Steganographer Identification

Conventional steganalysis detects the presence of steganography within single objects. In the real-world, we may face a complex scenario that one or some of multiple users called actors are guilty of using steganography, which is typically defined as the Steganographer Identification Problem (SIP). One might use the conventional steganalysis algorithms to separate stego objects from cover objects and then identify the guilty actors. However, the guilty actors may be lost due to a number of false alarms. To deal with the SIP, most of the state-of-the-arts use unsupervised learning based approaches. In their solutions, each actor holds multiple digital objects, from which a set of feature vectors can be extracted. The well-defined distances between these feature sets are determined to measure the similarity between the corresponding actors. By applying clustering or outlier detection, the most suspicious actor(s) will be judged as the steganographer(s). Though the SIP needs further study, the existing works have good ability to identify the steganographer(s) when non-adaptive steganographic embedding was applied. In this chapter, we will present foundational concepts and review advanced methodologies in SIP. This chapter is self-contained and intended as a tutorial introducing the SIP in the context of media steganography.Comment: A tutorial with 30 page

A Natural Steganography Embedding Scheme Dedicated to Color Sensors in the JPEG Domain

International audienceUsing Natural Steganography (NS), a cover raw image acquired at sensitivity ISO 1 is transformed into a stego image whose statistical distribution is similar to a cover image acquired at sensitivity ISO 2 > ISO 1. This paper proposes such an embedding scheme for color sensors in the JPEG domain, extending thus the prior art proposed for the pixel domain and the JPEG domain for monochrome sensors. We first show that color sensors generate strong intra-block and inter-block dependencies between DCT coefficients and that theses dependencies are due to the demosaicking step in the development process. Capturing theses dependencies using an empirical covariance matrix, we propose a pseudo-embedding algorithm on greyscale JPEG images which uses up to four sub-lattices and 64 lattices to embed information while preserving the estimated correlations among DCT coefficients. We then compute an approximation of the average embedding rate w.r.t. the JPEG quality factor and evaluate the empirical security of the proposed scheme for linear and non-linear demosaicing schemes. Our experiments show that we can achieve high capacity (around 2 bit per nzAC) with a high empirical security (P E 30% using DCTR at QF 95)

Multi-Class Classification for Identifying JPEG Steganography Embedding Methods

Over 725 steganography tools are available over the Internet, each providing a method for covert transmission of secret messages. This research presents four steganalysis advancements that result in an algorithm that identifies the steganalysis tool used to embed a secret message in a JPEG image file. The algorithm includes feature generation, feature preprocessing, multi-class classification and classifier fusion. The first contribution is a new feature generation method which is based on the decomposition of discrete cosine transform (DCT) coefficients used in the JPEG image encoder. The generated features are better suited to identifying discrepancies in each area of the decomposed DCT coefficients. Second, the classification accuracy is further improved with the development of a feature ranking technique in the preprocessing stage for the kernel Fisher s discriminant (KFD) and support vector machines (SVM) classifiers in the kernel space during the training process. Third, for the KFD and SVM two-class classifiers a classification tree is designed from the kernel space to provide a multi-class classification solution for both methods. Fourth, by analyzing a set of classifiers, signature detectors, and multi-class classification methods a classifier fusion system is developed to increase the detection accuracy of identifying the embedding method used in generating the steganography images. Based on classifying stego images created from research and commercial JPEG steganography techniques, F5, JP Hide, JSteg, Model-based, Model-based Version 1.2, OutGuess, Steganos, StegHide and UTSA embedding methods, the performance of the system shows a statistically significant increase in classification accuracy of 5%. In addition, this system provides a solution for identifying steganographic fingerprints as well as the ability to include future multi-class classification tools

Review of steganalysis of digital images

Steganography is the science and art of embedding hidden messages into cover multimedia such as text, image, audio and video. Steganalysis is the counterpart of steganography, which wants to identify if there is data hidden inside a digital medium. In this study, some specific steganographic schemes such as HUGO and LSB are studied and the steganalytic schemes developed to steganalyze the hidden message are studied. Furthermore, some new approaches such as deep learning and game theory, which have seldom been utilized in steganalysis before, are studied. In the rest of thesis study some steganalytic schemes using textural features including the LDP and LTP have been implemented

Natural Image Statistics for Digital Image Forensics

We describe a set of natural image statistics that are built upon two multi-scale image decompositions, the quadrature mirror filter pyramid decomposition and the local angular harmonic decomposition. These image statistics consist of first- and higher-order statistics that capture certain statistical regularities of natural images. We propose to apply these image statistics, together with classification techniques, to three problems in digital image forensics: (1) differentiating photographic images from computer-generated photorealistic images, (2) generic steganalysis; (3) rebroadcast image detection. We also apply these image statistics to the traditional art authentication for forgery detection and identification of artists in an art work. For each application we show the effectiveness of these image statistics and analyze their sensitivity and robustness

