Citation
Steganography and Steganalysis of Joint Picture Expert Group (JPEG) Images

Material Information

Title:
Steganography and Steganalysis of Joint Picture Expert Group (JPEG) Images
Creator:
Kumar,Mahendra
Place of Publication:
[Gainesville, Fla.]
Florida
Publisher:
University of Florida
Publication Date:
Language:
english
Physical Description:
1 online resource (141 p.)

Thesis/Dissertation Information

Degree:
Doctorate ( Ph.D.)
Degree Grantor:
University of Florida
Degree Disciplines:
Computer Engineering
Computer and Information Science and Engineering
Committee Chair:
Newman, Richard E
Committee Co-Chair:
Liu, Chien-Lian
Committee Members:
Fortes, Jose A
Chow, Yuan-Chieh R
Sun, Yijun
Graduation Date:
8/6/2011

Subjects

Subjects / Keywords:
Entropy ( jstor )
Histograms ( jstor )
Image classification ( jstor )
Index numbers ( jstor )
Matrices ( jstor )
Payloads ( jstor )
Statistics ( jstor )
Steganography ( jstor )
Transmitters ( jstor )
Zero ( jstor )
Computer and Information Science and Engineering -- Dissertations, Academic -- UF
compensation -- histogram -- image -- information -- jpeg -- statistical -- steganalysis -- steganography
Genre:
bibliography ( marcgt )
theses ( marcgt )
government publication (state, provincial, terriorial, dependent) ( marcgt )
born-digital ( sobekcm )
Electronic Thesis or Dissertation
Computer Engineering thesis, Ph.D.

Notes

Abstract:
Research motivation for this dissertation came from a project sponsored by Naval Research Laboratory (NRL) where I was working on algorithms to provide better stealthiness for hiding data inside JPEG images. With the guidance of my advisor, Dr. Richard Newman, and Ira S. Moskowitz from Center for High Assurance Computer Systems, NRL, we developed J2 steganography algorithm which was based on hiding data in the spatial domain by making changes in the frequency domain. J2 had problems such as lower capacity along with lack of first order histogram restoration. This paved path for the development of J3 where the global histogram is preserved along with higher capacity. Further enhancements in J3 included matrix encoding techniques where the number of coefficient changes are reduced if the payload is smaller than the maximum capacity. The advantage with J3 was high capacity with full histogram restoration as compared to other existing algorithms. J3 has outperformed other algorithms in terms of detection rate. The next algorithm was J4, an improvement over J3 which not only restores the global histogram but also individual histograms. A theoretical analysis is also done for the matrix encoding parameter, k, along with the estimated capacity. The estimation of matrix encoding, k, enables to choose the best encoding rate and optimize in terms of minimizing the number of coefficient changes. In order to develop a good steganography algorithm, one should have knowledge about the different steganalysis techniques. Keeping this in mind, a second order steganalysis scheme is proposed which uses two step inter and intra block Markov transition probability matrices as features. These features are then used for training a number of cover and stego images using a SVM classifier. Based on the trained data, another set of cover and stego images are used for estimation of prediction accuracy of those images. The results show that this new steganalysis algorithm outperforms all the other existing algorithms known at the time of writing this dissertation. Research goals: This dissertation focusses on the following topics: 1. Designing a frequency based embedding approach with spatial based extraction using hashing of the data from spatial domain- J2. 2. Designing a novel approach to high capacity JPEG steganography using global histogram compensation technique- J3. 3. Designing a JPEG steganography algorithm using global and dual histogram compensation along with matrix encoding to minimize changes- J4. 4. Designing a steganalysis scheme based on estimation of cover with two step Markov model. ( en )
General Note:
In the series University of Florida Digital Collections.
General Note:
Includes vita.
Bibliography:
Includes bibliographical references.
Source of Description:
Description based on online resource; title from PDF title page.
Source of Description:
This bibliographic record is available under the Creative Commons CC0 public domain dedication. The University of Florida Libraries, as creator of this bibliographic record, has waived all rights to it worldwide under copyright law, including all related and neighboring rights, to the extent allowed by law.
Thesis:
Thesis (Ph.D.)--University of Florida, 2011.
Local:
Adviser: Newman, Richard E.
Local:
Co-adviser: Liu, Chien-Lian.
Statement of Responsibility:
by Mahendra Kumar.

Record Information

Source Institution:
UFRGP
Rights Management:
Copyright Kumar,Mahendra. Permission granted to the University of Florida to digitize, archive and distribute this item for non-profit research and educational purposes. Any reuse of this item in excess of fair use or other copyright exemptions requires permission of the copyright holder.
Classification:
LD1780 2011 ( lcc )

Downloads

This item has the following downloads:


Full Text

PAGE 1

STEGANOGRAPHYANDSTEGANALYSISOFJOINTPICTUREEXPERTGROUP(JPEG)IMAGESByMAHENDRAKUMARADISSERTATIONPRESENTEDTOTHEGRADUATESCHOOLOFTHEUNIVERSITYOFFLORIDAINPARTIALFULFILLMENTOFTHEREQUIREMENTSFORTHEDEGREEOFDOCTOROFPHILOSOPHYUNIVERSITYOFFLORIDA2011

PAGE 2

c2011MahendraKumar 2

PAGE 3

Thisdissertationisdedicatedtomyparents,ShitalaandRani,fortheirendlesslove,supportandencouragementthroughoutmylife.TheirblessingshavealwaysshownmethelightthroughthedarknessandkeptmemotivatedtoachievemygoalstowardsthisPh.D. 3

PAGE 4

ACKNOWLEDGMENTS Iamheartilythankfultomyadvisor,Dr.RichardNewman,whoseencouragement,guidanceandsupportenabledmetodevelopanunderstandingofthisareaofresearchandcompletionofmydissertation.IwouldalsoliketothankDr.IraS.Moskowitz(CenterforHighAssuranceComputerSystems,NavalResearchLaboratory),whogaveusvaluableinputandfeedbacktowardsdevelopmentofJ2andJ3steganographyalgorithms.Iwouldliketoshowmydeepestgratitudetomycommitteemembers,Dr.JonathanLiuandDr.RandyChowfromDepartmentofComputerandInformationSciencesandEngineering(CISE),andDr.JoseFortesandDr.YijunSunfromDepartmentofElectricalandComputerEngineering,fortheirsupport,guidanceandnovelideastowardsmyresearch. 4

PAGE 5

TABLEOFCONTENTS page ACKNOWLEDGMENTS .................................. 4 LISTOFTABLES ...................................... 8 LISTOFFIGURES ..................................... 10 ABSTRACT ......................................... 12 CHAPTER 1JOINTPICTUREEXPERTGROUP(JPEG)STEGANOGRAPHY ........ 16 1.1Introduction ................................... 16 1.2JPEGCompression .............................. 17 1.3JPEGSteganography ............................. 17 1.4LeastSignicantBit(LSB)BasedEmbeddingTechnique .......... 19 1.5PopularSteganographyAlgorithms ...................... 20 1.5.1JSteg .................................. 20 1.5.2F5 .................................... 22 1.5.3Outguess ................................ 23 1.5.4Steghide ................................. 24 1.5.5SpreadSpectrumSteganography ................... 24 1.5.6ModelBasedSteganography ..................... 25 1.5.7StatisticalRestorationTechniques .................. 25 1.6MatrixEmbeddingForSteganography .................... 27 2JOINTPICTUREEXPERTGROUP(JPEG)STEGANALYSIS .......... 29 2.1Introduction ................................... 29 2.1.1PatternRecognitionClassier ..................... 30 2.1.2JPEGSteganalysisUsingSupportVectorMachines(SVM) .... 31 2.2SteganalysisUsingSecondOrderStatistics ................. 32 2.2.1MarkovModelBasedFeatures .................... 33 2.2.2MergingMarkovAndDiscreteCosineTransformation(DCT)-Features ................................. 36 2.2.3OtherSecondOrderStatisticalMethods ............... 37 3J2:REFINEMENTOFATOPOLOGICALSTEGANOGRAPHICMETHOD ... 41 3.1Introduction ................................... 41 3.2ReviewOfJ1 .................................. 42 3.3MotivationForProbabilisticSpatialDomainStego-Embedding ....... 45 3.4J2StegoEmbeddingTechnique ....................... 46 3.5J2AlgorithmInDetail ............................. 51 3.6Results ..................................... 54 5

PAGE 6

3.7Conclusion ................................... 57 4J3:HIGHPAYLOADHISTOGRAMNEUTRALJOINTPICTUREEXPERT-GROUP(JPEG)STEGANOGRAPHY ....................... 58 4.1Introduction ................................... 58 4.2J3EmbeddingModule ............................. 59 4.3J3EmbeddingAlgorithmInDetail ...................... 63 4.4J3ExtractionModule .............................. 69 4.5J3ExtractionAlgorithm ............................ 69 4.6EstimationOfEmbeddingCapacityAndStopPoint ............. 71 4.6.1StopPointEstimation .......................... 73 4.6.2CapacityEstimation .......................... 76 4.7Results ..................................... 78 4.7.1EstimatedCapacityVsActualCapacity ................ 80 4.7.2EstimatedStop-pointVsActualStop-point .............. 81 4.7.3EmbeddingEfciencyOfJ3 ...................... 83 4.7.4CapacityComparisonOfJ3WithOtherAlgorithms ......... 85 4.8SteganalysisOfJ3 ............................... 85 4.8.1BinaryClassication .......................... 87 4.8.2Multi-classication ........................... 88 4.9Conclusion ................................... 89 5J4:LOWDETECTIONSTEGANOGRAPHYUSINGDUALHISTOGRAM-COMPENSATION .................................. 91 5.1Introduction ................................... 91 5.2J4EmbeddingModule ............................. 92 5.2.1Pre-processingStage ......................... 93 5.2.2HeaderInformation ........................... 94 5.2.3EmbeddingStage ............................ 95 5.3J4EmbeddingAlgorithmInDetail ...................... 97 5.4J4ExtractionModule .............................. 100 5.5J4ExtractionAlgorithmDetail ......................... 101 5.6TheoreticalEstimationOfEmbeddingCapacity ............... 105 5.6.1CalculationOfStopPositionForEachPair .............. 108 5.6.2CapacityEstimation .......................... 110 5.7Results ..................................... 112 5.7.1IncreaseIn1,-1and0Coefcients .................. 113 5.7.2EmbeddingEfciency ......................... 113 5.7.3PayloadAnalysis ............................ 113 5.8SteganalysisOfJ4 ............................... 115 5.8.1Pre-processingOfImagesForSteganalysis ............. 115 5.8.2BinaryClassication .......................... 117 5.9Conclusion ................................... 118 6

PAGE 7

6HIGHPERFORMANCESTEGANALYSISUSINGTWOSTEPMARKOV-MODEL ........................................ 120 6.1Introduction ................................... 120 6.2AnalyzingFeatures ............................... 120 6.2.1Inter-blockTransitions ......................... 121 6.2.2Intra-blockTransitions ......................... 125 6.2.3GlobalEntropy ............................. 127 6.2.4DualEntropy .............................. 127 6.3SummaryOfFeatures ............................. 128 6.4Results ..................................... 128 6.5Conclusion ................................... 130 7CONCLUSION .................................... 132 LISTOFREFERENCES .................................. 137 BIOGRAPHICALSKETCH ................................ 141 7

PAGE 8

LISTOFTABLES Table page 2-1DetectionrateusingMarkovbasedfeaturesatdifferentbitspernon-zero-coefcient(bpnz) ................................... 36 2-2ExtendedDiscreteCosineTransformation(DCT)featuresetwith193features. 37 2-3Comparisonofdetectionaccuracyusingbinaryclassier. ............ 38 2-4Comparisonofdetectionaccuracyusinginterandintrablockfeatureswithothersecond-orderstatisticalmethods. ...................... 39 3-1HeaderstructureforJ2algorithm. ......................... 47 4-1HeaderstructureforJ3algorithm. ......................... 61 4-2DetectionrateofJ3atdifferentbpnzusingSupportVectorMachines(SVM)binary-classier. ................................... 87 4-3DetectionrateofF5atdifferentbpnzusingSVMbinary-classier. ........ 87 4-4DetectionrateofOutguessatdifferentbpnzusingSVMbinary-classier. .... 88 4-5DetectionrateofSteghideatdifferentbpnzusingSVMbinary-classier. .... 88 4-6DetectionrateusingSVMmulti-classierat0.05bpnz. .............. 89 4-7DetectionrateusingSVMmulti-classierat0.1bpnz. ............... 89 4-8DetectionrateusingSVMmulti-classierat0.2bpnz. ............... 89 5-1HeaderstructureforJ4algorithm .......................... 95 5-2Comparisonofdetectionrate(in%)ofJ4withotheralgorithmsusingSVM-binary-classierwith0.05and0.1bpnz.TP=TruePositive,TN=True-Negative,AR=AverageAccuracy. ......................... 117 5-3Comparisonofdetectionrate(in%)ofJ4withotheralgorithmsusingSVMbinary-classierwith0.2and0.3bpnz. ....................... 118 6-1Summaryoffeaturesetsfortheproposedsteganalysissystem. ......... 128 6-2Comparisonofdetectionrate(in%)ofalgorithmsusingSVMbinary-classierwith0.05bpnz.TP=TruePositive,TN=TrueNegative,AR=Average-Accuracy. ....................................... 129 6-3Comparisonofdetectionrate(in%)ofalgorithmsusingSVMbinary-classierwith0.1bpnz. ..................................... 130 8

PAGE 9

6-4Comparisonofdetectionrate(in%)ofalgorithmsusingSVMbinary-classierwith0.2bpnz. ..................................... 130 9

PAGE 10

LISTOFFIGURES Figure page 1-1BlockdiagramofJointPictureExpertGroup(JPEG)compressionshowingthelossyandlosslessstagesduringtheencodingprocess. ........... 18 1-2HistogramofJPEGcoefcients,Fq(u,v). ...................... 18 1-3IllustrationofembeddingmessageinaJPEGimage. ............... 19 1-4Illustrationofembeddingmessagebits101usingLeastSignicantBit(LSB)encoding. ....................................... 21 1-5ComparisonofglobalhistogrambeforeandafterapplicationofJStegalgorithm. ....................................... 22 2-1SupportVectorMachine(SVM)constructionofhyperplanebasedontwo-differentclassesofdatausingalinerclassier. .................. 31 2-2SVMconstructionusinganon-linerclassier. ................... 32 2-3Exampleofahorizontaldifferencematrixanditshistogramrepresentation. .. 34 2-4Exampleofconversionofahorizontaldifferencematrixtotransitionprobability-matrix. ........................................ 35 3-1NeighborsofDiscreteCosineTransformation(DCT)F0indequantized-coefcientspace. ................................... 43 3-2IllustrationofembeddingdatausingJ2. ...................... 51 3-3BlockdiagramofJ2embeddingmodule. ...................... 52 3-4BlockdiagramofJ2extractionmodule. ....................... 53 3-5HistogramsofcoverandJ2stegoleshowingonly0,1,2coefcients. ... 56 3-6HistogramsofcoverandJ2stegoleignoringzerocoefcients. ......... 56 3-7IllustrationofanoriginalimageanditsstegoversionembeddedwithJ2. .... 57 4-1BlockdiagramofJ3embeddingmodule. ...................... 60 4-2BlockdiagramofJ3proposedextractionmodule. ................. 69 4-3ComparisonofLenacoverimagewithherstegoimage. ............. 79 4-4ComparisonofLenahistogramatdifferentstagesofembeddingprocess. ... 79 4-5ComparisonofestimatedcapacitywithactualcapacityusingJ3. ........ 81 4-6JPEGimagesusedforcomparisonofstoppointindices. ............. 82 10

PAGE 11

4-7Comparisonofestimatedstoppointindexvsactualstoppointindex. ...... 82 4-8EmbeddingefciencyofJ3intermsofbitsperpixel. ............... 83 4-9EmbeddingefciencyofJ3intermsofbitspernon-zerocoefcient(bpnz). .. 84 4-10ComparisonofembeddingcapacityofJ3withotheralgorithms. ......... 84 5-1BlockdiagramofJ4embeddingmodule. ...................... 93 5-28x8quantizedDCTcoefcientmatrixanditsarrayrepresentation. ....... 94 5-3BlockdiagramofJ4extractionmodule. ....................... 100 5-4SomesampleimagesusedforJ4experiments. .................. 112 5-5Percentageincreaseanddecreasein1,-1and0coefcientsat0.05bpnz. .. 114 5-6EmbeddingefciencyofJ4atdifferentembeddingrates. ............. 115 5-7Actualbytesembeddedat0.05and0.1bpnz. ................... 116 6-1Illustrationofcoverimageestimationbycropping4rowsand4columnsfromthetopleft. ...................................... 124 11

PAGE 12

AbstractofDissertationPresentedtotheGraduateSchooloftheUniversityofFloridainPartialFulllmentoftheRequirementsfortheDegreeofDoctorofPhilosophySTEGANOGRAPHYANDSTEGANALYSISOFJOINTPICTUREEXPERTGROUP(JPEG)IMAGESByMahendraKumarAugust2011Chair:RichardE.NewmanCochair:JonathanC.LiuMajor:ComputerEngineering ResearchmotivationforthisdissertationcamefromaprojectsponsoredbyNavalResearchLaboratory(NRL)whereIwasworkingonalgorithmstoprovidebetterstealthinessforhidingdatainsideJPEGimages.Withtheguidanceofmyadvisor,Dr.RichardNewman,andIraS.MoskowitzfromCenterforHighAssuranceComputerSystems,NRL,wedevelopedJ2steganographyalgorithmwhichwasbasedonhidingdatainthespatialdomainbymakingchangesinthefrequencydomain.J2hadproblemssuchaslowercapacityalongwithlackofrstorderhistogramrestoration.ThispavedpathforthedevelopmentofJ3wheretheglobalhistogramispreservedalongwithhighercapacity.FurtherenhancementsinJ3includedmatrixencodingtechniqueswherethenumberofcoefcientchangesarereducedifthepayloadissmallerthanthemaximumcapacity.TheadvantagewithJ3washighcapacitywithfullhistogramrestorationascomparedtootherexistingalgorithms.J3hasoutperformedotheralgorithmsintermsofdetectionrate.ThenextalgorithmwasJ4,animprovementoverJ3whichnotonlyrestorestheglobalhistogrambutalsoindividualhistograms.Atheoreticalanalysisisalsodoneforthematrixencodingparameter,k,alongwiththeestimatedcapacity.Theestimationofmatrixencoding,k,enablestochoosethebestencodingrateandoptimizeintermsofminimizingthenumberofcoefcientchanges. 12

PAGE 13

Inordertodevelopagoodsteganographyalgorithm,oneshouldhaveknowledgeaboutthedifferentsteganalysistechniques.Keepingthisinmind,asecondordersteganalysisschemeisproposedwhichusestwostepinterandintrablockMarkovtransitionprobabilitymatricesasfeatures.ThesefeaturesarethenusedfortraininganumberofcoverandstegoimagesusingaSVMclassier.Basedonthetraineddata,anothersetofcoverandstegoimagesareusedforestimationofpredictionaccuracyofthoseimages.Theresultsshowthatthisnewsteganalysisalgorithmoutperformsalltheotherexistingalgorithmsknownatthetimeofwritingthisdissertation. Researchgoals:Thisdissertationfocussesonthefollowingtopics: 1. Designingafrequencybasedembeddingapproachwithspatialbasedextractionusinghashingofthedatafromspatialdomain-J2. 2. DesigninganovelapproachtohighcapacityJPEGsteganographyusingglobalhistogramcompensationtechnique-J3. 3. DesigningaJPEGsteganographyalgorithmusingglobalanddualhistogramcompensationalongwithmatrixencodingtominimizechanges-J4. 4. DesigningasteganalysisschemebasedonestimationofcoverwithtwostepMarkovmodel. Organizationofthisdissertation:Thisdissertationisdividedintothreemajorparts:Background,threesteganographyalgorithmsandonesteganalysisalgorithm.Chapter 1 and 2 givebackgroundinformationonsteganographyandsteganalysisandthepriorworkdoneintheseareas.Thesetwochaptersareimportantsincethisworkisentirelybasedonthesetwoareasofresearch.Chapter 1 introducestheconceptofsteganographywithanoverviewofthepopularalgorithmssuchasOutguess,F5,Steghideetc.Chapter 2 discussesimportantconceptsinsteganalysisusedtodetectthepresenceofdatainJPEGimages.Thesedetectionmethodsincludetherstandsecondorderstatisticalanalysisalongwithmachinelearningtechniquestoclassify,trainandpredictvarioussteganographyalgorithms. 13

