1 / 61

Multimedia Steganalysis as Part of Software IV & V

Qingzhong Liu, Sam Houston State University Noble Nkwocha , NASA Andrew H. Sung, New Mexico Institute of Mining & Technology. Multimedia Steganalysis as Part of Software IV & V. Steganography Steganalysis as part of IV & V  Image steganalysis Audio steganalysis

martin-blake
Download Presentation

Multimedia Steganalysis as Part of Software IV & V

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Qingzhong Liu, Sam Houston State University Noble Nkwocha, NASA Andrew H. Sung, New Mexico Institute of Mining & Technology Multimedia Steganalysisas Part ofSoftware IV & V

  2. Steganography • Steganalysis as part of IV & V  • Image steganalysis • Audio steganalysis • Discussion Overview

  3. Steganography ─ invisible cryptography • Greek origin • Covered/hidden writing • Covert communication • Steganography = hidden message + Carrier + steganography_key steganography

  4. carrier Others TCP/IP packets Images Video files Audio streams

  5. Example 1

  6. Example 2

  7. Any Difference ? No hidden data 628-byte message cover (carrier) stego-image (steganogram)

  8. Threat posed by sTEGANOGRAPHY

  9. Alleged use by terrorists A “Terrorist Training Manual", contained a section entitled "Covert Communications and Hiding Secrets Inside Images” Terrorism Monitor 5(6), March 30, 2007. The Jamestown Foundation, Washington, DC 20036 http://www.jamestown.org/programs/gta/single/?tx_ttnews[tt_news]=1057&tx_ttnews[backPid]=182&no_cache=1 Hidden data (payload) The Cover Technical Mujahid, Issue #2

  10. Steganography • Image steganalysis • Audio steganalysis steganalysis

  11. Image steganography Modifying pixel values e.g., Hide data in the header file of an image file Space-hiding Others Transform-hiding Modifying transform coefficients

  12. An example of Least significant Bit (lsb) embedding Bit-plane 7 Bit-plane 6 Bit-plane 5 Bit-plane 4 8-bit grayscale cover 8-bit grayscale steganogram Bit-plane 3 Bit-plane 2 Bit-plane 1 Bit-plane 0 from http://en.wikipedia.org/wiki/Image:Lichtenstein_bitplanes.png

  13. LSB embedding modifies the statistics of the cover, it enables us to detect the information-hiding — 2 - statistical analysis (Westfeld and Pfitzmann 2000, Lecture Notes in Computer Science) — Histogram Characteristic Function Center Of Mass (HCFCOM) (Harmsen and Pearlman 2003, Proc. of SPIE) — High-Order Moment statistical model in the Multi-Scale decomposition (HOMMS) (Lyu and Fari 2005, IEEE Trans. Signal Processing) — A.HCFCOM and C.A.HCFCOM (Ker 2005, IEEE Signal Processing Letters) steganalysis of lsb embedding

  14. LSB matching does not alter the statistics — randomly change some pixels by + 1 or -1,not simply replace the LSB • The detection is much more difficult T. Sharp, “An Implementation of Key-Based Digital Signal Steganography”, Lecture Notes in Computer Science, vol. 2137, pp. 13–26 lsb matching

  15. Histogram Characteristic Function Center Of Mass (HCFCOM) (RPI,Harmsen and Pearlman 2003, Proc. of SPIE) • High-Order Moment statistical model in the Multi-Scale decomposition (HOMMS) (Dartmouth College,Lyu and Farid 2005, IEEE Trans. Signal Processing) • Adjacent HCFCOM and Calibrated Adjacent HCFCOM (A.HCFCOM and C.A.HCFCOM) (Cambridge Univ., Ker 2005, IEEE Signal Processing Letters) The papers did not consider “image complexity” as a factor in evaluating detection performance Steganalysis of lsb matching

  16. Information-hiding ratio — The ratio of the size of hidden data to the maximal embedding capacity Relationship between detection performance and image complexity was notclearly illustrated “Image complexity is another important parameter for evaluation” * *Liu, Sung, Xu, Ribeiro (2006)“Image Complexity and Feature Extraction for Steganalysis of LSB Matching Steganography”. Proc. 18th International Conference on Pattern Recognition, ICPR (2):267-270 Evaluation of detection performance

  17. Image complexity & measurement Relationship among image complexity, information-hiding ratio and steganalysis performance Improvement of the detection of LSB Matching issues

  18. Image complexity (1) Low complexity VS. High complexity Flat, smooth Non-flat, more details

  19. Image complexity (2) • Generalized Gaussian Distribution (GGD) in the transform domain Shape parameter Transform coefficient Scale parameter • Calculation of shape parameter • Sharifi and Leon-Garcia (1995)“Estimation of Shape Parameter for Generalized Gaussian Distributions in Subband Decompositions of Video”, IEEE Trans. Circuits Syst. Video Technol, 5: 52–56

  20. Image complexity (3) * Liu et al. (2008), “Image Complexity and Feature Mining for Steganalysis of Least Significant Bit Matching Steganography”. Information Sciences 178(1): 21-36

  21. Image complexity (4) As image complexity increases, GGD shape parameter increases. Image complexity measured by the GGD shape parameter

  22. High correlation of adjacent pixels lsb matching steganalysis: feature design (1) Joint distribution of adjacent pixels Y X X: left-adjacent pixel value Y: right-adjacent pixel value

