Steganalysis in JPEG - University of Surrey€¦ · Steganalysis in JPEG CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey Spring 2007 ... Reading Core

Steganalysis in JPEGCSM25 Secure Information Hiding

Dr Hans Georg Schaathun

University of Surrey

Spring 2007

Dr Hans Georg Schaathun Steganalysis in JPEG Spring 2007 1 / 24

Learning Outcomes

learn additional techniques for steganalysis in the JPEG domain.


Reading

Core Reading

Jessica Fridrich, Miroslav Goljan, Dorin Hogea: «Steganalysis of JPEGImages: Breaking the F5 Algorithm» 5th Information Hiding Workshop,Noordwijkerhout, The Netherlands, 7–9 October 2002, pp. 310-323


JPEG Histogramme Histogramme

Outline

1 JPEG HistogrammeHistogrammeMatlab

2 JPEG CalibrationThe ideaMatlab

3 Conclusion



The JPEG Coefficients

Recall that JPEG uses the blockwise DCT transform8× 8 blockscalled DCT coefficients (floating point)

The entries are quantised,called JPEG coefficients (integers)

Each block hasone DC coefficient, (0, 0)63 AC coefficients, (i , j) 6= (0, 0), 0 ≤ i , j ≤ 7



Histogramme

We calculate the histogramme of the AC JPEG coefficientsh(x) is the number of coefficients equal to x

Frequency-wise histogrammehij(x) is the number of blocks where coefficient (i , j) is equal to x

DC histogramme h00(x)

The histogramme can be plottedcurvebar chart



Histogramme







Histogramme






JPEG Histogramme Matlab

Outline



3 Conclusion



JPEG ToolboxReading a JPEG image

» im = jpeg_read ( ’Kerckhoffs.jpg’ )

im =image_width: 180image_height: 247

image_components: 3image_color_space: 2jpeg_components: 3jpeg_color_space: 3

comments: {}coef_arrays: {[248x184 double] [128x96 double] [128x96 double]}quant_tables: {[8x8 double] [8x8 double]}

ac_huff_tables: [1x2 struct]dc_huff_tables: [1x2 struct]optimize_coding: 0

comp_info: [1x3 struct]progressive_mode: 0

»



JPEG ToolboxJPEG data

» Xy = im.coef_arraysim.comp_info(1).component_id ;» whos XyName Size Bytes Class AttributesXy 248x184 365056 double

» Q = im.quant_tablesim.comp_info(1).quant_tbl_no

Q =6 4 4 6 10 16 20 245 5 6 8 10 23 24 226 5 6 10 16 23 28 226 7 9 12 20 35 32 257 9 15 22 27 44 41 3110 14 22 26 32 42 45 3720 26 31 35 41 48 48 4029 37 38 39 45 40 41 40

»



w/o the toolboxLoad/Save workspace

jpeg_read and jpeg_write are compiled functions,Non-trivial to install

In the exercises, can load presaved workspaces

» load ’image.mat’» whosName Size Bytes Class Attributesim 1x1 575836 struct

There is one mat-file for each image on the web page



Other toolbox functions

I recommend that you use the other toolbox functionsbdct, ibdct, quantize, dequantize

These are m-files, which can be copied into current directory.

Alternatively, use matlab on tweek which has the toolbox.



Extracting AC coefficients

Consider N ×M matrix, AIf B is a boolean (logical) N ×M matrix,

then A(B) is a vector consisting of all elements from Acorresponding to a 1 (true) in B

Suppose we run (where A is N ×M DCT image)1 B = logical(ones(8,8)) % Make 8x8 matrix of ones2 B(1,1) = 0 % DC coefficient : zero3 BB = repmat ( B, N/8, M/8 ) % Concatenate block

for full image4 X = A(B) % Vector of AC coefficients



HistogrammeMatlab

We have discussed histogrammes beforeEssentially you need two functions

hist to extract frequenciesbar to make the plot

Refer to help filesand to exercise sheet



ExerciseJPEG Histogramme

1 Refer to details on the exercise sheet.2 Download Image A from the web site; and load it in Matlab.3 Make a vector X of AC coefficients (luminence) from A4 Plot a histogramme of the JPEG AC coefficients of A.


JPEG Calibration The idea

Outline



3 Conclusion



The calibrated image

JPEG has a block-structureSteganography in JPEG follows the block-structureWhat happens if we de- and re-compress the image

with different block structure?
















############

�� ############






############

�� ############________

________

________

________

________��

��

��

��

��

��



Histogramme comparison

1 Decompress the image2 Crop 4 pixels; either

4 rows at top and bottom4 columns left and right4 pixels on each edge

3 Recompress using same quality factor and quantisation matrixcalled calibrated image

4 Compare histogramme of original and calibrated images5 What do you see?


JPEG Calibration Matlab

Outline



3 Conclusion



JPEG ToolboxDecompression

Dequantisation» Xy2 = dequantize ( Xy, Q ) ;

Inverse transform» Xy3 = ibdct ( Xy2 ) ;

Normalisation» Xy4 = uint8( Xy3 + 128 ) ;

Did it work?» imshow ( Xy4 )

Note, we have only used grayscale information.



JPEG ToolboxRecompression

New range» Xy3 = double( Xy4 - 128 ) ;

Inverse transform» Xy2 = bdct ( Xy3 ) ;

Quantisation» Xy = quantize ( Xy2, Q ) ;

Reinsertion» im.coef_arrays{im.comp_info(1).component_id} =Xy ;



ExerciseJPEG Image Calibration

1 Refer to details on the exercise sheet.2 You still have the image A from the previous exercise.3 Make an m-file which takes an image as input and outputs the

calibrated image.Make a calibrated image A′ from A.

4 Plot a histogramme of the JPEG AC coefficients of A′.5 Compare the two histogrammes and comment.



Exercise (Part 2)JPEG Image Calibration

1 Refer to details on the exercise sheet.2 Download Image B from the web site; and load it in Matlab.3 Make a calibrated image B′ from B, as in Part 1.4 Plot histogrammes (JPEG coefficients) of B and B′ (as in the

previous part)5 Compare the histogrammes of A, B, A′, and B′.

What do you see?Do you think A and/or B is a stegogramme?


Conclusion

Conclusion

Compare an image and its calibrated imageNormally very similar statistics,. . . because neighbour blocks are similar (visually)

Data embedding change blocks independentlyChanges block structure and block statistics,. . . but the calibrated image is not changed in the same way

We can use the calibrated image to estimate statistics in theoriginal coverimage.


Conclusion

In general

Main challenge in stegananalysiswhat is the expected statistics for a normal image?a.k.a. baseline value

(Extra) Structural SteganalysisLook out for features in the JPEG formatWhat is in the comments field?Matlab gives you access to this field...See Image D


Steganalysis in JPEG - University of Surrey€¦ · Steganalysis in JPEG CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey Spring 2007 ... Reading Core

Documents

Steganalysis in JPEG - University of Surrey€¦ · Steganalysis in JPEG CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey Spring 2007 ... Reading Core