Quantitative steganalysis of digital images: estimating the secret message length

The objective of steganalysis is to detect messages hidden in cover objects, such as digital images. In practice, the steganalyst is frequently interested in more than whether or not a secret message is present. The ultimate goal is to extract and decipher the secret message. However, in the absence of the knowledge of the stego technique and the stego and cipher keys, this task may be extremely time consuming or completely infeasible. Therefore, any additional information, such as the message length or its approximate placement in image features, could prove very valuable to the analyst. In this paper, we present general principles for developing steganalytic methods that can accurately estimate the number of changes to the cover image imposed during embedding. Using those principles, we show how to estimate the secret message length for the most common embedding archetypes, including the F5 and OutGuess algorithms for JPEG, EzStego algorithm with random straddling for palette images, and the classical LSB embedding with random straddling for uncompressed image formats. The paper concludes with an outline of ideas for future research such as estimating the steganographic capacity of embedding algorithms.     

An improved approach to steganalysis of JPEG images

Steganography secretly embeds additional information in digital products, the potential for covert dissemination of malicious software, mobile code, or information is great. To combat the threat posed by steganography, steganalysis aims at the exposure of the stealthy communication. In this paper, a new scheme is proposed for steganalysis of JPEG images, which, being the most common image format, is believed to be widely used for steganography purposes as there are many free or commercial tools for producing steganography using JPEG covers.First, a recently proposed Markov approach [27] is expanded to the inter-block of the discrete cosine transform (DCT) and to the discrete wavelet transform (DWT). The features on the joint distributions of the transform coefficients and the features on the polynomial fitting errors of the histogram of the DCT coefficients are also extracted. All features are called original ExPanded Features (EPF). Next, the EPF features are extracted from the calibrated version; these are called reference EPF features. The difference between the original and the reference EPF features is calculated, and then the original EPF features and the difference are merged to form the feature vector for classification.To handle the large number of developed features, the feature selection method of support vector machine recursive feature elimination (SVM-RFE) and a method of multi-class support vector machine recursive feature elimination (MSVM-RFE) are used to select features for binary classification and multi-class classification, respectively. Finally, support vector machines are applied to the selected features for detecting stego-images.Experimental results show that, in comparison to the Markov approach [27], this new scheme remarkably improves the detection performance on several JPEG-based steganographic systems, including JPHS, CryptoBola, F5, Steghide, and Model based steganography.     

An evaluation of image based steganography methods

Steganography is a process that involves hiding a message in an appropriate carrier for example an image or an audio file. The carrier can then be sent to a receiver without anyone else knowing that it contains a hidden message. This is a process, which can be used for example by civil rights organisations in repressive states to communicate their message to the outside world without their own government being aware of it. Less virtuously it can be used by terrorists to communicate with one another without anyone else’s knowledge. In both cases the objective is not to make it difficult to read the message as cryptography does, it is to hide the existence of the message in the first place possibly to protect the courier. The initial aim of this study was to investigate steganography and how it is implemented. Based on this work a number of common methods of steganography could then be implemented and evaluated. The strengths and weaknesses of the chosen methods can then be analysed. To provide a common frame of reference all of the steganography methods implemented and analysed used GIF images. Seven steganography methods were implemented. The methods were chosen for their different strengths in terms of resistance to different types of steganalysis or their ability to maximise the size of the message they could store. All of the methods used were based on the manipulation of the least significant bits of pixel values or the rearrangement of colours to create least significant bit or parity patterns, which correspond to the message being hidden.An erratum to this article can be found at     

基于统计特征的JPEG图像隐写分析技术

介绍一种新的基于特征统计的JPEG图像隐写分析技术.利用选择的特征组,进行多元回归分析设计一个线性分类器,可以精确地判定图像中隐藏信息的存在性.这种方法可以检测各种JPEG图像信息嵌入系统,如J-Steg,OutGuess和F5算法.相对于现有的基于图像质量度量(QM)的统计方法,新方法的检测准确率更高(对同一嵌入率,本方法准确性提高了至少10%)     

A differential evolution based algorithm for breaking the visual steganalytic system

Image steganography is the process of sending messages secretly by hiding the message in image content. Steganalytic techniques are used to detect whether an image contains a hidden message by analyzing various image features between stego-images (the images containing hidden messages) and cover-images (the images containing no hidden messages). In the past, genetic algorithm (GA) was applied to design a robust steganographic system that breaks the steganalytic systems. However, GA consumes too much time to converge to the optimal solution. In this paper, we use a different evolutionary approach, named differential evolution (DE), to increase the performance of the steganographic system. The key element that DE is distinguished from other population based approaches is differential mutation, which aims to find the global optimum of a multidimensional, multimodal function. Experimental results show that the application of the DE based steganography not only improves the peak signal to noise ratio (PSNR) of the stego-image, but also promotes the normalized correlation (NC) of the extracted secret message for the same number of iterations. It is observed that the percentage increase in PSNR values ranges from 5% to 13% and that of NC values ranges from 0.8% to 3%.     

