1、Lecture 6:,Application of Supervised Learning Steganalysis Credit Scoring,Outline,Steganography history Steganography and Steganalysis Targeted steganalysis techniques Universal steganalysis Next generation practical steganography Conclusion,Steganography,Steganography - “covered writing”. For examp
2、le (sent by a German spy during World War I), Apparently neutrals protest is thoroughly discounted and ignored. Isman hard hit. Blockade issue affects pretext for embargo on byproducts, ejecting suets and vegetable oils. Pershing sails from NY June I.,Ancient Steganography,Herodotus (485 525 BC) is
3、the first Greek historian. His great work, The Histories, is the story of the war between the huge Persian empire and the much smaller Greek city-states.,Herodotus recounts the story of Histaiaeus, who wanted to encourage Aristagoras of Miletus to revolt against the Persian king. In order to securel
4、y convey his plan, Histaiaeus shaved the head of his messenger, wrote the message on his scalp, and then waited for the hair to regrow. The messenger, apparently carrying nothing contentious, could travel freely. Arriving at his destination, he shaved his head and pointed it at the recipient.,Ancien
5、t Steganography,Pliny the Elder explained how the milk of the thithymallus plant dried to transparency when applied to paper but darkened to brown when subsequently heated, thus recording one of the earliest recipes for invisible ink.,Pliny the Elder. AD 23 - 79,The Ancient Chinese wrote notes on sm
6、all pieces of silk that they then wadded into little balls and coated in wax, to be swallowed by a messenger and retrieved at the messengers gastrointestinal convenience.,Renaissance Steganography,Johannes Trithemius (1404-1472 ),1518 Johannes Trithemius wrote the first printed book on cryptology. H
7、e invented a steganographic cipher in which each letter was represented as a word taken from a succession of columns. The resulting series of words would be a legitimate prayer.,Renaissance Steganography,Giovanni Battista Porta (1535-1615 ),Giovanni Battista Porta described how to conceal a message
8、within a hard-boiled egg by writing on the shell with a special ink made with an ounce of alum and a pint of vinegar. The solution penetrates the porous shell, leaving no visible trace, but the message is stained on the surface of the hardened egg albumen, so it can be read when the shell is removed
9、.,Modern Steganography - The Prisoners Problem,Simmons 1983,Steganography VS Steganalysis,Yes,Modern Terminology and (Simplified) Framework,No,Embedding Algorithm,Cover Message,Stego Message,Secret Key,Secret Message,Message Retrieval Algorithm,Secret Message,Secret Key,Is Stego Message?,Suppress Me
10、ssage,Alice,Wendy,Bob,Cover Media,Many options in modern communication system: Text Alternative Data Streams TCP/IP headers Etc. Perhaps most attractive are multimedia objects - Images Audio Video We focus on Images as cover media. Though most ideas apply to video and audio as well.,Steganography, D
11、ata Hiding and Watermarking,Steganography is a special case of data hiding. Data hiding in general need not be steganography. Example Media Bridge. It is not the same as watermarking. Watermarking has a malicious adversary who may try to remove, invalidate, forge watermark. In Steganography, main go
12、al is to escape detection from Wendy.,Steganography in Practice,Image,Noise,Content,Modulated Message,Secret Message,Stego Image,+,LSB Matching,stego-coefficients,Secret messages,1,0,0,0,1,0,1,0,0,1,1,0,0,1,0,1,1,0,1,0,0,0,0,1,.,.,1,0,0,0,1,0,0,1,0,1,1,0,0,1,1,0,1,0,1,0,0,0,0,1,.,1,0,1,original coef
13、ficients,-1 +1 0,the Original & Stego Image,Original Image,Stego Image,Steganalysis,Steganalysis refers to the art and science of discrimination between stego-objects and cover-objects. Steganalysis needs to be done without any knowledge of secret key used for embedding and maybe even the embedding
14、algorithm. However, message does not have to be gleaned. Just its presence detected.,Why Steganalysis?,Law enforcement authorities have concerns about the distribution of child pornography. Intelligence agencies need to intercept covert communication between terrorists. An effective way to judge the
15、 security performance of steganographic techniques. One part of Information Forensics,Steganalysis in Practice,Techniques designed for a specific steganography algorithm Good detection accuracy for the specific technique Useless for a new technique Universal Steganalysis techniques Less accurate in
16、detection Usable on new embedding techniques,Run and Run Length,Run: A gray level run is a set of consecutive, collinear image points having the same gray level value. Run Length: The length of the run is the number of picture points (pixels) in the run.,Run Length Histograms,Features,Run length his
17、togram characteristic function (RLHCF),The detection algorithm,For any given image, calculate Embed a random secret message with a certain length into the given image by LSB matching Calculate of this new obtained image We get the alteration rate R by using,The detection algorithm (continued),Normal
