Noble Nkwocha NASA Andrew H Sung New Mexico Institute of Mining amp Technology Multimedia Steganalysis as Part of Software IV amp V Steganography Steganalysis as part of IV amp V ID: 1033260
Download Presentation The PPT/PDF document "Qingzhong Liu, Sam Houston State U..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
1. Qingzhong Liu, Sam Houston State UniversityNoble Nkwocha, NASAAndrew H. Sung, New Mexico Institute of Mining & TechnologyMultimedia Steganalysisas Part ofSoftware IV & V
2. SteganographySteganalysis as part of IV & V Image steganalysis Audio steganalysisDiscussion9/9/20132Overview
3. Steganography ─ invisible cryptography Greek origin Covered/hidden writing Covert communication Steganography = hidden message + Carrier + steganography_key 3steganography9/9/2013
4. 4ImagesAudiostreamsTCP/IP packetsOthersVideofilescarrier9/9/2013
5. 5Example 19/9/2013
6. 6Example 29/9/2013
7. 7628-byte messageNo hidden data stego-image(steganogram) cover(carrier)Any Difference ?9/9/2013
8. 8Threat posed by sTEGANOGRAPHY9/9/2013
9. 9Alleged use by terrorists9/9/2013 A “Terrorist Training Manual", contained a section entitled "Covert Communications and Hiding Secrets Inside Images”Terrorism Monitor 5(6), March 30, 2007.The Jamestown Foundation, Washington, DC 20036http://www.jamestown.org/programs/gta/single/?tx_ttnews[tt_news]=1057&tx_ttnews[backPid]=182&no_cache=1The CoverTechnical Mujahid, Issue #2Hidden data(payload)
10. SteganographyImage steganalysis Audio steganalysis10steganalysis9/9/2013
11. 11Space-hidingTransform-hiding OthersModifying pixel valuesModifying transform coefficientse.g., Hide data in the header file of an image fileImage steganography9/9/2013
12. 12from http://en.wikipedia.org/wiki/Image:Lichtenstein_bitplanes.pngBit-plane 7Bit-plane 6Bit-plane 5Bit-plane 4Bit-plane 0Bit-plane 1Bit-plane 2Bit-plane 38-bit grayscale steganogramAn example of Least significant Bit (lsb) embedding9/9/20138-bit grayscalecover
13. LSB embedding modifies the statistics of the cover, it enables us to detect the information-hiding — 2 - statistical analysis (Westfeld and Pfitzmann 2000, Lecture Notes in Computer Science) — Histogram Characteristic Function Center Of Mass (HCFCOM) (Harmsen and Pearlman 2003, Proc. of SPIE) — High-Order Moment statistical model in the Multi-Scale decomposition (HOMMS) (Lyu and Fari 2005, IEEE Trans. Signal Processing) — A.HCFCOM and C.A.HCFCOM (Ker 2005, IEEE Signal Processing Letters) 13steganalysis of lsb embedding9/9/2013
14. LSB matching does not alter the statistics — randomly change some pixels by + 1 or -1,not simply replace the LSBThe detection is much more difficult T. Sharp, “An Implementation of Key-Based Digital Signal Steganography”, Lecture Notes in Computer Science, vol. 2137, pp. 13–26 14lsb matching9/9/2013
15. Histogram Characteristic Function Center Of Mass (HCFCOM) (RPI, Harmsen and Pearlman 2003, Proc. of SPIE) High-Order Moment statistical model in the Multi-Scale decomposition (HOMMS) (Dartmouth College, Lyu and Farid 2005, IEEE Trans. Signal Processing) Adjacent HCFCOM and Calibrated Adjacent HCFCOM (A.HCFCOM and C.A.HCFCOM) (Cambridge Univ., Ker 2005, IEEE Signal Processing Letters) The papers did not consider “image complexity” as a factor in evaluating detection performance 15Steganalysis of lsb matching9/9/2013
16. Information-hiding ratio — The ratio of the size of hidden data to the maximal embedding capacityRelationship between detection performance and image complexity was not clearly illustrated“Image complexity is another important parameter for evaluation” * *Liu, Sung, Xu, Ribeiro (2006) “Image Complexity and Feature Extraction for Steganalysis of LSB Matching Steganography”. Proc. 18th International Conference on Pattern Recognition, ICPR (2):267-27016Evaluation of detection performance9/9/2013
17. Image complexity & measurementRelationship among image complexity, information-hiding ratio and steganalysis performanceImprovement of the detection of LSB Matching17issues9/9/2013
18. 18Flat, smoothNon-flat, more detailsLow complexityHigh complexityVS.Image complexity (1)9/9/2013
19. Generalized Gaussian Distribution (GGD) in the transform domain 19 Calculation of shape parameter Sharifi and Leon-Garcia (1995) “Estimation of Shape Parameter for Generalized Gaussian Distributions in Subband Decompositions of Video”, IEEE Trans. Circuits Syst. Video Technol, 5: 52–56Shape parameterTransform coefficientScale parameterImage complexity (2)9/9/2013
