1 Steganography Sami Dokheekh. 2 Agenda Research Hierarchy Related Work. Fact about JPEG Compression JPEG – Encoding/Decoding DCT Histogram. Spatial Blockness.

1

Steganography

Sami Dokheekh

2

Agenda Research Hierarchy Related Work. Fact about JPEG Compression JPEG – Encoding/Decoding DCT Histogram. Spatial Blockness. F5 algorithm. F5 Attack. How to recover original image? 2 Proposed new F5 attacks. Comparison results. Verification test results. Conclusion. Future work

3

Research Hierarchy

Content HidingExisting Hiding

Watermarking

VideoVideo AudioAudioImageImage

SteganographySteganography

Information Hiding

Cryptography

BMPBMP TIFTIFJPEGJPEGGIFGIF PNGPNG

Subject Pyramid

4

Related Work

JPEG

JStig F5 OutGuess

JSteg sequentially embeds the hidden data in LSBs of quantized DCT coefficients.JSteg disturb AC DCT histogram.Vulnerable to visual attacks.Vulnerable to statistical attacks also.

5

Related Work

JPEG

F5 distribute the message bits randomly by using a user password as a seed to a Random Generator.F5 does not disturb AC DCT histogram.F5 can’t be detected by visual attacks.Vulnerable against statistical attacks.

JStig F5 OutGuess

6

Related Work

JPEG

OutGuess distribute the message bits randomly by using a user password as a seed to a Random Generator.OutGuess preserve AC DCT Histogram.OutGuess can’t be detected by visual attacks.Vulnerable against statistical attacks.

JStig F5 OutGuess

7

Fact about JPEG Compression

JPEG stands for Joint Photographic Experts Group

JPEG compression is used with .jpg and can be embedded in .tiff and .eps files.

Used on 24-bit color files. Works well on photographic images. Although it is a lossy compression

technique, it yields an excellent quality image with high compression rates.

8

JPEG – Encoding/Decoding

RGB Image Data ( a Matrix of size NxMx3 ) [0-255]

Contain Header, Quantization Tables, Source Coding Tables, and Data.

Quantize/Dequantize

DCT/IDCT

SourceCoding/Decoding

JPEG File

Two Dimension Discrete Cosine Transformation

Division By a user define Quality table then integer roundation

Huffman coding or arithmetic coding

Lossless

Lossy

Lossless

9

JPEG – Encoding/Decoding

DCT Quantize

HuffmanCoding

HuffmanDecoding

Dequantize IDCT

DATA

Quantization Table

H.C. Table

RGBImageData

RGBImageData

Encoding Process Decoding Process

HC TableQ. Table

JPEG File

10

Frequency Domain

JPEG - Encoding

DCT Quantize

8x8 block 8x8 block

8x8 block

Quality Table

Spatial Domain

11

Frequency Domain

JPEG - Decoding

IDCT Dequantize

8x8 block 8x8 block

8x8 block

Quality Table

Spatial Domain

12

JPEG - Encoding e.g.

8x8 block in Spatial Domain

182183185187185186186183

186184181181181182183181

183183181182179179178174

182181178179176175170166

176174169171169168164163

169166164166166166164163

167165162165162161160160

176171165161155154155156

DCT

Spatial Domain

13Frequency Domain

JPEG - Encoding – e.g.

DCT

8x8 block in Frequency Domain

1381.9021.941.075.111.132.49-1.66-3.27

68.10-10.81-5.720.11-2.930.67-0.420.68

1.33-3.265.14-3.52-0.221.310.111.05

-3.51-11.50-3.650.851.06-0.480.430.00

0.888.34-0.20-0.75-0.38-0.070.49-0.49

2.61-2.92-6.30-0.87-0.350.69-0.10-0.59

0.94-0.33-0.64-0.84-0.860.730.360.44

-1.36-0.70-1.00-1.080.320.02-0.66-0.73

Quantize

14

Frequency Domain

JPEG - Encoding – e.g.Quality Table for 50

1611101624405161

1212141926586055

1413162440576956

1417222951878062

182237566810910377

243555648110411392

49647887103121120101

7292959811210010399

Quantize

15Frequency Domain

JPEG - Encoding – e.g.

Quantized 8x8 Block

Quantize

862000000

6-1000000

00000000

0-1000000

00000000

00000000

00000000

00000000

16Frequency Domain

JPEG - Decoding – e.g.