PAGE 14

Thesecondpartofthisdissertationconsistsofthecontributionsbymeinsteganography.TheseincludeJ2,J3andJ4algorithms.Chapter 3 discussesthedetailsabouttherststeganographyalgorithm,J2.J2introduceschangesinthefrequencydomaintohidedatainthespatialdomain.J2wasauniqueconceptsinceit'sconceptuallydifferentthanmostLSBembeddingtechniques.However,ithassomelimitationswhichincludelowdatarateandiscomputationallyexpensive.Chapter 4 discusesthenextalgorithm,J3,whichwasahugeimprovementintermsofembeddingcapacityaswellasdetectionrate.J3usesstoppointswhichareusedtokeeptrackofthechangesmadetothecoefcients.Thesestoppointstellthealgorithmwhentostopencodingacertaincoefcientsothatitcanrestoretheglobalhistogramcompletelyaftertheembeddingphase.Inadditiontocompleterestoration,J3alsohasaverylowdetectionratecomparedtootheralgorithms.J3alsousesmatrixembeddingwhichreducesthenumberofoverallchangesrequiredtoembedagivenmessage.Chapter 5 introducesanadvanceversionofJ3whichcanrestoretheglobalaswellasindividualhistogramsofeachDCTindex.Thisallowsthealgorithmtoreducethedetectionratesignicantly.ExperimentalresultsshowthatJ4outperformsotherwellknownalgorithmsintermsofdetectionrateatthesamepayload.ThesealgorithmsincludeF5,Outguess,Steghide,nsF5,MB1,MB2andPQ. ThethirdpartofthisdissertationconsistsofChapter 6 whichintroducesanewsteganalysisalgorithm.Thisalgorithmoutperformsotheralgorithmsbyasmallmargin.Thesmallmarginisduetothefactthatthebestknownsteganalysisalgorithmsalreadydetectmoststegoimageswith90-98%accuracy.Acomparisonofthesteganalysisalgorithmpresentedinthisdissertationtothebestknownsteganalysismethodprovesthatthisalgorithmperformsbetterintermsofdetectingstegoimages.Thissteganalysisalgorithmusessecondorderstatisticswhichconsistsofinterandintrablockcorrelationsamongstneighboringblocksoftheimage.Thefeatureextractorinthisalgorithm 14

PAGE 15

consistsoftwostepMarkovtransitionprobabilitymatricesalongwithglobalanddualentropytodetectanomaliesinstegoimagesascomparedtocoverimages. 15

PAGE 16

CHAPTER1JOINTPICTUREEXPERTGROUP(JPEG)STEGANOGRAPHY 1.1Introduction Steganographyisatechniquetohidedatainsideacovermediuminsuchawaythattheexistenceofanycommunicationitselfisundetectableasopposedtocryptographywheretheexistenceofsecretcommunicationisknownbutisindecipherable.ThewordsteganographyoriginallycamefromaGreekwordwhichmeansconcealedwriting.Steganographyhasanedgeovercryptographybecauseitdoesnotattractanypublicattention,andthedatamaybeencryptedbeforebeingembeddedinthecovermedium.Hence,itincorporatescryptographywithanaddedbenetofundetectablecommunication. Indigitalmedia,steganographyissimilartowatermarkingbutwithadifferentpurpose.Whilesteganographyaimsatconcealingtheexistenceofamessagewithhighdatacapacity,digitalwatermarkingmainlyfocussesontherobustnessofembeddedmessageratherthancapacityorconcealment.Sinceincreasingcapacityandrobustnessatthesametimeisnotpossible,steganographyandwatermarkinghaveadifferentpurposeandapplicationintherealworld.Steganographycanbeusedtoexchangesecretinformationinaundetectablewayoverapubliccommunicationchannel,whereaswatermarkingcanbeusedforcopyrightprotectionandtrackinglegitimateuseofaparticularsoftwareormediale. Imagelesarethemostcommoncovermediumusedforsteganography.Withresolutioninmostcaseshigherthanhumanperception,datacanbehiddeninthenoisybitsorpixelsoftheimagele.Becauseofthenoise,aslightchangeinthethosebitsisimperceptibletothehumaneye,althoughitmightbedetectedusingstatisticalmethods(i.e.,steganalysis).OneofthemostcommonandnaivemethodsofembeddingmessagebitsisLeastSignicantBits(LSB)replacementinspatialdomainwherethebitsareencodedinthecoverimagebyreplacingtheLSBofpixels[ 1 ].Othertechniques 16

PAGE 17

mightincludespreadspectrumandfrequencydomainmanipulation,whichhavebetterconcealmentpropertiesthanspatialdomainmethods.SinceJPEGisthemostpopularimageformatusedovertheInternetandbyimageacquisitiondevices,IuseJPEGasthedefaultchoiceforsteganography. 1.2JPEGCompression JointPhotographicExpertGroup,alsoknownasJPEG,isthemostpopularandwidelyusedimageformatforsharingandstoringdigitalimagesovertheInternetoranyPC.ThepopularityofJPEGisduetoitshighcompressionratiowithgoodvisualimagequality.TheleformatdenedbyJPEGstoresdatainJFIF(JPEGFileInterchangeFormat),whichuseslossycompressionalongwithHuffmanentropycodingtoencodeblocksofpixels.Figure 1-1 showstheblockdiagramtocompressabitmap(BMP)imageintoJPEGformat.First,thealgorithmbreakstheBMPimageintoblocksof8by8pixels.Then,discretecosinetransformation(DCT)isperformedontheseblockstoconvertthesepixelvaluesfromspatialdomaintofrequencydomain.ThesecoefcientsarethenquantizedusingaquantizationtablewhichisstoredasapartoftheJPEGimage.Thisquantizationstepislossysinceitroundsthecoefcientvalues.Inthenextstep,Huffmanentropycodingisperformedtocompressthesequantized8x8blocks.ThehistograminFigure 1-2 showsatypical,idealizeddistributionofJPEGcoefcients.Fromthehistogram,itcanbeconcludedthatthefrequencyofoccurrenceofcoefcientsdecreasewithincreaseintheirabsolutevalues.Thisdecreaseisdependentonthequantizingtableandtheimage,butisoftenaroundafactorof2.Itcanalsobeobservedthatthenumberofzerosismuchlargerthananyothercoefcientvalue.MoredetailsaboutJPEGcompressioncanbefoundinreferences[ 2 3 4 ]. 1.3JPEGSteganography Therearetwobroadcategoriesofimage-basedsteganographythatexisttoday:frequencydomainandspatialdomainsteganography.TherstdigitalimagesteganographywasdoneinthespatialdomainusingLSBcoding(replacingtheleastsignicantbitor 17

PAGE 18

Figure1-1. BlockdiagramofJointPictureExpertGroup(JPEG)compressionshowingthelossyandlosslessstagesduringtheencodingprocess. Figure1-2. HistogramofJPEGcoefcients,Fq(u,v). bitswithembeddeddatabits).SinceJPEGtransformsspatialdataintothefrequencydomainwhereitthenemployslossycompression,embeddingdatainthespatialdomainbeforeJPEGcompressionislikelytointroducetoomuchnoiseandresultintoomanyerrorsduringdecodingoftheembeddeddatawhenitisreturnedtothespatialdomain.Thesewouldbehardtocorrectusingerrorcorrectioncoding.Hence,itwasthoughtthatsteganographywouldnotbepossiblewithJPEGimagesbecauseofitslossycharacteristics.However,JPEGencodingisdividedintolossyandlossless 18

PAGE 19

stages.DCTtransformationtothefrequencydomainandquantizationstagesarelossy,whereasentropyencodingofthequantizedDCTcoefcients(whichwillbecalledJPEGcoefcientstodistinguishthemfromtherawfrequencydomaincoefcients)islosslesscompression.Takingadvantageofthis,researchershaveembeddeddatabitsinsidetheJPEGcoefcientsbeforetheentropycodingstage.ThelossyandlosslessstagesinaJPEGencodingprocessareillustratedinFigure 1-1 AgenericmethodtoembedmessageinaJPEGimageistochangetheDCTcoefcientvaluestoreectthemessagebits.Oncetherequiredmessagebitshavebeenembedded,themodiedcoefcientsarecompressedusingentropyencodingtonallyproducetheJPEGstegoimage.ByembeddinginformationinJPEGcoefcients,itisdifculttodetectthepresenceofanyhiddendatasincethechangesareusuallynotvisibletothehumaneyeinthespatialdomain.Duringtheextractionprocess,theJPEGleisentropydecodedtoobtaintheJPEGcoefcients,fromwhichthemessagebitsareextractedfromtheLSBofeachcoefcient.Figure 1-3 showsanoverviewofembeddingdatainaJPEGimage. Figure1-3. IllustrationofembeddingmessageinaJPEGimage. 1.4LeastSignicantBit(LSB)BasedEmbeddingTechnique LSBembedding(seesources[ 1 5 6 ])isthemostcommontechniquetoembedmessagebitsinDCTcoefcients.Thismethodhasalsobeenusedinthespatialdomainwheretheleastsignicantbitvalueofapixelischangedtoinsertazerooraone.Asimpleexamplewouldbetoassociateevencoefcientswithbit0andoddcoefcients 19

PAGE 20

withbit1.InordertoembedamessagebitinapixeloraDCTcoefcient,thesenderincreasesordecreasesthevalueofthecoefcient/pixeltoembedazerooraone.Thereceiverthenextractsthehiddenmessagebitsbyreadingthecoefcientsinthesamesequenceanddecodingtheminaccordancewiththeencodingtechniqueperformedonit.Figure 1-4 showsanexampleofembeddingmessage101inaJPEGimagebyLSBreplacementtechnique.TheadvantageofLSBembeddingisthatithasgoodembeddingcapacityandthechangeisusuallyvisuallyundetectabletothehumaneye.Ifallthecoefcientsareused,itcanprovideacapacityofalmostonebitpercoefcientusingthefrequencydomaintechnique.Ontheotherhand,itcanprovideagreatercapacityforthespatialdomainembeddingwithalmost1bitperpixelforeachcolorcomponent.However,sendingarawimagesuchasaBitmap(BMP)tothereceiverwouldcreatesuspicioninandofitself,unlesstheimageleisverysmall.Fridrichetal.proposedasteganalysismethodwhichprovidesahighdetectionrateforshorterhiddenmessages[ 7 ].WestfeldandPtzmannproposedanothersteganalysisalgorithmforBMPimageswherethemessagelengthiscomparabletothepixelcount[ 8 ].Mostofthepopularformatstodayarecompressedinthefrequencydomainandthereforeitisnotacommonpracticetoembedbitsdirectlyinthespatialdomain.Hence,frequencydomainembeddingsarethepreferredchoiceforimagesteganography. 1.5PopularSteganographyAlgorithms 1.5.1JSteg Jsteg[ 9 ]wasoneoftherstJPEGsteganographyalgorithms.DevelopedbyDerekUpham,JStegembedsmessagebitsinLSBoftheJPEGcoefcients.JStegdoesnotrandomizetheindexofJPEGcoefcientstoembedmessagebits.Hence,thechangesareconcentratedtooneportionoftheimageifallthecoefcientsarenotused.Usingallthecoefcientsmightremovethisanomalybutwillperturbtoomanybitstobeeasilydetected.JStegdoesnotembedanymessageinDCTcoefcientswithvalue0and1.Thisistoavoidchangingtoomanyzerosto1'ssincenumberofzerosisextremelyhigh 20

PAGE 21

Figure1-4. Illustrationofembeddingmessagebits101usingLeastSignicantBit(LSB)encoding. ascomparedtonumberof1's.Hence,morenumberofzeroswillbechangedto1'sascomparedto1'sbeingchangedtozeros.Toembedamessagebit,itsimplyreplacestheLSBoftheDCTcoefcientwiththemessagebittoembed.Thealgorithmtoembedisgivenbelowinbrief. Algorithm1.1:AlgorithmtoembeddatausingJSteg. Input: GivenJPEGImage,Messagebits Output: StegoImageinJPEGformat 1 begin 2whileDatalefttoembeddo 3GetnextDCTcoefcientfromthecoverimage; 4ifDCT=1ORDCT=0then 5continue /* GotothenextDCTsinceitsa0ora1*/ 6else 7GetnextLSBfrommessage; 8ReplaceDCTLSBwithmessagebit; 9end 10end 11StorethechangedDCTasstegoimage. 12end 21

PAGE 22

Thisstrategytoembeddatacanbeeasilydetectedbythechi-squareattack[ 10 ]sincetheyequalizepairsofcoefcientsinatypicalhistogramoftheimage,givingastaircaseappearancetothehistogramasshowninFigure 1-5 AHistogrambeforeJSteg. BHistogramafterJSteg. Figure1-5. ComparisonofglobalhistogrambeforeandafterapplicationofJStegalgorithm. JPHideandSeek[ 11 ]isanotherJPEGsteganographyprogram,improvingstealthbyusingtheBlowshencryptionalgorithmtorandomizetheindexforstoringthemessagebits.Thisensuresthatthechangesarenotconcentratedinanyparticularportionoftheimage,adeciencythatmadeJstegeasilydetectable.SimilartotheJStegalgorithm,italsohidesdatabyreplacingtheLSBoftheDCTcoefcients.Theonlydifferenceisthatitalsousesallcoefcientsincludingtheoneswithvalue0and1.ThemaximumcapacityofJPHideandSeekisaround10%tominimizevisualandstatisticalchanges.Hidingmoredatacanleadtovisualchangesintheimagewhichcanbedetectedbythehumaneye. 1.5.2F5 F5[ 12 ]isoneofthemostpopularalgorithms,andisundetectableusingthechi-squaretechnique.F5usesmatrixencodingalongwithpermutatedstraddlingtoencodemessagebits.Permutatedstraddlinghelpsdistributethechangesevenlythroughoutthestegoimage.Matrixencodingcanembedkbitsbychangingonlyoneofn=2k)]TJ /F4 11.955 Tf 11.32 0 Td[(1places.Thisensureslesscoefcientchangestoencodethesame 22

PAGE 23

amountofmessagebits.F5alsoavoidsmakingchangestoanyDCcoefcientsandcoefcientswithzerovalue.IfthevalueofthemessagebitdoesnotmatchtheLSBofthecoefcient,thecoefcient'svalueisalwaysdecremented,sothattheoverallshapeofthehistogramisretained.However,aonecanchangetoazeroandhencethesamemessagebitmustbeembeddedinthesubsequentcoefcientsuntilitsvaluebecomesnon-zero,sincezerocoefcientsareignoredondecoding.However,thistechniquemodiesthehistogramofJPEGcoefcientsinapredictablemanner.Thisisbecauseoftheshrinkageofonesconvertedtozerosincreasesthenumberofzeroswhiledecreasesthehistogramofothercoefcientsandhencecanbedetectedonceanestimateoftheoriginalhistogramisobtained[ 13 ]. 1.5.3Outguess Outguess,proposedbyNielsProvos,wasoneoftherstalgorithmstouserstorderstatisticalrestorationmethodstocounterchi-squareattacks[ 14 ].Thealgorithmworksintwophases,theembedphaseandtherestorationphase.Aftertheembeddingphase,thealgorithmmakescorrectionstotheunvisitedcoefcientstomatchittothecoverhistogramusingarandomwalk.Outguessdoesnotmakeanychangetocoefcientswith1or0value.Itusesaerrorthresholdforeachcoefcienttodeterminetheamountofchangewhichcanbetoleratedinthestegohistogram.Ifacoefcientmodication(2i!2i+1)resultsinexceedingofthreshold,itwilltrytocompensateforthechangewithoneoftheadjacentcoefcients(2i+1!2i)inthesameiteration.But,itmaynotbeabletodososincetheprobabilityofndingacoefcienttocompensateforthechangesisnot1.Attheendoftheembeddingprocess,ittriestoxalltheremainingerrors.But,notallthecorrectionsmightbepossibleiftheerrorthresholdistoolarge.Thismeansthatalgorithmmaynotbeabletorestorethehistogramcompletelyascomparedtothecoverimage.Ifthethresholdistoosmall,thedatacapacitycanreducedrasticallysincetherewillbetoomanyunusedcoefcients.Also,thefractionofcoefcientsusedtoholdthemessage,a,isinverselyproportionaltothe 23

PAGE 24

totalnumberofcoefcientsintheimage.ThismeansOutguesswillperformpoorlywhenthenumberofavailablecoefcientsistoolarge.Since,Outguesspreservesonlytherstorderhistogram,itisdetectableusingsecondorderstatistics[ 15 ]andimagecroppingtechniquestoguessthecoverimage[ 16 15 ]. 1.5.4Steghide AnotherpopularalgorithmisSteghide[ 17 ],wheretheauthorsclaimtouseexchangingcoefcientsratherthanoverwritingthemtoembedbitsinDCTcoefcients.Theyusegraphtheorytechniqueswheretwointer-changeablecoefcientsareconnectedbyanedgeinthegraphwithcoefcientsasverticesofthegraph.Theembeddingisdonebysolvingthecombinatorialproblemofmaximumcardinalitymatching.Ifacoefcientneedstobechangedinordertoembedthemessagebit,itisswappedbyoneoftheothercoefcientsconnectedthroughthegraph.Thisensuresthattheglobalhistogramispreservedandhenceitisdifculttodetectanydistortionusingrstorderstatisticalanalysis.However,exchangingtwocoefcientsisessentiallymodifyingtwocoefcientswhichwilldistorttheintra/interblockdependencies.ThecapacityofSteghideisonly5.86%withrespecttothecoverlesizeascomparedtoJ3whichhasacapacityof9%. 1.5.5SpreadSpectrumSteganography AnothersteganographysystemproposedbyMarveletal.[ 18 19 ]usesspreadspectrumtechniquestoembeddatainthecoverle.Theideaistoembedsecretdatainsideanoisesignalwhichisthencombinedwiththecoversignalusingamodulationscheme.Everyimagehassomenoiseinitbecauseoftheimageacquisitiondeviceandhencethispropertycanbeexploitedtoembeddatainsidethecoverimage.Ifthenoisebeingaddediskeptatalowlevel,itwillbedifculttodetecttheexistenceofmessageinsidethecoversignal.Tomakethedetectionhard,thenoisesignalisspreadacrossawiderspectrum.Atthedecoderside,imagerestorationtechniquesareappliedtoguesstheoriginalimagewhichisthencomparedwiththestegoimagetoestimatethe 24

