Block Structure in JPEG and · PDF fileBlock Structure in JPEG and Steganalysis CSM25 Secure Information Hiding ... Jessica Fridrich, Miroslav Goljan, Dorin Hogea: ‘Steganalysis

Block Structure in JPEG and SteganalysisCSM25 Secure Information Hiding

Dr Hans Georg Schaathun

University of Surrey

Spring 2009 – Week 4

Dr Hans Georg Schaathun Block Structure in JPEG and Steganalysis Spring 2009 – Week 4 1 / 41

JPEG Histogramme

Outline

1 JPEG HistogrammeHistogrammeSteganalysis

2 Improvements – F3 & F4

3 JPEG Calibration

4 Blockiness as a Statistic

5 Conclusion


JPEG Histogramme Histogramme

Outline



3 JPEG CalibrationThe ideaMatlab

4 Blockiness as a StatisticThe Blockiness AttackYASS

5 Conclusion



The JPEG Coefficients

Recall that JPEG uses theblockwise DCT transform

8× 8 DCT coefficientsdifferent frequencies

The entries are quantised,called JPEG coefficients (integers)

DC – highest frequence coefficient(0, 0)

63 AC coefficients, (i , j) 6= (0, 0),0 ≤ i , j ≤ 7



Histogramme

Different frequencies have different characteristicsDC coefficient stick out

We calculate the histogramme of the AC JPEG coefficientsh(x) is the number of coefficients equal to x

Frequency-wise histogrammehij(x) is the number of blocks where coefficient (i , j) is equal to x

DC histogramme h00(x)



Histogramme

Different frequencies have different characteristicsDC coefficient stick out

We calculate the histogramme of the AC JPEG coefficientsh(x) is the number of coefficients equal to x

Frequency-wise histogrammehij(x) is the number of blocks where coefficient (i , j) is equal to x

DC histogramme h00(x)



Extracting AC coefficients

Consider N ×M matrix, AIf B is a boolean (logical) N ×M matrix,

then A(B) is a vector consisting of all elements from Acorresponding to a 1 (true) in B

Suppose we run (where A is N ×M DCT image)1 B = logical(ones(8,8)) % Make 8x8 matrix of ones2 B(1,1) = 0 % DC coefficient : zero3 BB = repmat ( B, N/8, M/8 ) % Concatenate block

for full image4 X = A(B) % Vector of AC coefficients



HistogrammeMatlab

We have discussed histogrammes beforeEssentially you need two functions

hist to extract frequenciesbar or stem to make the plot

Refer to help filesand to exercise sheet


JPEG Histogramme Steganalysis

Outline





5 Conclusion



JSteg Histogramme

0 +1 +2 +3 +4 +5−1−2−3−4−5Cover

0 +1 +2 +3 +4 +5−1−2−3−4−5Stego��

��

��

��

��

��....

....

�� ....

....

�� ....

....

�� ....

....

��

Typical JPEG. Typical JSteg.



Histogramme analysis

1 Pairs of valuesGeneralised χ2 works

2 SymmetryEmbedding exchange +2 ↔ +3 and −2 ↔ −1.The DCT histogramme is expected to be symmetricOutguess/JSteg destroy the symmetry.



Symmetry analysis

J2i =

(1− q

2

)I2i +

q2

I2i+1,

J2i+i =q2

I2i +

(1− q

2

)I2i+1

Writing

a =1− q/21− q

and b =q/2

1− q,

we get

I2i = aJ2i − bJ2i+1,

I2i+1 = −bJ2i + aJ2i+1.



Symmetry analysis (II)

∑i>0

I2i =∑i<0

I2i , and∑i<0

I2i+1 =∑i>0

I2i+1.

In other words ∑i>0

I2i +∑i<0

I2i+1 =∑i<0

I2i +∑i>0

I2i+1.