Quantized 8x8 Block

Dequantize

862000000

6-1000000

00000000

0-1000000

00000000

00000000

00000000

00000000

17

Frequency Domain

JPEG - Decoding – e.g.Quality Table for 50

1611101624405161

1212141926586055

1413162440576956

1417222951878062

182237566810910377

243555648110411392

49647887103121120101

7292959811210010399

Dequantize

18Frequency Domain

JPEG - Decoding – e.g.

IDCT


Dequantize

137622000000

72-12000000

00000000

0-17000000

00000000

00000000

00000000

00000000

19

JPEG - Decoding e.g.


IDCT

Spatial Domain

Round

182182183184185186187187

185184184183182181181180

185184183180178176174173

180179178176173171170169

172171171170169168168167

166166166165165164164164

167166165163160158157156

170168165162157154151149

20

JPEG – Encoding/Decoding e.g.

A 8x8 block in Spatial Domain

Spatial Domain

182182183184185186187187

185184184183182181181180

185184183180178176174173

180179178176173171170169

172171171170169168168167

166166166165165164164164

167166165163160158157156

170168165162157154151149

A 8x8 block in Spatial Domain

182183185187185186186183

186184181181181182183181

183183181182179179178174

182181178179176175170166

176174169171169168164163

169166164166166166164163

167165162165162161160160

176171165161155154155156

JPEGEncodingDecoding

Quality 50

They are not the same

JPEGFILE

21

JPEG – AC/DC DCT

DCACACACACACACAC

ACACACACACACACAC

ACACACACACACACAC

ACACACACACACACAC

ACACACACACACACAC

ACACACACACACACAC

ACACACACACACACAC

ACACACACACACACAC

8 co

effi

cien

ts

8 coefficients

An 8x8 Block in the Frequency Domain

DC coefficient is a special coefficient, it is equal to the average value of all 64 values in the RGB spatial block divided by 8.

AC coefficients is the rest 63 coefficients in the Block.

Each type have a coding algorithm in the jpeg encoding process.

Show me

22

JPEG - DCT

DCT is reversible function: DCT(X) == IDCT(DCT(X))

DCT Convert RGB Block to Frequency Domain Block.

Frequency block can be quantized to produce zero coefficients as much as possible.

23

JPEG - Quantization

The frequency block is quantized by a user define quality factor.

Quality is in the range [1 2 ..50..51 ..100] 1 means very low quality. 100 means full quality.

The looseness rise due to the rounding process.

24

JPEG - QuantizationStandard JPEG quantization matrix formula :

for Q>50 for Q<50

25

JPEG – Huffman Coding

AC coefficients are arranged in a zigzag order before applying the Huffman coding.

This is done so that the coefficients are in order of increasing frequency.

The higher frequency coefficients are more

likely to be 0 after quantization. The goal is to group all the zeros together,

to allow compression.

26

JPEG – Huffman Coding

Huffman coding applied on DC coefficients differ from AC coefficients.

862000000

6-1000000

00000000

0-1000000

00000000

00000000

00000000

00000000

Example :Zigzag order :86,2,6,0,-1,0,0,0,0,0,0,-1,0,0,0,0,0,0,0,0,0,0 … 0

Symbols = {0,-1,2,6,86}Probability = {0.9219, 0.0313, 0.0156, 0.0156, 0.0156}

Huffman Decoder :{1011001100001100 0000110000000000 0000000000000000 00000000000000000000000} = 74 bit

Original block = 64 byteCompression ratio = 100 - (74/(64*8))*100 = 85.5469 %

27

JPEG – AC DCT Histogram

28

JPEG - AC DCT Histogram of Frequency (k,l)

1215512155

43764276

73927392

34613461

1215512155

42764276

73927392

34613461

1248312155

85764276

73957392

34613461

1215512155

42764276

73927392

34613461

22Freq

2

2

2Image HistogramFrequency (2,2).

1215512155

42764276

73927392

34613461

1215512155

42764276

73927392

34613461

1248312155

83764276

73957392

34613461

1215512155

42764276

73927392

34613461

A

2

1

2

2 3 4 50

Where 1 ≤ k,l ≥ 8

29

JPEG – Compression Effect

Quality = 100

Next

30


Quality = 90

Next

31


Quality = 80

Next

32


Quality = 60

Next

33


Quality = 40

Next

34


Quality = 20

35

F5

Was developed by German researchers Pfitzmann and Westfeld in 2001.

Embeds message bits into randomly-chosen DCT coefficients in JPEG images and employs matrix embedding that minimizes the necessary number of changes to embed a message of certain length.

comes after a series of past algorithms like F3 and F4.

