},{"header":"II.\tLITERATURE SURVEY","content":"\u003cp\u003eRecent work by Alanoud m almhlbdi et al. aims to detect and classify LSB-based steganographic payloads in images [\u003cspan citationid=\"CR1\" class=\"CitationRef\"\u003e1\u003c/span\u003e]. It employs deep learning models, including CNN, CNN-GRU, CNN-LSTM, and ViT. Testing across 32,000 icon samples containing five distinct payload categories revealed that the recurrent-enhanced CNN variant achieved 0.98 classification accuracy. Results show resizing harms detection performance. A key limitation is restricted generalization to other steganography methods and datasets.\u003c/p\u003e \u003cp\u003eDonghui Hu and his team proposed a coverless steganography approach built on DCGANs to generate images that inherently encode hidden data. [\u003cspan citationid=\"CR2\" class=\"CitationRef\"\u003e2\u003c/span\u003e]. It maps information into noise vectors, uses a trained generator to create stego images, and employs a CNN-based extractor for recovery. Experiments on CelebA and Food101 show high extraction accuracy and strong resistance to steganalysis. The study is constrained by imperfect recovery, small image size, and occasional unnatural outputs.\u003c/p\u003e \u003cp\u003eKhan Farhan Rafat and collaborators introduced a reversible and more secure variation of LSB steganography [\u003cspan citationid=\"CR3\" class=\"CitationRef\"\u003e3\u003c/span\u003e]. It uses hashed-stegokey\u0026ndash;driven random LSB modification, dual-copy embedding, channel permutation, and XOR-based reconstruction to ensure confidentiality and reversibility. Experiments on the SET12 grayscale dataset show high PSNR, strong imperceptibility, and resistance to steganalysis. Notable constraints are higher computational cost, reliance on grayscale images, and sensitivity to post-processing operations.\u003c/p\u003e \u003cp\u003eYongzhi wang explored embed data into videos so that the hidden information survives down sampling during thumbnail generation [\u003cspan citationid=\"CR4\" class=\"CitationRef\"\u003e4\u003c/span\u003e]. It uses adaptive block selection, motion-based embedding, and robust transform-domain modification. Experiments on large video sets show high payload recovery even after resizing and compression. Results indicate improved resilience compared to prior methods. Constraints include reduced capacity, higher computation, and weaker robustness under aggressive transcoding.\u003c/p\u003e \u003cp\u003eNandhini Subramanian and co-authors surveyed recent developments in spatial, transform-based, and deep learning image steganography [\u003cspan citationid=\"CR5\" class=\"CitationRef\"\u003e5\u003c/span\u003e]. It analyzes methods based on embedding strategy, robustness, and detectability. Using summarized findings from multiple datasets such as BOSSBase and ImageNet, the study highlights improvements in imperceptibility and security. Challenges include lack of standard evaluation benchmarks, inconsistent datasets across works, and limited focus on cross-domain generalization.\u003c/p\u003e \u003cp\u003eWen Juan and colleagues explored linguistic steganalysis through a model that merges semantic, lexical, and structural language cues [\u003cspan citationid=\"CR6\" class=\"CitationRef\"\u003e6\u003c/span\u003e]. It uses an attention-based neural architecture combining character-level, word-level, and sentence-level representations. Experiments on linguistic steganography datasets show high detection accuracy across multiple embedding schemes. Results outperform traditional statistical baselines. Reliance on sizable labeled corpora, susceptibility to hostile text rewriting, and diminished performance on low-resource languages are some of its drawbacks.\u003c/p\u003e \u003cp\u003eCouple of authors aimed to improve JPEG steganalysis using a CNN that integrates non-linear pre-processing, channel-spatial attention, and spatial pyramid pooling [\u003cspan citationid=\"CR7\" class=\"CitationRef\"\u003e7\u003c/span\u003e]. It enhances weak stego signals in the spatial domain and extracts hierarchical discriminative features. Tests on standard JPEG datasets demonstrate superior detection accuracy compared to HuangNet and SRNet. This approach has a few drawbacks, including higher model complexity, dependence on decompression artifacts, and reduced effectiveness on unseen embedding schemes.