PAGE 25

embeddedsignal.SeveralotherdatahidingschemesusingspreadspectrumhavebeenpresentedbySmithandComiskeyin[ 20 ].Steganalysistechniquestodetectspreadspectrumsteganographyhavebeenshownin[ 21 22 ],wheretheauthorsclaimtodetect70%oftheembeddedmessagebitsand95%oftheimagesrespectively. 1.5.6ModelBasedSteganography Modelbasedsteganography(MB1),proposedbyPhilSallee[ 23 ],claimstoachievehighembeddingefciencywithresistanttorstorderstatisticalattacks.WhileOutguesspreservestherstorderstatisticsbyreservingaround50%ofthecoefcientstorestorethehistogram,MB1triestopreservethemodelofsomeofthestatisticalpropertiesoftheimageduringtheembeddingprocess.ThemarginalstatisticsofthequantizedACDCTcoefcientsaremodeledwithaparametricdensityfunction.Theauthorsdenetheoffsetvalues(LSBs)oftheDCTcoefcientsassymbolswithinahistogrambinandcomputesthecorrespondingsymbolprobabilitiesfromtherelativefrequenciesofthesymbols,i.e.,theoffsetvalueofcoefcientsinallbins.Themessagetobeembeddedisrstencryptedandentropydecodedwithrespecttothemeasuredsymbolprobabilities.Theentropydecodedmessageisthenembeddedbyspecifyingnewbinoffsetsforeachcoefcient.Thecoefcientsineachbinaremodiedaccordingtotheembeddingrulebuttheglobalhistogramandsymbolprobabilitiesarepreserved.Duringtheextractionprocess,themodelparametersaredeterminedtomeasurethesymbolprobabilitiesandtoobtainthedecodedmessage(symbolsequence).Themodelparametersandsymbolprobabilitiesaresameduringembeddingandextractingprocess. 1.5.7StatisticalRestorationTechniques Statisticalrestorationreferstotheclassofembeddingdatasuchthattherstandhigherorderstatisticsarepreservedaftertheembeddingprocess.Asmentionedearlier,embeddingdatainaJPEGimagecanleadtochangesinthetypicalstatisticsoftheimage,whichinturncanbedetectedbysteganalysis.Mostofthesteganalysismethodsexistingtodayemployrstandsecondorderstatisticalpropertiesoftheimagetodetect 25

PAGE 26

anyanomalyinthestegoimage.Statisticalrestorationisdonetorestorethestatisticsoftheimageascloseaspossibletothegivencoverimage. J3,discussedinChapter 4 ,fallsunderthecategoryofstatisticalrestorationorpreservationschemes[ 14 17 24 25 26 ].Outguess,proposedbyNielsProvos,wasoneoftherstalgorithmstousestatisticalrestorationmethodstocounterchi-squareattacks[ 14 ]whichwasdiscussedintheprevioussection. AnotherstatisticalrestorationtechniqueispresentedbySolankiet.al[ 24 ]whereauthorsclaimtoachievezeroK-Ldivergencebetweenthecoverandthestegoimagewhilehidingdataathighrates.Theprobabilitydensityfunction(pdf)ofthestegosignalexactlymatchesthecoversignal.Theydividetheleintotwoseparateparts,oneusedforhidingandtheotherforcompensation.Thegoalistomatchthecontinuouspdfofthecoversignaltothestegosignal.TheyusedamagnitudebasedthresholdwheretheyavoidhidinganydatainsymbolswhosemagnitudeisgreaterthanT.ForJPEGimages,theyuse25%ofthecoefcientsforhidingwhilepreservingtherestforcompensation.Thisapproachisnotveryefcientbecauseitdoesnotuseallthepotentialcoefcientsforhidingdata.Thecoefcientsinthecompensationstreamaremodiedusingminimummean-squarederrorcriteria[ 24 ].However,theydonotconsidertheintraandinterblockdependencyamongstJPEGblockswhichisanimportanttoolsusedbysteganalyststodetectstegoimages. Anotherhigherorderstatisticalrestorationtechniquehasbeenpresentedbythesameauthors[ 27 ]wheretheyusetheearth-mover'sdistance(EMD)techniquetorestorethesecondorderstatistics.EMDisapopulardistancemetricusedincomputervisionapplications.Thecoverandthestegoimageshavedifferentprobabilitymassfunction(PMF).EMDisdenedastheminimumworkdonetoconvertthehostsignaltothestegosignal.Theauthorshaveconsideredtheconceptofbinswhereeachbinstoresahorizontaltransitionfromonecoefcienttoanother.Eachblockisstoredin1-Dvectorinzigzagscanningorder.Hence,thereare64columnsandNrrowswhereNr 26

PAGE 27

isequaltothetotalnumberofblocksintheimage.This2-Dmatrixcanhelpcapturebothinteraswellasintrablockdependencies.Thetransitionsarestoredinbins.Ifanyofthecoefcientsaremodied,oneofmorebinsmaybemodieddependingonthechange.Dependingonthechange,theytrytondanoptimallocationtocompensatethatchangeinthebinssothatthebincountsremainequaltobincountsinthecoverimage.However,theauthorshaveonlyconsideredthehorizontaltransitionprobabilityforbothinterandintrablockdependencies.Theyhavenotconsideredthediagonalandtheverticaltransitionswhicharealsoanimportantfactortorestorethesecondorderstatistics. 1.6MatrixEmbeddingForSteganography Twoofthesteganographyalgorithmspresentedinthisdissertation,namelyJ3andJ4,usematrixembeddingtechniquetominimizethenumberofchanges.Thissectiongivesasmallbackgroundonthematrixencodingtechnique.Matrixembedding/encodingwasrstproposedbyRonCrandall[ 28 ]andrstusedinF5algorithm.MatrixembeddingisaformofHammingerrorcorrectioncodes[ 29 ]whichcandetectuptotwosimultaneouserrorbitsandcancorrectsinglebiterrorsinatransmittedmessage.Matrixembeddingusesthistechniquetoembedkmessagesbitsin2k)]TJ /F4 11.955 Tf 10.95 0 Td[(1bitsbychangingatmostonebit.IntermsofJPEGcoefcients,matrixencodingcanembedkbitsin2k)]TJ /F4 11.955 Tf 11.06 0 Td[(1JPEGcoefcientsbychangingatmostonecoefcientwhichisrepresentedbythetuple(1,n,k),wheren=2k)]TJ /F4 11.955 Tf 11.48 0 Td[(1.Forexample,(1,7,3)codecanembed3bitsofmessagein7coefcientsbychangingatmost1coefcient.IfweassumethatthemessagebitstobeembeddedisuniformlydistributedovertheJPEGcoefcientvalues,thenonlyhalfofthemessagebitswouldbechanged.OtherhalfwouldremainunchangedbecauseofthemessagebitsbeingsameastheLSBofthecoefcients.Hence,withoutmatrixembedding,wewouldhaveanembeddingefciencyof2bitsperchange.With(1,7,3)code,theembeddingefciencyincreasesto3.43. 27

PAGE 28

Theprocessofcalculatingtheindexofcoefcienttochange(shownin[ 12 ]isillustratedbelow: LetnbethenumberofJPEGcoefcientswhicharetobeembeddedwithkbitsofmessage.LetaibetheLSBoftheithcoefcient.Wecanthendeterminethehashfunctionby: f(a)=nMi=1ai.i(1) Functionf(a)XORsallthecoefcientindiceswhoseLSBsare1.Thiswillproducekoutputbits.Letx1xkbethemessagebitsequencetobeembedded,denotedbyvectorx.WeXORf(a)withxtogetthecoefcientpositionwhoseLSBistobeipped. s=f(a)x(1) Theembeddingrate,R(k),isdenedastheratioofkton,i.e.k=n.LetD(k)bethechangedensity,whichistheprobabilityofacoefcientbeingchangedinablockofncoefcients.Theefciency,E(k),isdenedasthenumberofbitsembeddedperchange. D(k)=1 n+1 (1) E(k)=R(k) D(k)=2k 2k)]TJ /F4 11.955 Tf 10.95 0 Td[(1.k (1) Matrixembeddingisidealifthenumberofbitstobeembeddedissmallerthanthetotalnumberofpotentialcoefcientsavailable.Forexample,ifwehave50000coefcientsavailableand1000bitstoembed,theembeddingratewouldbe1000/50000,i.e.2%whichgivesanefciencyof8bitsembeddedperchange.Hence,wecanleveragethepotentialofmatrixembeddingtominimizethetotalnumberofchangesandreducedetection. 28

PAGE 29

CHAPTER2JOINTPICTUREEXPERTGROUP(JPEG)STEGANALYSIS 2.1Introduction Steganographyisagameofhideandseek.Whilesteganographyaimsathidingdatawithmaximumstealthiness,steganalysisaimstodetectthepresenceofanyhiddeninformationinthestegomedia(inthisdissertation,itreferstoJPEGimages).Inthepast,steganographyavoidedanyvisualdistortionsinthestegoimages.Hence,majorityofthestegoimagesdonotrevealanyvisualcluesastowhetheracertainimagecontainsanyhiddenmessageornot.Currentsteganalysisaimstofocusmoreondetectingstatisticalanomaliesinthestegoimageswhicharebasedonthefeaturesextractedfromtypicalcoverimageswithoutanymodications.Coverimageswithoutanymodicationordistortioncontainapredictablestatisticalcorrelationwhichwhenmodiedinanyformwillresultindistortionstothatcorrelation.Theseincludeglobalhistograms,blockiness,interandintrablockdependenciesandotherrstandsecondorderstatisticsoftheimage.Moststeganalysisalgorithmsarebasedonexploitingthesestrongdependencieswhicharetypicalofnaturalimages. Steganalysiscanbeclassiedintotwobroadcategories: 1. Specic/TargetedSteganalysis:Specicsteganalysis,alsosometimesknowsastargetedsteganalysis,isdesignedtoattackoneparticulartypeofsteganographyalgorithm.Thesteganalystisawareoftheembeddingmethodsandstatisticaltrendsofthestegoimageifembeddedwithaknownalgorithm.Thisattackmethodisveryeffectivewhentestedonimageswiththeknownembeddingtechniqueswhereasitmightfailconsiderablyifthealgorithmisunknowntothesteganalyst.Forexample,Fridrichetal.broketheF5algorithmbyestimatinganapproximationofcoverimageusingthestegoimage[ 13 ].BohmeandWestfeldbrokethemodel-basedsteganography[ 23 ]usinganalysisoftheCauchyprobabilitydistribution[ 30 ].Jsteg[ 9 ],whichsimplychangestheLSBofacoefcientto 29

PAGE 30

thevaluedesiredforthenextembeddeddatabit,canbedetectedbytheeffectithasofequalizingadjacentpairsofcoefcientvalues[ 10 ]. 2. Blind/Generic/UniversalSteganalysis:Blindsteganalysis,alsoknownasuniversalsteganalysis,isthemodernandmorepowerfulapproachtoattackastegomediasincethismethoddoesnotdependonknowinganyparticularembeddingtechnique.Thismethodcandetectdifferenttypesofsteganographycontentevenifthealgorithmisnotknown.However,thismethodcannotdetecttheexactalgorithmusedtoembeddataifthetrainingsetisnottrainedwiththatparticularstegoalgorithm.Themethodisbasedondesigningaclassierwhichdependsonthefeaturesorcorrelationsexistinginthenaturalcoverimages.Themostcurrentandpopularmethodsincludeextractingstatisticalcharacteristics(alsoknownasfeatures)fromthegivensetofimages.Apatternrecognitionclassieristhenusedonthesefeaturestodifferentiatebetweenacoverimageandastegoimage.Thisisdiscussedindetailinthefollowingsection. 2.1.1PatternRecognitionClassier Classierisamechanismoralgorithmwhichtakesanunknownvariableandgivesapredictionoftheclassofthatvariableasanoutput.Beforeaclassiercanbeused,ithastobetrainedwithagivendatasetwhichincludesvariablefromdifferentclasses.SupportVectorMachines(SVM),inventedbyV.Vapnik,[ 31 ],isthemostcommonpatternclassierusedforbinaryandmulticlassicationofdifferenttypesofdata.SVMshavebeenusedinmedical,engineeringandothereldstoclassifydata.ThestandardSVMisastandardbinarynon-probabilisticclassierwhichpredicts,foreachinput,whichofthetwopossibleclassesistheinputmemberof.TouseSVM,ithastobetrainedonasetoftrainingexamplesfrombothtypesofdataonwhichthealgorithmbuildsapredictionmodelwhichpredictswhetheranewexamplefallsintoonecategoryortheother.Inasimplerform,SVMmodelrepresentstrainingexamplesaspointsinspaceandtriestoseparateexamplesofdifferentcategorieswiththemaximumdistance 30

PAGE 31

Figure2-1. SupportVectorMachine(SVM)constructionofhyperplanebasedontwodifferentclassesofdatausingalinerclassier. possiblebetweenthem.WhenatestingexampleisgivetotheSVM,ittriestomapthegivenexampleintothesamespacesothatitfallsinoneofthetwoside.Formally,SVMtriedtondahyperplanethatbestseparatesthetwoclassesbymaximizingthedistancebetweenthetwoclassvectorswhileminimizingsomemeasureoflossontrainingdata,i.e.,minimizingerror.Thelinerandnon-linearclassiersareshowningures 2-1 and 2-2 respectively. 2.1.2JPEGSteganalysisUsingSupportVectorMachines(SVM) SVMshavebecomerecentlypopulartoclassifyifagivenimageisstegooracover[ 32 ].Thetrainingdatasetconsistsofanumberoffeaturesextractedfromasetofcoverandstegoimages.Basedonthistrainingmodel,SVMcanbuildapredictionmodelwhichcanclassifytheseimages.SteganalysisofJPEGimagesisbasedonstatisticalpropertiesoftheJPEGcoefcients,sincethesestatisticalcorrelationsareviolatedwhentheDCTcoefcientsaremodiedtohidedata.ThesestatisticalpropertiesincludestheDCTfeatures[ 33 ]andtheMarkovfeatures[ 34 ].Amoreeffectiveapproachto 31

PAGE 32

Figure2-2. SVMconstructionusinganon-linerclassier. steganalysiswasachievedbycombining,calibratingandextendingtheDCTandMarkovfeaturestogethertoproduced274mergedfeatureset[ 35 ].TheresultsshowthatthismethodproducesabetterdetectionratethanusingtheDCTfeaturesortheMarkovfeaturesalone. 2.2SteganalysisUsingSecondOrderStatistics Faridwasoneofthersttoproposetheuseofhigherorderstatisticstodetecthiddenmessagesinastegomedium[ 36 ].Heusesawaveletlikedecompositiontobuildahigherorderstatisticalmodelfornaturalimages.Thedecompositionusesquadraturemirrorlterswhichsplitsthefrequencyspaceintomultiplescaleandorientation.Hethenapplieslowpassandhighpassltersalongtheimageaxistogeneratevertical,horizontal,diagonalandlowpasssub-bands.Giventhisdata,themean,variance,skewnessandkurtosisforeachofthesubbandsondifferentscaleiscalculatedwhichishigherorderstatistics.Fisherlineardiscriminant(FLD)patternclassierisusedtotrainandpredictifagivenimageiscoverorstego.Theresultsshowanaverageof 32

PAGE 33

90%detectionrateforOutguessandJSteg.ThesametechniquehasbeenusedbytheLyuandFaridin[ 37 ],butintheirpapertheyuseaSVMclassierinsteadofFLD.Thetrainingsetconsistedof1800coverJPEGimageswithrandomsubsetoftheimagesembeddedusingOutguessandJSteg.TheresultsshowimprovementondetectionratewhenusinganonlinerSVMclassierascomparedtoFLD.Theirotherpaperalsousesthesamestatisticalfeaturesbutalsoincludesphasestatistics[ 38 ]. 2.2.1MarkovModelBasedFeatures Shietal.werethersttouseMarkovmodeltodetectthepresenceofhiddendatainamedium[ 34 ].TheirtechniqueisbasedonmodelingtheJPEGcoefcientsasMarkovprocessandextractingusefulfeaturesfromthemusingintra-blockdependenciesbetweenthecoefcients.Since,thesurroundingpixelsinaJPEGimagesarecloselyrelatedtoeachother,thiscorrelationcanbeusedtodetectifanychangeshavebeenmadetothecoefcientsarenot.ThedifferencebetweenabsolutevaluesofneighboringDCTcoefcientsismodeledasaMarkovprocess.ThequantizedDCTcoefcients,F(u,v),arearrangedinthesamewayasthepixelsintheimage.ThefeaturesetisformedbycalculatingfourdifferencematricesfromthequantizedJPEG2Darrayalonghorizontal,vertical,majordiagonalandminordiagonaldirections. Fh(u,v)=F(u,v))]TJ /F3 11.955 Tf 10.95 0 Td[(F(u+1,v) (2) Fv(u,v)=F(u,v))]TJ /F3 11.955 Tf 10.95 0 Td[(F(u,v+1) (2) Fd(u,v)=F(u,v))]TJ /F3 11.955 Tf 10.95 0 Td[(F(u+1,v+1) (2) Fm(u,v)=F(u+1,v))]TJ /F3 11.955 Tf 10.95 0 Td[(F(u,v+1) (2) whereu2[1,Su)]TJ /F4 11.955 Tf 11.27 0 Td[(1],v2[1,Sv)]TJ /F4 11.955 Tf 11.27 0 Td[(1],SuisthesizeoftheJPEG2-Darrayinhorizontaldirection,Svisthesizeofarrayinverticaldirection,Fh,Fv,Fd,Fmarethedifferencearraysinhorizontal,vertical,majorandminordiagonals,respectively.Figure 2-3 showsanexampleofhorizontaldifferencematrixanditscorrespondinghistogramrepresentation. 33

PAGE 34

Figure2-3. Exampleofahorizontaldifferencematrixanditshistogramrepresentation. Fromthesefourarray,fourtransitionprobabilitymatricesareconstructed,namely,Mh,Mv,Md,Mmasshowsinequations 2 .Inordertoreducethecomputationalcomplexity,theyusedathresholdof[-4,+4],i.e.,anycoefcientoutsidetherangewereconvertedto-4or+4dependingonthevalue.Thisrangeleadstoaprobabilitytransitionmatrixof9x9,whichinturnwillproduceatotalof81x4=324featuresusingthefourdifferencematrices.Figure 2-4 showsthetwostagesintheconversionofahorizontaldifferencematrix(Figure 2-3 )intotransitionprobabilitymatrix.Athresholdof[0,2]wasconsideredforsimplicityandillustrationofthisprocess.Thedifferencematrixisrstconvertedintoatransitionmatrixfromwhichthenaltransitionprobabilitymatrixiscalculated.Figure 2-3 alsoshowsthecorrespondingstatetransitiongraphofthetransitionprobabilitymatrix. Mh(i,j)=Su)]TJ /F19 8.966 Tf 6.97 0 Td[(2u=1Svv=1d(Fh(u,v)=i,Fh(u+1,v)=j) Su)]TJ /F19 8.966 Tf 6.96 0 Td[(1u=1Svv=1d(Fh(u,v)=i) (2) Mv(i,j)=Suu=1Sv)]TJ /F19 8.966 Tf 6.97 0 Td[(2v=1d(Fv(u,v)=i,Fv(u,v+1)=j) Suu=1Sv)]TJ /F19 8.966 Tf 6.96 0 Td[(1v=1d(Fv(u,v)=i) (2) Md(i,j)=Su)]TJ /F19 8.966 Tf 6.96 0 Td[(2u=1Sv)]TJ /F19 8.966 Tf 6.96 0 Td[(2v=1d(Fd(u,v)=i,Fh(u+1,v+1)=j) Su)]TJ /F19 8.966 Tf 6.97 0 Td[(1u=1Sv)]TJ /F19 8.966 Tf 6.97 0 Td[(1v=1d(Fd(u,v)=i) (2) Mm(i,j)=Su)]TJ /F19 8.966 Tf 6.96 0 Td[(2u=1Sv)]TJ /F19 8.966 Tf 6.97 0 Td[(2v=1d(Fm(u+1,v)=i,Fm(u,v+1)=j) Su)]TJ /F19 8.966 Tf 6.97 0 Td[(1u=1Sv)]TJ /F19 8.966 Tf 6.97 0 Td[(1v=1d(Fm(u,v)=i) (2) 34