36

F5 – Process Overview

JPEGCompress

010101010010010100 PasswordClean image

(JPEG)(BMP)User Quality

CompressedImage

Stego Image

Message

Embedding Process

37

F5 – Process Details

Clean image(JPEG)(BMP)

DCT

DCT Coefficients

QualityTable

QuantizedDCT Coefficients

PasswordRandom Walk

Generator 010101010010010100

MessageBits

Bit Counter

Find k, n

Non-Zero AC CoefficientCounter

Usable Coefficients BufferRepeat Until all Message Bits are embeddedOr No more Usable Coefficients left

Quantize

Get n CoefficientsBuffer

Get k MessageBits

Yes

DecrementBuffer BitS

No

Eliminate BitS From UCBRepeat this iteration

Calculate SIfS = 0

IfShrinkage

YesNo

kn

38

F5 – Matrix Encoding

Simple encoding Introduce very high number of changes.

Matrix Encoding was introduced by “Ron Crandall” in 1998.

Matrix Encoding minimize the number of changes required by embedding a message.

That is reaching high embedding rates. F5 was possibly the first implementation of

Matrix Encoding.

39


F5 uses Matrix Encoding such as encoding k message bits inside n codeword with no more than 1 change in the codeword if needed.

n = 1/2k-1. Change density D(k)= 1/(n+1). Embedding rate R(k)= k/n. Embedding efficiency W(k)= R(k)/D(k).

W(k) = 2kxk/2k-1.

40

F5 - Steganographic interpretation

Positive coefficients: LSB. Negative coefficients: invertedinverted LSB. Decrement positive coefficients. Increment negative coefficients. ShrinkageShrinkage is the situation where a coefficient had

decremented or incremented leading its value to zero

Repeat if shrinkage occurs.

41

F5 – Embedding Process

-4 -3 -2 -1 0 1 2 3 4

-4 -3 -2 -1 0 1 2 3 4 1 0 1 0 skip 1 0 1 01 0 1 0 skip 1 0 1 0

01

01

01

011 0 1 0 1 0 1 0

… …

shri

nkag

e

shri

nkag

eshrinkage

shrinkage

42


Embedding EfficiencyEmbedding rateChange Densitynk

2100.00%50.00%11

2.6766.67%25.00%32

3.4342.86%12.50%73

4.2726.67%6.25%154

5.1616.13%3.12%315

6.099.52%1.56%636

7.065.51%0.78%1277

8.033.14%0.39%2558

9.021.76%0.20%5119

Relations between change densities and embedding rates

43

F5 – Traditional Embedding

1010100

010

Embed

Message Bits

Carrier

0100100

W(k) = 1 bit per change.

44


1010100

010

Embed

Message Bits

Carrier

f(a)a1a2a3a4a5a6a7

x11010101

x20110011

x30001111

Hash Function

f(a) = ai . binary(i)i=1

n

1

1

1

=

1010100

X

f(a)a1a2a3a4a5a6a7

x11010100

x20010000

x30000100

Xor

0

1

0

Xor

1

0

1

=1

2

4

XXX

1

0

4

=

SUM

5

Change a5

1010000

MSG Bit

W(k) = 3 bit per change.

a

x

45

F5 - Encoding e.g.


616151527292629

1216131118202027

1314121215161926

69121415161921

810111110141716

181714109152019

2322181515182122

2121212121171617

DCT

Spatial Domain

Embed Message [AB]In an Image of 8X8Pixel

46Frequency Domain

F5 - Encoding – e.g.

DCT


133.37-20.568.84-2.06-2.63-5.24-0.550.21

-0.10-20.50-3.240.08-0.27-7.030.380.21

20.642.48-3.552.810.49-5.550.090.83

-0.58-4.112.032.60-5.450.18-0.24-0.31

-1.63-4.64-12.24-0.52-0.13-0.08-0.480.38

6.11-3.89-0.380.18-0.35-0.18-0.460.12

0.510.470.090.140.200.26-0.200.22

0.080.210.630.300.21-0.22-0.14-0.41

Quantize

47

Frequency Domain

F5 - Encoding – e.g.Quality Table for 100

Quantize

11111111

11111111

11111111

11111111

11111111

11111111

11111111

11111111

48Frequency Domain

F5 - Encoding – e.g.

Quantized 8x8 Block

Quantize

133-219-2-3-5-10

0-21-300-700

212-430-601

-1-423-5000

-2-5-12-10000

6-4000000

10000000

00100000

49

F5 Encoding – e.g.