\u003c/p\u003e \u003cp\u003eA collaborative study to improve image steganography by enhancing embedding capacity and imperceptibility [\u003cspan citationid=\"CR8\" class=\"CitationRef\"\u003e8\u003c/span\u003e]. It employs a modified multiway pixel-value differencing (PVD) method using non\u0026ndash;power-of-two quantization ranges and randomized bit embedding. Experiments on grayscale image datasets show higher embedding rates and good image quality undetectable by RS steganalysis. Results outperform existing multiway PVD methods. A few issues with this approach are higher computational complexity and limited validation on color images.\u003c/p\u003e \u003cp\u003eSoumik Mondal et al. addressed develop a robust steganalysis framework using hybrid deep learning [\u003cspan citationid=\"CR9\" class=\"CitationRef\"\u003e9\u003c/span\u003e]. It integrates handcrafted features with a residual U-Net\u0026ndash;based convolutional architecture named H-StegoNet. Experiments on BOSS and BOWS2 datasets demonstrate superior detection accuracy and reduced overfitting compared to prior models. Results validate strong generalization across payload variations. Limitations include the need for paired cover\u0026ndash;stego data and heavy computational demands during training.\u003c/p\u003e \u003cp\u003eAl-Rawashdeh investigated enhance the imperceptibility, capacity, and robustness of image steganography [\u003cspan citationid=\"CR10\" class=\"CitationRef\"\u003e10\u003c/span\u003e]. It combines edge detection (Canny/Sobel) with a CNN-based embedding and extraction model to hide data in image edge regions. Experiments on Ting ImageNet, BOSSbase, and USC-SIPI datasets achieve PSNR up to 39.85 dB and SSIM up to 0.997, ensuring resistance to steganalysis. The work is subject to certain limitations such as high computational cost and dependence on edge-detection precision.\u003c/p\u003e \u003cp\u003eRini wisnu wardhani and collaborative researchers aims to advance steganalysis using a hybrid classical deep learning\u0026ndash;quantum framework [\u003cspan citationid=\"CR11\" class=\"CitationRef\"\u003e11\u003c/span\u003e]. It integrates EfficientNet CNN with quantum convolutional neural networks for enhanced image classification accuracy. Experiments on the ALASKA2 dataset yield 97% detection accuracy, outperforming conventional deep learning models. Results highlight improved robustness and efficiency. Key drawbacks of the approach are reliance on quantum simulators, scalability issues, and restricted access to real quantum computing hardware.\u003c/p\u003e \u003cp\u003eJian Ye et al. aims to perform image steganalysis using a unified deep learning framework [\u003cspan citationid=\"CR12\" class=\"CitationRef\"\u003e12\u003c/span\u003e]. It introduces a CNN initialized with high-pass SRM filters and employs a truncated linear unit activation to capture weak stego signals. Experiments on the BOSSbase dataset show higher detection accuracy than SRM and maxSRMd2 models across multiple payloads. Results confirm CNN effectiveness for feature learning. Deployment barriers are high training complexity and limited adaptability to unseen schemes.\u003c/p\u003e"},{"header":"III. DATASET DESCRIPTION","content":"\u003cp\u003eThe experimental framework utilized a subset of the CIFAR collection, specifically processing 60,000 RGB samples at 32\u0026times;32 resolution. [\u003cspan citationid=\"CR13\" class=\"CitationRef\"\u003e13\u003c/span\u003e]. For this work, 50,000 images were used for training and 10,000 for testing. To create a controlled steganographic dataset, CIFAR-10 images as shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig1\" class=\"InternalRef\"\u003e1\u003c/span\u003e served as high-quality cover images, while stego images were generated using four embedding algorithms: Simple Spatial Domain LSB, Robust Spatial Variant LSB, Pixel Pair Matching (PPM) Adaptive Steganography, and Parity Encoding. Payloads were embedded at varying rates of 1, 0.3, and 0.25 bits per pixel to simulate real-world hiding scenarios with different data densities.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eA custom dataset, termed StegaCIFAR v1.0 [\u003cspan citationid=\"CR14\" class=\"CitationRef\"\u003e14\u003c/span\u003e], was developed to include both benign and malicious samples. The malicious samples consisted of simulated malware payloads designed solely for static detection experiments. These harmless scripts printed a payload banner and exited, ensuring complete safety and ethical compliance. The different version samples are shown in Fig.\u0026nbsp;\u003cspan refid=\"Fig2\" class=\"InternalRef\"\u003e2\u003c/span\u003e.