Steganalysis of Block-DCT Image Steganography Ying Wang and Pierre Moulin Beckman Institute, CSL ECE Department University of Illinois at Urbana-Champaign.

Steganalysis of Block-DCT Image Steganography

Ying Wang and Pierre Moulin

Beckman Institute, CSL & ECE DepartmentUniversity of Illinois at Urbana-Champaign

September 29th, 2003

2

Introduction• Steganography is a branch of information hiding,

aiming to achieve perfectly secret communication.

3

Steganographer vs. Steganalyzer

Steganographer

• Embedding distortion

• Various embedding methods can be used.

Steganalyzer

• Trace of embedding?– Is typical of ?

• Detection methods– Ad hoc– Detection-theoretic

eDNX NS

P

4

Block-DCT Embedding

Spatial domain

• Host image:

• 2-D stationary process with 0 mean and correlation function

DCT domain

• -DCT coefficients:

• 64 equal-size channels containing approximately independent data, with variances

88),(~ lku

u(m,n)

)],(),([),( tnsmunmuEtsru ),(2~ lku

5

8

8

8

8

Spatial domain DCT domain

),( nmu ),(~ lku

6

Modified Spread Spectrum Data Hiding Model

DCT domain

• Marked DCT coefficients:

• Constraint and 1-D undetectability constraint:

Spatial domain

• Stego-image:

),(~),(~),(~ lkzlkvlku

),(~~, lkua lk )),(,0( 2

~ lkN z

.,,),(~),(~ lkpp lkulku

),(),(),( nmznmvnmu

),(),(~),(~DCT

IDCT

nmvlkulka

eD ),(),(~DCT

IDCT

nmzlkz

zv

7

Statistics of the Pixel Differences

• Block processing introduces discontinuity at the block boundaries

• Develop steganalysis method based on pixel differences!

8

Host image

• is a stationary process with

zero mean and correlation function

• The pdfs for all pairs are the same

Stego-image

• is non-stationary

• The pdfs for inner pairs and border pairs are

different

)1,(),(),( nmunmunmd )1,(),(),( nmunmunmd

)1,()1,(),(2

][),( ,,

lkrlkrlkr

ddElkr

uuu

lnkmnmd

}{ 0d}{ 1d

9

10

Binary Hypothesis Testing Problem

• Two populations

• Difficulty: pdfs are unknown!

• We use non-parametric two-sample goodness-of-fit tests such as Komogorov-Smirnov (K-S) test.

}{ 1d

• K-S test: F0 and F1 are cumulative

density functions.

• Test statistic:

101

100

::

FFHFFH

)()(sup 10, xSxSDx

NM

NxnmdxSMxnmdxS/),(#)(/),(#)(

11

00

}{ 0d

11

• The decision rule with is

FAP

.1/001

,,,

,,,

,,,

NMNM

NMNM

NMNM

D

DDDDDD

12

Discussion

• With the same embedding strength, stego-images of smooth host images such as Lena and Jet, are more likely to be detected than those of images with noise-like textures, such as Baboon.

– The best candidates for steganography are complex images such as Baboon.

– Block-DCT steganography is not suitable for smooth images.

13

• The key idea of our paper is to find an intrinsic property of natural images, which is modified by the information hiding process.

– Another example: detecting wavelet-based information hiding. Upsampling introduces a stationary process in one subband to a non-stationary process in the spatial domain.

14

• The K-S test is universal in the sense that the pdfs can be unknown.

• Comparing the K-S test with the likelihood ratio test, their universality is achieved at the cost of performance degradation.

15

References• N. F. Johnson and S. Katzenbeisser, ``A survey of

steganographic techniques", in S. Katzenbeisser and F. Peticolas (Eds.): Information Hiding, pp.43-78. Artech House, Norwood, MA, 2000.

• J. D. Gibbons and S. Chakraborti, Nonparametric statistical inference, Marcel Dekker, New York, 1992.

• L. Breiman, Probability, SIAM, Philadelphia, 1992.

• O. Dabeer, K. Sullivan, U. Madhow, S. Chandrasekharan, and B. S. Manjunath, ``Detection of hiding in the least significant bit", Proc. CISS, The Johns Hopkins University, Mar. 2003.

16

Lena Baboon