133-219-2-3-5-10

0-21-300-700

212-430-601

-1-423-5000

-2-5-12-10000

6-4000000

10000000

00100000

*Assume the user password is [mysecretpassword]*Assume the Random Walk Generator generates The walk as column by column.*Assume the k value along with the message bit count will be known by the receiver. Actually F5 embed these two information at the beginning of the message.

For simplicity :

21-1-261-21-212-4-5-49-3-42-121-233-1-3-5-5-7-6-11

RandomWalkGenerator

Password

Usable Coefficients Buffer

Clean Image Quantized DCT Coefficients 8x8 Block

50


21-1-261-21-212-4-5-49-3-42-121-233-1-3-5-5-7-6-11

10000011000010

Message Bits


Embedding ratenk

100.00%11

66.67%32

42.86%73

26.67%154

16.13%315

9.52%636

5.51%1277

3.14%2558

1.76%5119

Count = 28

Count = 14

Embedding Rate = (14/28)*100= 50%So we chose k=2, n=3.

AA BB

51


21-1-261-21-212-4-5-49-3-42-121-233-1-3-5-5-7-6-11

10000011000010

Message Bits


1st iteration

21-1-2

101

Buffer

Buffer LSB10

k Message Bits

Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(1 xor 1) xor 1] * 1 + [(0 xor 1) xor 0] * 2 = [0 xor 1] * 1 + [1 xor 0] * 2 = 1 * 1 + 1 * 2 = 1+2 = 3Sum = 3 Change a3

a x

21-1-1

Buffer

Increment Buffer coefficient # 3

21-1-1

Buffer

Test Shrinkage

1. Update this changed coefficients to the original Image Coefficients (8X8)Block.2. k message bit was embedded with a single change.3. Proceed to next iteration.

No shrinkage occurred

52


61-21-212-4-5-49-3-42-121-233-1-3-5-5-7-6-11

000011000010

Message Bits


61-21

010

Buffer

Buffer LSB00

k Message Bits


a x

2nd iteration

60-21

Buffer

Decrement Buffer coefficient # 2

60-21

Buffer

Test Shrinkage

1. Update this changed coefficients to the original Image Coefficients (8X8)Block.2. Eliminate the changed coefficient from the usable coefficients Buffer.3. Repeat this iteration.

Shrinkage had occurred

53


6-21-212-4-5-49-3-42-121-233-1-3-5-5-7-6-11

000011000010

Message Bits


2nd iteration

6-21-21

000

Buffer

Buffer LSB00

k Message Bits

Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(0 xor 0) xor 0] * 1 + [(0 xor 0) xor 0] * 2 = [0 xor 0] * 1 + [0 xor 0] * 2 = 0 * 1 + 0 * 2 = 0+0 = 0Sum = 0 No Change

a x

1. k message bit was embedded without a change.2. Proceed to next iteration.

54


2-4-5-49-3-42-121-233-1-3-5-5-7-6-11

0011000010

Message Bits


3rd iteration

2-4-5

010

Buffer

Buffer LSB00

k Message Bits


a x

2-3-5

Buffer

Increment Buffer coefficient # 2

2-3-5

Buffer


Test Shrinkage


55


-49-3-42-121-233-1-3-5-5-7-6-11

11000010

Message Bits


4th iteration

-49-3

110

Buffer

Buffer LSB11

k Message Bits

Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(1 xor 0) xor 1] * 1 + [(1 xor 0) xor 1] * 2 = [1 xor 1] * 1 + [1 xor 1] * 2 = 0 * 1 + 0 * 2 = 0+0 = 0Sum = 0 No change.

a x


56


-42-121-233-1-3-5-5-7-6-11

000010

Message Bits


5th iteration

-42-12

101

Buffer

Buffer LSB00

k Message Bits


a x

-41-12

Buffer

Decrement Buffer coefficient # 2

-41-12

Buffer

Test Shrinkage



57


1-233-1-3-5-5-7-6-11

0010

Message Bits


6th iteration

1-23

111

Buffer

Buffer LSB00

k Message Bits


a x


58


3-1-3-5-5-7-6-11

10

Message Bits


7th iteration

3-1-3

100

Buffer

Buffer LSB10

k Message Bits


a x

1. k message bit was embedded without a change.2. K message bit finished -> Stop.

