Steganographer Identification

Conventional steganalysis detects the presence of steganography within single objects. In the real-world, we may face a complex scenario that one or some of multiple users called actors are guilty of using steganography, which is typically defined as the Steganographer Identification Problem (SIP). One might use the conventional steganalysis algorithms to separate stego objects from cover objects and then identify the guilty actors. However, the guilty actors may be lost due to a number of false alarms. To deal with the SIP, most of the state-of-the-arts use unsupervised learning based approaches. In their solutions, each actor holds multiple digital objects, from which a set of feature vectors can be extracted. The well-defined distances between these feature sets are determined to measure the similarity between the corresponding actors. By applying clustering or outlier detection, the most suspicious actor(s) will be judged as the steganographer(s). Though the SIP needs further study, the existing works have good ability to identify the steganographer(s) when non-adaptive steganographic embedding was applied. In this chapter, we will present foundational concepts and review advanced methodologies in SIP. This chapter is self-contained and intended as a tutorial introducing the SIP in the context of media steganography.Comment: A tutorial with 30 page

Aligned and Non-Aligned Double JPEG Detection Using Convolutional Neural Networks

Due to the wide diffusion of JPEG coding standard, the image forensic community has devoted significant attention to the development of double JPEG (DJPEG) compression detectors through the years. The ability of detecting whether an image has been compressed twice provides paramount information toward image authenticity assessment. Given the trend recently gained by convolutional neural networks (CNN) in many computer vision tasks, in this paper we propose to use CNNs for aligned and non-aligned double JPEG compression detection. In particular, we explore the capability of CNNs to capture DJPEG artifacts directly from images. Results show that the proposed CNN-based detectors achieve good performance even with small size images (i.e., 64x64), outperforming state-of-the-art solutions, especially in the non-aligned case. Besides, good results are also achieved in the commonly-recognized challenging case in which the first quality factor is larger than the second one.Comment: Submitted to Journal of Visual Communication and Image Representation (first submission: March 20, 2017; second submission: August 2, 2017

A study of probability distributions of DCT coefficients in JPEG compression

The Discrete Cosine Transform (DCT) used in JPEG compression has shown excellent energy compaction properties that rival that of the ideal Karhunen-Loève Transform. Lossy compression in JPEG is achieved by distorting 8x8 block DCT coefficients through quantization. It has been shown in literature that DC block DCT coefficients are Gaussian probability distributed and AC block DCT coefficients are Generalized Normal probability distributed. In this investigation, three probability density models for individual modes of non- quantized AC block DCT coefficients are evaluated and are used as basis for the derivation of probability distributions for quantized block DCT coefficients. The suitability of each of the three derived models is evaluated using the Kolmogorov-Smirnov and χ2 goodness-of-fit tests, and the moments of the best-fit model are derived. The best-fit model is applied to detect the presence and extent of JPEG compression history in bitmap images. A model for all quantized AC block DCT coefficients is derived using mixtures of individual quantized block DCT modes, and the model hence developed is used to validate the Generalized Benford\u27s Law for leading digit distributions of quantized AC block DCT coefficients