Substitute for I2i and J2i+1

One equation in one unknown : q



ExerciseSymmetry analysis

∑i>0

I2i +∑i<0

I2i+1 =∑i<0

I2i +∑i>0

I2i+1.

Substitute for I2i and I2i+1get equation in J2i and J2i+1.

Solve for J1, write as equation inJ1 (left hand side)∆i = J2i − J2i+1 (i > 0), and ∆i = J2i+1 − J2i (i < 0).

Solve for qCan you implement the resulting expression for p in Matlab?


Improvements – F3 & F4

Outline

1 JPEG Histogramme


3 JPEG Calibration


5 Conclusion



Improvements at a glance

F3 – F4 changes the embeddingbetter histogramme – maintain symmetry

Statistics-aware embeddingOutguess 0.2 uses unused capacitydummy changes are used to even out the statistics

Matrix coding/wet paper codingF5 minimises distortion using coding theoryfewer bit-flips per message bittechniques from coding for restricted memory



Bitflips in F3

Avoid pairs of values.Always decrease absolute value when changingZeros are ignored.Zero created: reembed in new coefficient

0 +1 +2 +3 +4 +5−1−2−3−4−5Cover

0 +1 +2 +3 +4 +5−1−2−3−4−5Stego��..

....

..

��

��....

....

�� ....

....

��

��

�� ....

....

�� ....

....

��

��

��



The problem of F3

ReembeddingZero created by message zeroesZeros are reembeddedExtra zeros embedded ⇒ overweight of even coefficients.

Typical JPEG. Typical F3.



F4 : evening out even values

Swap interpretation for negative coefficients+1 causes reembedding of zero-1 causes reembedding of one

0 +1 +2 +3 +4 +5−1−2−3−4−5Cover

0 +1 +2 +3 +4 +5−1−2−3−4−5Stego

F3��..

....

..

��

��....

....

�� ....

....

��

��

�� ....

....

�� ....

....

��

��

��

0 +1 +2 +3 +4 +5−1−2−3−4−5Cover

0 +1 +2 +3 +4 +5−1−2−3−4−5Stego

F4��..

....

..

��

��

��

�� ....

....

�� ....

....

��

��

�� ....

....

�� ....

....

��



F4 histogramme

What does the histogramme look like after F4 embedding?Maginitudes have generally been decreased.Effect similar to reduced quality factor.F4 (and F5) can be broken

Suggested Reading

Jessica Fridrich, Miroslav Goljan, Dorin Hogea: ‘Steganalysis of JPEGImages: Breaking the F5 Algorithm’. http://www.ws.binghamton.edu/fridrich/Research/F5.pdf


http://www.ws.binghamton.edu/fridrich/Research/F5.pdf



F4 histogramme


Suggested Reading






F4 histogramme


Suggested Reading






F4 histogramme


Suggested Reading






F5 : Matrix embedding

Embedding as F4. . . extra Matrix Coding layer

n coefficients represent k bits

Flip fewer k/2 bits on average.See Week 7 for details



Statistics-aware embeddingOutguess 0.2

Modify unused coefficientsMimick original statisticTune for every statistic used in known analysis techniques

OutGuess 0.2Embedding as OutGuess 0.1.Modify selected unused coefficients to correct histogram

Flexible – adapt to any modelIf you know attacker’s model

... you mimick it.







... you mimick it.







... you mimick it.







... you mimick it.







... you mimick it.







... you mimick it.







... you mimick it.







... you mimick it.







... you mimick it.



Combinations

Statistics-aware Matrix CodingMore advanced code allows a choice of coefficient to modifyUse choice to mimick original statistical distribution

Known as Wet Paper CodesBased on Dirty Paper Codes by Costa 1983.


JPEG Calibration

Outline

1 JPEG Histogramme




5 Conclusion


JPEG Calibration The idea

Outline





5 Conclusion



The calibrated image

JPEG has a block-structureSteganography in JPEG follows the block-structureWhat happens if we de- and re-compress the image

with different block structure?
















