PROPOSAL “EDGE STEGO DIGIT WATERMARK” A. Astapkovich State University of Aerospace Instrumentation 2011.

PROPOSAL “EDGE STEGO DIGIT WATERMARK”

A. Astapkovich

State University of Aerospace Instrumentation

2011

Preliminary_1: digital fingerprinting formalizm• Special notations will be used:

• In common case watermarking suppose using the encryptions and whole procedure is described with I x K x M → I”

where I - container imageK – encryption keyM – watermark

• Attack is described with

I” x A → IA” container image after attack MA” watermark image extracted from attacked image

• Number of pixel in image Im will be described as

NP (Im)

Preliminary_2: robustness measurements

Let us N (I1,I2) is some norm for difference between images I1 and I2

Robustness is described with the vector

N ( I, I”) - quality of the watermarked image

N (I, IA”) - attack wildness

N (M,MA”) – quality of the extracted watermark image after the attack

N (M,MA”)/ N (I,IA”) - relative robustness of the watermarking procedure;

Goal of the research

THEORY

Creating the knowledge base to support research activity in digital watermarking and digital fingerprinting fields; Developing and investigating the new concepts for robust

watermarking and fingerprinting algorithm oriented for the digit video applications;

PRACTICE

The digital fingerprinting method for high quality video files has to be developed;

The method has to be realized as the demo version of the soft tool for fingerprinting;

Basic requirements - practice

Video file has format 1080p60 and is compressed with MPEG4;

1 min segment of video file can be used for the fingerprinting;

Method has to withstand attacks:

rotation, small enlargements with cropping, noising,

small nonlinear distortions, down sampling up to

720p30, collusion attack with at least 100 copies;

Basic requirements - theory

Volume of the container (set of images) is the huge in comparizon with the marking information

NP (M ) << NP( ∑ Im ) (C.1)

Any watermark can be destroyed with severe attack and to provide the surviving of the fingerprint method has to meet the condition

N (M,MA”)/ N (I,IA”) < 1 (C.2) Existence of the embedded watermark is more important than the quality of

extracted image, but has to be good enough to be recognized

N (M,MA”) < prescribed level (C.3)

Edge watermark concept

Any watermark can be destroyed by attack with strong enough wildness

Attacked image has to have

N (I, IA”) < corrupted quality

Watermarking method has to be build such way that

N (M,MA”)/ N (I,IA”) < 1 It is reasonable to build the watermark to most fragile element of image, like edges

Possibility to use edge region has to be investigated, also

Digital Fingerprinting Method (DFM)

DFM includes:

method to Generate the Fingerprint Set (GFS)

method to generate the Set of Marking Positions (SMP)

method to Embed the Marking Information at selected marking positions (EmMI) and method to Extract the Marking Information (ExMI)

method to Interpretation Extracted Fingerprint (IEF)

Generating the Fingerprint Set (GFS)

To provide robustness the fingerprinting information is converting to set of the images

C 0 1 2 3

C0123… -> I0, I1, I2,I3 ,I4..

This images have to be embed to appropriate frames of video to survive against conclusion attack

Images can be used directly or as wavelet decomposition components: LL,LH,HL,HH and so on

Generating the Set of Marking Positions (SMP)

To provide robustness against collusion attack SMP has to provide possibility the Boneh-Shaw fingerprint scheme (code)

For c+1 total users Boney-Shaw code uses

O ( с3 log (1/ε) )

bits to attain security against coalition of size c with error ε

Boneh-Shaw code is used as building block for many sophisticated digital watermarking schemes

Condition (C.1 ) provides possibility to build method with Boneh-Shaw code for C >> 100

Distortion against collusion

Other possibilities have to be proposed and investigated As example :

Collision attack based on difference of the images and creating the new version to eliminate the distributor ability to trace the object to any of them

Little distortion of images with digital fingerprint destroy the simple collusion attack scheme

