Qingzhong Liu, Sam Houston State University

Noble Nkwocha, NASA

Andrew H. Sung, New Mexico Institute of Mining & Technology

MULTIMEDIA STEGANALYSISAS PART OF

SOFTWARE IV & V

2

SteganographySteganalysis as part of IV & V Image steganalysis Audio steganalysisDiscussion

04/19/2023

OVERVIEW

3

Steganography ─ invisible cryptography

Greek origin Covered/hidden writing Covert communication Steganography

= hidden message + Carrier + steganography_key

STEGANOGRAPHY

04/19/2023

4

Images

Audiostreams

TCP/IP packets

Others

Videofiles

CARRIER

04/19/2023

5

Alzheimer's: The Mysteries of the Most Common Form of Dementia In November of nineteen ninety-four, Ronald Reagan wrote a letter to the American people. The former president shared the news that he had Alzheimer’s disease. Mister Reagan began what he called his journey into the sunset of his life. That ten year journey ended on June fifth, two thousand four, at the age of ninety-three. In his letter, America's fortieth President wrote about the fears and difficulties presented by Alzheimer’s disease. He said that he and his wife Nancy hoped their public announcement would lead to greater understanding of the condition among individuals and families affected by it. Ronald Reagan was probably the most famous person to suffer from Alzheimer's disease. In the United States, about four million five hundred thousand people have the disease. Many millions more are expected to have it in years to come. Doctors describe Alzheimer's as a slowly increasing brain disorder. It affects memory and personality -- those qualities that make a person an individual. There is no known cure. Victims slowly lose their abilities to deal with everyday life. At first they forget simple things, like where they put something or a person’s name. As time passes, they forget more and more. They forget the names of their husband, wife or children. Then they forget who they are. Finally, they remember nothing. It is as if their brain dies before the other parts of the body. Victims of Alzheimer’s do die from the disease, but it may take many years.

The source of hidden data: http://www.voanews.com/specialenglish/2007-01-15-voa2.cfm

EXAMPLE 1

04/19/2023

6

EXAMPLE 2

04/19/2023

7

628-byte messageNo

hidden data

stego-image(steganogram)

cover(carrier)

ANY DIFFERENCE ?

04/19/2023

8

THREAT POSED BY STEGANOGRAPHY

04/19/2023

9

ALLEGED USE BY TERRORISTS

04/19/2023

A “Terrorist Training Manual", contained a section entitled "Covert Communications and Hiding Secrets Inside Images”

Terrorism Monitor 5(6), March 30, 2007.The Jamestown Foundation, Washington, DC 20036http://www.jamestown.org/programs/gta/single/?tx_ttnews[tt_news]=1057&tx_ttnews[backPid]=182&no_cache=1

The CoverTechnical Mujahid, Issue #2

Hidden data(payload)

10

Steganography Image steganalysis Audio steganalysis

STEGANALYSIS

04/19/2023

11

Modifying pixel values

Modifying transform

coefficients

e.g., Hide data in the header file of

an image file

IMAGE STEGANOGRAPHY

04/19/2023

12

from http://en.wikipedia.org/wiki/Image:Lichtenstein_bitplanes.png

Bit-plane 7 Bit-plane 6 Bit-plane 5 Bit-plane 4

Bit-plane 0Bit-plane 1Bit-plane 2Bit-plane 3

8-bit grayscale steganogram

AN EXAMPLE OF LEAST SIGNIFICANT BIT (LSB) EMBEDDING

04/19/2023

8-bit grayscale

cover

13

LSB embedding modifies the statistics of the cover, it enables us to detect the information-hiding

— 2 - statistical analysis

(Westfeld and Pfitzmann 2000, Lecture Notes in Computer Science)

— Histogram Characteristic Function Center Of Mass (HCFCOM) (Harmsen and Pearlman 2003, Proc. of SPIE)

— High-Order Moment statistical model in the Multi-Scale decomposition (HOMMS)

(Lyu and Fari 2005, IEEE Trans. Signal Processing)

— A.HCFCOM and C.A.HCFCOM (Ker 2005, IEEE Signal Processing Letters)

STEGANALYSIS OF LSB EMBEDDING

04/19/2023

14

LSB matching does not alter the statistics — randomly change some pixels by + 1 or -1,not simply replace the

LSB

The detection is much more difficult

T. Sharp, “An Implementation of Key-Based Digital Signal Steganography”, Lecture Notes in Computer Science, vol. 2137, pp. 13–26

LSB MATCHING

04/19/2023

15

Histogram Characteristic Function Center Of Mass (HCFCOM)

(RPI, Harmsen and Pearlman 2003, Proc. of SPIE)

High-Order Moment statistical model in the Multi-Scale decomposition (HOMMS)

