Introduction to Steganalysis Schemes

8/18/2019 Introduction to Steganalysis Schemes

1/33


2/33

Outline

• Steganalysis to LSB encoding

• Steganalysis based on JPEG compatibility

• Some discussions


3/33

Introduction

• Steganography

– he art o! secret communication

– Stego content "e#g# images$ should notcontain any easily detectable arti!acts due

to message embedding

– he less in!ormation is embedded% the

smaller the probability o! introducingdetectable arti!acts


4/33

&atermar'ing (s# Steganography

)idelity

*obustness+apacity

&atermar'ing

Steganography


5/33

Steganalysis o! LSB Encoding


6/33

Goal

• o inspect one or possibly more images!or statistical arti!acts due to messageembedding in color images using theLSB method – o !ind out ,hich images are li'ely to

contain secret messages

– o estimate the reliability o! decisions• ype I error "!alse-alarm$ and ype II error

"Miss$


7/33

.pplication Scenarios

Internet

.utomatic

+hec'ing

Internet node ,ith a special !ilter

)orensics E/pert

Images in

Sei0ed computer Images sent

to a certain address


8/33

LSB Encoding

• *eplacing the LSB o! e(ery gray-le(el o!

color channel ,ith message bits

– On a(erage 123 o! the LSB are changed

– Logic behind this scheme• LSB in scanned or camera-ta'en images are

essentially random

• Encrypted "randomi0ed$ message are random

• 4o statistical arti!acts ,ill be introduced


9/33

Important Obser(ation

• 4umber o! uni5ue colors in co(er images – ypically smaller than the number o! pi/els in the images

• 678 !or high 5uality scans in BMP !ormat

• 679 or lo,er !or JPEG images or (ideo

• Many true-color images ha(e a relati(ely small :palette;

• .!ter LSB embedding% ne, color palette ,ill ha(e adistinct !eature

– Many pairs o! close colors – .n e(idence o! LSB encoding-based steganography


10/33

)ormulations

• U 7 number o! uni5ue colors in an image

• P 7 number o! close color pairs

– Two colors (R 1,G1,B1 ) and (R 2 ,G2 ,B2 ) are

close i!


11/33

he Proposed Scheme

• .!ter embedding% @ ,ill be increased to @%and ,e can e(aluate the number o! uni5ue

pairs o! P#

• he (alue o! * !or an image that does notha(e a message ,ill be smaller than that

o! an image that already has a message

already embedded in it


12/33

he Proposed Scheme "cont#$

• It is impossible to !ind a threshold o! * !or allimages – Cue to a large (ariation o! @

• Obser(ations !or reliable distinguishing – )or an image already contains a large message

• Embedding another message in it does not modi!y *signi!icantly

– )or an image not containing a message

• * increases signi!icantly – @se the relati(e comparison o! * as the decision

criterion


13/33

Cetection .lgorithm

• o !ind out ,hether or not an image has a secretmessage

6# +alculate *>P?+"@% 8$

8# @sing LSB embedding in randomly selected pi/els – Si0e o! the test message7 D a M 4 "!or M by 4 color images$‧ ‧ ‧

D# +alculate *>P?+"@%8$

# Cecide ,hether an image is embedded

– *F>* the image already had a large message hidden

– **the image did not ha(e a message in it

*?*7 the separating statistics


14/33

Limitations

• I! the secret message si0e is too small

– the t,o ratio ,ill be (ery close to each other

• &e cannot distinguish images ,ith and ,ithout

messages


15/33

E/periments

• @sing an image database o! D22 color images – D12/812 pi/els

– JPEG compressed

– +apacity !or each image7 D8#H' bits "D12/812D?H$

• . message o! length 82B "8?D o! ma/imal capacity$ ,asembedded into each image to !orm a ne, database o!images ,ith messages

• he detection algorithm is run !or both database and themessage presence is tested by embedding a test

message o! si0e 6B "a>6?D2$


16/33

E/perimental *esults

6#6

K 7 original database

7 embedded database


17/33

Parameter Optimi0ation

• Model the density !unctions as Gaussiandistributions – N(μ, σ) and N(μ s, σ s )

• Ci!!erent si0e o! secret messages%denoted as s% and test messages aretested – Secret messages7 63 to 123 – est messages7 a>2#26 – 2#1

• *esults – μ>μ s !or all s

– s decreases N(μ s, σ s ) become !lat andthe pea' mo(es right

– s increases N(μ s, σ s ) become narro,er

and the pea' mo(es le!t• Easier to separate the t,o pea's !or largersecret message si0es


18/33

hreshold Selection

ype I Error > ype II Error

"e5uals minimi0ing o(erall error$

+hange the threshold h to adust !or the importance o! not

missing an image ,ith a secret message at the e/pense o!