\u003c/p\u003e \u003cp\u003e \u003cdiv class=\"BlockQuote\"\u003e \u003cp\u003eTo maintain uniformity, the dataset was structured so that cover and stego samples were represented in equal proportions. Each steganographic algorithm contributed an equal number of samples to maintain algorithmic diversity.\u003c/p\u003e \u003cp\u003eAll images were standardized into a consistent format and verified for visual integrity using error and quality metrics, ensuring that the embedded payloads remained imperceptible to the human eye. This preprocessing pipeline produced a high-fidelity dataset with strong visual consistency and controlled embedding conditions. The resulting dataset enables cross-algorithm generalization and serves as a robust foundation for training and evaluating the proposed hybrid deep learning steganalysis model.\u003c/p\u003e \u003c/div\u003e \u003c/p\u003e"},{"header":"IV. PROPOSED METHODOLOGY","content":"\u003cp\u003e \u003cdiv class=\"BlockQuote\"\u003e \u003cp\u003eThe proposed methodology integrates both spatial and frequency domain feature learning to enhance image steganalysis accuracy and generalization. The workflow and system architecture are designed to ensure modularity, reusability, and performance transparency. The overall process flow is illustrated in Fig.\u0026nbsp;\u003cspan refid=\"Fig4\" class=\"InternalRef\"\u003e4\u003c/span\u003e, while the detailed system architecture is presented in Fig.\u0026nbsp;\u003cspan refid=\"Fig3\" class=\"InternalRef\"\u003e3\u003c/span\u003e.\u003c/p\u003e \u003cp\u003eThe input pipeline processes CIFAR-10 imagery\u0026mdash;60,000 samples at 32\u0026times;32\u0026times;3 RGB resolution divided into 50,000 training and 10,000 validation partitions.The dataset is normalized to the range [0, 1], divided into batches of 64, and shuffled for unbiased learning.\u003c/p\u003e \u003cp\u003eFollowing data loading, the Preprocessing Module embeds hidden payloads into cover images using a Steganographic Encoder. Several embedding techniques, such as Least Significant Bit (LSB) and spatial variant algorithms, are used to simulate diverse steganographic conditions. To enhance model robustness, data augmentation (including rotation, flipping, and scaling) is performed. A Quality Validator ensures that augmented and encoded images maintain perceptual fidelity. This module guarantees a consistent, high-quality input set for the subsequent stages of analysis.\u003c/p\u003e \u003cp\u003eThe frequency-domain extractor captures spectral patterns that change when hidden information is embedded into the image. [\u003cspan citationid=\"CR15\" class=\"CitationRef\"\u003e15\u003c/span\u003e]. A Transform Module, implemented using NumPy or SciPy, applies the Discrete Cosine Transform (DCT) to isolate frequency coefficients. This operation highlights subtle distortions in the spectral domain that arise from steganographic operations.\u003c/p\u003e \u003cp\u003eSubsequently, an Autoencoder Network, designed using Keras or PyTorch, learns compressed latent representations of these transformed coefficients. The autoencoder captures deviations in frequency distributions that differentiate stego images from natural covers. This component enhances the model\u0026rsquo;s sensitivity to frequency-domain irregularities that often remain undetected by spatial filters.\u003c/p\u003e \u003cp\u003eAt the same time, the spatial feature module analyzes fine-grained pixel patterns to detect irregularities caused by embedding. [\u003cspan citationid=\"CR16\" class=\"CitationRef\"\u003e16\u003c/span\u003e]. A Convolutional Neural Network (CNN) architecture, implemented in PyTorch or TensorFlow, is used to extract spatial features through a sequence of convolutional and pooling layers. These layers detect structural and textural inconsistencies, such as noise residuals or pixel anomalies, introduced\u003c/p\u003e \u003cp\u003eembedding. The CNN thereby provides spatial context that complements the frequency-based representations, forming a dual-domain feature learning framework.\u003c/p\u003e \u003cp\u003eOutputs from both feature extractors are integrated in the Feature Fusion Module through a Concatenation Layer that merges spatial and frequency features into a unified vector. This fused representation captures both global spectral behavior and localized spatial distortions. A Dense Neural Network then processes the concatenated features to perform discriminative learning.\u003c/p\u003e \u003cp\u003eThe Classification Module uses a Sigmoid-activated Output Layer to perform binary classification between cover and stego images. Training is optimized using the Adam Optimizer with binary cross-entropy loss, ensuring efficient gradient propagation and stable convergence. The modular classification design allows for flexible substitution of layers or optimization algorithms in future enhancements.