(Dartmouth College, Lyu and Farid 2005, IEEE Trans. Signal Processing)

Adjacent HCFCOM and Calibrated Adjacent HCFCOM

(A.HCFCOM and C.A.HCFCOM) (Cambridge Univ., Ker 2005, IEEE Signal Processing Letters)

The papers did not consider “image complexity” as a factor in evaluating detection performance

STEGANALYSIS OF LSB MATCHING

04/19/2023

16

1. Information-hiding ratio — The ratio of the size of hidden data to the maximal embedding capacity

2. Relationship between detection performance and image complexity was not clearly illustrated

3. “Image complexity is another important parameter for evaluation” *

*Liu, Sung, Xu, Ribeiro (2006) “Image Complexity and Feature Extraction for Steganalysis of LSB Matching Steganography”. Proc. 18th International Conference on Pattern Recognition, ICPR (2):267-270

EVALUATION OF DETECTION PERFORMANCE

04/19/2023

17

1. Image complexity & measurement

2. Relationship among image complexity, information-hiding ratio and steganalysis performance

3. Improvement of the detection of LSB Matching

ISSUES

04/19/2023

18

Flat, smooth Non-flat, more details

Low complexity High complexityVS.

IMAGE COMPLEXITY (1)

04/19/2023

19

Generalized Gaussian Distribution (GGD) in the transform domain

(| |/ )( ; , )2 (1/ )

xp x e

1

0( ) , 0t zz e t dt z

Calculation of shape parameter

Sharifi and Leon-Garcia (1995) “Estimation of Shape Parameter for Generalized Gaussian Distributions in Subband Decompositions of Video”, IEEE Trans. Circuits Syst. Video Technol, 5: 52–56

Shape parameter

Transform coefficient

Scale parameter

IMAGE COMPLEXITY (2)

04/19/2023

20

* Liu et al. (2008), “Image Complexity and Feature Mining for Steganalysis of Least Significant Bit Matching Steganography”. Information Sciences 178(1): 21-36

0.305 0.6102

0.9698 1.3724

IMAGE COMPLEXITY (3)

04/19/2023

21

As image complexity increases, GGD shape parameter increases.

Image complexity measured by the GGD shape parameter

IMAGE COMPLEXITY (4)

04/19/2023

22

High correlation of adjacent pixels

50 100 150 200 250

50

100

150

200

2500

0.01

0.02

0.03

0.04

0.05

X

Y

X: left-adjacent pixel value Y: right-adjacent pixel value

LSB MATCHING STEGANALYSIS: FEATURE DESIGN (1)

04/19/2023

Joint distribution of adjacent pixels

23

Hypothesis : Information hiding in the spatial domain will affect the joint distribution of adjacent pixels

Design different features

Liu, Sung, Ribeiro, Wei, Chen, Xu (2008) “Image

Complexity and Feature Mining for Steganalysis of Least Significant Bit Matching Steganography”. Information Sciences, 178(1): 21-36

LSB MATCHING STEGANALYSIS: FEATURE DESIGN (2)

04/19/2023

24

X-axis: False Positive (FP) Y-axis: False Negative (FP)

ROC curves (Color images, 50% maximal hiding ratio)

IMAGE COMPLEXITY AND DETECTION PERFORMANCE

1. At a fixed hiding ratio, detection performance decreases as image complexity increases

2. Our approach prominently improves the detection performance

25

100% 75%

50% 25%

Results of my method

Results of HCFCOM

Results of HOMMS

IMAGE COMPLEXITY, HIDING RATIO & DETECTION PERFORMANCEDetection accuracy (color image, 100%, 75%, 50% & 25% maximal hiding ratio)

04/19/2023

26

100% 75%

50% 25%

Results of my method

Results of HCFCOM

Results of HOMMS

1. As information-hiding ratio decreases, detection performance decreases

IMAGE COMPLEXITY, HIDING RATIO & DETECTION PERFORMANCEDetection accuracy (color image, 100%, 75%, 50% & 25% maximal hiding ratio)

04/19/2023

27

100% 75%

50% 25%

Results of my method

Results of HCFCOM

Results of HOMMS

2. As image complexity increases, detection performance decreases

IMAGE COMPLEXITY, HIDING RATIO & DETECTION PERFORMANCEDetection accuracy (color image, 100%, 75%, 50% & 25% maximal hiding ratio)

04/19/2023

28

100% 75%

50% 25%

Results of my method

Results of HCFCOM

Results of HOMMS

3. Our method outperforms other two well-known methods

IMAGE COMPLEXITY, HIDING RATIO & DETECTION PERFORMANCEDetection accuracy (color image, 100%, 75%, 50% & 25% maximal hiding ratio)