18、ize R to a common range 0, 1, using the following equation Calculate , the HCF COM, of the given image using method of 3, and normalize it to 0, 1. (7) Fusion .,Result: ROC curves on Uncompressed Images,Result: ROC curves on Compressed Images,Compared with Kers Method for Uncompressed Images,Compare
19、d with Kers Method for Compressed Images,A Note on Message Lengths,Steganalysis techniques have been proposed which estimate the message length BUT: An attack is called successful if it could detect the presence of a message. So we mostly ignore message length estimating components.,Simple LSB Embed
20、ding in Raw Images,LSB embedding Least significant bit plane is changed. Assumes passive warden. Examples: Encyptic9, Stegotif10, Hide11 Different approaches Change LSB of pixels in a random walk Change LSB of subsets of pixels (i.e. around edges) Increment/decrement the pixel value instead of flipp
21、ing the LSB,LSB Embedding,Steganalysis of LSB Embedding,PoV steganalysis - Westfeld and Pfitzmann 12. Exploits fact that odd and even pairs from “closed set” under LSB flipping. Accurately detects when message length is comparable to size of bit plane. RS-Steganalysis - Fridrich et. al. 14 Very effe
22、ctive. Even detects around 2 to 4% of randomly flipped bits.,LSB steganalysis with Primary Sets,Proposed by Dumitrescu, Wu, Memon 13 Based on statistics of sets defined on neighboring pixel pairs. Some of these sets have equal expected cardinalities, if the pixel pairs are drawn from a continuous-to
23、ne image. Random LSB flipping causes transitions between the sets with given probabilities, and alters the statistical relations between their cardinalities. Analysis leads to a quadratic equation to estimate the embedded message length with high precision.,State Transition Diagram for LSB Flipping,
24、X (2k-m,2k) (2k+1+m,2k+1),W (2k+1,2k) (2k,2k+1),Z (2k,2k) (2k+1,2k+1),V (2k+1+m,2k) (2k-m,2k+1),00,10,m1,k0,Y (2k+m,2k) (2k+1-m,2k+1),X,V, W, and Z, which are called primary sets,Transition Probabilities,If the message bits of LSB steganography are randomly scattered in the image, thenLet X, Y, V, W
25、 and Z denotes sets in original image and X, Y. W and Z denote the same in stego image.,Message Length in Terms of Cardinalities of Primary Sets,Cardinalities of primary sets in stego image can be computed in terms of the original AssumingWhere,Simulation Results,Hide,Instead of simply flipping the
26、LSB, it increments or decrements the pixel value Westfeld 16 shows that this operation could create 26 neighboring colors for each pixel On natural images there are 4 to 5 neighboring colors on average,Hide,Neighborhood histogram of a cover image (top) and stego image with 40 KB message embedded (bo
27、ttom)16,LSB Embedding in Palette Images,Embedding is done by changing the LSB of color index in the palette Examples: EzStego17, Gifshuffle18, Hide and Seek19 Such alteration result in annoying artifacts Johnson and Jajodia20 look at anomalies caused by such embedding,EzStego,EzStego 17 tries to min
28、imize distortion by sorting the color palette before embedding Fridrich 6 shows that the color pairs after sorting have considerable structure After embedding this structure is disturbed thus the entropy of the color pairs are increased The entropy would be maximal when the maximum message length is
29、 embedded,Embedding in JPEG Images,Embedding is done by altering the DCT coefficient in transform domain Examples: Jsteg21, F522, Outguess23 Many different techniques for altering the DCT coefficients,F5,F5 uses hash based embedding to minimize changes made for a given message length The modificatio
30、ns done, alter the histogram of DCT coefficients Fridrich 6 shows that given the original histogram, one is able to estimate the message length accurately The original histogram is estimated by cropping the jpeg image by 4 columns and then recompressing it The histogram of the recompressed image est
31、imated the original histogram,F5 plot,Fig. 5. The effect of F5 embedding on the histogram of the DCT coefficient (2,1).6,Outguess,Embeds messages by changing the LSB of DCT coefficients on a random walk Only half of the coefficients are used at first The remaining coefficients are adjusted so that t
32、he histogram of DCT coefficient would remain unchanged Since the Histogram is not altered the steganalysis technique proposed for F5 will be useless,Outguess,Fridrich 6 proposes the “blockiness” attack Noise is introduced in DCT coefficients after embedding Spatial discontinuities along 8x8 jpeg blo
33、cks is increases Embedding a second time does not introduce as much noise, since there are cancellations Increase or lack of increase indicates if the image is clean or stego,Comments on Specific Steganalysis,Advantage of Specific Steganalysis: Often be able to attack the steganographic method with
