Steganographer Identification

Conventional steganalysis detects the presence of steganography within single objects. In the real-world, we may face a complex scenario that one or some of multiple users called actors are guilty of using steganography, which is typically defined as the Steganographer Identification Problem (SIP). One might use the conventional steganalysis algorithms to separate stego objects from cover objects and then identify the guilty actors. However, the guilty actors may be lost due to a number of false alarms. To deal with the SIP, most of the state-of-the-arts use unsupervised learning based approaches. In their solutions, each actor holds multiple digital objects, from which a set of feature vectors can be extracted. The well-defined distances between these feature sets are determined to measure the similarity between the corresponding actors. By applying clustering or outlier detection, the most suspicious actor(s) will be judged as the steganographer(s). Though the SIP needs further study, the existing works have good ability to identify the steganographer(s) when non-adaptive steganographic embedding was applied. In this chapter, we will present foundational concepts and review advanced methodologies in SIP. This chapter is self-contained and intended as a tutorial introducing the SIP in the context of media steganography.Comment: A tutorial with 30 page

Agrupamentos de dados em modelos de frustração celular

Cellular frustrated systems are models of interacting agents displaying complex dynamics which can be used for anomaly detection applications. In their simplest versions, these models consist of two agent types, called presenters and detectors. Presenters display information from data samples. Detectors read this information and perceive it in a binary signal, depending on its frequency of appearance. The type of signal perceived will have an impact on the agents' decision dynamics. In particular, the presence of anomalies leads to less frustrated dynamics, i.e., more stable. In this thesis it is questioned if the mapping in binary signals could not bene t from the knowledge of the existence of clusters in the data set. To this end, a clustering technique was developed that gives particular attention to the fact that cellular frustrated systems discriminate samples depending on the number of features displaying rare values. The clusters obtained with this technique are also compared with those obtained using k-means or hierarchical agglomerative clustering. It is shown that using a clustering technique prior to application of cellular frustration system can improve anomaly detection rates. However, it is also shown that depending on the type of anomalies, this may not be generally the case, and therefore simpler cellular frustration algorithms may have the advantage of being simpler. It is believed that this study proposes new directions on how to improve the cellular frustration technique in a broader context.Sistemas de frustração celular são modelos de interação de agentes que demonstram uma dinâmica complexa que pode ser utilizada para aplicações de deteção de anomalias. Na sua versão mais simples, estes modelos são compostos por dois tipos de agentes, designados de apresentadores e detetores. Os apresentadores exibem a informação das amostras. Os detetores leem essa informação e percecionam-na em sinais binários, dependendo da frequência com que são apresentados. O tipo de sinal percecionado terá impacto na dinâmica de decisões dos agentes. Em particular, a presença de anomalias produz uma dinâmica menos frustrada, i.e., mais estável. Nesta tese é questionado se este mapeamento em sinais binários não poderá bene ciar do conhecimento da existência de grupos (clusters) nas amostras. Com esta nalidade, foi desenvolvida uma técnica de clustering, que dá particular atenção ao facto que os sistemas de frustração celular detetam as amostras dependendo do número de características que exibem valores extremos. Os clusters obtidos com esta técnica também são comparados com aqueles obtidos com técnicas conhecidas, como o k-means ou o clus- tering hierárquico aglomerativo. Nesta tese demonstra-se que a utilização de uma técnica de clustering antes da aplicação do sistema de frustração celular pode melhorar as taxas de deteção de anomalias. Contudo, também é demonstrado que dependendo do tipo de anomalias, esta alteração pode não ser bené ca, podendo ser mais vantajoso utilizar a técnica de frustração celular original, uma vez que é mais simples. Acredita-se que este estudo propõe direções claras sobre como se poderá vir a melhorar a técnica da frustração celular num contexto mais geral.Mestrado em Engenharia Físic

Context Trees: Augmenting Geospatial Trajectories with Context

Exposing latent knowledge in geospatial trajectories has the potential to provide a better understanding of the movements of individuals and groups. Motivated by such a desire, this work presents the context tree, a new hierarchical data structure that summarises the context behind user actions in a single model. We propose a method for context tree construction that augments geospatial trajectories with land usage data to identify such contexts. Through evaluation of the construction method and analysis of the properties of generated context trees, we demonstrate the foundation for understanding and modelling behaviour afforded. Summarising user contexts into a single data structure gives easy access to information that would otherwise remain latent, providing the basis for better understanding and predicting the actions and behaviours of individuals and groups. Finally, we also present a method for pruning context trees, for use in applications where it is desirable to reduce the size of the tree while retaining useful information