Simple averaging will destroy the images and make collusion copy worthless

Example of the edge watermarking

(I).bmp = 640x480

NP (EDGE) = 68698 NP(M) = NP( 100x100)= 104 бит

(I x M ).bmp = 640x480

• Marking Image was build to set of G and B components

of edge pixels, generated with CANNY edge detector;

Extracted M

Method to Embed the Marking Information (EmMI)

Kutter algorithm for embedding provides defense against the noising attack

Mi - bit of marking information I = {R,G,B} container

p(x,y) – selected position for embedding ;

Mi is embedded to B channel

L(p)= 0.299 R(p) +0.587 G(p)+0.114 B(p) B(p) + q*L(p), if Mi =0

B(p)” = B(p) - q*L(p), if Mi =1

q – robustness parameter ( larger q leads to better robustness)

In order to increase robustness every bit is embedded r times as the cross figure (7*7, с = 3), so total number is

N = 3*r ;

Method to Extract the Marking Information (ExMI) ;

Kutter algorithm for blind ExMI related with EmMI

The bit value is determined by looking at the sign of the

difference between the pixel under inspection and the estimated original

Modification of ExMI + EmMI on base Kutter algorithm for

edge pixel set has to be developed

Robustness of the wavelet decomposition

As estimates the result of work Mohsen Ashourian, Peyman Moallem, Yo-Sung Ho “A Robust Method for Data Hiding in Color Images” can be used //PCM (2) 258-269 , 2005;

LL,HL,LH,HH Haar components of watermark (MASTER b/w

image) is imbedded with modified Kutter algorithm

a b

c d(a+b+c+d)/4

(a-b+c-d)/4

(a+b-c-d)/4 (a-b-c+d)/4

LL LH

HL HH

MH1MASTER_PIC

Eхамples of the wavelet decomposition approach

LL LH

HL HH

• Watermark MASTER image had the size ½ * ½ * 1/3 of the container image;

Container images

Robustness against the compression attack

PSNR for compression with JPEG

• The published results demonstrate the good robustness properties against compression with JPEG and JPEG2000

Extracted watermark image

for Q=55

• Robustness to MPEG4 has to be investigated ;

Robustness against down sampling attack

Origin watermark Extracted watermark

after ½ down sampling

• This is possible due to decomposition of the watermark image and the mixing of Haar components during embedding

Robustness against the filtering attack

PSNR (dB) for extracted M MF GF

Parrots 20.65 25.80Boats 21.65 24.43

Median filtering (MF) Gauss filtering (GF)

Robustness against the cropping attack

IA” MA” for 10% cutting

• Wavelet decomposition of the M provides high robustness for this type of attack ;

Open questions

Robustness is described with the vector and

some approaches have to be investigated:

what norm has to be used ?

is it the same norm has to be used for all components ?

what level of norm meanings has to be defined from practical point of view ?

For IEF stage norm has to be selected also ;

Brief norm review Classical approach is using the peak signal-to-noise ratio (PSNR)  and MSE ;

MAXI — maximal pixel meaning value (for 8-bit w/b image MAXI = 255);

PSNR is no sign measure and useful for small distortions case;

Original image Enhanced contrast

PSNR=25 dB

JPEG compression

PSNR=25 dB

Attack wildness measurements

MASTER_PIC

To measure the attack wildness the linear measure has to be used (at least)

NL 105 0

Nx 1

i 0

Ny 1

j

O_Ij i D_I

j i 2

Nx Ny MAX

NOISY_MASTER_50

NOISY_MASTER_100 NOISY_MASTER_200

0 50 100 150 2000

10

20

30

40

50

60

PSNRi

i

0 50 100 150 2000

100

200

300

NLi

i

Salt and pepper noise attack Noise amplitude

PSNR can be modified (as example)

Modern structural norms

Original image

MSE=0

SSIM=1

CW-SSIM=1

MSE=306

SSIM=0.928

CW-SSIM=0.938

Enhanced contrast Distorted brightness

MSE=309

SSIM=0.987

CW-SSIM=1

Gauss noise

MSE=309

SSIM=0.576

CW-SSIM=0.814

Zhou Wang and Eero P. SimoncelliTranslation insensitive image similarity in complex wavelet domain / Proc. IEEE Inter. Conf. Acoustic, Speech & Signal Processing Volume II, Pages 573-576, March 2005