59


133-219-2-3-5-10

0-21-300-700

212-430-601

-1-423-5000

-2-5-12-10000

6-4000000

10000000

00100000

133-219-2-3-5-10

0-21-300-700

212-430-601

-1-313-5000

-1-5-12-10000

6-4000000

00000000

00100000

Clean Image DCT Block Stego Image DCT Block

60


Number of changed Coefficients = 4.

Number of shrunken coefficients = 1.

So we actually embed 14 bit by only changing 4 coefficients.

Estimated embedding efficiency = 2.67 bpc.

Actual embedding efficiency = 14/4= 3.5 bpc.

61


Clean Image Stego Image

Observations:1. F5 is not does not effect the appearance of the image.2. The human eye can’t distinguish stego image from clean one.

62



616151527292629

1216131118202127

1214121214162027

69121414161922

810111110141716

181714109151918

2322181515182122

2021212121181717

616151527292629

1216131118202027

1314121215161926

69121415161921

810111110141716

181714109152019

2322181515182122

2121212121171617

Unchanged pixelIncremented pixelDecremented pixel

Observations:1. F5 effect in spatial block is light (change by +- 1).2. Most of the changes occurs at the boundaries. (7 out of 12 changes).

63

F5 Decoding – e.g.

133-219-2-3-5-10

0-21-300-700

212-430-601

-1-313-5000

-1-5-12-10000

6-4000000

00000000

00100000

*Assume the user password is [mysecretpassword]*Assume the Random Walk Generator generates The walk as column by column.*Assume the k value along with the message bit count will be known by the receiver. Actually F5 embed these two information at the beginning of the message.

For simplicity :

RandomWalkGenerator

Password


Stego Image Quantized DCT Coefficients 8x8 Block

21-1-16-21-212-3-5-49-3-41-121-233-1-3-5-5-7-6-11

64

EmptyEmpty


Message Bits Buffer


1st iteration

21-1-1

100

Buffer

Buffer LSB

10

k Message Bitsx1 = a1 xor a3 = 1 xor 0 = 1

x2 = a2 xor a3 = 0 xor 0 = 0

a

x

1. k message bit was recovered from n usable coefficients Buffer.2. Add k bits to the message bit buffer.3. Proceed to next iteration.

21-1-16-21-212-3-5-49-3-41-121-233-1-3-5-5-7-6-11

65


Message Bits Buffer


2nd iteration

6-21-21

000

Buffer

Buffer LSB

00


x2 = a2 xor a3 = 0 xor 0 = 0

a

x


10

6-21-212-3-5-49-3-41-121-233-1-3-5-5-7-6-11

66


Message Bits Buffer


3rd iteration

2-3-5

000

Buffer

Buffer LSB

00


x2 = a2 xor a3 = 0 xor 0 = 0

a

x


10 00

2-3-5-49-3-41-121-233-1-3-5-5-7-6-11

67


Message Bits Buffer


4th iteration

-49-3

110

Buffer

Buffer LSB

11


x2 = a2 xor a3 = 1 xor 0 = 1

a

x


10 00 00

-49-3-41-121-233-1-3-5-5-7-6-11

68


Message Bits Buffer


5th iteration

-41-12

111

Buffer

Buffer LSB

00


x2 = a2 xor a3 = 1 xor 1 = 0

a

x


10 00 00 11

-41-121-233-1-3-5-5-7-6-11

69


Message Bits Buffer


6th iteration

1-23

111

Buffer

Buffer LSB

00


x2 = a2 xor a3 = 1 xor 1 = 0

a

x


10 00 00 11 00

1-233-1-3-5-5-7-6-11

70

F5 Decoding – e.g.Usable Coefficients Buffer

7th iteration

3-1-3

100

Buffer

Buffer LSB

10


x2 = a2 xor a3 = 0 xor 0 = 0

a

x

1. k message bit was recovered from n usable coefficients Buffer.2. Add k bits to the message bit buffer.3. Terminate loop. {all message bits were recovered}.

100000110000

Message Bits Buffer

3-1-3-5-5-7-6-11

71


Message Bits Buffer

10000011000010

AA BB

Original Message = ABABRecovered Message = ABAB

72

F5 – Implementing the algorithm.

We implement the F5 algorithm on Matlab 7. F5 was implemented without a random walk

generator. (no need for password) Inputs is gray image matrix. Output is DCT coefficients matrix. JPEG compression/decompression process

is not included. Only the F5 embedding and extraction

process is implemented.

73

Shifted Image

Fridrich claim that spatial shifting of the stego image will restore the original image histogram.