图像信息隐藏检测及其在互联网监管中的应用

本文分别从空间域、变换域分析了常用的图像信息隐藏技术和图像信息隐藏检测技术,研究了一种可对DFT域、DCT域和DWT域图像信息隐藏实现通用盲检测的基于频率域差分直方图能量分布分析的通用信息隐藏检测方法,并在此基础上设计了互联网内容监管网关中的图像信息隐藏检测模块,进行了功能性实验,表明该方法能有效检测图像信息隐藏。     

基于图像的信息隐藏分析技术综述

信息隐藏分析技术就是对信息隐藏系统进行攻击的技术。该文简要介绍了信息隐藏技术和信息隐藏分析技术,分析了基于数字图像的信息隐藏分析技术,并对现有的多种信息隐藏分析方法和研究现状进行了深入讨论。     

基于图像颜色特征的隐写分析算法

提出基于图像颜色特征的隐写分析算法,该算法利用24位BMP图像的颜色特征,采用攻击的方法,根据原始图像和隐写图像在被攻击前后颜色数目和相近颜色对数目变化的不同,提取特征向量,利用支持向量机进行分类,取得了比较好的检测结果.     

基于马尔可夫模型和特征融合的图像隐写分析

提出一种针对JPEG图像隐写的通用隐写分析方法.根据量化后分块DCT系数绝对值构造水平、垂直和zigzag方向的差分数组,利用三向差分数组马尔可夫模型挖掘量化后分块DCT块内邻近系数相关性,提取转移概率矩阵的特征.对三向特征加权融合后进行隐写分析,以提高分类性能.对安全性较高的JPEG隐写OutGuess和F5,在不同嵌入率下进行隐写分析.实验结果显示,引入特征融合后隐写分析的检出率明显提高.     

A fast algorithm for one-unit ICA-R

Independent component analysis (ICA) aims to recover a set of unknown mutually independent source signals from their observed mixtures without knowledge of the mixing coefficients. In some applications, it is preferable to extract only one desired source signal instead of all source signals, and this can be achieved by a one-unit ICA technique. ICA with reference (ICA-R) is a one-unit ICA algorithm capable of extracting an expected signal by using prior information. However, a drawback of ICA-R is that it is computationally expensive. In this paper, a fast one-unit ICA-R algorithm is derived. The reduction of the computational complexity for the ICA-R algorithm is achieved through (1) pre-whitening the observed signals; and (2) normalizing the weight vector. Computer simulations were performed on synthesized signals, a speech signal, and electrocardiograms (ECG). Results of these analyses demonstrate the efficiency and accuracy of the proposed algorithm.     

基于变步长量化的安全图像隐写

图像隐写通过将信息隐藏在载体图像中进行秘密传送,实现隐蔽通信.提出了VSQS图像隐写算法,利用密钥控制生成高斯序列并取整,用于对经伪随机排列后的图像像素进行变步长量化,根据量化像素与秘密信息之间的关系来修改像素,实现信息的嵌入.同时给出了该算法的一种扩展(称为TLQS隐写).实验结果表明,VSQS和TLQS图像隐写可提供较大的隐藏容量,并能抵抗几种常见的隐写分析方法.     