Some new ideas based on structural symmetry (SSIM) and complex wavelet structural symmetry (CW-SSIM) can be useful for the watermarking applications

Modern structural norms

MSE=313

SSIM=0.73

CW-SSIM=0.811

Impulse noise JPEG

compression

Enlargement

MSE=309

SSIM=0.58

CW-SSIM=0.63

MSE=694

SSIM=0.505

CW-SSIM=0.925

MSE= 873

SSIM= 0.399

CW-SSIM=0.933

Rotation to left

Metrology benchmark image library and software tools have to be created

Structural similarity norm can be useful for estimation of the quality of

the extracted watermark N (M,MA”)

Noiseproof edge detector

Edge watermarking withstand some attacks like cropping, rotation, displacement easily

For blind watermarking this approach needs a noise proof edge detector

Concept of the neuron like adaptive noise proof edge detector was proposed and investigated

“The teaching by showing” methodology was used : this approach is very flexible : different samples can be used during initial learning filter can increase experience due to additional learning with new samples

This approach can be classified as “open algorithm approach”

Canny edge detector

Clean image

Noisy image edges Noisy image

Canny filter is the best edge detector, but …..

Clean image edges

Neuron adaptive linear filter

Initial learning min II Sw – F II w

Adding the new experience is not very expensive procedure

Let us Sek = ∑ SkTSk - experience matrix for k samples

Fek = ∑ SkTFk – experience vector for k samples

New filter weights Wk+1 = (Sek + S k+1T Sk+1 + E) –1 * (Fek+Sk+1

T Fk+1)

S1 S2 S3

S4 S5 S6

S7 S8 S9image

Filter 3*3S1

S2

SNSEN

1

(S,W)

THmin THmax

W = (ST S + E) –1 ST F

Neuron like adaptive noise proof edge detector

NHL5_FIG_2N

TRmin = 40

NHL5_FIG_1N

TRmin = 40

NHL5_FIG_2C

TRmin = 30

Results of filtering for the clean and noisy test image with H51 and H52 filters with different low threshold (Trmin)

H51

1.431 103

0.069

0.137

0.083

4.21 103

0.073

0.143

0.094

0.164

0.066

0.134

0.09

0.371

0.076

0.151

0.071

0.148

0.091

0.159

0.074

8.796 103

0.071

0.145

0.07

3.713 104

H52

6.134 103

0.051

0.034

0.052

0.012

0.036

0.117

0.044

0.128

0.037

0.051

0.034

0.541

0.036

0.054

0.041

0.107

0.04

0.13

0.041

4.03 103

0.043

0.038

0.047

9.927 103

H51_CONST 4.991H52_CONST 2.265

Methodology is universal and has no limits on size of edge filter

Example of 5*5 filter, learned with one and two sample noised images

MASTER_PIC

M_TEST_52H_30 M_TEST_52H_60 M_TEST_52L_30 M_TEST_52L_60

Real image test

Two linear 5*5 filter were used to find the edges

with different prescribed low thresholds

Artificial generated pictures with added noise were

used to generate the learning samples

Different teacher samples were used

Filter, learned with LAPLAS edge detector

Filter, learned with hand pointed edge

low threshold : 30 and 60

Conclusion : result is the vector

Method component

The fingerprinting based on multiple description subband ( wavelet decomposition) image coding, that is embedded to edge domain with modified Kutter algorithm has to be investigated as the possible solution

Some preliminary estimates demonstrate a good robustness against the various signal processing and geometrical attacks

2D embedding process (spatial + time) domains has to be investigated as the defense against the set of attacks (includes collusion)

Theory component

Vector approach for robustness measurements has to be developed and investigated Adaptive algorithm on base of neuron net approach for edge detector has to be developed and investigated

Practice component

Metrology base has to be created

The demo version of the digital fingerprinting tool has to be created