Detecting steganography by analysing non-significant data entropy? I am not thinking only steganography in images, I think it is also possible to encode data for example into the length of spaces of a clear html text.

I suspect, the steganography changes (elevates) the entropy of the non-significant part of the messages.

But:


How to detect in the general case, what is "non-significant"?
Sometimes the hidden content has also a low entropy, while "clean" content can have also high.


For (1): Afaik, it is impossible, the only possibility would be to use some application-level decoding and interpretation.

For (2): I think, there is (should be) some type of correlation between the entropy (complexity) of non-significant part and the significant part of the carrier content, too. Some type of uncommon deviation could be maybe detected.

Does such technique, algorithm already exist?
You cannot detect the use of steganography without taking into account the inherent variation in the protocol. Of course, you should be able to detect bad steganographic practices that operate outside the normal limits - you don't expect huge swaths of whitespace in HTML - but well applied steganography should be hard to detect by definition. So I agree with your evaluation of (1).



Entropy is not complexity. Pi may be considered complex if you try to estimate the value of subsequent digits (in whatever base) without using the common methods to calculate Pi. A common X.509 certificate is rather complex, but only the modulus (of the public key within the certificate) and signature may contain entropy.

Furthermore, I don't see how complexity of the significant part and non-significant part are necessarily related in any way. Take the certificate: you can easily re-encode it using XML encoding rules. Now generally a converter doesn't add any whitespace. However, a simple XHTML file may contain a lot of whitespace placed almost randomly between tags as it may be human generated.

As there doesn't necessarily seem to be a correlation, it would be impossible to create a generic algorithm that could detect steganography. Of course, heuristics can be used, but given that the amount of variation is unknown it advance, there must be either false positives, false negatives or both given any protocol that allows variation and any steganographic practice.

So I don't agree with your assessment of (2), and in my opinion, no generic algorithm should be possible to exist. Proof: take a protocol that randomly adds a space or tab character, ignored by the receiving party. Replace these by a CPA secure ciphertext, bit by bit. Now both the original data and space/tab encoded ciphertext should be completely random to an adversary.