20. 20* Liu et al. (2008), “Image Complexity and Feature Mining for Steganalysis of Least Significant Bit Matching Steganography”. Information Sciences 178(1): 21-36Image complexity (3)9/9/2013
21. 21As image complexity increases, GGD shape parameter increases.Image complexity measured by the GGD shape parameterImage complexity (4)9/9/2013
22. High correlation of adjacent pixels22XYX: left-adjacent pixel value Y: right-adjacent pixel value lsb matching steganalysis: feature design (1)9/9/2013Joint distribution of adjacent pixels
23. Hypothesis : Information hiding in the spatial domain will affect the joint distribution of adjacent pixelsDesign different features Liu, Sung, Ribeiro, Wei, Chen, Xu (2008) “Image Complexity and Feature Mining for Steganalysis of Least Significant Bit Matching Steganography”. Information Sciences, 178(1): 21-3623lsb matching steganalysis: feature design (2)9/9/2013
24. 24X-axis: False Positive (FP) Y-axis: False Negative (FP)ROC curves (Color images, 50% maximal hiding ratio)image complexity and detection performance1. At a fixed hiding ratio, detection performance decreases as image complexity increases2. Our approach prominently improves the detection performance
25. 25100%75%50%25%Results of my methodResults of HCFCOMResults of HOMMSimage complexity, hiding ratio & detection performanceDetection accuracy (color image, 100%, 75%, 50% & 25% maximal hiding ratio)9/9/2013
26. 26100%75%50%25%Results of my methodResults of HCFCOMResults of HOMMSAs information-hiding ratio decreases, detection performance decreasesimage complexity, hiding ratio & detection performanceDetection accuracy (color image, 100%, 75%, 50% & 25% maximal hiding ratio)9/9/2013
27. 27100%75%50%25%Results of my methodResults of HCFCOMResults of HOMMSAs image complexity increases, detection performance decreasesimage complexity, hiding ratio & detection performanceDetection accuracy (color image, 100%, 75%, 50% & 25% maximal hiding ratio)9/9/2013
28. 28100%75%50%25%Results of my methodResults of HCFCOMResults of HOMMSOur method outperforms other two well-known methodsimage complexity, hiding ratio & detection performanceDetection accuracy (color image, 100%, 75%, 50% & 25% maximal hiding ratio)9/9/2013
29. 29Space-hidingTransform-hiding OthersImage steganography9/9/2013
30. hiding data IN jpeg imagesOriginal blockTransformed blockQuantization matrix15 0 -2 -1 -1 -1 0 …Bit-streamZig-zag scanEncodingDCTQuantized DCT coefficients
31. Original blockTransformed blockQuantization matrix15 0 -1 0 -1 0 0 1 -1 …Zig-zag scanDCTHiding01010011Original quantized DCT coefficientsModified quantized DCT coefficientshiding data IN jpeg images
32. Steganalysis of Jpeg images32Feature-based Steganalysis (SUNY-Binghamton, Fridrich 2004, Information Hiding) Markov Approach on Intra-block (NJIT, Shi, Chen and Chen 2006, Information Hiding) Merging Markov Approach and Feature-based Steganalysis (SUNY-Binghamton, Pevny and Fridrich 2007, SPIE)Markov Approach on Intra-block & Inter-block (NJIT, Chen and Shi 2008, IEEE symposium on Circuits and Systems; NMT, Liu et al. 2008, IJCNN)Why is Markov approach successful?
33. Modification of joint density33In several JPEG-based steganographic systems, when a covert message is embedded in the DCT domain The DCT neighboring joint density is modified, which results in the change of the Markov transition probability Markov approach does not completely explore the relation of neighboring coefficientsLiu, Sung, and Qiao. “Improved Detection and Evaluation for JPEG Steganalysis”, ACM-MM09Neighboring joint density features may be better than Markov transition probability features
34. example34CoverF5 stego-imageSteghide stego-image
35. example35CoverF5 stego-imageSteghide stego-image
36. Experimental results (1)36Mean testing accuracy over 100 experiments M: Markov transition feature setNJ: Neighboring Joint density feature set
37. Experimental results (2)37Mean testing accuracy over 50 experiments under different image complexities (High image complexity corresponds to high GGD shape parameter) M: Markov transition feature setNJ: Neighboring Joint density feature setOn average, neighboring joint density features are better than Markov transition features.As image complexity increases, detection performance decreases.