!alse-alarm


19/33

E/perimental *esults

K K

K K


20/33

E/perimental *esults "cont#$

K

K


21/33

+onclusions

• he probability o! error prediction is mainly determinedby the si0e o! the secret message – he in!luence o! the test message si0e is much smaller

• he optimal test message si0e is di!!erent !or di!!erent

secret message si0e• he detection algorithm mainly targets !or images ,ithsmaller number o! uni5ue colors – he results !or high-5uality scanned and loselessly compressed

images "@2#1M4$ may be unreliable


22/33

Steganalysis Based on JPEG

+ompatibility


23/33

Image Steganography

• Image !ormats

– @ncompressed "BMP$

• O!!ering the highest capacity and best o(erall security

– Palette "GI)$

• Ci!!icult to pro(ide security ,ith reasonable capacity

– Lossy compressed "JPEG% JPEG 8222$

• Ci!!icult to hide message in JPEG stream in a secure

manner ,hile 'eeping the capacity practical


24/33

Goal o! this Paper

• o sho, that images may be e/tremely poorcandidates !or co(er images i!

• Initially ac5uired as JPEG images and later decompressed to aloseless !ormat

• )or steganalysis methods% minimal amount o!distortion is to be achie(ed to reduce (isible arti!acts – he act o! message embedding ,ill not erase the

characteristic structure created by JPEG compression – .naly0ing the C+ coe!!icients o! images to reco(er e(en

the (alues o! JPEG 5uanti0ation table

• E(idence !or steganography – .n image stored in loseless !ormat that bears a strong

!ingerprinting o! JPEG compression% yet is not !ullycompatible ,ith JPEG compressed image


25/33

JPEG +ompression

Uncompressed Image

Borig

C+

d'"i$% i>2%%9D

C'"i$>*ound "d'"i$?N"i$$

JPEG Nuanti0ation Matri/ N

ig0ag-scanu!!man coder


26/33

JPEG Cecompression

• u!!man decoding

• NC'"i$>N"i$C'"i$

– Multiplying 5uanti0ed C+ step ,ith

5uanti0ation step• Bra,>C+-6"NC $

– In(erse C+

• B>QBra,R – rounded to integers in the range o! 2-811


27/33

Obser(ations

• I! the bloc' B has no pi/els saturated at 2or 811

–


28/33

he Proposed Scheme

• Nuestion – Gi(en an arbitrary H/H bloc' B o! pi/el (alues% could this bloc'

ha(e arisen through the process o! JPEG decompression ,iththe 5uanti0ation matri/ N "i! a(ailable$T

–


29/33

.lgorithm

6# Ci(ide the images into H/H bloc's

8# .rrange the bloc's in a list% and remo(e all

saturated bloc's !rom the list

• 7 number o! remaining bloc'sD# E/tract the 5uanti0ation matri/ N !rom all

bloc's

• I! all elements o! N are 6s% the image is not

calculated


30/33

.lgorithm "cont#$

# )or each bloc' B% calculate S1# I! S69%

B is not compatible ,ith JPEG compression#

else

Per!orm the additional chec'9# .!ter going through bloc's% i! no incompatible bloc's is

!ound% no e(idence o! steganography is a(ailable#

V# *epeat the algorithm !or di!!erent H/H di(ision !or

detecting cropped images


31/33

E/tracting the Nuanti0ation Matri/


32/33

Some Ciscussions


33/33

*e!erence

• J# )ridrich% *# Cu and M# Long% :Steganalysis o!LSB encoding in color images% ; I+ME 8222%4e, Wor'% 8222

• J# )ridrich% M# Golan and *# Cu% :Steganalysis

based on JPEG compatibility%; SPIE MultimediaSystems and .pplications IX% Cen(er% 8226

• G# Goth% :Steganalysis gets past the hype% IEEECistributed Systems Online% .pril 8221

Introduction to Steganalysis Schemes

Documents