  23. Hypothesis : Information hiding in the spatial domain will affect the joint distribution of adjacent pixels • Design different features Liu, Sung, Ribeiro, Wei, Chen, Xu (2008)“Image Complexity and Feature Mining for Steganalysis of Least Significant Bit Matching Steganography”. Information Sciences, 178(1): 21-36 lsb matching steganalysis: feature design (2)

  24. image complexity and detection performance ROC curves (Color images, 50% maximal hiding ratio) X-axis: False Positive (FP) Y-axis: False Negative (FP) 2. Our approach prominently improves the detection performance 1. At a fixed hiding ratio, detection performance decreases as image complexity increases

  25. image complexity, hiding ratio & detection performance Detection accuracy (color image, 100%, 75%, 50% & 25% maximal hiding ratio) 100% 75% Results of my method Results of HCFCOM Results of HOMMS 50% 25%

  26. image complexity, hiding ratio & detection performance Detection accuracy (color image, 100%, 75%, 50% & 25% maximal hiding ratio) 100% 75% Results of my method Results of HCFCOM Results of HOMMS • As information-hiding ratio decreases, detection performance decreases 50% 25%

  27. image complexity, hiding ratio & detection performance Detection accuracy (color image, 100%, 75%, 50% & 25% maximal hiding ratio) 100% 75% Results of my method Results of HCFCOM Results of HOMMS • As image complexity increases, detection performance decreases 50% 25%

  28. image complexity, hiding ratio & detection performance Detection accuracy (color image, 100%, 75%, 50% & 25% maximal hiding ratio) 100% 75% Results of my method Results of HCFCOM Results of HOMMS • Our method outperforms other two well-known methods 50% 25%

  29. Image steganography Space-hiding Others Transform-hiding

  30. hiding data IN jpeg images DCT Original block Transformed block Quantization matrix Bit-stream 15 0 -2 -1 -1 -1 0 … Encoding Zig-zag scan Quantized DCT coefficients

  31. hiding data IN jpeg images DCT Original block Transformed block Quantization matrix Hiding 0 1 0 1 0 0 1 1 15 0 -1 0 -1 0 0 1 -1 … Zig-zag scan Modified quantized DCT coefficients Original quantized DCT coefficients

  32. Steganalysis of Jpeg images • Feature-based Steganalysis (SUNY-Binghamton,Fridrich 2004, Information Hiding) • Markov Approach on Intra-block (NJIT, Shi, Chen andChen 2006, Information Hiding) • Merging Markov Approach and Feature-based Steganalysis • (SUNY-Binghamton, Pevny andFridrich 2007, SPIE) • Markov Approach on Intra-block & Inter-block • (NJIT, Chen and Shi 2008, IEEE symposium on Circuits and Systems; • NMT, Liu et al. 2008, IJCNN) Why is Markov approach successful?

  33. Modification of joint density • In several JPEG-based steganographic systems, when a covert message is embedded in the DCT domain • The DCT neighboring joint density is modified, which results in the change of the Markov transition probability • Markov approach does not completely explore the relation of neighboring coefficients Neighboring joint density features may be better than Markov transition probability features Liu, Sung, and Qiao. “Improved Detection and Evaluation for JPEG Steganalysis”, ACM-MM09

  34. example Cover F5 stego-image Steghide stego-image

  35. example Cover F5 stego-image Steghide stego-image

  36. Experimental results (1) Mean testing accuracy over 100 experiments M: Markov transition feature set NJ: Neighboring Joint density feature set

  37. Experimental results (2) Mean testing accuracy over 50 experiments under different image complexities (High image complexity corresponds to high GGD shape parameter) M: Markov transition feature set NJ: Neighboring Joint density feature set On average, neighboring joint density features are better than Markov transition features. As image complexity increases, detection performance decreases.

  38. Steganography • Image steganalysis • Audio steganalysis steganalysis

  39. Two voices The left voice is hidden in the right. 2013/9/9

  40. “In several audio hiding systems, the derivatives of a cover signal and the stego-signal have different high-frequency spectra” Fourier spectrum steganalysis (FSS) Liu, Sung and Qiao (2009) Spectrum Steganalysis of Digital WAV Audios, Proceedings of 6th International Conference on Machine Learning and Data Mining (MLDM 2009, Germany, July 2009), LNAI Vol. 5632, pp.582-593.

  41. Noise addition model for fss

  42. Noise addition model for fss

  43. Noise Addition model for fss

  44. Noise Addition model for fss

  45. Noise Addition model for fss

  46. SPECTRUM Of ERROR DERIVATIVE Low frequency High frequency Information-hiding in audios increases the magnitude of the high frequency spectrum

  47. DERIVATIVE Spectrum: cover VS. STEGO Information-hiding in audios increases the magnitude of the high frequency spectrum

  48. Then, can we directly use high-frequency statistics for detection? question Information-hiding in audios increases the magnitude of the high frequency spectrum

  49. Are there any hidden data with these two voices? EXAMPLE Different voices have different characteristics on the high frequency spectra Without reference, the detection may be incorrect! One is cover, the other is stego. Which one does it carry hidden data? x Cover Stego High-frequency spectrum

  50. Variance of Power spectrum (stego) Power spectrum of the second derivative of the signal Power spectrum of the second derivative of the error The change rate of power spectrum of the second derivative of the stego-audio is quite different from that of original cover

More Related