PAGE 35

Figure2-4. Exampleofconversionofahorizontaldifferencematrixtotransitionprobabilitymatrix. Intheirexperiment,theauthorsused7500JPEGimageswithaqualityfactorrangingfrom70to90.Alltheimageswerethenembeddedwith3differentalgorithms,namely,Outguess,F5andMB1.Next,theyextract324features(asdiscussedabove)fromcoverimagesetandstegoimagesetembeddedwiththese3algorithms.HalfofthestegoandcoverimageswererandomlyselectedastrainingdatausingtheSVM.Theinputtotheclassieristhefeaturevectorfromeachoftheseimages.Theotherhalfoftheimagesetwerethenusedforpredictingifthosecanbeclassiedinoneofthesefourcategories(cover,F5,Outguess,MB1)bytheSVM.TheresultsinTable 2-1 showaremarkabledetectionrateascomparedtoanyothersteganalysistechniqueproposedbefore.ThekernelusedforSVMclassicationandpredictionwaspolynomial.Table 2-1 showsthatShietal'smethodofextractingfeaturesandmodelingthemasaMarkovprocessgreatlyimprovesthedetectionrateofthethreealgorithms.Theadvantagewiththiskindoftechniqueisthatitcanbeusedwithanyexistingalgorithmwithoutanymodicationandhencecanbecategorizedasauniversalsteganalyzer. 35

PAGE 36

Table2-1. DetectionrateusingMarkovbasedfeaturesatdifferentbitspernon-zerocoefcient(bpnz) bpnzTNTPAR Outguess0.0587.690.188.9Outguess0.194.696.595.5Outguess0.297.298.397.8 F50.0558.657.057.8F50.168.170.269.1F50.285.888.387.0F50.495.997.696.8 MB10.0579.482.080.7MB10.191.293.392.3MB10.296.797.897.3MB10.498.899.499.1 2.2.2MergingMarkovAndDiscreteCosineTransformation(DCT)Features In2005,Fridrichetal.introducedamethodtodetectstegoimagesusingrstandsecondorderfeaturescomputeddirectlyfromtheDCTdomainsincethisiswheremostofthechangesaremade[ 39 ].Theseincludedatotalof23functionalstogettheDCTfeatureset.Therstorderstatisticsincludetheglobalhistogram,individualhistogramsofindividuallowerfrequencyDCTcoefcientsand,dualhistograms,whichare8x8matricesofeachindividualDCTcoefcientvalues.Thesecondorderstatisticsincludetheinter-blockdependencies,blockiness,andco-occurrencematrix.TherefeatureswerethenusedwithaSVMlinearclassierfordetectionofcoverandstegoimages.AmoredetailedanalysisoftheDCTfeatureswasdiscussedin[ 40 ]and[ 41 ]wheretheauthorsusedaGaussiankernelinsteadofalinerkernelasin[ 39 ].Theclassiercouldnotonlyabletodistinguishdifferentstegoalgorithmsbutcouldalsoclassifystegoimagesifthealgorithmwasunknown.Basedontheprevioustechniques,theauthorslaterextendedtheirworktoinclude193DCTfeaturesascomparedto23featuresandmergedthemwiththeMarkovfeaturestodesignamoresensitivedetector[ 35 ].These193DCTfeaturesareshowninTable 2-2 Since,theoriginalMarkovfeaturescapturetheintra-blockdependenciesandDCTfeaturescapturetheinter-blockdependencies,itwasagoodideatomergethere 36

PAGE 37

Table2-2. ExtendedDiscreteCosineTransformation(DCT)featuresetwith193features. FunctionalDimensionality GlobalHistogram115ACHistograms5x1111DualHistograms11x9VariationV12Blockiness2Co-occurrenceMatrix25 twofeaturesetsandcalibratethemtouseforsteganalysis.Hence,bothfeaturesetscomplimenteachotherwhenitcomestoimprovementindetection.Forexample,theMarkovfeaturesetisbetterindetectingF5whiletheDCTfeaturesetisbetterindetectingJPHideandSeek.Combiningboththefeaturesetwouldproduce193+324=517-dimensionalfeaturevector.Toreducethedimensionality,theauthorsaveragethefourprobabilitytransitionmatricestoget81features,i.e.,M=(M(c)h+M(c)v+M(c)d+M(c)m)=4.HereM(c)=M(J1))]TJ /F20 11.955 Tf 11.27 0 Td[(M(J2),whereJ1isthestegoimageandJ2isthecalibratedimagewhichisobtainedfromestimationofthecoverimagebycropping4columnsand4rowsandre-compressingitintoJPEGformat.81featuresfromMarkovmethodand193fromDCTcombinedtogetherproduce174-dimensionfeaturesetwhichisthenusedtotrainandpredictimagesusingaSVMclassier.Thetrainingsetforeveryclassierconsistedof3400coverand3400ofstegoimagesembeddedwithrandombit-stream.Thetestingimageswerepreparedinthesamewaywhichconsistedof2500images.Thetrainingandtestingsetsaremutuallyexclusive.Trainingandtestingsetsformulti-classicationwerepreparedinasimilarway.Toclassifyimagesinto7classes,theyusethemax-winmethodwhichconsistsof)]TJ /F13 8.966 Tf 5.48 -4.38 Td[(n2binarySVMclassiers[ 42 ]foreverypairofclasses.TheresultsforthebinaryclassicationareshowninFigure 2-3 2.2.3OtherSecondOrderStatisticalMethods MarkovbasedsteganalysisproposedbyShietal.considersonlyintra-blockdependencieswhichisnotsufcient.AJPEGimagemayexhibitcorrelationinDCTdomainacrossneighboringblocks.Hence,itmightbeusefultoanalyzeandextract 37

PAGE 38

Table2-3. Comparisonofdetectionaccuracyusingbinaryclassier. DetectionAccuracy(%)covervs.Messagelength(%)DCTMarkovMerged F510099.4999.8099.925098.8099.2099.842584.5486.9498.36cover99.8091.5399.64 JPHideandSeek10099.8898.0899.525098.5684.3899.602586.4627.1692.01cover99.3297.0099.56 MB110099.6499.9699.965098.9299.9699.922586.9499.7299.72cover97.7297.2099.88 MB23092.2999.92100.00cover98.9298.4899.92 Outguess10099.9299.92100.005099.6499.6899.962598.3697.8499.48cover99.4898.0499.76 Steghide10099.8499.96100.005099.4899.9299.922590.9398.8899.32cover97.4098.0099.92 featuresbasedoninter-blockdependencies.Theinter-blockdependenciesreferstothecorrelationbetweendifferentcoefcientslocatedatthesamepositionacrossneighboring8x8DCTblocks.JPEGsteganographyinDCTdomainwilldisrupttheseinter-blockdependencies.Similartotheintra-blocktechniqueusedby[ 34 ],fourdifferencematricesarecalculatedwhichresultsinfourprobabilitytransitionmatricesacrosshorizontal,vertical,majorandminordiagonals[ 43 ].Theinter-blockandintra-blockdependenciesarecombinedtogethertoforma486-Dfeaturevector.Thethresholdusedfortransitionprobabilitymatrices(TPM)was[-4,+4]whichleadsto81featuresfromeachofthedifference2-Darrays.Theauthorsconsider4differencematricesforintra-blockbutonlytwoforinter-block,i.e.,horizontalandvertical.Theyignorethediagonalmatricessincetheydonotinuencetheresultssignicantly.Hence, 38

PAGE 39

81x4featuresforintra-blockand81x2forinter-blockleadsto324+162=486-Dfeaturevector.Theauthorscomparedtheirresultstoothersteganalysistechniquesasdiscussedin[ 34 35 39 ].TheresultsshowanimprovementovertheseexistingtechniquesasdemonstratedinTable 2-4 Table2-4. Comparisonofdetectionaccuracyusinginterandintrablockfeatureswithothersecond-orderstatisticalmethods. SteganalysisDetectionRate(%)StegoAlgorithmBPCFridrich'sShietal'sP&F'sInter-IntraBlock Outguess0.050.34330.85750.94300.9625Outguess0.10.65630.95120.99100.9917Outguess0.20.90760.98330.99770.9978 MB10.050.11520.72690.40830.7492MB10.10.25270.91270.70180.9314MB10.20.51140.97590.91570.9859MB10.40.79760.99550.98820.9975 MB20.050.13620.78760.44950.8013MB20.10.29040.93480.75060.9482MB20.20.54540.98400.94420.9908MB20.40.79390.99660.99310.9978 F50.050.10080.20430.22240.2230F50.10.28470.48210.50720.5109F50.20.64720.83490.84630.8569F50.40.92190.97400.97600.9807 AnthersimilartechniquehasbeenusedbyZhouetal.[ 44 ]wheretheauthorsusedinteraswellasintrablockdependenciestocalculatethefeaturevector.However,tocalculatetheTPM,theyusethezig-zagscanningorderinsteadoftheusualrow-columnordertocalculatethematrices.Theirresultsshowthatthedetectionrateforeachsteganography(includingF5)with0.05bpnzcanexceeds95%.Inanotherinter/intrablocksteganalysistechnique[ 44 ],theauthorsuseFisherLinearDiscriminanttocalculatethedifferencematricesforTPMsfrominterandintrablockdependencies.Theyclaimtoachieve97%detectionratewithF5.Shietal.proposedanotheralgorithmwheretheyuseMarkovempiricaltransitionmatrixinblockDCTdomaintoextractfeaturesfrominterandintrablockdependencies[ 45 ].Theyre-arrangeeach8x82-DDCTarrayinto1-Drowusingzigzagscanningorder.Alltheblockarearrangedin 39

PAGE 40

rowwisetoformaBrowand64columnmatrix,whereBisthenumberofblock.Therow-wisescanningrepresentstheinterblockdependencywhilethecolumnsrepresenttheintra-blockdependency.However,usingthistechnique,theycanonlycalculatethehorizontaldifferencematricesforbothinterandintrablockfeatures. 40

PAGE 41

CHAPTER3J2:REFINEMENTOFATOPOLOGICALSTEGANOGRAPHICMETHOD 3.1Introduction J2[ 46 ]isanextensionofanearlierwork,J1,whichisbasedonanovelspatialembeddingtechniqueforJPEGimages.J1wasbasedontopologicalconceptswhichusesapseudo-metricoperatinginthefrequencydomaintoembeddata[ 47 ].Sincethechangesaremadeinthefrequencydomainandthedataisextractedinthespatialdomain,thestegoimagesproducedbyJ1canbestoredeitherinJPEGformatitselforanyspatialformatsuchasbitmap.Furthermore,eventheextremelysensitiveJPEGcompatibilitysteganalysismethod[ 48 ]cannotdetectJ1manipulationofthespatialimage.However,J1maybedetectedeasilybyothermeans.OneofthemajorawswithJ1wasthelackofrandomizationofthechangesmadeintheDCTdomainandtheblockwalkorder.Mostofthechangesinsideeachblockwereconcentratedintheupperleftcornerandhenceitcanbeeasilydetectedbyaknowledgeableattacker. Anotherimportantitemremainingwasestimationofthepayloadsize[ 49 ]ofagivencoverimage,sinceitispossiblethatsomeoftheblocksmaynotbeusabletostoretheembeddeddata.Forexample,ifablockcontainsalotofzeros,itmightnotbeabletoproducethedesiredembeddedbitsinthespatialdomain.Thedataextractionfunctionhadnowayofdeterminingwhichblockscontaindataandwhichdonot.J2containsathresholdtechniquewhichdetermineswhetherornotablockwouldbeusable.Basedonthenumberofusableblock,J2canaccuratelydeterminehowmuchpayloaditcancarrywithagivenimage. ThekeyideabehindtheextensionofJ1toJ2istomakethedatumembeddedstronglyandrandomlydependentonallspatialbitsintheblock.Thisisdoneby 41

PAGE 42

applyingacryptographichashtothe64bytesofeach88block1inspatialdomaintoproduceahashvalue,fromwhichagivennumberofbitsmaybeextracted(limitedbytheabilitytoproducethedesiredbitpattern).ThenumberofbitsbeingextractedperblockispredenedbyaconstantKintheheaderstructureofthele.Sincethedataembeddedisdependentonthehashofallthebytesinablock,anychangetothespatialblockproducesapparentlyrandomchangestothedatumtheblockencodes.Byrandomizingtheoutputoftheextractionfunction,embeddingmethodcanbethenlegitimatelyanalyzedprobabilistically. 3.2ReviewOfJ1 ThissectionreviewsthebaselineJ1algorithmversionofatopologicalapproachthatencodesdatainthespatialrealizationofaJPEG,butmanipulatestheJPEGquantizedDCTcoefcientsthemselvestodothis[ 47 ].Bymanipulatingtheimageinthefrequencydomain,theembeddingwillneverbedetectedbyJPEGcompatibilitysteganalysis[ 48 ].TheJ1systemstoresonlyonebitofembeddeddataperJPEGblock(in8-bit,grayscaleimages).Itsdataextractionfunction,,takestheLSBoftheupperleftpixelintheblocktobetheembeddeddata.Asmall,xedsizelengtheldisusedtodelimittheembeddeddata.EncodingisdonebygoingbacktotheDCTcoefcientsforthatJPEGblockandchangingthemslightlyinasystematicwaytosearchforaminimallyperturbedJPEGcompatibleblockthatembedsthedesiredbit,hencethetopologicalconceptofnearby.Thechangeshavetobetootherpointsindequantizedcoefcientspace(thatis,tosetsofcoefcientsDjforwhicheachcoefcientDj(i),i=1,,64isamultipleofthecorrespondingelementofthequantizationtable, 1J2isrestrictedtograyscaleimagesonly,butthemethodisapplicabletocolorimagesalso. 42

PAGE 43

QT(i)).ThisisdepictedinFigure 3-1 ,whereB0istherawDCTcoefcientsetforsomeblockF0ofacoverimage,andD1isthesetofdequantizedcoefcientsnearesttoB0.2 Figure3-1. NeighborsofDiscreteCosineTransformation(DCT)F0indequantizedcoefcientspace. ThepreliminaryversionchangesonlyoneJPEGcoefcientatatimebyonlyonequantizationstep.Inotherwords,itusestheL1metriconthepointsinthe64-dimensionalquantizedcoefcientspacecorrespondingtothespatialblocks,andamaximumdistanceofunity.(NotethatthisisdifferentfromchangingtheLSBoftheJPEGcoefcientsbyunity,whichonlygivesoneneighborpercoefcient.)Formostblocks,achangeofonequantumforonlyonecoefcientproducesacceptabledistortion 2ForquantizedDCTcoefcientsorforDCTcoefcientsets,dequantizedorraw,L1metrichasbeenusedtodenedistances. 43

PAGE 44

fortheHVS.Thisresultsinbetween65and129JPEGcompatibleneighbors3foreachblockintheoriginalimage. IfthereisnoneighboringsetofJPEGcoefcientswhosespatialdomainimagecarriesthedesireddatum,thentheblockcannotbeused.Thesystemcoulddealwiththisinanumberofways.Inthebaselinesystem,thesenderaltersunusableblocksinsuchawaythatthereceivercantellwhichblocksthesendercouldnotusewithoutthesenderexplicitlymarkingthem.Thereceiverdeterminesifthenextblocktobedecodedcouldhaveencodedanydatum(i.e.,wasrich)ornot(i.e.,waspoor).Richblocksaredecodedandpoorblocksareskipped,sothesendermustsimplyencodevaliddatainrichblocks(afterembedding)orifthisisnotpossible,signalthereceivertoskiptheblockbymakingsureitispoor. Intherstdenitionofusableforthesystem,onlytheblocksthathadarichneighborforeverypossibledatumtobeusablewereconsidered.Later,thisconditionwasrelaxedbyconsideringwhatdatumisdesiredtobeencodewiththeblock,sothatusabilitydependedontheembeddeddata.Inthiscase,ablockwasconsideredusableifithadsomerichneighborthatencodedthedesireddatum. Algorithminbrief: ThekeytoJ2algorithmisthatthesenderguaranteesthatallblocksareused. Transmitterhasusableblock(Fisusable): IfFencodestheinformationthatthetransmitterwishestosend,thetransmitterleavesFaloneandFissent.Thereceivergets(rich)F,decodesitandgetsthecorrectinformation. 3Changesareactuallydoneinquantizedcoefcientspace.Eachofthe64JPEGcoefcientsmaybechangedby+1or-1,exceptthosethatarealreadyextremal.Extremalcoefcientswillonlyproduceoneneighbor,soincludingtheoriginalblockitself,thetotalnumberofneighborsisatmost129,andisreducedfrom129bythenumberofextremalcoefcients. 44

PAGE 45

IfFdoesnotencodethecorrectinformation,thetransmitterreplacesitwitharichneighborF0thatdoesencodethecorrectinformation.Thereplacementabilityfollowsfromthedenitionofusable.SinceF0isaneighborofFthedeviationissmallandtheHVSdoesnotdetecttheswitch. Transmitterhasunusableblock(Fisunusable): IfFispoor,thetransmitterleavesFalone,Fissent,andthereceiverignoresF.Noinformationistransferred. IfFisrich,thetransmitterchangesittoaneighborF0thatispoor.BlockF0issubstitutedforblockF,thereceiverignoresF0sinceitispoor,andnoinformationispassed.SinceF0isaneighborofFthedeviationissmallandtheHVSdoesnotdetecttheswitch. Notethatwhendealingwithanunusableblockthatthealgorithmmaywastepayload.Forexample,ifFisunusableandpoor,Fmaystillhavearichneighborthatencodesthedesiredinformation.Theadvantageofthealgorithmasgivenaboveisthatitisnon-adaptive.Thismeansthatthepayloadsizeisindependentofthedatathatwewishtosend.Ifwemodifythealgorithmassuggested,thepayloadcanvarydependingonthedatathatwearesending. 3.3MotivationForProbabilisticSpatialDomainStego-Embedding Thebaselineversionoftheembeddingalgorithmhidonlyonebitperblock,andsothepayloadsizewasverysmall.Further,althoughitislikelythatthepayloadrate(inbitsperblock)couldhavebeenincreased,thereremainedtwodifculties.First,useofasimpleextractionfunctionsrenderstheencodeddatavaluesunevenlydistributedovertheneighborsofablock,andsotherecouldbeconsiderablenon-uniformityinthedataencodedbytheblocksofaneighborhood.Thismadeitdifculttopredictwhetherornotablockwouldbeusable,andhencemadeanalysiscomplicated.Thiseffectwasmostproblematicwhensmallquantawereusedinthequantizingtable,whensmallchangestothespatialdatamightnotproduceanychangeintheextracteddata. Second,boththesenderandthereceiverhadtoperformaconsiderableamountofcomputationperblockinordertoembedandtoextractthedata,respectively.Thesenderhadtotesteachblockforusability,whichinturnmeantthateachblock's 45