\u003c/p\u003e \u003c/div\u003e \u003c/p\u003e \u003cp\u003eThe Evaluation Module quantifies the effectiveness of the proposed framework using standard metrics such as Accuracy, F1-Score, and AUC-ROC. To assess generalization, Cross-Family Variance is measured, indicating robustness against varying embedding families and payload rates. Comparative analysis is conducted against baseline models including CNN, ResNet, RNN, GAN-Discriminator, and standalone Autoencoder architectures. The proposed hybrid design demonstrates improved detection performance and reduced variance across multiple embedding techniques.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eframework illustrating the sequential process from preprocessing and feature extraction to classification and evaluation.\u003c/p\u003e \u003cp\u003e \u003c/p\u003e \u003cp\u003eframework illustrating the sequential process from preprocessing and feature extraction to classification and evaluation.\u003c/p\u003e"},{"header":"V. RESULT AND ANALYSIS","content":"\u003cp\u003eThe ability of the suggested Hybrid StegNetA model to identify embedded payloads produced by various steganographic techniques was thoroughly tested using the StegaCIFAR v1.0 dataset. The dataset had equal amounts of stego and clean images produced with different payload rates of 1, 0.3, and 0.25 bits per pixel using four embedding families: LSB-1, LSB-3, Pixel Pair Matching (PPM), and Parity Encoding. Five well-known deep learning baselines\u0026mdash;CNN, ResNet, RNN, GAN-D, and Autoencoder\u0026mdash;were used to compare the model\u0026apos;s performance using three main metrics: accuracy, F1-Score, and Area Under the ROC Curve (AUC).\u003c/p\u003e\n\u003cp\u003eTABLE I \u003cspan type=\"SmallCaps\" class=\"SmallCaps\" name=\"Emphasis\"\u003eComparison of Model Performance (Accuracy / F1 Score / AUC) Across Stegware Families\u003c/span\u003e\u003c/p\u003e\n\u003cp\u003e\u003cimg src=\"https://myfiles.space/user_files/58895_8739fc6c57c1c19a/58895_custom_files/img1767705279.png\" width=\"747\" height=\"763\"\u003e\u003c/p\u003e\n\u003cdiv class=\"BlockQuote\"\u003e\n \u003cp\u003eThe comparative performance summary is presented in Table I, which demonstrates that Hybrid StegNetA maintained stable performance across all four stego families. While some baseline models (notably ResNet and CNN) showed slightly higher F1-scores for specific algorithms such as LSB-1, their performance fluctuated significantly when tested against other embedding methods[\u003cspan class=\"CitationRef\"\u003e17\u003c/span\u003e]. In contrast, the proposed model-maintained AUC scores between 0.50 and 0.54, showing little variation across multiple embedding methods. This consistency reflects the model\u0026rsquo;s enhanced cross-algorithm generalization and confirms its ability to learn algorithm-invariant features rather than overfitting to the statistical artifacts of any single embedding scheme.\u003c/p\u003e\n \u003cp\u003eTo measure how consistently the model performed across different algorithms, the Cross-Family Variance (CFV) metric was computed. [\u003cspan class=\"CitationRef\"\u003e18\u003c/span\u003e]. Hybrid StegNetA recorded a CFV of 0.0012, substantially lower than ResNet\u0026rsquo;s 0.0028, confirming superior robustness and uniformity in classification behavior. This low variance indicates that the hybrid feature fusion effectively minimizes algorithm bias, leading to reliable payload detection in diverse steganographic environments.\u003c/p\u003e\n \u003cp\u003eVisualization through t-SNE projections further reinforced this observation. The fused latent representation from the hybrid model exhibited distinct clustering between clean and stego samples, even when the payloads originated from different embedding algorithms. The frequency-domain autoencoder efficiently captured high-frequency perturbations, while the CNN backbone emphasized spatial noise residuals, producing complementary representations that improved discriminability.\u003c/p\u003e\n\u003c/div\u003e\n\u003cp\u003e\u003cbr\u003e\u003c/p\u003e\n\u003cp\u003eHybrid StegNetA\u0026apos;s AUC stability and low CFV make it evident that the model prioritizes consistency and adaptability, which are crucial qualities for real-world deployment where unknown or low-payload stego techniques may appear, even though its raw accuracy values seemed moderate when compared to some baselines. The findings support the theory that dual-domain feature fusion improves payload detection performance and robustness to algorithmic changes, indicating that the suggested framework is a viable option for universal stegware interception.