Fridrich stated that this process will destroy all previous JPEG compression effect on the image.

She recommended a low-pass filter after shifting the stego image.

74

Shifted Image

8 pixels4 pixels

4 pixels

75

F5 Facts- Histogram

76

F5 Facts-Continues Embedding

Original Image Image After 30 F5Embedding Maximum

Capacity.

Image After 190 F5Embedding Maximum

Capacity.

77

F5 Facts-Continues Embedding

78

F5 Facts - Blockness

79


80

F5 Facts – Cross Blockness

SB = |a-b| + |c-d| + |a-c| + |b-d| + |a-d| + |c-b|

For each 4 disjoint blocks

81


82

F5 Facts – Cross Blockness

83

F5 Attack

Based on the fact that F5 increases the total number of zero coefficients and decreases the non-zero ones.

The cover image (baseline) is evaluated to compare the two histograms.

Baseline image is evaluated by cropping the stego image by 4 pixels and apply a low-pass filter to the cropped image.

84

F5 Attack

Decompression

Crop By 4 pixel

Filtering

CompressionStegoImageQuality

Baseline image

CalculateDCT

Histogram

CalculateDCT

Histogram

Stego Image

85

F5 Attack

Baseline Histogram Stego Histogram-4 -3 -2 -1 0 1 2 3 4 -4 -3 -2 -1 0 1 2 3 4

h(d) , d = 0,1,2 … , is the total number of AC coefficients in the cover-image withabsolute value equal to d after the image has been compressed inside the F5 algorithm.

hkl(d) the total number of AC DCT coefficients corresponding to the frequency (k, l), 1 ≤ k, l ≤ 8, whose absolute value is equal to d.

H(d) & Hkl(d) are the same for the stego image.

86

F5 Attack

h(d) H(d)

0 1 2 3 4 0 1 2 3 4

Let us suppose that the F5 embedding process changes n AC coefficients. Theprobability that a non-zero AC coefficient will be modified is β = n/P, where P is thetotal number of non-zero AC coefficients (P = h(1) + h(2) + …). Because theselection of the coefficients is random in F5, the expected values of the histograms Hkl

of the stego-image are:

Hkl(d) = (1 – β) hkl(d) + β hkl(d+1) , for d>0,Hkl(0) = hkl(0) + β hkl(1) , for d=0,

87

F5 Attack

h(d) H(d)01234 01234

We can calculate an estimate h^kl(d) of the cover image

histogram (baseline) , so based on the previous formula we can estimate β very easily.

We know stego histogram Hkl(d) and we have h^kl(d) We

can evaluate β. They have experimented with different formulas for β and

the best performance was obtained using the least square approximation.

We calculate β as the value that minimizes the square error between the stego-image histogram Hkl, and the expected values h^

kl(d) calculated from the estimated histogram h^

kl using last equation.

88

F5 Attack

h(d) H(d)01234 01234

Because the first two values in the histogram (d=0 and d=1) experiences the largest change during the embedding, We can write:

ββklkl = arg min = arg minββ [[HHklkl(0)(0) – – hh^̂

klkl(0)(0) – – ββ hh^̂klkl(1)(1) ] ]22+[+[HHklkl((11)) – (1 – – (1 – ββ)) hh^̂

klkl((11)) – – ββ hh^̂klkl((22)) ] ]22

Which led to the following equation for β :

89

F5 Attack

h(d) H(d)

0 1 2 3 4 0 1 2 3 4

We calculate ββ as the average against the three frequencies [1,2],[2,1],[2,2] ββ = (ββ 12 + ββ 21 + ββ 22) / 3

90

F5 Attack – Double compression

JPEGCompress

010101010010010100

Embedding Process

PasswordClean image(JPEG)

User Quality)Q2( Compressed

Image

Stego Image

Message

OldQuality

)Q1(Double Compression

91


Double compression take place when the image sent to F5 is already a JPEG compressed image.

Their detection algorithm can’t detect such stego images correctly.

They adds a double correction step to their algorithm to eliminate the problem.

92


Decompression

Crop By 4 pixel

Filtering

CompressionStegoImageQuality

Baseline image

CalculateDCT

Histogram

CalculateDCT

Histogram

Stego Image

JpegImage

OldQuality

Decompression

Compression

93


We calculate ββ for fixed of quantization tables {Q1,…Qt}.

For each Qi, 1 ≤ i ≤ t, we run the detection algorithm with a little change.

