From Pixels to Processes: A Process Mining- Inspired Approach to Image Steganalysis

Steganography attempts to conceal messages in plain sight while steganalysis seeks to identify them or, more importantly, to extract the embedded data. Low-payload and spatially localized steganographic embedding is increasingly used to evade detection by classical steganalysis methods. While such strategies preserve global image statistics and remain visually imperceptible, they can disrupt natural pixel-level behavior. This work proposes a behavioral steganalysis framework inspired by process mining that detects image steganography by analyzing localized behavioral deviation using regional behavioral contrast and behavioral amplification. Experiments on lossless grayscale PNG images from the USC SIPI database and 10,000 images from the BOWS2 dataset using 1-bit LSB embedding show that the proposed framework reliably identifies steganographic embedding. On the USC SIPI dataset, conventional statistical detectors, including chi-square analysis and the StegExpose tool, showed limited detection capability under the evaluated localized embedding settings. Despite high perceptual quality of stego images (PSNR > 55 dB), significant behavioral deviation is consistently observed within embedded regions. These results demonstrate that the proposed process mining-inspired framework provides an interpretable and complementary direction for image steganalysis, particularly under low-payload and localized embedding scenarios.