\u003c/p\u003e"},{"header":"VI. CONCLUSION","content":"\u003cp\u003eThe proposed model Hybrid StegNetA, a hybrid deep learning architecture that integrates spatial-domain convolutional encoding and frequency-domain autoencoding for enhanced cross-algorithm steganalysis. The model is designed to fuse texture-level perturbations with spectral residuals to achieve improved payload detection consistency across diverse embedding algorithms. Preliminary evaluations indicate that the proposed framework can achieve stable performance, with AUC values between 0.50\u0026ndash;0.54 and a Cross-Family Variance of 0.0012, suggesting its strong potential for algorithm-invariant behavior compared to existing deep architectures such as ResNet and GAN-based discriminators.\u0026nbsp;\u003c/p\u003e\n\u003cp\u003eFuture work will focus on developing and extending the proposed framework in three key directions. First, dynamic payload localization using attention-guided saliency mechanisms will be implemented to identify the specific regions of embedding, improving model interpretability. Second, the architecture will be extended for cross-modal steganalysis, enabling its application to multimedia formats such as audio and video through temporal or 3D convolutional modeling. Third, adversarial training and regularization will be incorporated to enhance robustness against adaptive stegware that leverages generative models to bypass static detection. These developments will transform the proposed concept into a fully functional and scalable steganalysis system capable of serving as a dependable defense layer in modern cybersecurity environments.\u003c/p\u003e"},{"header":"Declarations","content":"\u003ch2\u003eAuthor Contribution\u003c/h2\u003e\u003cp\u003eH.P. conceived the research idea, designed the methodology, implemented the proposed Hybrid StegNetA model, conducted experiments, analyzed the results, and wrote the manuscript. H.P. also reviewed and approved the final version of the manuscript.\u003c/p\u003e\u003ch2\u003eData Availability\u003c/h2\u003e\u003cp\u003eThe datasets used in this study are based on the publicly available CIFAR image dataset. Stego images were generated using standard steganographic methods. The data supporting the findings of this study are available from the corresponding author upon reasonable request.\u003c/p\u003e"},{"header":"References","content":"\u003col\u003e\n \u003cli\u003eAlmhlbdi, Alanoud \u0026amp; Altowairqi, Norah \u0026amp; Alshutayri, Areej \u0026amp; Qarout, Rehab. (2025). Deep Learning-Based Multi-Class Detection of LSB Steganography in Digital Images.. IEEE Access. PP. 1-1. 10.1109/ACCESS.2025.3628784.\u003c/li\u003e\n \u003cli\u003eHu, D., Wang, L., Jiang, W., Zheng, S., \u0026amp; Li, B. (2018). A novel image steganography method via deep convolutional generative adversarial networks. IEEE access, 6, 38303-38314.\u003c/li\u003e\n \u003cli\u003eRafat, K. F., \u0026amp; Sajjad, S. M. (2024). Advancing reversible LSB steganography: Addressing imperfections and embracing pioneering techniques for enhanced security. IEEE Access.\u003c/li\u003e\n \u003cli\u003eWang, Y. (2024). Hiding Data within Thumbnail Videos: An Adaptive Downsampling-Resilient Video Steganography Method. IEEE Access, 12, 52963-52977.\u003c/li\u003e\n \u003cli\u003eSubramanian, N., Elharrouss, O., Al-Maadeed, S., \u0026amp; Bouridane, A. (2021). Image steganography: A review of the recent advances. IEEE access, 9, 23409-23423.\u003c/li\u003e\n \u003cli\u003eWen, J., Deng, Y., Peng, W., \u0026amp; Xue, Y. (2023). Linguistic steganalysis via fusing multi-granularity attentional text features. Chinese Journal of Electronics, 32(1), 76-84.\u003c/li\u003e\n \u003cli\u003eLiu, Q., Ni, J., \u0026amp; Jian, M. (2022, July). Effective JPEG steganalysis using non-linear pre-processing and residual channel-spatial attention. In 2022 IEEE International Conference on Multimedia and Expo (ICME) (pp. 1-6). IEEE.\u003c/li\u003e\n \u003cli\u003eWu, D. C., Shih, Z. N., \u0026amp; Wu, J. H. (2021). Modified multiway pixel-value differencing methods based on general quantization ranges for image steganography. IEEE Access, 10, 8824-8839.\u003c/li\u003e\n \u003cli\u003eMondal, S., Ling, Y. S., \u0026amp; Ambikapathi, A. (2021, July). H-stegonet: A hybrid deep learning framework for robust steganalysis. In 2021 IEEE International Conference on Multimedia and Expo (ICME) (pp. 1-6). IEEE Computer Society.