A Method to Detect AAC Audio Forgery

Advanced Audio Coding (AAC), a standardized lossy compression scheme for digital audio, which was designed to be the successor of the MP3 format, generally achieves better sound quality than MP3 at similar bit rates. While AAC is also the default or standard audio format for many devices and AAC audio files may be presented as important digital evidences, the authentication of the audio files is highly needed but relatively missing. In this paper, we propose a scheme to expose tampered AAC audio streams that are encoded at the same encoding bit-rate. Specifically, we design a shift-recompression based method to retrieve the differential features between the re-encoded audio stream at each shifting and original audio stream, learning classifier is employed to recognize different patterns of differential features of the doctored forgery files and original (untouched) audio files. Experimental results show that our approach is very promising and effective to detect the forgery of the same encoding bit-rate on AAC audio streams. Our study also shows that shift recompression-based differential analysis is very effective for detection of the MP3 forgery at the same bit rate

Digital image forensics

Digital image forensics is a relatively new research field that aims to expose the origin and composition of, and the history of processing applied to digital images. Hence, the digital image forensics is expected to be of significant importance to our modern society in which the digital media are getting more and more popular. In this thesis, image tampering detection and classification of double JPEG compression are the two major subjects studied. Since any manipulation applied to digital images changes image statistics, identifying statistical artifacts becomes critically important in image forensics. In this thesis, a few typical forensic techniques have been studied. Finally, it is foreseen that the investigations on endless confliction between forensics and anti-forensics are to deepen our understanding on image statistics and advance civilization of our society

Forensic research on detecting seam carving in digital images

Digital images have been playing an important role in our daily life for the last several decades. Naturally, image editing technologies have been tremendously developed due to the increasing demands. As a result, digital images can be easily manipulated on a personal computer or even a cellphone for many purposes nowadays, so that the authenticity of digital images becomes an important issue. In this dissertation research, four machine learning based forensic methods are presented to detect one of the popular image editing techniques, called ‘seam carving’. To reveal seam carving applied to uncompressed images from the perspective of energy distribution change, an energy based statistical model is proposed as the first work in this dissertation. Features measured global energy of images, remaining optimal seams, and noise level are extracted from four local derivative pattern (LDP) domains instead of from the original pixel domain to heighten the energy change caused by seam carving. A support vector machine (SVM) based classifier is employed to determine whether an image has been seam carved or not. In the second work, an advanced feature model is presented for seam carving detection by investigating the statistical variation among neighboring pixels. Comprised with three types of statistical features, i.e., LDP features, Markov features, and SPAM features, the powerful feature model significantly improved the state-of-the-art accuracy in detecting low carving rate seam carving. After the feature selection by utilizing SVM based recursive feature elimination (SVM-RFE), with a small amount of features selected from the proposed model the overall performance is further improved. Combining above mentioned two works, a hybrid feature model is then proposed as the third work to further boost the accuracy in detecting seam carving at low carving rate. The proposed model consists of two sets of features, which capture energy change and neighboring relationship variation respectively, achieves remarkable performance on revealing seam carving, especially low carving rate seam carving, in digital images. Besides these three hand crafted feature models, a deep convolutional neural network is designed for seam carving detection. It is the first work that successfully utilizes deep learning technology to solve this forensic problem. The experimental works demonstrate their much more improved performance in the cases where the amount of seam carving is not serious. Although these four pieces of work move the seam carving detection ahead substantially, future research works with more advanced statistical model or deep neural network along this line are expected

A Comparison Study using Stegexpose for Steganalysis.

Article originally published in International Journal of Knowledge EngineeringSteganography is the art of hiding secret message in innocent digital data files. Steganalysis aims to expose the existence of steganograms. While internet applications and social media has grown tremendously in recent years, the use of social media is increasingly being used by cybercriminals as well as terrorists as a means of command and control communication including taking advantage of steganography for covert communication. In this paper, we investigate open source steganography/steganalysis software and test StegExpose for steganalysis. Our experimental results show that the capability of stegExpose is very limited.Sam Houston State University (SHSU) Office of Research and Sponsored Programs, SHSU Department of Computer Science

Double-Compressed JPEG Detection in a Steganalysis System

The detection of hidden messages in JPEG images is a growing concern. Current detection of JPEG stego images must include detection of double compression: a JPEG image is double compressed if it has been compressed with one quality factor, uncompressed, and then re-compressed with a different quality factor. When detection of double compression is not included, erroneous detection rates are very high. The main contribution of this paper is to present an efficient double-compression detection algorithm that has relatively lower dimensionality of features and relatively lower computational time for the detection part, than current comparative classifiers. We use a model-based approach for creating features, using a subclass of Markov random fields called partially ordered Markov models (POMMs) to modeling the phenomenon of the bit changes that occur in an image after an application of steganography. We model as noise the embedding process, and create features to capture this noise characteristic. We show that the nonparametric conditional probabilities that are modeled using a POMM can work very well to distinguish between an image that has been double compressed and one that has not, with lower overall computational cost. After double compression detection, we analyze histogram patterns that identify the primary quality compression factor to classify the image as stego or cover. The latter is an analytic approach that requires no classifier training. We compare our results with another state-of-the-art double compression detector. Keywords: steganalysis; steganography; JPEG; double compression; digital image forensics