38. SteganographyImage steganalysis Audio steganalysis38steganalysis9/9/2013
39. 39The left voice is hidden in the right.2013/9/9Two voices
40. “In several audio hiding systems, the derivatives of a cover signal and the stego-signal have different high-frequency spectra” 40Fourier spectrum steganalysis (FSS)9/9/2013Liu, Sung and Qiao (2009)Spectrum Steganalysis of Digital WAV Audios, Proceedings of 6th International Conference on Machine Learning and Data Mining (MLDM 2009, Germany, July 2009), LNAI Vol. 5632, pp.582-593.
41. 41Noise addition model for fss9/9/2013
42. 42Noise addition model for fss9/9/2013
43. 43Noise Addition model for fss9/9/2013
44. 44Noise Addition model for fss9/9/2013
45. 45Noise Addition model for fss9/9/2013
46. 46Low frequencyHigh frequencySPECTRUM Of ERROR DERIVATIVE 9/9/2013Information-hiding in audios increases the magnitude of the high frequency spectrum
47. 47DERIVATIVE Spectrum: cover VS. STEGO Information-hiding in audios increases the magnitude of the high frequency spectrum9/9/2013
48. Then, can we directly use high-frequency statistics for detection?48question9/9/2013Information-hiding in audios increases the magnitude of the high frequency spectrum
49. Are there any hidden data with these two voices? 49 One is cover, the other is stego. Which one does it carry hidden data? StegoCoverx Different voices have different characteristics on the high frequency spectra Without reference, the detection may be incorrect! High-frequency spectrumEXAMPLE9/9/2013
50. 50Variance of Power spectrum (stego)9/9/2013The change rate of power spectrum of the second derivative of the stego-audio is quite different from that of original coverPower spectrum of the second derivative of the errorPower spectrum of the second derivative of the signal
51. The rate of power change in different spectrum bands Mel-frequency cepstral coefficients (MFCCs) Filtered Mel-frequency cepstral coefficients (FMFCCs)Signal based Mel-cepstrum features519/9/2013Kraetzer and Dittmann. Pros and Cons of Mel-cepstrum Based Audio Steganalysis Using SVM Classification. LNCS, vol. 4567, pp. 359-377, 2008.
52. Mel-frequency cepstral coefficients (MFCCs) Filtered Mel-frequency cepstral coefficients (FMFCCs)Second derivative based Mel-cepstrum features529/9/2013Liu, Sung and Qiao, Temporal Derivative Based Spectrum and Mel-Cepstrum Audio Steganalysis, IEEE Trans. Information Forensics and Security, September, 2009
53. Signal-based vs. Wavelet/derivative-based539/9/2013
54. Second derivative based markov transition features549/9/2013Liu, Sung and Qiao, Novel Stream Mining for Audio Steganalysis. ACM Multimedia 2009
55. 9/9/201355Hiding Tool/Algorithm Hiding size /max-hidingSignal complexityMean testing accuracy ( %)AAST *2D-MMInvisible100%low89.195.9middle82.597.7high49.795.550%low64.986.5middle58.385.8high50.082.0Hide4PGP25%low91.294.8middle79.097.6high50.095.7LSB matching100%low91.996.0middle81.498.3high50.896.050%low87.291.4middle72.795.4high50.289.4steghide100%low81.693.2middle69.786.2high57.182.8* Kraetzer and Dittmann Detection Performance
56. Image Steganalysis — LSB matching steganalysis — JPEG steganalysis — High correlation between adjacent pixelsAudio Steganalysis — WAV — MP3 — Second derivative based approach (2D-MM)56summary9/9/2013
57. 1. Discover better features to improve detection Perpetual pursuit in machine learning & data mining Start from good heuristics Is there a critical subset of features, w.r.t. a particular set of features? Learning machine + Feature Selection combination57Further Study9/9/2013
58. 9/9/201358Feature extraction: To develop / extract features which are good for classification.Good Features: from the same class have similar feature values. from different classes have different values.“Good” features“Bad” features
59. 2. Analyze computational complexity so far performance has been analyzed vs. hiding ratio & signal complexity important for real-world application59Further Study9/9/2013
60. 3. Think about the next steps payload extraction, code breaking? Very hard, if possible at all.60Further Study9/9/2013
61. 4. Include steganalysis as part of IV & V detection destroy / disable payload? Usually easy! integration into the IV & V process61Further Study9/9/2013