04/19/2023

29

IMAGE STEGANOGRAPHY

04/19/2023

HIDING DATA IN JPEG IMAGES

Original block Transformed block Quantization matrix

15 0 -2 -1 -1 -1 0 …Bit-stream

Zig-zag scanEncoding

DCT

Quantized DCT coefficients

Original block Transformed block Quantization matrix

15 0 -1 0 -1 0 0 1 -1 …

Zig-zag scan

DCT

Hiding 0 1 0 1 0 0 1 1

Original quantized DCT coefficientsModified quantized DCT coefficients

HIDING DATA IN JPEG IMAGES

32

STEGANALYSIS OF JPEG IMAGES

Feature-based Steganalysis (SUNY-Binghamton, Fridrich 2004, Information Hiding)

Markov Approach on Intra-block (NJIT, Shi, Chen and Chen 2006, Information Hiding)

Merging Markov Approach and Feature-based Steganalysis

(SUNY-Binghamton, Pevny and Fridrich 2007, SPIE)

Markov Approach on Intra-block & Inter-block (NJIT, Chen and Shi 2008, IEEE symposium on Circuits and Systems; NMT, Liu et al. 2008, IJCNN)

Why is Markov approach successful?

33

MODIFICATION OF JOINT DENSITY

In several JPEG-based steganographic systems, when a covert message is embedded in the DCT domain

The DCT neighboring joint density is modified, which results in the change of the Markov transition probability

Markov approach does not completely explore the relation of neighboring coefficients

Liu, Sung, and Qiao. “Improved Detection and Evaluation for JPEG Steganalysis”, ACM-MM09

Neighboring joint density features may be better than Markov transition probability features

34

EXAMPLECover F5 stego-image Steghide stego-image

35

EXAMPLECover F5 stego-image Steghide stego-image

36

EXPERIMENTAL RESULTS (1)

Mean testing accuracy over 100 experiments

M: Markov transition feature setNJ: Neighboring Joint density feature set

37

EXPERIMENTAL RESULTS (2)

Mean testing accuracy over 50 experiments under different image complexities

(High image complexity corresponds to high GGD shape parameter)

M: Markov transition feature setNJ: Neighboring Joint density feature set

On average, neighboring joint density features are better than Markov transition features.

As image complexity increases, detection performance decreases.

38

Steganography Image steganalysis Audio steganalysis

STEGANALYSIS

04/19/2023

39

The left voice is hidden in the right.

04/19/2023

TWO VOICES

40

“In several audio hiding systems, the derivatives of a cover signal and the stego-signal have different high-frequency spectra”

FOURIER SPECTRUM STEGANALYSIS (FSS)

04/19/2023

Liu, Sung and Qiao (2009)Spectrum Steganalysis of Digital WAV Audios, Proceedings of 6th International Conference on Machine Learning and Data Mining (MLDM 2009, Germany, July 2009), LNAI Vol. 5632, pp.582-593.

41

( ) ( ) ( ) 0,1,..., 1s t f t e t t N

( ) : cover; ( ) : steg

( ) : hiding error between ( ) and ( )

f t s t

e t s t f t

th

22

2

: the order derivative of

. ., n 2,

nnf n

f

d fD n f

dt

d fe g D

dt

NOISE ADDITION MODEL FOR FSS

04/19/2023

42

21

0

21

0

21

0

is the number of sampling of ( )

( ) ( )

( ) ( )

( ) ( )

0,1,..., 1

ns

nf

ne

n

jM ktn MsD

t

jM ktn MfD

t

jM ktn MeD

t

M D t

F k D t e

F k D t e

F k D t e

k M

n n ns f eD D D

n n ns f eD D D

F F F

NOISE ADDITION MODEL FOR FSS

04/19/2023

43

; ;

: angle between and

n nf e

n nf e

D D

D D

F a F b

F F

a

b sinb

cosb

2 2 2

2 2

cos sin

2 cos

nsD

F a b b

a b ab

nfD

F

neD

FnsD

F

NOISE ADDITION MODEL FOR FSS

04/19/2023

44

2 22

0

0

2 cosnsD

a b ab dE F

d

02 2 2 2

2 2

2 sin

n nf eD D

aba b a b

F F

NOISE ADDITION MODEL FOR FSS

04/19/2023

45

22

22

if ,

;

otherwise if 0,

.

n nf e

n ns f

ne

n ns f

D D

D D

D

D D

F F

E F F

F

E F F

NOISE ADDITION MODEL FOR FSS

04/19/2023

46

2

2 2

ns

n nf e

D

D D

E F

F F

High Magnitude

at High Frequency

Spectrum

Low frequency

High frequency

SPECTRUM OF ERROR DERIVATIVE

2

2 2

ns

n nf e

D

D D

E F

F F

04/19/2023

Information-hiding in audios increases the magnitude of the high frequency spectrum

47

DERIVATIVE SPECTRUM: COVER VS. STEGO

Information-hiding in audios increases the magnitude of the high frequency spectrum

04/19/2023

48

Then, can we directly use high-frequency statistics for detection?