After shifting and filtering process we compress the image with Qi and immediately decompress it again after going throw the rest of the algorithm.

94


Now we have a set of calculated ββii ,1≤ i ≤ t. For each i and for each DCT mode k, l, we

calculate the L2 distance E(i)kl between Hkl and

h^kl with ββ == ββii :

The final ββ is obtained as ββ == ββtt where :

95

F5 Attack – Estimating the True Message Length

Let n be the total number of changes in quantized DCT coefficients introduced by the F5 algorithm.

We can write n as n = s + m, where s is the shrinkage, and m is the number of changes due to actual message bit embedding.

The probability of selecting a coefficient that may lead to shrinkage is PٍٍٍٍS = h(1)/P.

Since the coefficients are selected at random, the expected value of s is nPS.

Thus, we obtain the following formula:

m + nPS = n

96

F5 Attack – Estimating the True Message Length

which gives m=n(1–PS) for the number of changes due to message embedding.

Assuming the (1,2k−1, k) matrix embedding, the expected number of bits per change W(k) is:

Thus, the unknown message length M can be calculated as:

Where:

97

F5 Attack – Implementing the algorithm

We Implement the algorithm on Matlab 7.

We add a GUI to the tool. Ability to chose the difficulty of the

algorithm. (Shifting + Old Quality estimate).

Ability to see progress at progress bar.

98

F5 Attack Tool

99

F5 Attack – Results Comparison

We compare our implemented algorithm results with their results.

20 test images. Using averaging shifting from 3:5 Using Old Quality rang from 80:2:100. Results is ββ and n.

100

F5 Attack – Results ComparisonScore:

Paper : 5/20 = 25% Project : 15/20 = 75%

101

F5 Attack – Results ComparisonScore:

Paper : 4/20 = 20% Project : 16/20 = 80%

102

New Methodology

As we mention before, most of F5 changes on spatial domain effect the boundaries of each 8x8 block.


616151527292629

1216131118202127

1214121214162027

69121414161922

810111110141716

181714109151918

2322181515182122

2021212121181717

616151527292629

1216131118202027

1314121215161926

69121415161921

810111110141716

181714109152019

2322181515182122

2121212121171617

Unchanged pixelIncremented pixelDecremented pixel

103

New Methodology - Blockness

The Blockness value of the stego image is much more than the clean image.

The Blockness increases almost linearly with the size of the embedded message.

We have collect a set of 30 JPEG images with deferent dimensions and for each image we embedded deferent message size from 1KB to 30KB.

We test both normal Blockness and cross Blockness.

104

New Methodology - Blockness

2 0

105

New Methodology - Continues Embedding

Blockness value increases also linearly when continuing embedding messages.

Normal Blockness show better linearity than cross Blockness.

We have tested 10 images with deferent dimensions on continually embedding process of 1KB message each step.

106

New Methodology - Continues Embedding

2 0

107

Proposed Algorithm 1

Lets assume the B(I) is the blockiness value of image I. Is is the stego image. Ic is the cover or clean image. If is the stego image using full capacity. We calculate the linear equation of blockiness increasement

against number of changed coefficients as: y = m*x + c first we calculate the mean: m = (B(If) - B(Ic))/(N(If) - N(Ic)) N is the number of changed coefficients. we know that Ic don't have changed coefficients, so we can

write: m = (B(If) - B(Ic))/N(If)

108


Now we can calculate the constant c value: c = B(Ic) so now we have the linear equation, y = m*x + c we want to calculate x: x = y - c / m now we change x and y by relative values from stego image Is: N(Is) = (B(Is) - B(Ic))/(B(If) - B(Ic))/N(If) which gives: N(Is) = N(If)*(B(Is) - B(Ic))/(B(If) - B(Ic)) Now we have N(Is),to calculate Beta, we count all non-zero

coefficients from Ic, let it P: β = N(Is)/P(Ic) we estimate the true message length in the same way

109


Unfortunately, the results was disappointed.

Estimated Message Length is far away from the actual message length.

This because the recovered baseline image blockiness value is less far away from actual clean image blockiness value.

110


This proposed algorithm is actually an improvement of the original F5 attack we had described before.

The original algorithm calculates β value for deferent shift values.

In the description of the algorithm, we stated that the shift is by 4 pixels in both directions.

Actually, the original algorithm results was an average value of deferent estimated β calculated using deferent shift values.

111


This proposed algorithm calculates β value as the value calculated from a shift having minimum E value among all shifts.

E value is calculated in the original algorithm to tackle the double compression problem.

