Detection of covert channels in web applications based on unimodality violation in the walsh–hadamard spectrum

This paper presents the theoretical foundations of an innovative method for steganalysis of digital images based on detecting violations of unimodality in the Walsh-Hadamard transform spectrum.The method targets the detection of covert information transmission channels in web applications, particularly in scenarios where users are allowed to upload graphic content.The relevance of this research stems from the increasing use of modern steganographic techniques that are resistant to classical steganalysis methods, thereby posing potential threats of data leakage or the transmission of hidden commands within seemingly legitimate content.The paper formalizes the concept of code-controlled embedding in the spatial domain by selectively affecting individual Walsh-Hadamard transformants.It is shown that such embedding leads to statistically significant deviations from unimodality in the distribution of the corresponding spectral components, which can serve as indicators of hidden activity.Two theoretical propositions are proven: the first describes the expected statistical behavior of Walsh-Hadamard transformants in natural images, while the second demonstrates the emergence of bimodal histograms under steganographic embedding.The theoretical framework is supported by computational experiments across large datasets of real-world images.The findings form a basis for the development of effective detection systems for covert channels in web applications.The proposed approach can be used to generate meaningful features for training artificial intelligence models integrated into automated security testing pipelines, as well as for monitoring uploaded content for the presence of hidden information.The method is formatagnostic and retains effectiveness even under common attack conditions, such as lossy JPEG compression.