PAGE 46

neighborshadtobeproduced,decoded,andthedatumextracted,andifarichneighborencodingthisdatumhadnotyetbeenfound,thentheneighbor'sneighborshadtobeproduced,decoded,andtheirdataextractedtodetermineifthisparticularneighborwererich.Thisprocesscontinueduntilarichneighborforeachdatumwerefound,oralltheneighborshadbeentested.Likewise,thereceiverhadtotesteachblocktodetermineifitwererichornot,byproducing,decoding,andextractingthedatumfromeachneighboruntilitwaseitherdeterminedthattheblockwasrichoralltheneighborshadbeentested.Forasmalldataset(e.g.,binary),thiscouldbefairlyfast,butforlargerdatasetsitcouldbequitecostly. Bothoftheselimitationscreatedsignicantproblemswhenthedatasetbecamelarger.Therstcausedthelikelihoodofndingausableblocktodecreaseandforthistobecomeunpredictable.Thesecondmeantthatthecomputationalburdenwouldbecometoogreatastheneighborhoodsizeincreased(byincreasing)toaccommodatelargerpayloads.Toovercometheseproblems,thebaselineapproachismodiedasdescribedinthefollowingsection. 3.4J2StegoEmbeddingTechnique Inordertoprovideablockdatumextractionmechanismthatisguaranteedtodependstronglyandrandomlyoneachbitofthespatialblock,asecurehashfunctionH(.)isappliedtoeachspatialblocktoproducealargenumberofbits,fromwhichwemayextractasmanybitsasthepayloadraterequires.Thiscausesthesetofdatavaluesencodedbyaneighborhoodtobe,ineffect,arandomvariablewithuniformdistribution.Notonlydoesthismakeitmorelikelythataneighborblockencodingthedesireddatumwillbefound,butitmakesprobabilisticanalysispossible,sothatthislikelihoodcanbequantied.Inaddition,itmakesiteasytohidetheembeddeddatawithoutencryptingitrst. Theproblemtodistinguishusableblocksfromunusableonthereceiversideremainedamajorproblem.Toovercomethisproblem,wesetaglobalthresholdwhich 46

PAGE 47

determinesifablockcanbeusedtoembeddataornot.ThisthresholddependsonthenumberofzerosineachquantizedDCTblock.Ifthenumberexceedsthethreshold,thisblockisignored.Anotherproblemforthereceiverwastodeterminethelengthofthedataduringtheextractionprocess.SimilartoJ1,J2embedsdatainbitsperblock,i.e.,axednumberofbitsareembeddedineveryusableblock.J1embedsonlyonebitperblockwhereasJ2iscapableofembeddingmorebitsperblock.Thisvalueisaconstantthroughoutthewholeembeddingandextractionprocess.Headerinformationprexingamessageisusedtoletthereceiverknowaboutallthesepre-denedconstants.Thisheaderdataincludes,a)sizeofactualmessageexcludingtheheaderbits,b)thresholdvaluetodeterminetheusabilityofblocksand,c)K,numberofbitsencodedperblock.ThestructureofheaderisshowninTable 3-1 Table3-1. HeaderstructureforJ2algorithm. 3Bits20Bits6Bits Bitsencodedperblock,KDataLengthinBytes,ME Thresholdtodetermineablockusability,Thr IncontrasttoJ1,thevisitationorderofblocksdependsonthesharedkeybetweenthesenderandthereceiver.Thehashedvalueofsharedkeyisusedtocomputeauniqueseedwhichcanbeusedtoproduceasetofpseudorandomnumberstodeterminetheorderinwhichtheblockshouldbevisited.Sincetheactualrandomnumbersequenceproducedbythegivenseedcannotbeunique,thealgorithmismodiedslightlytoignoretheduplicates.Duringthevisitation,ifnumberofzerosintheblockexceedsthethreshold,theblockisskippedandthesendertriestoembedthedatainthenextblockinthetraversalsequence.ThepermutationofthevisitationorderalsohelpsinscramblingthedatathroughouttheJPEGimagetominimizevisualandstatisticalartifacts.Computationally,boththesender'sandthereceiver'sjobsaremademuchsimpler. Toreceiverwouldnothaveanyknowledgeoftheheaderconstantsuntiltheheaderdataisretrievedfromaxednumberofblocks.Toensureconsistency,weembed1 47

PAGE 48

bitperblockanduseeveryblockinthevisitationorder(eventheunusableones)untiltheheaderinformationisembeddedonthesenderside.Oncetheheaderinformationisembedded,weusetheconstantsintheheadertoembedthemessagebits,i.e.,weskiptheunusableblocksandembedknumberofbitsineachusableblock.Thesender'sjobismadesimpler:thesenderjusthastondaneighborofeachblockinthepermutedorderthatencodesthedesireddatum,orstartoveragainifthiscan'tbedone.Inparticular,thesenderjusthastomakesurethatthezerosintheblockisbelowthethresholdsetintheheader.Ifthedesireddatumcannotbeencodedusingalltheneighboringblocks,wemodifymorethanonecoefcientinthegivenblocktoencodethedesireddatum. Thereceiver'sjobissimplied.Thereceiverrstextractstheheaderinformationinthepermutedorder,i.e.,1bitperblockwithoutskippinganyblocks.Oncetheheaderinformationisextracted,theheaderconstantsareusedtoextractthemessagebitsinthepermutedorder.Ifablockexceedsthenumberofzerosasdenedintheheader,itisskipped. Themodiedmethodcannowbeformalized.Theembeddeddatamustbeself-delimitinginorderforthereceivertoknowwhereitends,soatleastthisamountofpreprocessingmustbedonepriortotheembeddingdescribed.Inaddition,theembeddeddatamayrstbeencrypted(althoughthisseemsunnecessaryifasecurehashfunctionisusedforextraction),anditmayhaveaframechecksequence(FCS)addedtodetecttransmissionerrors. Lettheembeddeddatastring(afterencryption,enddelimitation,framechecksequenceifdesired,etc.)bes=s1,s2,...,sK.Thedataareallfromanitedomain=fs1,s2,...,sNg,andsi2fori=1,2,...,K.Lett:!f0,1gbeaterminationdetectorfortheembeddedstring,sothatt(s1,s2,...,sj)=0forallj=1,2,...,K)]TJ /F4 11.955 Tf 11.11 0 Td[(1,andt(s1,s2,...,sK)=1.LetS=[0..2m)]TJ /F4 11.955 Tf 11.39 0 Td[(1]64bethesetof88spatialdomainblockswithmbitsperpixel(whethertheyareJPEGcompatibleornot),andletSQTSbe 48

PAGE 49

theJPEGcompatiblespatialblocksforagivenquantizationtableQT.4LetextracttheembeddeddatafromaspatialblockF,:S!.InJ1,theextractionfunctionisn,bas(F)=LSBn(F[0,0]),thatis,thenLSBsoftheupper,leftmostpixel,F[0,0].(Intheproof-of-conceptprogram,n=1[ 47 ].)Fortheprobabilisticalgorithms,theextractionfunctionisn,prob(F)=LSBn(H(FjX)),thenLSBsofthehashHoftheblockFconcatenatedwithasecretkey,X. LetbeapseudometriconSQT,:SQTSQT!R+[f0g.Inparticular,wewilluseapseudometricthatcountsthenumberofplacesinwhichthequantizedJPEGcoefcientsdifferbetweentwoJPEGblocks,ifthatdifferenceisatmostunity;ifdifferencesgreaterthanunityarescaledsothattwoblockswhoseJPEGcoefcientsdifferbyatmostunityarealwayscloserthantwoblockswithevenonecoefcientthatdiffersbymorethanunity. LetN(F)bethesetofJPEGcompatibleneighborsofJPEGcompatibleblockFaccordingtothepseudometricandthresholdbasedonsomeacceptabledistortionlevel(andareknowntobothsenderandreceiver),N(F)def=fF02SQTj(F,F0)
PAGE 50

IfF02N(F),wesaythatF0isa(,)-neighbororjustneighborofF(theisusuallyunderstoodandisnotexplicitlymentionedfornotationalconvenience).Beinganeighborisbothreexiveandsymmetric. Therstmodicationthatwemaketothebaselineencodingistochangethedataextractionfunction,.Ifithasbeendecidedtousenbitsperdatum,thentakesthenleastsignicantbitsofthehashofthespatialblock,takenasastringofbytesinrow-majororder5,concatenatedwithasecretX(Xisjustapassphraseofarbitrarylength-itwillalwaysbehashedtoaconsistentsizeforlateruse).Thishastheeffectofrandomizingtheencodedvalues,sothatprobabilisticanalysisispossible.Italsohastheeffectofhidingandrandomizingtheembeddeddata,sothattheydonotneedtobeencryptedrst.LackingthesecretX,theattackerwillnotbeabletoapplythedataextractionfunctionandsowillnotbeabletodiscerntheembeddeddataforanyblock,soitwillbeimpossiblefortheattackertosearchforpatternsintheextracteddata.Further,eveniftheembeddeddataareknown,theattackerwillhavetotrytoguessapassphrasethatcausesthesedatatoappearintheoutputsofthesecurehashfunctionH(.),whichisveryhard.Inallotherrespects,thealgorithmisthesameasthebaselinealgorithm.Figure 3-2 showstheabstractprocessofembeddingdatainthespatialdomainbychangingavalueinthefrequencydomain.Thecoefcientchangedinthegureismarkedbyacircle. Asecondmodicationwemakeistorandomizetheorderinwhichtheblocksarevisited,furtherconfoundingtheattacker.Todothis,thehashofthesecretpassphraseisusedwithablockfromthestegoimagetogenerateapseudorandomnumbersequencethatisthenconvertedintoapermutationofindicesoftheremainingblocks.Thispermutationdenesthewalkorderinwhichtheblocksarevisitedforencodingand 5Thatis,thebytesofarowareconcatenatedtoforman8-bytestring,thenthe8stringscorrespondingtothe8rowsareconcatenatedtoforma64-bytestring. 50

PAGE 51

Figure3-2. IllustrationofembeddingdatausingJ2. decoding.Withoutthewalkorder,theattackerdoesnotevenknowwhichblocksmayholdtheembeddeddata,andsostatisticsmustbetakenontheimageasawhole,makingiteasiertohidethesmallchangeswemake. Thethirdmodicationistorandomizetheorderinwhichthecoefcientsinthegivenblockthemselvesarevisited.Thismodicationhelpsinscramblingthechangesinsideablocksothatthechangesarenotconcentratedinonlytheupperleftpartoftheblock.Thereceiverneednotbeawareofthevisitationorderinsidetheblocksincetheextractionisindependentofthechangesmadeinthefrequencydomain.Also,thechangescanbemadetomorethanonecoefcientifasinglecoefcientchangeisnotabletoproducethedesireddatuminthespatialdomain.Note,thatwenevertrytochangeanycoefcientbymorethanunitytominimizethedistortionandartifactsintheimage. Figures 3-3 and 3-4 showtheabstractowchartofembeddingandextractionprocess.Theowcharttakesonlypositivecoefcientsinconsiderationforsimplicity;J2howevercanmodifybothpositiveaswellasnegativecoefcientsdependingonthetraversalorderintheblock. 3.5J2AlgorithmInDetail Thissectiondescribesthealgorithmindetail.Thealgorithmshowsonlyonecoefcientchangeperblockforsimplicity.TheactualJ2canchangemorethanone 51

PAGE 52

Figure3-3. BlockdiagramofJ2embeddingmodule. 52

PAGE 53

Figure3-4. BlockdiagramofJ2extractionmodule. coefcientifthecurrentblockisnotabletoproducethedesireddatumonthespatialdomain. Enc(AES,M,P)=ME=EncryptionofmessageMusingPaskeywithAESstandard. THr=UpperboundonthemaximumnumberofazerosinaDCTblock.Ifthetotalnumberofzeros,sayx,islessthanTHr,weignorethatblockduringembeddingandextracting.THrisapresetconstant. PRNG(seed,x)=Pseudo-randomnumbergeneratinganumberbetween0andx.seed=H(P),whereH(P)isthehashofsharedprivatekeyP. 53

PAGE 54

ai=ithbitinmessageME. MtotalE=Totalnumberofbitsinencryptedmessage,ME. bi=ithDCTblockofthegivenJPEGimage. btotal=TotalnumberofDCTblockinthegivenJPEGimage. fi=ValueofJPEGACcoefcientatindexi. 3.6Results J2stegoalgorithmhasbeenimplementedandtestedonanumberofimageswiththenumberofbitsperblockrangingfromonetoeight.AvalueofThr=2sufced.MD5wasusedasthehashfunction,andtheimagesandhistogramsshownhereareforeightbitsofdataembeddedperblock.Aloglewasusedforembeddeddata,althoughitreallydoesnotmatterwhatthenatureoftheembeddeddataare(theycouldbeallzeros)duetothewayextractionworks.Theimageswereperceptuallyunaltered,andthehistogramsofthestegoimagewerenearlyidenticaltothoseofthecoverimage.TypicalresultsforallquantizedJPEGcoefcientsareshowninFigures 3-5 (omittingzerocoefcientssincethesedominatetheothercoefcientvaluestothepointofobscuringthedifferences)and 3-6 (whichhighlightstheinterestingchanges).Notunexpectedly,thenumberofzerocoefcientsisdecreasedslightly(lessthan3%)andthenumbersofcoefcientswithvalue-1or1isaccordinglyincreased(by20-30%inthiscase)asshowninFigure 3-5 .ThisisbecausethevastmajorityofquantizedJPEGcoefcientshavezerovalue,sorandomlychangingacoefcientby+/-1canbeexpectedtoremovemanymorezerosthanitadds.Ofcourse,thevaluesof+1and-1areincreasedaccordingly,witharelativelysmallnumberof+1and-1coefcientschangedtozeroor+/-2.Allothercoefcientvalueswithreasonableoccurrencewerechangedbylessthan+/-10%,mostbylessthan+/-5%(seeFigure 3-6 ). Anexampleimageisalsoincludedhereasademonstration.TheimageinFigure 3-7A isanunalteredcoverle,whiletheimageinFigure 3-7B isthesamelewithembeddeddataencodedatarateofeightbitsperblock,usingalmostalltheblocks. 54

PAGE 55

Algorithm3.1:AlgorithmtoEmbeddatausingJ2algorithm. Input: (1)GivenJPEGImage,(2)PSharedprivatekeybetweensenderandreceiver,(3)MMessageMtobeembedded. Output: StegoImageinJPEGformat 1 begin 2fori=0tobtotaldo 3Lety=PRNG(seed,btotal); // byisthenextblocktoembeddata 4letx=totalnumberofzerocoefcientsinblockby; 5LetMnE=nextnbitsofthedatatobeembedded.; 6ifx
PAGE 56

Figure3-5. HistogramsofcoverandJ2stegoleshowingonly0,1,2coefcients. Figure3-6. HistogramsofcoverandJ2stegoleignoringzerocoefcients. 56

PAGE 57

Acoverimage BJ2stegoimage Figure3-7. IllustrationofanoriginalimageanditsstegoversionembeddedwithJ2. 3.7Conclusion ThischapterhasbrieydiscussedthebaselinestegoembeddingmethodintroducedinpriorworktocircumventdetectionbytheJPEGcompatiblesteganalysismethod.Itthendiscussedsomeshortcomingsofthebaselineapproach,anddescribedamodiedversionthatovercomestheseproblems(tosomeextent).J2stillcannotbedetectedbyJPEG-compatibilitysteganalysis,andthechangestothespatialdomainandtotheJPEGcoefcienthistogramsaresosmallthatwithouttheoriginal,itwouldbeverydifculttodetectanyabnormalities. Themethodisquitefragile,andanychangetoaspatialdomainblock(ortoaJPEGblock)willcertainlyrandomizethecorrespondingextractedbits.Hence,itisexpectedthatthemethodwillbeverydifculttodetect,butrelativelyeasytoscrubusingactivemeasures. 57

PAGE 58

CHAPTER4J3:HIGHPAYLOADHISTOGRAMNEUTRALJOINTPICTUREEXPERTGROUP(JPEG)STEGANOGRAPHY 4.1Introduction ThischapterproposesanewJPEGsteganographyalgorithm,J3[ 50 ],whichconcealsdatainsideaJPEGimageinsuchawaythatitcompletelypreservesitsrstorderstatisticalproperties[ 25 ]andhenceisresistanttochi-squareattacks[ 10 ].J3canrestoretheDCThistogramofanyJPEGimagetoitsoriginalvaluesafterembeddingdataalongwithanaddedbenetofahighdatacapacityof0.4to0.7bitspernon-zerocoefcient(bpnz).ItdoesthisbymanipulatingJPEGcoefcientsinpairsandreservingenoughcoefcientpairstorestoretheoriginalhistogram.Matrixencodingtechnique,proposedbyCrandall[ 28 ],hasbeenusedinJ3whenthemessagelengthislessthanthemaximumcapacity.Thisencodingmethodcanembedkbitsofmessagein2k)]TJ /F4 11.955 Tf 11.21 0 Td[(1coverbitsbychangingatmost1bit.Inthegenericembeddingcase,wewouldhavetoreplaceatmostk=2bits.Hence,thisencodingmethodisveryusefulwhenthemessagelengthisshorterthanthemaximumembeddingcapacity.F5,proposedbyA.Westfeld,wastherststeganographyalgorithmtousematrixencoding. Stoppointsareakeyfeatureofthisalgorithm;theyareusedbytheembeddingmoduletodeterminetheindexatwhichthealgorithmshouldstopencodingaparticularcoefcientpair.Coefcientvaluesareonlyswappedinpairstominimizedetection.Forexample,(2x,2x+1)formapair.Thismeansthatacoefcientwithvalue(2x+1)willonlydecreaseto2xtoembedabitwhile2xwillonlyincreaseto(2x+1).Eachpairofcoefcientisconsideredindependently.Beforeembeddingdatainanunusedcoefcient,thealgorithmdeterminesifitcanrestorethehistogramtoitsoriginalpositionornot.Thisisbasedonthenumberofunusedcoefcientsinthatpair.Ifduringembedding,thealgorithmdeterminesthatthereareonlyasufcientnumberofcoefcientsremainingtorestorehistogram,itwillstopencodingthatpairandstoreitsindexlocationinthestoppointsectionoftheheader.Theheadergivesimportantdetailsabouttheembedded 58

PAGE 59

datasuchasstoppoints,datalengthinbytes,dynamicheaderlength,etc.Attheendoftheembeddingprocess,coefcientrestorationtakesplacewhichequalizestheindividualcoefcientcountasintheoriginalle.Sinceallthestoppointscanonlybeknownaftertheembeddingprocess,theheaderbytesarealwaysencodedlastontheembeddersidewhereastheyaredecodedrstontheextractorside. TheperformanceofJ3hasbeencomparedagainstthreepopularalgorithmsnamely,F5,SteghideandOutguess.Basedon3000sampleJPEGimages,theSVM-basedsteganalysisexperimentsshowthatJ3hasamuchlowerdetectionratethanthethreealgorithms.J3has50%detectionrateat0.05bpnzand70%at0.1bpnz.Theotheralgorithmsatthesamebpnzhadadetectionrateof90%andhigher.TheseresultsshowthatJ3wouldbeanidealcandidateforsteganographyascomparedtotheotherthreealgorithms.Atheoreticalestimationofembeddingcapacityandstoppointshasalsobeendoneinsection 4.6 andtheresultsfollowcloselywiththeexperimentaloutcome. Therestofthischapterisorganizedasfollows.Section 4.2 and 4.4 discusstheproposedJ3embeddingandextractionalgorithmindetailwhileSection 4.6 dealswiththetheoreticalestimationofmaximumembeddingcapacityofJ3anditsstoppointcalculation.Section 4.7 comparestheexperimentalresultsofJ3withF5,OutguessandSteghide.Section 4.8 comparesthesteganalysisperformanceofthethreealgorithmsalongwithJ3.Finally,Section 4.9 concludesthechapterwithreferencetofutureworkinthisarea. 4.2J3EmbeddingModule Figure 4-1 showstheblockdiagramofJ3embeddingmodule.ThecoverimageisrstentropydecodedtoobtaintheJPEGcoefcients.ThemessagetobeembeddedcanbeencryptedusingAESorDES.Apseudo-randomnumbergeneratorisusedtovisitthecoefcientsinrandomordertoembedtheencryptedmessage.Thealgorithmalwaysmakeschangestothecoefcientsinapairwisefashion.Forexample,aJPEG 59