QUESTION

04/19/2023

Information-hiding in audios increases the magnitude of the high frequency spectrum

49

Are there any hidden data with these two voices?

One is cover, the other is stego. Which one does it carry hidden data?

Stego Coverx Different voices have

different characteristics on the high frequency spectra

Without reference, the detection may be incorrect!

High-frequency spectrum

EXAMPLE

04/19/2023

50

VARIANCE OF POWER SPECTRUM (STEGO)

04/19/2023

2 2

2 2

2 2

2 22

22 20

0

2 2

4 cos( )

2

f e

s s

f e

D D

D D

D D

F F dE F E F

d

F F

The change rate of power spectrum of the second derivative of the stego-audio is quite different from that of original cover

Power spectrum of the second derivative of the

error

Power spectrum of the second derivative of the

signal

1

2

C

( ( ( )))...

mel

mel

mel

sf

sfMelCepstrum FT MT FT f

sf

1

2

C

(Filtering( ( ( ))))...

mel

mel

mel

sf

sfFilteredMelCepstrum FT MT FT f

sf

The rate of power change in different spectrum bands

Mel-frequency cepstral coefficients (MFCCs)

Filtered Mel-frequency cepstral coefficients (FMFCCs)

SIGNAL BASED MEL-CEPSTRUM FEATURES

5104/19/2023

Kraetzer and Dittmann. Pros and Cons of Mel-cepstrum Based Audio Steganalysis Using SVM Classification. LNCS, vol. 4567, pp. 359-377, 2008.

1

22

C

( ( ( )))...

mel

melf

mel

sf

sfMelCepstrum FT MT FT D

sf

1

22

C

(Filtering( ( ( ))))...

mel

melf

mel

sf

sfFilteredMelCepstrum FT MT FT D

sf

Mel-frequency cepstral coefficients (MFCCs)

Filtered Mel-frequency cepstral coefficients (FMFCCs)

SECOND DERIVATIVE BASED MEL-CEPSTRUM FEATURES

5204/19/2023

Liu, Sung and Qiao, Temporal Derivative Based Spectrum and Mel-Cepstrum Audio Steganalysis, IEEE Trans. Information Forensics and Security, September, 2009

SIGNAL-BASED VS. WAVELET/DERIVATIVE-BASED

5304/19/2023

2

4 2 2

04 2

0

( ( ) , ( 1) )( , )

( ( ) )f

N

f ftND

ft

D t i D t jM i j

D t i

, [ 4, 4]i j

SECOND DERIVATIVE BASED MARKOV TRANSITION FEATURES

5404/19/2023

Liu, Sung and Qiao, Novel Stream Mining for Audio Steganalysis. ACM Multimedia 2009

04/19/202355

Hiding Tool/Algorithm

Hiding size /max-

hidingSignal complexity

Mean testing accuracy ( %)

AAST * 2D-MM

Invisible

100%low 89.1 95.9

middle 82.5 97.7high 49.7 95.5

50%

low 64.9 86.5middle 58.3 85.8high 50.0 82.0

Hide4PGP 25%low 91.2 94.8

middle 79.0 97.6high 50.0 95.7

LSB matching

100%low 91.9 96.0

middle 81.4 98.3high 50.8 96.0

50%low 87.2 91.4

middle 72.7 95.4high 50.2 89.4

steghide 100%low 81.6 93.2

middle 69.7 86.2high 57.1 82.8

* Kraetzer and Dittmann

DETECTION PERFORMANCE

56

Image Steganalysis

— LSB matching steganalysis

— JPEG steganalysis

— High correlation between adjacent pixels

Audio Steganalysis

— WAV

— MP3

— Second derivative based approach (2D-MM)

SUMMARY

04/19/2023

57

1. Discover better features to improve detection

Perpetual pursuit in machine learning &

data mining

Start from good heuristics

Is there a critical subset of features, w.r.t. a

particular set of features?

Learning machine + Feature Selection

combination

FURTHER STUDY

04/19/2023

5804/19/2023

Feature extraction: To develop / extract features which are good for classification.

Good Features:• from the same class have similar feature values.• from different classes have different values.

“Good” features “Bad” features

59

2. Analyze computational complexity

so far performance has been analyzed vs.

hiding ratio & signal complexity

important for real-world application

FURTHER STUDY

04/19/2023

60

3. Think about the next steps

payload extraction, code breaking? Very hard, if possible at all.

FURTHER STUDY

04/19/2023

61

4. Include steganalysis as part of IV & V

detection

destroy / disable payload? Usually easy!

integration into the IV & V process

FURTHER STUDY

04/19/2023