\u003c/li\u003e\n \u003cli\u003eAl-Rawashdeh, R., Rahman, M. M., \u0026amp; Niazi, M. (2025). Robust Image Steganography Approach based on Edge Detection Combined with CNN Algorithm. IEEE Access.\u003c/li\u003e\n \u003cli\u003eWardhani, R. W., Putranto, D. S. C., Ji, J., \u0026amp; Kim, H. (2024). Toward hybrid classical deep learning-quantum methods for steganalysis. IEEE Access, 12, 45238-45252.\u003c/li\u003e\n \u003cli\u003eYe, J., Ni, J., \u0026amp; Yi, Y. (2017). Deep learning hierarchical representations for imagesteganalysis. IEEE Transactions on Information Forensics and Security, 12(11), 2545-2557.\u003c/li\u003e\n \u003cli\u003eCIFAR-10 and CIFAR-100 datasets. (n.d.). https://www.cs.toronto.edu/~kriz/cifar.html\u003c/li\u003e\n \u003cli\u003eHARIHARAVISWANATHAN P (2025). StegaCIFAR v1.0. IEEE Dataport. https://dx.doi.org/10.21227/c42w-8x53\u003c/li\u003e\n \u003cli\u003eLi, L., \u0026amp; Wu, J. (2024). Common feature enhancement extraction-based unsupervised adversarial deep transfer learning: A frequency security assessment method for variable renewable energy power systems. CSEE Journal of Power and Energy Systems.\u003c/li\u003e\n \u003cli\u003eHe, J., Su, N., He, G., Liao, Y., Yan, Y., Fu, S., ... \u0026amp; Feng, S. (2025). JRVSNet: Joint Representation of Visual and Scattering Features for Ship Detection in Complex-Valued SAR Images. IEEE Journal of Selected Topics in Applied Earth Observations and Remote Sensing.\u003c/li\u003e\n \u003cli\u003eA. Pai, \u0026ldquo;12 Types of Neural Networks in Deep Learning,\u0026rdquo; Analytics Vidhya, Feb. 2020. Accessed: May 8, 2025. [Online]. Available: https://www.analyticsvidhya.com/blog/2020/02/cnn-vs-rnn-vs-mlp-analyzing-3-types-of-neural-networks-in-deep-learning/\u003c/li\u003e\n \u003cli\u003eDmitriev, A., Trofimov, I., Burnaev, E., \u0026amp; Barannikov, S. (2025). Topological alternatives for Precision and Recall in generative models. IEEE Access.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003e\u0026nbsp;\u003c/p\u003e"}],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":true,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":false,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":false,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Deep learning, malware detection, neural net- works, steganalysis, steganography, stegware","lastPublishedDoi":"10.21203/rs.3.rs-8449298/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8449298/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eStegware refers to malware payloads concealed within benign multimedia files that exploit weaknesses in traditional detection systems. This paper presents a hybrid deep learning framework called Hybrid StegNetA, designed for payload centric steganalysis with enhanced cross algorithm generalization. Five baseline architectures including CNN, RNN, ResNet, GAN, and Autoencoder were comparatively evaluated on stego images generated via LSB Matching, DCT/DWT, and Spread Spectrum techniques. The proposed model integrates residual learning and frequency domain encoding to isolate embedding noise from semantic content. Experimental results on a balanced CIFAR based dataset demonstrate improved stability, achieving consistent AUC ranging from 0.50 to 0.54 and minimal cross family variance of 0.0012, significantly outperforming ResNet which exhibited a cross family variance of 0.0028. The model maintains robust detection capability across four distinct steganographic families: LSB1, LSB3, Pixel Pair Matching, and Parity encoding. These results confirm that dual domain feature fusion enhances algorithm invariant payload detection capability and establishes a foundation for generalized stegware interception in dynamic threat environments.\u003c/p\u003e","manuscriptTitle":"Cross-Algorithm Steganalysis via Dual-Domain Feature Fusion: A Hybrid Deep Learning Approach for Payload Detection","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-01-06 14:29:41","doi":"10.21203/rs.3.rs-8449298/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"db3e2a45-017e-4b70-9831-4141da50931d","owner":[],"postedDate":"January 6th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[],"tags":[],"updatedAt":"2026-01-06T14:29:41+00:00","versionOfRecord":[],"versionCreatedAt":"2026-01-06 14:29:41","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8449298","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8449298","identity":"rs-8449298","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}