PAGE 60

Figure4-1. BlockdiagramofJ3embeddingmodule. coefcientwithavalueof2willonlychangetoa3toencodemessagebit1,andacoefcientwithavalue3willonlychangeto2toencodemessagebit0.Itissimilartoastatemachinewhereanevennumberwilleitherremaininitsownstateorincreaseby1dependingonthemessagebit.Similarly,anoddnumberwilleitherremaininitsownstateordecreaseby1.Weapplythesametechniquefornegativecoefcientsexceptthatwetakeitsabsolutevaluetochangethecoefcient.Coefcientswithvalue1and-1haveadifferentembeddingstrategysincetheirfrequencyisveryhighascomparedtoothercoefcients.A-1coefcientisequivalenttomessagebit0and+1isequivalenttomessagebit1.Toencodemessagebit0inacoefcientwithvalue1,wechangeitsvalueto-1.Similarly,toencodebit1in-1coefcient,wechangeitto1.Toavoidanydetection,weskipcoefcientswithvalue0.Theembeddingcoefcientpairsare()]TJ /F4 11.955 Tf 9.29 0 Td[(2n,)]TJ /F4 11.955 Tf 9.29 0 Td[(2n)]TJ /F4 11.955 Tf 11.16 0 Td[(1)()]TJ /F4 11.955 Tf 9.28 0 Td[(2,)]TJ /F4 11.955 Tf 9.29 0 Td[(3),()]TJ /F4 11.955 Tf 9.29 0 Td[(1,1),(2,3)(2n,2n+1),where2n+1and)]TJ /F4 11.955 Tf 9.29 0 Td[(2n)]TJ /F4 11.955 Tf 11.15 0 Td[(1arethethresholdlimitsforpositiveandnegativecoefcients,respectively. Beforeembeddingadatabitinacoefcient,thealgorithmdetermineswhetherasufcientnumberofcoefcientsoftheothermemberofthepairarelefttobalancethehistogramornot.Ifnot,itstoresthetraversalindexintheheaderarray,alsoknownasstoppointforthatpair.Oncethestoppointforapairisfound,thealgorithmwillno 60

PAGE 61

longerembedanydatabitsinthatcoefcientpair.Theunusedcoefcientsforthatpairwillbeusedlatertocompensatefortheimbalance.Theheaderbitsareembeddedafterthedatabitsareembeddedsinceallthestoppointsareonlyknownattheendofembedding. Theheaderstoresusefulinformationsuchadatalength,locationofstoppointsforeachcoefcientvaluepair,andthenumberofbitsrequiredtostoreeachstoppoint.ThestructureoftheheaderisgiveninTable 4-1 .Theformaldenitionofastoppointisgivenbelow. Denition1. [StopPoints]Astoppoint,SP(x,y),inJ3storestheindexofDCTcoefcientmatrixanddirectsthealgorithmtoignoreanycoefcientswithvaluexorythathaveanindexvalueSP(x,y)duringembeddingorextractionprocess. Table4-1. HeaderstructureforJ3algorithm. 4Bits20Bits5Bits5Bits(NSPNbSP)Bits Valueofkformatrixencoding,HkDatalengthinbytes,ML No.ofbitsrequiredtostoreasinglestoppoint,NbSP No.ofstoppoints,NSPStoppointarray,SP()]TJ /F4 11.955 Tf 9.29 0 Td[(2n,)]TJ /F4 11.955 Tf 9.29 0 Td[(2n)]TJ /F4 11.955 Tf 23.78 0 Td[(1)SP()]TJ /F4 11.955 Tf 9.29 0 Td[(2,)]TJ /F4 11.955 Tf 9.29 0 Td[(3),SP()]TJ /F4 11.955 Tf 9.29 0 Td[(1,1),SP(2,3)SP(2n,2n+1) ExplanationofHeaderelds: Hk=Valueofninmatrixencoding(1,2k)]TJ /F4 11.955 Tf 10.98 0 Td[(1,k).Thenotation(1,2k)]TJ /F4 11.955 Tf 10.98 0 Td[(1,k)denotesembeddingkmessagesbitsin2k)]TJ /F4 11.955 Tf 10.95 0 Td[(1coverbitsbychangingatmostonebit. ML=Representsthetotalmessagelengthinbytes.Itdoesnotincludethelengthofheader. NbSP=Representsthetotalnumberofbitsrequiredtostoreastoppoint.LetNBbethetotalnumberofblocksinthecoverle.Thetotalnumberofcoefcientsisthen64NB.NbSPrepresentstheminimumnumberofbitsneededtorepresentanynumberbetween0to64NB,whichislog2(64NB).Receivercancomputethisfromtheleitselfbuthasbeenincludedtoprovidemorerobustnessduringdecoding. NSP=representsthetotalnumberofstoppointspresentintheheader. SP(x,y)=representsastoppoint.EachstoppointoccupiesNbSPbitsintheheader. 61

PAGE 62

Terminology: Hist(x):Totalnumberofcoefcientxinitiallypresentinthecoverimage. TR(x):Remainingnumberofcoefcientsxwhichremainunusedanduntouchedduringembedding. TC(x!y):Totalnumberofcoefcientxchangedtoyduringembedding. TC(x!x):Totalnumberofcoefcientxunchangedbutusedfordata. TT(x):Totalnumberofcoefcientxusedatanypointtostoredata.TT(x)=TC(x!y)+TC(x!x)=Hist(x))]TJ /F3 11.955 Tf 10.95 0 Td[(TR(x). (x):RepresentstheunbalanceincoefcientxascomparetoHist(x). NB:Totalnumberofblocksinthecoverimage. Cx:Valueofcoefcientatindexlocationxinthecoverimagewhere0x64NB. Coetotal:totalnumberofcoefcientsintheimage=64NB. Let'sdemonstratetheideaofstoppointsusinganexample: Example1. AtthestartofembeddingprocessHist(x)=TR(x),sincenoneofthecoefcientxhavebeenusedfordata.Assumethefollowingscenarioduringembedding: Hist(2)=500,TC(2!3)=100,TC(2!2)=100 Hist(3)=200,TC(3!2)=50,TC(3!3)=100 )TR(2)=300,TR(3)=50 Since1002'shavebeenchangedtoa3and503'shavebeenchangedbackto2,wehaveanimbalanceinthehistogram. (2)=TC(3!2))]TJ /F3 11.955 Tf 10.95 0 Td[(TC(2!3)=)]TJ /F4 11.955 Tf 9.29 0 Td[(50. (3)=TC(2!3))]TJ /F3 11.955 Tf 10.95 0 Td[(TC(3!2)=)]TJ /F4 11.955 Tf 9.29 0 Td[((2)=50. Thismeanswehave50more3'sthanrequiredand50fewer2'sthanneededtobalancethehistogrampair(2,3)toitsoriginalvalues.Hence,weneedatleast503'stobalancethepair(2,3). Let'sassumethatthenextcoefcientindexencounteredduringembeddingis2013andC2013=3.IfTR(3)=(3),thenweknowthatwecannotencodeanymoredatainpair(2,3)sincewehavejusttheminimumnumberof3'sremainingtobalanceit.Hence,westoretheindex 62

PAGE 63

locationinSP(2,3),i.e.,SP(2,3)=2013.Thisdirectsthealgorithmtostopembeddinganymoredatainthispairafterindex2013.Thisstoppointisalsousedduringtheextractionprocesstostopdecodingcoefcients2and3whenitreachesindex2013. 4.3J3EmbeddingAlgorithmInDetail Embeddingisdividedintovarioussmallersubtasks.Algorithm 4.1 calculatesthecoefcient'supperlimittoconsiderforembedding.Ifacoefcientvalueislargerthanthecoefcientlimit,itignoresitandselectsthenextoneintraversalsequence.Italsoskipsthecoefcientsforembeddingheaderbitssincethesewillbeembeddedonlyafterallthestoppointsareknown.Thenumberofbitsrequiredtostoreheaderinformationcanbecalculatedbeforetheembeddingprocess.Oncethecoefcientsforembeddingheaderbitsareskipped,algorithm 4.2 embedstheactualmessagebits.Itcallsfunction EmbedBit toupdatetheTCtablesandfunction EvaluateStopPoint toevaluateifsufcientnumberofcoefcientsarestillremainingtobalancethehistogram.Oncethemessagebitshavebeenembeddedandallthestoparepointsknown,algorithm 4.3 embedstheheaderbitsusingthesamerandomsequencetraversedinalgorithm 4.1 .Sincealgorithm 4.2 and 4.1 modifythecoefcients,algorithm 4.4 calculatesthenetchangeinindividualcoefcientsandrestoresthehistogramtoitsoriginalvaluesusingtheunusedcoefcients.Negativecoefcientsandthe(-1,1)pairshavenotbeenshowninthealgorithmsbelowforsimplicitybutcanbeincludedwithaslightmodication.Also,matrixencodinghasnotbeenshowninthealgorithmsinceweareconsideringthemaximumcapacityofJ3. LetPbethepasswordsharedbetweenthesenderandthereceiver.Thispasswordisusedtogeneratetheseedforpseudo-randomnumbersbetween0and64NB.Thesamepasswordisalsousedforencryptinganddecryptingthedata.Let, Enc(AES,M,k)=EncryptionofmessageMusingkaskeywithAESstandard. 63

PAGE 64

THr=Lowerboundonthetotalnumberofacoefcient,sayx,tobeusedforembeddingdata.IfthetotalnumberofcoefcientxislessthanTHr,weignorethatcoefcientduringembeddingandextracting.ThisTHrisapresetconstant. PRNG(seed,x)=Pseudo-randomnumbergeneratinganumberbetween0andx. Bit(M,i)=ithbitinmessageM. MEtotal=Totalnumberofbitsinencryptedmessage,ME. f=JPEGACcoefcientinfrequencydomain. ProcedureEmbedBit(DataBitbit,indexx) 1 begin 2ifCx2odd^bit0then /* Decreasethecoefficientvalueby1ifmessagebitis0andcoefficientisodd*/ 3TC(Cx!Cx)]TJ /F4 11.955 Tf 10.95 0 Td[(1) TC(Cx!Cx)]TJ /F4 11.955 Tf 10.95 0 Td[(1)+1; /* UpdatetheTCtabletoreflectthetotalnumberofchangedcoefficients*/ 4Cx Cx)]TJ /F4 11.955 Tf 10.95 0 Td[(1; 5elseifCx2even^bit1then 6TC(Cx!Cx+1) TC(Cx!Cx+1)+1; 7Cx Cx+1; 8end 9end 64

PAGE 65

Algorithm4.1:Calculatethethresholdcoefcientvaluetoconsiderforembedding. Input: (i)CInputDCTcoefcientarray,(ii)Mthemessagetobeembedded,and(iii)P. Output: CModiedDCTcoefcientarray. 1 begin 2seed=MD5(P); /* GenerateseedusingMD5hashingforPRNG*/ 3ME=Enc(AES,M,P); /* EncryptmessageMwithPasthekeywithAESstandard*/ 4fori=2to255do 5ifHist(i)
PAGE 66

Algorithm4.2:EmbeddatabitsinthegivenJPEGcoefcients. 1 begin /* ThisalgorithmembedsallthemessagebitsintheeligibleJPEGcoefficients.*/ 2DataIndex=0; 3whileDataIndexcoe limit_Cx=2fthen 6continue; /* ineligiblecoefficientvalue,sofetchnextrandomnumber.*/ 7elseifEvaluateStopPoint(x)falsethen 8DataBitb=ExtractthenextdatabittobeembeddedfromME.EmbedBit(b,x); /* Callthefunctiontoembedonebitofmessageincoefficientatindexx.*/ 9TR(Cx) TR(Cx))]TJ /F4 11.955 Tf 10.95 0 Td[(1; /* Updatethetotalnumberofremainingcoefficientstable,TC.*/ 10dataIndex dataIndex+1; 11end 12end 13end Algorithm4.3:Embedheaderbitsinthecoefcients. 1 begin /* AssumethattheheaderdataisstoredinHDRarray*/ 2DataIndex=0; 3whileDataIndexHDRtotaldo 4x=PRNG1(seed,Coetotal); /* generatesamesequenceforheadercoeff.*/ 5ifCx0_Cx>coe limit_Cx=2fthen 6continue; /* ineligiblecoefficientvalue,sofetchnextrandomnumber*/ 7else 8EmbedBitBit(HDR,DataIndex),x; 9dataIndex dataIndex+1; 10end 11end 12end 66

PAGE 67

ProcedureEvaluateStopPoint(indexx) 1 begin 2ifCx2oddthen; /* Ifthecoefficientatindexxisodd.*/ 3 4=TC(Cx)]TJ /F4 11.955 Tf 10.95 0 Td[(1!Cx))]TJ /F3 11.955 Tf 10.94 0 Td[(TC(Cx!Cx)]TJ /F4 11.955 Tf 10.95 0 Td[(1); /* Calculatethenetchangeinthecoefficientpair.*/ 5ifTR(Cx)then /* stopencodingthepair*/ 6SP(Cx)]TJ /F4 11.955 Tf 10.95 0 Td[(1,Cx) x; /* storethestoppoint*/ 7returntrue; 8end 9elseifCx2eventhen 10=TC(Cx+1!Cx))]TJ /F3 11.955 Tf 10.95 0 Td[(TC(Cx!Cx+1); 11ifTR(Cx)then /* stopencodingthepair*/ 12SP(Cx,Cx+1) x; /* storethestoppoint*/ 13returntrue; 14end 15end 16returnfalse; 17end 67

PAGE 68

Algorithm4.4:Compensatehistogramforchangesmadeinalgorithm 4.2 and 4.3 1 begin /* Calculatenetchangeincoefficientpairs*/ 2fori=2tocoe limitdo 3ifTC(i!i+1)>TC(i+1!i)then 4TC(i!i+1) TC(i!i+1))]TJ /F3 11.955 Tf 10.95 0 Td[(TC(i+1!i); 5TC(i+1!i) 0; 6else 7TC(i+1!i) TC(i+1!i))]TJ /F3 11.955 Tf 10.95 0 Td[(TC(i!i+1); 8TC(i!i+1) 0; 9end 10i i+2; 11end /* Calculatethetotalchangeinhistogram*/ 12netChange=SPtotalk=1TC(2k!2k+1)+TC(2k+1!2k) /* Makechangestotheunusedcoefficientstobalance*/ 13whilenetChange>0do 14x=PRNG(seed,Coetotal); 15ifCx=0_Cx>coe limit_Cx=2fthen 16continue; 17elseifCx2even^TC(Cx+1!Cx)>0then 18T(Cx+1!Cx) TC(Cx+1!Cx))]TJ /F4 11.955 Tf 10.95 0 Td[(1; 19Cx Cx+1; 20netChange netChange)]TJ /F4 11.955 Tf 10.95 0 Td[(1; 21elseifCx2odd^TC(Cx)]TJ /F4 11.955 Tf 10.95 0 Td[(1!Cx)>0then 22T(Cx)]TJ /F4 11.955 Tf 10.95 0 Td[(1!Cx) TC(Cx)]TJ /F4 11.955 Tf 10.95 0 Td[(1!Cx))]TJ /F4 11.955 Tf 10.95 0 Td[(1; 23Cx Cx)]TJ /F4 11.955 Tf 10.95 0 Td[(1; 24netChange netChange)]TJ /F4 11.955 Tf 10.95 0 Td[(1; 25end 26end 27end 68

PAGE 69

4.4J3ExtractionModule Figure4-2. BlockdiagramofJ3proposedextractionmodule. ThissectiondealswiththeextractionofamessageMfromagivenstegoimage.Theextractionalgorithmissimple,asthereceiverhastodealonlywiththeexactindexlocationstostopdecodingeachcoefcientpair.PasswordPisusedtogeneratetherandomnumbersequenceusedtopermutethecoefcientindicesforvisitationorder.Theconstantpartoftheheaderisdecodedrst,whichinturnrevealsthelengthofthedynamicportionoftheheader.Thedynamicportionoftheheadercontainsthestoppointswhicharenecessarytostopdecodingagivencoefcientpairwhenitsstoppointmatchesthecoefcientindexencountered. Oncealltheheaderbitshavebeenextracted,theextractionprocessstartsdecodingthemessagebits,takingcaretostopextractionfromacoefcientpairwhenitsstoppointhasbeenreached.Thedecodingalgorithmisgivenbelow.Asexplainedearlier,onlythepositivecoefcientshavebeenconsideredinthealgorithm.Similarrulesapplytothenegativecoefcientsandthe(-1,1)pair,withslightmodication.AblockdiagramoftheextractionmoduleisgiveninFigure 4-2 4.5J3ExtractionAlgorithm Theextractionalgorithmisdividedintotwomodules.Algorithm 4.5 rstdecodesthestaticpartoftheheadertorecoverthemessagelength,thenumberofstoppoints,andthenumberofbitsneededtostoreeachstoppoint.Usingthestaticheaderpart,thealgorithmdeterminesthelengthandinterpretationofthedynamicportionofheaderto 69

PAGE 70

nallydecodeallthestoppoints.Finally,algorithm 4.6 extractstheencryptedmessagebits,whicharethendecryptedtorecovertheactualmessage. Algorithm4.5:Extractionofheaderbitsfromstegoimage. 1 begin 2Dec(AES,M,k)=DecryptionofMessageMusingkaskeywithAESstandard.; Input: (i)CModiedDCTcoefcientarrayand(ii)Psharedpasswordbetweenthesenderandreceiver. Output: MoutOutputMessage 3seed=k=MD5(P); /* AssumeHDRarraytobeemptyinitially.Extractstaticheaderpartfirst*/ 4HDRstatic=20+5+5; /* staticheaderlengthinbits*/ 5LetHDRi=ithbitofHDRarray; 6i=0; 7whileiHDRstaticdo 8x=PRNG(seed,Coetotal); /* PRNGtogeneraterandomindicesforcoeff.*/ /* coe limitiscalculatedthesamewayasintheembeddingalgorithm*/ 9ifCx0_Cx>coe limit_Cx=2fthen 10continue; 11elseifCx2oddthen 12HDRi 1; 13i++; 14elseifCx2eventhen 15HDRi 0; 16i++; 17end 18end 19DecodedataLengthinBytes,MLandNo.ofbitsrequiredtorepresentacoefcientlocation,NbSPfromHDRarray; 20DecodeNo.ofstoppointsandSPtotalfromHDRarray; 21Nowcalculatethedynamicheaderlengthusingthenumberofstoppoints,SPtotalandNbSP; 22Traversethecoefcientsanddecodethestoppointsfromdynamicheaderarray; 23StorethevaluesinSP(x,y)arrayfromdecodedbits; 24end 70