视频信息伪装技术综述*

介绍了视频信息伪装技术的一般原理,分析了其特点,阐述了所采用的一些主要方法,并对视频信息伪装的攻击手段进行了探讨;最后指出了目前视频信息伪装技术值得进一步研究的问题。     

一种改进的空域LSB掩密算法

本文基于对RS掩密分析技术的分析,利用矩阵编码技术对现有的空域LSB掩密算法提出了改进,改进后的算法可以在一定程度上抵抗RS攻击,从而进一步提高了LSB算法的安全性。     

一种基于线性规划特征选择和集成分类器的图像隐写分析方法

隐写分析是防范由隐写术进行信息隐藏所带来危害的有效方法。图像隐写分析方法主要用于检测图像是否被隐写术嵌入隐秘信息。通用型图像隐写分析能够针对广泛类型的隐写术进行检测,该类方法一般采用从图像提取的统计特征和分类器模型进行。当前的高性能隐写分析一般采用高维特征和集成分类器进行。高维特征能够较好地表达图像统计特性中被隐写术扰动的成分,但另一方面,高维特征具有较多的冗余和无效成分,因此进行特征选择能较好的提升效率。本文提出一种使用线性规划的特征选择模型,该模型可与集成分类器协同使用,同时考虑集成分类器中子分类器的检测精度和多个子分类器使用特征的多样性。实验证明,本文提出的方法对多个隐写术的检测性能有较好的提升。     

结合失真函数的稀疏域图像隐写算法

稀疏域图像隐写利用稀疏表示在载体图像中嵌入秘密信息。提出设计稀疏域图像隐写的失真函数,通过选择使失真函数最小的修改方式进行秘密嵌入,从而减小秘密信息嵌入对载体的影响。实验结果表明,该算法可以在保持图像视觉效果的同时,更有效地抵抗现有的隐写分析算法。     

Image complexity and feature mining for steganalysis of least significant bit matching steganography

The information-hiding ratio is a well-known metric for evaluating steganalysis performance. In this paper, we introduce a new metric of image complexity to enhance the evaluation of steganalysis performance. In addition, we also present a scheme of steganalysis of least significant bit (LSB) matching steganography, based on feature mining and pattern recognition techniques. Compared to other well-known methods of steganalysis of LSB matching steganography, our method performs the best. Results also indicate that the significance of features and the detection performance depend not only on the information-hiding ratio, but also on the image complexity.     

A perfect maze based steganographic method

In steganography, several different types of media have been used as carriers, such as images, audios and video streams, to hide secret data. Nevertheless, various novel media and applications have been developed due to the rapid growth of internet. In this paper, we select maze games as carrier media to conceal secret data. The original idea of embedding data in a maze is proposed by Niwayama et al. Their method has two disadvantages. One is the very small embedding capacity; the other is that the stego maze is not perfect. Here, we propose an improved algorithm for increasing the embedding capacity and preserving the “perfect” property.     

A framework for avoiding steganography usage over HTTP

Steganographic techniques allow users to covertly transmit information, hiding the existence of the communication itself. These can be used in several scenarios ranging from evading censorship to discreetly extracting sensitive information from an organization. In this paper, we consider the problem of using steganography through a widely used network protocol (i.e. HTTP). We analyze the steganographic possibilities of HTTP, and propose an active warden model to hinder the usage of covert communication channels. Our framework is meant to be useful in many scenarios. It could be employed to ensure that malicious insiders are not able to use steganography to leak information outside an organization. Furthermore, our model could be used by web servers administrators to ensure that their services are not being abused, for example, as anonymous steganographic mailboxes. Our experiments show that steganographic contents can be successfully eliminated, but that dealing with high payload carriers such as large images may introduce notable delays in the communication process.     

基于数字图像LSB嵌入的检测算法

信息隐藏技术和信息隐藏分析技术是信息安全领域的重要研究方向。信息隐藏技术包括隐写术和数字水印。信息隐藏分析技术包括了检测、攻击和破解3个步骤。位图的最不重要位嵌入方法是当今流行的基于图像的信息隐藏方法。提出了在嵌入信息服从均匀分布的情况下,两个基于图像时空域最低有效位连续嵌入的统计检测算法：μ检验算法和x^2检验算法。对部分算法进行了漏报率和误报率分析。通过实验验证了两个算法的检测效果,给出了相关的实验分析和结论。     

Electrogastrogram extraction using independent component analysis with references

Electrogastrogram (EGG) is a noninvasive measurement of gastric myoelectrical activity cutaneously, which is usually covered by strong artifacts. In this paper, the independent component analysis (ICA) with references was applied to separate the gastric signal from noises. The nonlinear uncorrelatedness between the desired component and references was introduced as a constraint. The results show that the proposed method can extract the desired component corresponding to gastric slow waves directly, avoiding the ordering indeterminacy in ICA. Furthermore, the perturbations in EGG can be suppressed effectively. In summary, it can be a useful method for EGG analysis in research and clinical practice.