############

�� ############






############

�� ############________

________

________

________

________��

��

��

��

��

��



Histogramme comparison

1 Decompress the image2 Crop 4 pixels; either

4 rows at top and bottom4 columns left and right4 pixels on each edge

3 Recompress using same quality factor and quantisation matrixcalled calibrated image

4 Compare histogramme of original and calibrated images5 What do you see?



Effect of calibration

Original and Calibrated image have similar statisticsMost JPEG stego-systems

change the statistics in 8× 8 grid... but the calibrated image hardly change

Statistical difference between an image and its calibration... tends to indicate a steganogram


JPEG Calibration Matlab

Outline





5 Conclusion



JPEG ToolboxDecompression

Dequantisation» Xy2 = dequantize ( Xy, Q ) ;

Inverse transform» Xy3 = ibdct ( Xy2 ) ;

Normalisation» Xy4 = uint8( Xy3 + 128 ) ;

Did it work?» imshow ( Xy4 )

Note, we have only used grayscale information.



JPEG ToolboxRecompression

New range» Xy3 = double( Xy4 - 128 ) ;

Inverse transform» Xy2 = bdct ( Xy3 ) ;

Quantisation» Xy = quantize ( Xy2, Q ) ;

Reinsertion» im.coef_arrays{im.comp_info(1).component_id} =Xy ;


Blockiness as a Statistic

Outline

1 JPEG Histogramme


3 JPEG Calibration


5 Conclusion


Blockiness as a Statistic The Blockiness Attack

Outline





5 Conclusion



The Blockiness Statistic

Compare each edge pixelwith its neighbourAdd all the differences

B =

M/8−1∑i=1

N∑j=1

|g8i,j − g8i+1,j |

+M∑

i=1

N/8−1∑j=1

|gi,8j − gi,8j+1



Information on Blockiness

Blockiness increases linearly in the number of modifiedcoefficients

Empirically confirmed

Calibration is used for comparison



Comparing slides

Suspicious image (to be classified) [S]Calibrated image [S0]Suspicious image with maximum capacity embedding on top [S1]

Sample the statistic forembedded messagesof different lengths qDistance between thecurves indicatessteganogramMessage length can beestimated



The message estimate

q =s0 − ss0 − s1

where s0, s, and s1 are the average slopes of S0, S, and S1respectively



Acknowledgment

Figures in this section are from

Suggested Reading

MSc dissertation 2007: Statistical Steganalysis by Marios Leivaditis

Core Reading

Fridrich, J., Goljan, M. and Hogea, D. (December 6, 2002) «Attackingthe OutGuess», Proc. of the ACM Workshop on Multimedia andSecurity 2002


Blockiness as a Statistic YASS

Outline





5 Conclusion


Blockiness as a Statistic YASS

YASS – Yet Another Steganographic SchemeSolanki, Sarkar, and Manjunath IH’07

Simple idea – do not use the 8× 8 grid for embedding10× 10 macro-blocks

Pseudo-random 8× 8 subblock in each macro-block... DCT-transform the subblock... embed in DCT coefficients... reconvert

Embedding creates some blockiness,but analyst does not know where to expect it


Conclusion

Outline

1 JPEG Histogramme


3 JPEG Calibration


5 Conclusion


Conclusion

Conclusion

Main challenge in stegananalysiswhat is the expected statistics for a normal image?a.k.a. baseline value

Calibrated image offers a solutionNormally very similar statistics,. . . because neighbour blocks are similar (visually)

Data embedding change blocks independentlyChanges block structure and block statistics,. . . but the calibrated image is not changed in the same way

We can use the calibrated image to estimate statistics in theoriginal coverimage.


Block Structure in JPEG and · PDF fileBlock Structure in JPEG and Steganalysis CSM25 Secure Information Hiding ... Jessica Fridrich, Miroslav Goljan, Dorin Hogea: ‘Steganalysis

Documents