PAGE 71

Algorithm4.6:Extractionofmessagebitsfromthestegoimage. 1 begin 2Mtotal=ML8; /* totalmessagelengthinbits*/ 3i=0; 4whileiMtotaldo 5x=PRNG(seed,Coetotal); /* PRNGtogeneraterandomindicesforcoeff.*/ 6ifCx0_Cx>coe limit_Cx=2fthen 7continue; /* ineligiblecoefffordataextraction*/ 8elseifCx2even^SP(Cx,Cx+1)6=xthen /* currentindexdoesn'tmatchstoppoint*/ 9Mi 0; /* ithbitofMessagearray,M*/ 10i i+1; 11elseifCx2odd^SP(Cx)]TJ /F4 11.955 Tf 10.95 0 Td[(1,Cx)6=xthen /* currentindexdoesn'tmatchstoppoint*/ 12Mi 1; /* ithbitofMessagearray,M*/ 13i i+1; 14end 15end 16Mout=Dec(AES,M,k); /* DecryptmessageMusingkeykandAESstandard*/ 17end 4.6EstimationOfEmbeddingCapacityAndStopPoint ThissectionshowshowtoestimatetheexpectedembeddingcapacityofacoverleusingJ3andthestoppointindicesforeachcoefcientpair.Thecalculationisshownforpositivecoefcientsonly.Thecalculationforthenegativecoefcientsandthe(-1,1)pairaresimilarwithslightmodications. coe limit=Coefcientlimittoconsiderforembedding. pm,0=Probabilityofbit0inthemessage. pm,1=(1)]TJ /F3 11.955 Tf 10.95 0 Td[(pm,0)=Probabilityofbit1inmessage. pc,2x+1=Probabilityofencounteringanoddnumberwithvalue(2x+1)intraversingthecoefcients. pc,2x=Probabilityofencounteringanevennumberwithvalue2xintraversingthecoefcients. 71

PAGE 72

ktotal=Totalnumberofcoefcientsintheinputimage. Pr(x!y)=Probabilityofcoefcientxbeingchangedtocoefcienty. pm,0=M0 M0+M1 (4) pm,1=M1 M0+M1 (4) ktotal=coe limitx=2Hist(x) (4) pc,2x+1=Hist(2x+1) ktotal (4) pc,2x=Hist(2x) ktotal (4) Anoddcoefcientcanonlydecreaseorretainitsvaluetoembedadatabit.Similarly,anevennumbercanonlyincreaseorretainitsvaluetoembedadatabit,asexplainedinembeddingmodule.Hence, Pr(2x+1!2x)=pm,0pc,2x+1 (4) Pr(2x!2x+1)=pm,1pc,2x (4) Pr(2x+1!2x+1)=pm,1pc,2x+1 (4) Pr(2x!2x)=pm,0pc,2x (4) Letg2x,2x+1=Totalnumberofeligiblecoefcientsvisitedsofaratanyinstant. LetTCEx(x!y)betheexpectednumberofcoefcientswithvaluexchangedtoytoembedadatabit. 72

PAGE 73

LetTREx(x)betheexpectednumberofcoefcientswithvaluexremainingunchangedandunused.TCEx(2x+1!2x)=g2x,2x+1Pr(2x+1!2x) (4)TCEx(2x+1!2x+1)=g2x,2x+1Pr(2x+1!2x+1) (4)TCEx(2x!2x+1)=g2x,2x+1Pr(2x!2x+1) (4)TCEx(2x!2x)=g2x,2x+1Pr(2x!2x) (4)TREx(2x+1)=Hist(2x+1))]TJ /F16 11.955 Tf -147.25 -13.62 Td[(hTCEx(2x+1!2x)+TCEx(2x+1!2x+1)i (4)TREx(2x)=Hist(2x))]TJ /F16 11.955 Tf 10.95 13.27 Td[(hTCEx(2x!2x+1)+TCEx(2x!2x)i (4) 4.6.1StopPointEstimation LetEx(x)betheexpectednetunbalanceofcoefcientswithvaluex. SincewehaveestimatedTREx(i)forallthecoefcients,wecannowcalculatetheconditionwhenthecoefcientpairwillnolongerbeusedtoembeddata,sincewewillbeleftwiththeexactamountofcoefcienttobalancethehistogramaftertheembeddingprocess.Theconditionis:Ex(2x+1)=TCEx(2x!2x+1))]TJ /F3 11.955 Tf 10.95 0 Td[(TCEx(2x+1!2x),TCEx(2x!2x+1)TCEx(2x+1!2x) (4)Ex(2x)=TCEx(2x+1!2x))]TJ /F3 11.955 Tf 10.95 0 Td[(TCEx(2x!2x+1),TCEx(2x+1!2x)TCEx(2x!2x+1) (4) Thestopconditionis: TREx(x)=Ex(x) 73

PAGE 74

ReplacingLHSofEquation 4 withRHSofEquation 4 ,wegetHist(2x+1))]TJ /F16 11.955 Tf 10.95 13.28 Td[(hTCEx(2x+1!2x)+TCEx(2x+1!2x+1)i=TCEx(2x!2x+1))]TJ /F3 11.955 Tf 10.94 0 Td[(TCEx(2x+1!2x) (4) UsingEquation 4 4 and 4 ,weget: Hist(2x+1))]TJ /F5 11.955 Tf 10.95 0 Td[(g2x,2x+1Pr(2x+1!2x+1)=g2x,2x+1Pr(2x!2x+1) (4) Solvingforg2x,2x+1usingEquation 4 and 4 ,weget: g2x,2x+1=Hist(2x+1) pm,1(pc,2x+pc,2x+1) (4) SimplifyingusingEquation 4 4 4 and 4 ,weget: g2x,2x+1=Hist(2x+1)coe limiti=2Hist(i)M0+M1 M1Hist(2x)+Hist(2x+1) (4) IfwesolveEquation 4 inasimilarway,wegetanothervalueofg2x,2x+1as: g2x,2x+1=Hist(2x)coe limiti=2Hist(i)M0+M1 M0Hist(2x)+Hist(2x+1) (4) LetEquation 4 berepresentedasga2x,2x+1andEquation 4 asgb2x,2x+1forconvenience. Theorem1. Theestimatedstoppointforpair(2x,2x+1),gest2x,2x+1,istheminimumofga2x,2x+1andgb2x,2x+1. gest2x,2x+1=minnga2x,2x+1,gb2x,2x+1o Proof. LetthemaximumcoefcientindexberepresentedbyIndexmax.Themaximumindexvalueisequaltothemaximumnumberofeligiblecoefcientsintheimage.Hence, Indexmax=coe limiti=2Hist(i) 74

PAGE 75

Anystoppoint,g2x,2x+1cannotexceedthevalueofmaximumcoefcientindex.Letsassume ga2x,2x+1Indexmax)ga2x,2x+1coe limiti=2Hist(i) UsingEquation 4 and 4 andsubstitutingforga2x,2x+1,weget Hist(2x+1)coe limiti=2Hist(i) pm,1Hist(2x)+Hist(2x+1)coe limiti=2Hist(i)(4) SimplifyingEquation 4 ,weget Hist(2x+1) (1)]TJ /F3 11.955 Tf 10.95 0 Td[(pm,0Hist(2x)+Hist(2x+1)1(4) Furthersimplifying, pm,0Hist(2x+1)+Hist(2x)Hist(2x) (4) )Hist(2x) pm,0Hist(2x)+Hist(2x+1)1 (4) Multiplyingbothsidesbycoe limiti=2Hist(i),weget Hist(2x)coe limiti=2Hist(i) pm,0Hist(2x)+Hist(2x+1)coe limiti=2Hist(i)(4) FromEquation 4 ,L.H.S.oftheaboveequationisgb2x,2x+1andR.H.S.isIndexmax. )gb2x,2x+1Indexmax,whichisnotvalid. Similarly,usinggb2x,2x+1asthestartingpointforproof,weget ga2x,2x+1Indexmax Hence,gest2x,2x+1canbewrittenas gest2x,2x+1=minnga2x,2x+1,gb2x,2x+1o(4) 75

PAGE 76

Henceproved. Sincenumberofzerosisalmostequaltonumberofonesinthemessage,wecanassumepm,0pm,1LetRandKbedenedasfollows: R=Hist(2x) Hist(2x+1),K=coe limiti=2Hist(i) pm,0 NowEquation 4 canberewrittenas: gest2x,2x+18>>>><>>>>:K1 1+RifR>1K1 2ifR=1KR 1+RifR<1(4) SinceHist(2x)isusuallygreaterthanHist(2x+1),Rismostlygreaterthan1.Fromtheaboveequation,wecandeducethatanincreaseinRwouldresultindecreaseofgest2x,2x+1. Fromthecalculations,wecanconcludethatthestoppointforthepair(2x,2x+1)wouldlikelybethecoefcientindexatwhichthecurrentvalueofg2x,2x+1satiseseitherEquation 4 or 4 4.6.2CapacityEstimation Theestimatedembeddingcapacity,Cest,forcoefcientpair(2x,2x+1)is:Cest(2x,2x+1)=TCEx(2x!2x+1)+TCEx(2x!2x)+TCEx(2x+1!2x)+TCEx(2x+1!2x+1)Bits (4) SimplifyingEquation 4 usingEquation 4 to 4 ,weget Cest(2x,2x+1)=g2x,2x+1pc,2x+pc,2x+1Bits (4) Totalexpectedcapacityincludingnegativecoefcientsand(-1,1)pairis: 76

PAGE 77

Ctotalest=NegativeCoefcientCapacity+()]TJ /F4 11.955 Tf 9.29 0 Td[(1,1)Capacity+Positivecoefcientcapacity.Ctotalest=)]TJ /F13 8.966 Tf 6.97 0 Td[(coe limitx=)]TJ /F19 8.966 Tf 6.96 0 Td[(1g2x,2x)]TJ /F19 8.966 Tf 6.97 0 Td[(1(pc,2x+pc,2x)]TJ /F19 8.966 Tf 6.96 0 Td[(1)+g)]TJ /F19 8.966 Tf 6.97 0 Td[(1,1(pc,)]TJ /F19 8.966 Tf 6.96 0 Td[(1+pc,1)+coe limitx=1g2x,2x+1(pc,2x+pc,2x+1)Bits (4) Using 4 andreplacingthevalueofg2x,2x+1fromEquation 4 and 4 ,weget Ctotalest,1=coe limitx=1Hist(2x)+Hist()]TJ /F4 11.955 Tf 9.29 0 Td[(2x)+Hist()]TJ /F4 11.955 Tf 9.29 0 Td[(1) pm,0Bits (4) Ctotalest,2=coe limitx=1Hist(2x+1)+Hist()]TJ /F4 11.955 Tf 9.29 0 Td[(2x)]TJ /F4 11.955 Tf 10.95 0 Td[(1)+Hist(1) pm,1Bits (4) LetCmaxest=maximumcapacitypossible. NowCmaxestwillbeequaltothetotalnumberofcoefcientswithincoe limitrange. Cmaxest=coe limitx=1Hist(2x)+Hist(2x+1)+Hist()]TJ /F4 11.955 Tf 9.29 0 Td[(2x)+Hist()]TJ /F4 11.955 Tf 9.29 0 Td[(2x)]TJ /F4 11.955 Tf 10.95 0 Td[(1)+Hist(1)+Hist()]TJ /F4 11.955 Tf 9.29 0 Td[(1) SimplifyingusingEquation 4 and 4 ,weget Cmaxest=Ctotalest,1pm,0+Ctotalest,2pm,1 (4) Theorem2. TheestimatedcapacityCestistheminimumofCtotalest,1andCtotalest,2,i.e.,Cest=minnCtotalest,1,Ctotalest,2o Proof. LetCtotalest,1Cmaxest (4) 77

PAGE 78

SubstitutingvalueofCtotalest,1from 4 ,weget Cmaxest)]TJ /F3 11.955 Tf 10.95 0 Td[(Ctotalest,2pm,1 pm,0CmaxestCmaxest)]TJ /F3 11.955 Tf 10.95 0 Td[(Ctotalest,2pm,1Cmaxestpm,0Cmaxest(1)]TJ /F3 11.955 Tf 10.95 0 Td[(pm,0)Ctotalest,2pm,1 since(1)]TJ /F3 11.955 Tf 10.94 0 Td[(pm,0)=pm,1 Cmaxestpm,1Ctotalest,2pm,1Ctotalest,2Cmaxest (4) FromEquation 4 and 4 ,Cestcanbewrittenas: Cest=Ctotalest,1=minnCtotalest,1,Ctotalest,2o Ctotalest,2isnotvalidsinceCtotalest,2Cmaxest.Similarly,assumingthatCtotalest,2Cmaxest,wegettheresult: Cest=Ctotalest,2=minnCtotalest,1,Ctotalest,2o Henceproved. 4.7Results ThealgorithmwasimplementedinJavawhichincludescodeto,1)decodeaJPEGimagetogettheJPEGcoefcients,2)embeddataineligiblecoefcients,3)balancethehistogramtoitsoriginalvalues,andnally,4)re-encodetheimageinJPEGformatwithmodiedcoefcientswhilepreservingtheoriginalquantizationtablesandotherpropertiesoftheimage.Testswereperformedon3000differentJPEGcolorimagesofvaryingsizeandtextureobtainedfromNationalGeographic.Everyimagewasembeddedwithrandomdatabitsusingarandomlygeneratedpassword.Thepassword 78

PAGE 79

isusedtogeneratedthepseudorandomnumbersequencefordeterminingthetraversalsequenceforcoefcients. ThecoverandstegoimageofapopularlyusedLenaimageisshowninFigure 4-3A and 4-3B ALenaCover,Size=44KB,512x512pixels BLenaStego,Size=45KB,512x512pixels,EmbeddedData=5019Bytes Figure4-3. ComparisonofLenacoverimagewithherstegoimage. Figure4-4. ComparisonofLenahistogramatdifferentstagesofembeddingprocess. 79

PAGE 80

ThehistogramoftheLenaimage(Figure 4-3 )isshowninFigure 4-4 .Thegraphshowsthehistogramoftheimagebeforeembedding,beforecompensationandaftercompensation.Thebeforecompensationbarsshowsthattheoddcoefcientshaveincreasedinnumberasopposedtotheevencoefcients,whichhavereducedinnumber.Thisisbecauseoftheembeddingscheme.Sincewemakechangesinpairs(2x,2x+1),andHist(2x)2Hist(2x+1),thenumberofchangesfrom2xto2x+1willbemorethannumberofchangesfrom2x+1to2x.Hence,evencoefcientsdecreaseandoddcoefcientsincreaseintheiroverallnumber.Asmentionedinthealgorithminsection 4.2 ,(-1,1)pairhasbeenconsideredseparatelyforencoding.Thenumberof-1'shavedecreasedinthebeforecompensationphaseeventhoughthetotal-1'sisapproximatelyequalto+1'sbeforeembedding.Thiscanbebecauseofthetraversalschemeasmore-1'smighthavebeenencounteredthan+1's.Aftertheembeddingprocess,thereisanimbalanceinthehistogramasaresultofchangesintheJPEGcoefcients.Theaftercompensationbarsshowthestatusofthehistogramaftercompensationisdone.Wethusverifyexperimentallythatthereiszerodeviationinthehistogramafterthecompensationprocessiscompleted. 4.7.1EstimatedCapacityVsActualCapacity Insection 4.6 ,weestimatedthetheoreticalcapacityoftheembeddeddatainJPEGimagesusingJ3.ThegraphinFigure 4-5 comparesthisestimatedcapacitywiththeactualcapacitywithsamplestakenfromthesetof3000images.Inconclusion,theestimatedcapacityisalmostequaltotheactualcapacity,whichsupportsthecorrectnessofthetheoreticalanalysisofcapacityestimation.Theslightvariationbetweentheactualandtheoreticalcapacityisbecausepm,0andpm,1arecalculatedbasedonthetotalmessagebitstobeembedded,whichismuchlargerthanthe Althoughthehistogramlookssymmetrical,valueswereobtainedusinganexperimentalsetup. 80

PAGE 81

maximumcapacityoftheimage.Thealgorithmonlyembedsdataintheimageuptoitsmaximumcapacityuntilwhichitcanbalancethehistogram.Also,theheaderdataisnotaccountedforinthecalculationswhichmakesanothercontributionintheslightdifferencebetweenthetwographs.Moreover,therandomnumbergeneratorisapseudo-randomnumbergeneratorandnotatruerandomnumbergenerator,whichalsomakesdifferencebetweenactualandtheoreticalembeddingcapacity. Figure4-5. ComparisonofestimatedcapacitywithactualcapacityusingJ3. 4.7.2EstimatedStop-pointVsActualStop-point Itisthatnomatterwhatthevisitationorderis,itislikelythattherewillbesomedeviationfromtheexpectedinvisitationorderforeachpair,sowewillhavetostopsoonerthanexpected.GraphinFigure 4-7 provesthiscorollaryandshowsthattheactualstoppointoccursbeforethetheoreticalstoppointwhichhasbeenderivedinSection 4.6 .ImagesinFigure 4-6 havebeenusedtodemonstratethisresultforafewcoefcientpairs.Thenegativecoefcientpairshavenotbeenshowninthegraphbutthetrendissimilartothepositivecoefcientpairs.Thehighervaluecoefcientpairsbeyond(10,11)havenotbeenshowninthegraphforsimplicityandalsobecausethe 81

PAGE 82

frequencyofoccurrenceofthesehighervaluesisusuallybelowthethresholdrequiredforembedding.J3ignoresthesehighercoefcientswhileembeddingdata.TheupsanddownsinthecurveisduetothevariationinRasshowninEquation 4 .Forexample,thestoppointfor(-1,1)pairishighascomparedtootherstoppointsbecausethenumberof-1'sisapproximatelyequaltonumberof1's.Hence,valueofRisminimumfor(-1,1)pair,whichmaximizesthestoppoint. Alotus.jpg Bplane.jpg Cpeppers.jpg Figure4-6. JPEGimagesusedforcomparisonofstoppointindices. Figure4-7. Comparisonofestimatedstoppointindexvsactualstoppointindex. 82

PAGE 83

Figure4-8. EmbeddingefciencyofJ3intermsofbitsperpixel. 4.7.3EmbeddingEfciencyOfJ3 GraphinFigure 4-8 showstheembeddingefciencywithrespecttothenumberofbitsembeddedperpixel(bpp).Thegeneraltrendinthegraphshowsthattheaveragebppisaround0.16.Sinceasuddenincreaseinthenumberofpixelswillnotleadtothesameamountofincreaseinembeddedbits,apeakinthenumberofpixelswillusuallyresultinavalleyinthebppcurveandvice-versa.Themovingaveragelinesprovethispropertyinthegraph. ThegraphinFigure 4-9 showsthatbpnzvariesfrom0.45to0.75.ThisdemonstratesthatJ3hasagoodpayloadcapacity,sinceweareabletousealmost40%-70%ofnon-zerocoefcientstoembeddataasthemaximumcapacity.But,onlyabpnzof0.1orlowerwouldbeidealforhidingdatawithgoodstealthinessasshowninthesteganalysissection.Thepeaksandvalleysinthecurveareduetothevariationinthenumberofnon-zerosinJPEGleswhichisalsoshowninthegraph.Since,anincreaseinthenumberofnon-zeroswillnotleadtothesameamountofincreaseinnumberof 83

PAGE 84

Figure4-9. EmbeddingefciencyofJ3intermsofbitspernon-zerocoefcient(bpnz). Figure4-10. ComparisonofembeddingcapacityofJ3withotheralgorithms. 84