34、higher detection rate which this specific steganalysis scheme is designed for. Sometimes, be able to estimate the length of hidden message Limitation of Specific Steganalysis: May fail in detecting hidden messages generated by different steganographic methods.,Universal Steganalysis Techniques,Techn
35、iques which are independent of the embedding technique One approach identify certain image features that reflect hidden message presence. Two problems Calculate features which are sensitive to the embedding process Finding strong classification algorithms which are able to classify the images using
36、the calculated features,What makes a Feature “good”,A good feature should be: Accurate Detect stego images with high accuracy and low error Consistent The accuracy results should be consistent for a set of large images, i.e. features should be independent of image type or texture Monotonic Features
37、should be monotonic in their relationship with respect to the message size,IQM,Avcibas et al.24,26 use Image Quality Metrics as a set of features IQMs are objective measures From a set of 26 IQM measures a subset with most discriminative power was chosen ANOVA is used to select those metrics that re
38、spond best to image distortions due to embedding,Choice of IQMs,Different metrics respond differently to different distortions. For example: mean square error responds more to additive noise spectral phase or mean square HVS-weighted error are more sensitive to blur gradient measure reacts more to d
39、istortions concentrated around edges and textures. Steganalyzer must work with a variety of steganography algorithms Several quality metrics needed to probe all aspects of an image impacted by the embedding,IQM,The images are first blurred The IQM are then calculated from the difference of the origi
40、nal and blurred image,IQM,Scatter plot of 3 image quality measures showing separation of marked and unmarked images.,Farid,Farid et. al.27 argues that most steganalysis attacks look at only first order statistics But new techniques try to keep the first order statistics intact So Farid builds a mode
41、l for natural images and then classifies images which deviate from this model as stego images,Farid,Quadratic mirror filters are used to decompose the image, after which higher order statistics are collected These include mean, variance, kurtosis, skewness Another set of features used are error obta
42、ined from an optimal linear predictor of coefficient magnitudes of each sub band,Classifiers,Different types of classifier used by different authors. Avcibas et. al. use a MMSE linear predictor Farid et. al. use Fisher linear discriminates as well as a SVM classifier SVM classifiers seem to do much
43、better in classification All the authors show good results in their experiments, but direct comparison is hard since the setups are very much different.,So What Can Alice (Bob) Do?,Limit message length so that detector does not trigger Use model based embedding. Stochastic Modulation (Fridrich 02) P
44、hil Sallees method Adaptive embedding Embed in locations where it is hard to detect. Active embedding Add noise after embedding to mask presence. Outguess,Adaptive Embedding,LSB embedding in a location only if its 8-neighborhood variance is high. Embedding locations still secret key dependent. Numbe
45、r of bits that can be embedded is significantly small. Would work against most steganalyzers?,Stretching more ,In fact it need not look like an image or audio or video at all. Idea Take encrypted secret message random stream. Decompress it using some codec like JPEG, JPEG200 etc. Compress the result
46、ing stream losslessly and transmit.,Images From DCT-based Image Decoders,From Wavelet-based Image Decoders,From JPEG-LS Lossless Image Decoder,Ton Kalkers Algorithm,Fix positions in the image that will carry massage. Examine pictures until you find one in which bits in these positions are exactly wh
47、at you want to embed. Clearly secure, but very low capacity. Much more than 10 bits or so will be impractical. Capacity can be increased by blocking strategy. But security becomes unclear.,Conclusion,Steganography and steganalysis are still at an early stage of research In general, the covert channe
48、l detection problem is known to be undecidable! Although in principle secure schemes exist, practical ones with reasonable capacity are not known. Notion of security and capacity for steganography needs to be investigated Steganography and corresponding steganalysis using image models needs to be fu
49、rther investigated,Other thoughts,Unlike cryptography, Steganography allows you to choose the cover object. How do you choose good cover object for a given stego message What kind of images are good for using as cover objects?,Forensics,Motivation Seeing is believing or is it?,Easy to be deceived,Goals,Identify image tampering methods.Assess methods available for protecting images.Assess image authentication techniques.Identify directions for future work.,