112


113


Current Shift

Calculating E value for old quality range

Current OldQuality

Min(E), β

Crop Stego image

Apply Low-pass Filter

Calculate β

Calculate E

Average() Select with β minimum E

2nd proposedalgorithm

originalalgorithm

114

Verification

We generate test data of 432 images from 12 images was taken from mobile camera.

12

150x200 300x400

100 50…. 100 50….

1 KB2 KB

1 KB

2 KB

144 clean

144 stego 1 KB

144 stego 2 KB

115

Test Results

116

Test Results

117

Test Results

118

Test Results

119

Test Results

120

Test Results

121

Test Results

122

Test Results

False PositiveFalse NegativeTrue PositiveTrue Negative

Original28.82%31.94%71.18%68.06%

Improved18.40%36.81%81.60%63.19%

T = 0.025.

123

Test Results

βAAEMax(AAE)Min(AAE)Std(AAE)variance(AAE)

Tool0.0840.52800.087260.00761

Improved0.0670.81900.086720.00752

nAAEMax(AAE)Min(AAE)Std(AAE)variance (AAE)

Tool3378290800427618281302

Improved209117609025476485807

MLAAEMax(AAE)Min(AAE)Std(AAE)variance (AAE)

Tool0.888.810.001.151.33

Improved0.585.750.000.720.52

124

Conclusion

Our improved F5 attack tool have better detection classification of stego images than the original tool.

Our improved F5 attack tool showed less average absolute error values of estimated β, n, and secret message length compared with same values obtained by original F5 attack tool results.

125

Conclusion

Our improved F5 attack tool showed less true negative value than the original tool using the threshold T = 0.025.

Our improved F5 attack tool had more average absolute error values of estimated β than the original tool for stego images with actual β values less than 0.05.

Our improved F5 attack tool had more average absolute error values of estimated β than the original tool for test images that have been compressed -before sending it to the F5 algorithm- with old JPEG quality = 100.

We can use the original algorithm as a classifier and the proposed algorithm as a estimator for stego images.

126

Future Work

For 1st proposed algorithm: trace out the problem of bad results. The blockiness value of the estimated cover

image is less than the blockiness value of the original cover image.

We have observed that this deference ratio is the same for images with similar size.

We want to figure out how we can estimate this ratio for a given image to correct the blockiness value.

127

Future Work

For 2nd proposed algorithm: improve the way that we evaluate the

baseline estimate. (Shifting + Filtering). reduce the processing time. (parallel

processing ). threshold value must be related to each

stego image. (Based on size and Old quality …)

128

Any Questions ?

129

Discrete cosine transform (DCT)

Back

DCT

IDCT

M = N = 8

M = N = 8

Pixel Value in location m, n Coeff. Value in location p, q

Pixel Value in location m, nCoeff. Value in location p, q

130

Discrete cosine transform (DCT) DC

Back

B00 = α0 α0 Amn cos cos

7 7

m=0 n=0

Π(2m+1)0 Π(2n+1)0

16 16 N = M = 8

B00 = ⅛ Amn cos(0) cos(0)

7 7

m=0 n=0

B00 = ⅛ Amn

7 7

m=0 n=0

131

JPEG Quantization

2015

3016

23

45/

105

73=

2015

2815

23

45*

105

73=

Quantization Process

Dequantization Process

round

Image DCT Block JPEG Quality Table JPEG Quantized Block

JPEG Quantized Block JPEG Quality Table Image DCT Block

Back

132

JPEG Quality Tables11111111

11111111

11111111

11111111

11111111

11111111

11111111

11111111

3223581012

22345121211

33358111411

334610171612

4471114222115

57111316212318

1013161721242420

1418192022202120

JPEG Standard TableFor Quality 100


Back

133

JPEG Quality Tables



6151402416101116

5560582619141212

5669574024161314

6280875129221714

771031096856372218

921131048164553524

10112012110387786449

9910310011298959272

1531281006040252840

1381501456548353030

14017314310060403335

15520021812873554335

193258273170140935545

2302832602031601388860

253300303258218195160123

248258250280245238230180

Back

1 Steganography Sami Dokheekh. 2 Agenda Research Hierarchy Related Work. Fact about JPEG Compression JPEG – Encoding/Decoding DCT Histogram. Spatial Blockness.

Documents

table jpeg file slide

dct spatial domain slide

jstigf5outguess slide

related work jpeg f5

future work slide

dct 8x8 block

visual attacks

statistical attacks