PAGE 85

embeddedbits,itwillresultinadecreaseinbpnz.Hence,thepeaksinthenon-zerowillresultinvalleyinthebpnzcurve.Themovingaveragecurvesforbpnzandnumberofnon-zerosshowthisproperty. 4.7.4CapacityComparisonOfJ3WithOtherAlgorithms Inthisexperiment,3000imageswereembeddedwithrandomdatatotheirmaximumcapacityusingJ3,F5,SteghideandOutguessalgorithms.ThecomparisongraphisshowninFigure 4-10 .Fromthegraph,wecaninferthatJ3performsbetterwhentheimagesizeislarge.Peaksandvalleysinthegraphareduetothevaryingtextureofimages.Valleysoccurwhenimagesdon'tcontainmuchvariationinthemandareusuallyplaintextured.Thisleadstogoodcompressionratioandhencealargenumberofzerocoefcients,whichdoesn'tleavemanycoefcientsinwhichtoembeddata.J3hasabetterdatacapacitythanOutguessandSteghidewhentheimagesizeissmall,anditperformsbetterthanF5insomecaseswhentheimagesizeislarge.J3usesstoppointstominimizethewastageofanyunusedcoefcientsandleavesjusttherightamounttobalancethehistogram.Outguessperformstheworstinembeddingcapacitysinceitstopsembeddingdatawhenacertainthresholdisreached. Note:Sincetheembeddingcapacitydoesnotproveanefcientsteganographyalgorithm,steganalysisresultshavebeendiscussedinSection 4.8 whichsupportsthatJ3hasalowerdetectionratewhenalgorithmsareembeddedwithequalpayload. 4.8SteganalysisOfJ3 SteganalysisexperimentsforJ3werebasedonSupportVectorMachines(SVM)forclassicationofimagesembeddedwiththefollowingstegoalgorithms:Outguess,F5,SteghideandJ3alongwiththecoverimages.SoftmarginSVM(C-SVM)withRBF(RadialBasisFunction)kernelwasused,whichisoneofthemostpopularchoicesforkerneltypeinsupportvectormachines.LIBSVM[ 51 ]hasbeenusedwhichisapopularlibraryforSVMclassication.Theexperimentsuseafeatureextractorwhichextracts274mergedMarkovandDCTfeaturesforsteganalysisasmentionedin[ 35 ](Thanksto 85

PAGE 86

theauthorsforprovidingthesourcecodeandexecutablesforit).ThereasontousethisfeatureextractorisbecauseitoutperformsDCTorMarkovbasedsteganalysisbyitself,asshownintheauthors'results.Tosummarize,followingstepsarecarriedoutforalltheclassicationexperiments: 1. Embedequaldataintheimagesusingthegivenalgorithms. 2. Extractthe274mergedfeaturesfromtheimages. 3. TransformtheextractedfeaturestotheLIBSVMformat. 4. Performsimplescalingonthetransformeddata. 5. Performagridsearchtondthebest(C,g).AcrossvalidationtoolprovidedintheLIBSVMlibrarywasusedforthispurpose. 6. Usethebest(C,g)totrainthewholetrainingset. 7. Performpredictiononthetestingdatausingthetrainedmodel. 8. Randomizethetrainingandtestingsetandrepeatsteps 6 and 7 .(C,g)remainconstantthroughoutalltheiterations. 9. Calculatetheaverageresultfromalltheiterations. 3000JPEGcolorimageswithdifferenttextureandsizerangingfrom60KBto1000KBwereusedforthesteganalysisexperiment.Everyimagewasembeddedwithrandomdatausingthefourmentionedalgorithms.Attheendofembeddingprocess,wehave4setsofimagescontaining3000stegoimagesineachset.Eachsetconsistsofallthestegoimagesembeddedwithonlyoneofthe4algorithms.Wewillalsohaveonesetofcoverimageswithoutanyembedding.Inall,wehave15000imagesfortheexperiments.70%oftheimages,i.e.2100fromeachsetwereusedfortrainingandtherest900wereusedfortesting.Thetrainingandtestingsetsaremutuallyexclusive.Atotalof100iterationswasperformedforeachexperimentbyrandomizingthetrainingandtestingdatatogetamoreaccurateresult. 86

PAGE 87

4.8.1BinaryClassication Inthispartoftheexperiment,abinaryclassicationwasdonewhereonlyoneofthestegosetsandthecoversetwereusedfortrainingandtesting.Thisbinaryclassicationwasdoneforallthe4algorithms.Theclassicationexperimentwasperformedwith0.05,0.1and0.2bitspernon-zerocoefcients(bpnz).Theresultsareshownintables 4-2 4-3 4-4 and 4-5 Table4-2. DetectionrateofJ3atdifferentbpnzusingSupportVectorMachines(SVM)binary-classier. Classiedas(%)BPNZ AlgorithmCoverJ3 0.05 Cover43.2456.76 J340.2159.79 0.1 Cover76.1423.86 J324.6575.35 0.2 Cover97.472.53 J33.6296.38 Table4-3. DetectionrateofF5atdifferentbpnzusingSVMbinary-classier. Classiedas(%)BPNZ AlgorithmCoverF5 0.05 Cover92.687.32 F56.8293.18 0.1 Cover93.646.36 F56.3993.61 0.2 Cover97.282.72 F53.3096.70 ResultsinTable 4-2 showthatJ3outperformsotheralgorithmsbyahugemarginintermsofdetectionratewithbpnzof0.05.SVMclassierwasonlyabletoclassify60%oftheimagesinJ3stegocategory.Infact,itclassied40%oftheJ3imagesascoverimages,whichprovesthatJ3resemblesthecharacteristicsofacoverimagewhenthepayloadisless.J3had30%lowerdetectionrateascomparedtootherthreealgorithmsat0.05bpnz.Since,50%detectionrateisclassiedasrandomguess,adetectionrateof60%forJ3provesthatJ3wouldbeidealforalowpayloadsteganographyalgorithm. 87

PAGE 88

Table4-4. DetectionrateofOutguessatdifferentbpnzusingSVMbinary-classier. Classiedas(%)BPNZ AlgorithmCoverOutguess 0.05 Cover97.912.09 Outguess1.8398.17 0.1 Cover98.301.70 Outguess1.4498.56 0.2 Cover97.892.11 Outguess1.8598.15 Table4-5. DetectionrateofSteghideatdifferentbpnzusingSVMbinary-classier. Classiedas(%)BPNZ AlgorithmCoverSteghide 0.05 Cover87.7612.24 Steghide16.6183.39 0.1 Cover95.964.04 Steghide6.8593.15 0.2 Cover98.061.94 Steghide2.3897.62 With0.1bpnz,J3hasadetectionrateof75%,whichis15%lowerthantheotheralgorithms,asshowninTable 4-2 .Allthealgorithmsperformpoorlywithabpnzof0.2.Theresultsforbpnzof0.3andhigherarenotshown,sincethedetectionrateisabove90%forallthealgorithms. 4.8.2Multi-classication Inthispartoftheexperiment,allthestegosetsandthecoversetaregroupedtogetherformulti-classifyingtheimages.2100imagesweretakenfromeverystegosetandthecoversetfortrainingdata.Remaining900imagesfromeverysetwereusedfortesting.Table 4-6 showstheresultsoftheexperiment.Cell(rowi,columnj),wherei,j>0,inthetablerepresentsthepercentageofimageswhichwere(rowi,column0)typebutwereclassiedas(row0,columnj)typebytheSVMpredictor.i=jrepresentshowmanyimagesofaparticularalgorithmwerepredictedcorrectly.Thelowerthenumberis,thebetteristhestealthinessofthealgorithm.Table 4-6 showsthatthedetectionrateofJ3isonly52%whichisrandomguessforaSVMclassier.Infact,48%oftheJ3 88

PAGE 89

imageswereclassiedascoverimageswhichshowsthatJ3imagesresembleatypicalcoverimageat0.05bpnz.Table 4-7 showsthatJ3has72%detectionrateincontrasttoalmost90%withotherstegoalgorithms.Asinthebinaryclassication,abpnzof0.2(Table 4-8 )andhigherwouldnotbesuitableforhidingdatasinceallthealgorithmshaveaveryhighdetectionrate. Table4-6. DetectionrateusingSVMmulti-classierat0.05bpnz. Classiedas(%)AlgorithmCoverJ3F5OutguessSteghide Cover38.5447.296.060.167.95J337.8552.535.350.244.04F53.113.5191.940.880.56Outguess0.370.726.9991.280.64Steghide8.806.763.800.9679.68 Table4-7. DetectionrateusingSVMmulti-classierat0.1bpnz. Classiedas(%)AlgorithmCoverJ3F5OutguessSteghide Cover70.3720.535.590.352.16J322.5871.993.880.321.22F54.102.6191.760.880.66Outguess0.900.664.6093.300.53Steghide5.191.062.132.0289.60 Table4-8. DetectionrateusingSVMmulti-classierat0.2bpnz. Classiedas(%)AlgorithmCoverJ3F5OutguessSteghide Cover93.302.231.621.141.70J32.4795.900.960.210.45F52.610.8095.690.590.32Outguess1.440.451.4496.140.53Steghide2.310.400.641.0195.64 4.9Conclusion J3isanewJPEGsteganographyalgorithmthatusesLSBencodingtoembeddataandhistogramcompensationtobalanceallthecoefcientschangedduringthe 89

PAGE 90

embeddingprocess.J3onlymakeschangestothenon-zerocoefcientsinpairs,whichensuresthatthecoefcientsareonlychangedbya+1or-1,exceptforthe(-1,1)pair.Stoppoints,whichtellthealgorithmwhentostopencodingordecodingaparticularcoefcient,arethekeyelementstothisalgorithm.J3alsousesmatrixencodingtoreducetheamountofcoefcientchangeswhenthemessagelengthissmallerthanitsmaximumcapacity. Theproposedalgorithm,J3,wascomparedwiththreemostpopularalgorithms:F5,Steghide,andOutguess.ExtensivesteganalysisperformedonthesealgorithmsprovethatdetectionrateofJ3isaround50%at0.05bpnzwithmulti-classicationand60%withbinaryclassication.Incontrast,theotherthreealgorithmshada80%andhigherdetectionrateatthesamebpnz.ThedetectionrateofJ3at0.1bpnzisaround70%ascomparedto90%forotheralgorithms.Allthealgorithmshaveaveryhighdetectionrateatbpnzof0.2andhigher.Since,50-60%detectionisclassiedasrandomguessinSVMclassication,theresultsprovethatJ3wouldbeanidealcandidateforembeddingdataatlowrates. Thesteganalysiswasbasedon3000colorJPEGimagesdownloadedfromNationalGeographicwebsite.The274mergedDCTandMarkovfeatureextractorusedforsteganalysiswasthebestavailableatthetimeofwritingthisarticleindetectionaccuracy,asclaimedbytheauthorsin[ 35 ].Although,thesteganalysisexperimentsinSection 4.8 usessecondorderstatisticstodetectanomaliesandJ3isarst-orderrestorationscheme,J3isstillabletoperformextremelywellonlowerdataratesandbeatthissteganalysissystem.Infuture,J3canbemodiedandextendedtocompensateforsecondorderstatisticalchangesaswell.Thesewillincludecompensatingfortheinterandintrablockdependencychanges. 90

PAGE 91

CHAPTER5J4:LOWDETECTIONSTEGANOGRAPHYUSINGDUALHISTOGRAMCOMPENSATION 5.1Introduction TheDCTfeaturesasproposedbyFridrich[ 33 ],areveryeffectiveinattackinganysteganographicsystem.TheirsteganalysisalgorithmisbasedonextractionofanumberofDCTfeaturesfromthegivenimagesettodetectembeddeddatausingapatternclassier.J4aimstocompensateforthosestatisticalchangesafterembeddingdata.Inchapter 4 ,J3wasintroducedwheredataisembeddedbycompensatingforglobalhistogramchanges.Matrixembeddingwasusedtominimizethenumberofchangedcoefcients.J3outperformedotheralgorithmintermsoflowdetectionrateatthesamepayload.Thedetectionratewasalmost40%lowerthanthepopularalgorithms.TheideaofJ3hasbeenextendedtoJ4whichnotonlycompensatesforglobalhistogrambutalsofordualhistogramsaswellpreservingtheindividualDCTmodes.IncontrasttoJ3,stoppointinformationisnotembeddedinsidetheheaderdata.Instead,theoreticalembeddingcapacityofeachcoefcientpairforeachindexpositionisestimated.Oncetheestimatedcapacityforaparticularisreached,thealgorithmstopsembeddingdatainthatpair.Otherpairswhoseembeddingcapacityhasnotbeenreachedcanstillbeusedforembeddingdata.Thecapacityestimationisdoneinsuchawaythatthereareenoughcoefcientsleftineachpairtocompensateforanychangestorestoretheglobalaswellasdualhistogramsafterembedding.SimilartoJ3,matrixencodingtechnique,proposedbyCrandall[ 28 ],hasalsobeenusedinJ4tominimizethechanges.J4alsoembedsdatainthezerocoefcientsinthelowercoefcientindices.WeconsiderzerocoefcientsinJ4sincethenumberofzerosisextremelylargeascomparedtoothercoefcients.Hence,totakeadvantageofthematrixembeddingandminimizechanges,weembeddatainafewzerocoefcients.Note,thatonlyasmallnumberofzerocoefcientswillbechangedsincetheefciencyincreasesduetoalargenumberofavailablecoefcients.Zerocoefcientsarechangesinsuchawaythatitdoesn'taffect 91

PAGE 92

thehistogramandtheshapeisretained.Thedetailsofthealgorithmarediscussedlaterinthischapter. BackgroundondualhistogramandindividualDCTmode:In2004,Fridrichetal.proposedasteganalysistechniquewhichwasbasedontheDCTpropertiesoftheJPEGimages.TheDCTfeaturesextractedfromtheJPEGimagesoutperformedexistingtechniquesbyahugemargin.Severalofthesefeatureswerebasedontheglobalhistogram,dualhistogramsandtheindividualDCTmodes.TheindividualDCTmode(alsocalledindividualhistogram)istheoccurrenceoftotalnumberofeachcoefcientinaparticularrowandcolumnofthe8x8DCTmatrix.Forexample,anindividualhistogramfor(1,1)wouldbetheoccurrenceofallcoefcientsat(1,1)locationacrossallDCTblocksofthegivenJPEGimages.Dualhistogramsarepreservedautomaticallyifanalgorithmpreservesalltheindividualhistograms.InJ4,wepreservealltheindividualhistogramsforthelowerordercoefcientsinthelowerindicesoftheDCTblocks.Letdk(i,j)denotethequantizedDCTcoefcientfor(i,j)coefcientinthekthblock.Theindividualhistogramfor(i,j)isdenedas:Hi,j=(hi,j)]TJ /F13 8.966 Tf 6.97 0 Td[(x,...,hi,jx)(i,j)2f(2,1),(3,1),(4,1),(1,2),(2,2),(3,2),(1,3),(2,3),(1,4)g wherehi,jxisthefrequencyofoccurrenceofcoefcientxatlocation(i,j)inalltheDCTblocks.Therange()]TJ /F3 11.955 Tf 9.29 0 Td[(x,x)issetto()]TJ /F4 11.955 Tf 9.29 0 Td[(5,5)sincethefrequencyofhigherordercoefcientsistoolowtobeconsideredfordetectioncomparedtotheincreasedcomplexity. 5.2J4EmbeddingModule Asdiscussedbefore,J4triestorestoretheindividualhistogramsaswellastheglobalhistogram.Restorationoftheindividualhistogramswouldalsoresultintherestorationoftheglobalhistogram.However,J4doesn'trestoretheindividualandglobalhistogramof1,-1,and0coefcients.Thisistoreducetheoverallnumberof 92

PAGE 93

Figure5-1. BlockdiagramofJ4embeddingmodule. changes.Tominimizeimpact,theratioof1'sto-1'sisalwaysmaintainedthroughouttheembeddingprocess.TheembeddingprocessofJ4goesthroughanumberofstepsasdiscussedbelow.Figure 5-1 showstheembeddingmoduleofJ4. 5.2.1Pre-processingStage Preprocessingestimatesembeddingcapacityforeachcoefcientpair.Inordertosimplifythealgorithm,theDCTcoefcientsofan8x8matrixareconsideredasaonedimensionalarraywherethecoefcientsarearrangedinzigzagorder.8x8matrixwithits1-DrepresentationisshowninFigure 5-2 .Therighthalfofthecoefcientsinthearrayarehighfrequencycomponents,andaremostlyzerosafterquantization.Themajorityofthecoefcientsvaluesforwhichthedetectionalgorithmsareappliedareusuallyintherangeof-10to10.Therefore,weonlyconsidertherst28elementsofthearrayforembeddingandcompensationsincetheseholdmostofthenon-zerocoefcients.Therstelement,thatis,theDCcoefcientisignored.ThefrequencycountofeachcoefcientiscalculatedforeachindexpositioninthearrayoveralltheDCTblocks.Thisarrangementcanbeviewedasatwodimensionalbinoramatrix,wheretherowsigniestheindexintheDCTarrayandthecolumnsigniesthecoefcientvalue.Histi(y)representsthetotaloccurrencesofcoefcientvalueyatpositioniineachDCTarrayofaJPEGimage.Oncetheindividualhistogramsarecalculated,capacityofeachofthepairsinthebinsisestimatedtheoretically(Section 5.6 ).Forexample,we 93

PAGE 94

estimatethecapacityofpair(2y,2y+1)foreachpositioniinthearray,alsorepresentedasEsti(2y,2y+1).Theestimatedcapacityiskeptinseparate2-Dbins.Wealsohaveanadditional2-Dbinthatkeepstrackofthecurrentnumberofcoefcientsthathavebeenusedfromagivenpair,denotedbyUsedi(2y,2y+1),where(2y,2y+1)formacoefcientpairandiisthecoefcientindex. Figure5-2. 8x8quantizedDCTcoefcientmatrixanditsarrayrepresentation. 5.2.2HeaderInformation Oncethepreprocessingisover,wedeterminetheappropriatevaluesofnandkformatrixencoding.Thematrixencodingisdenotedby(1,n,k),whichmeanskbitsofmessagecanbeembeddedinncoefcientsbychangingatmost1coefcientoutofn,wheren=2k)]TJ /F4 11.955 Tf 11.16 0 Td[(1.Theration=kcanbeobtainedbysummingthetotalestimatedcapacityinbitsdividedbythetotalmessagebits.Thereceiverneedstoknowkinordertoproperlydecodethemessage,soitisstoredintheheaderbitsofthemessage.Theheaderalsostoresusefulinformationsuchasthedatalength,coefcientthreshold,andDCTarrayindexlimit.Theheaderinformationitselfisnotmatrixembeddedsincethereceiverneedstodecodetheheaderbitstoknowtheembeddingrate,k.ThestructureoftheheaderisgiveninTable 5-1 ExplanationofHeaderelds: 94

PAGE 95

Table5-1. HeaderstructureforJ4algorithm 4Bits20Bits4Bits2Bits Valueofmatrixencoding,kDatalengthinbytes,MLCoefcientthreshold,CoethDCTindexthreshold,Indexth k=valueofkinmatrixencoding(1,2k)]TJ /F4 11.955 Tf 10.95 0 Td[(1,k). ML=totalmessagelengthinbytes,notincludingthelengthofheader. Coeth=absolutevalueofuppercoefcientlimitforDCTcoefcients.AnyDCTcoefcientvaluehigherthanthiswillbeignoredduringtheembeddingprocess. Indexth=representstheboundaryindexinthe1-D8x8zigzagarrayafterwhichweignoreallthecoefcients.Theactualindexpositionisencodedusingtwobits,where00=28,01=36,10=43,11=54.J4bydefaultusesvalue00,i.e.28coefcientsinthearrayforembedding,sincerighthalfofthevaluesintheJPEGcoefcientsarezeroinatypicalimage. 5.2.3EmbeddingStage ThecoverimageisrstentropydecodedtoobtaintheJPEGcoefcients.ThemessagetobeembeddedcanbeencryptedusingAESorDES.Apseudo-randomnumbergeneratorisusedtovisitthecoefcientsinrandomordertoembedtheencryptedmessage,seededusingsharedpasswordP.Thealgorithmalwaysmakeschangestothecoefcientsinapairwisefashion;e.g.(2,3)correspondstoapair.AJPEGcoefcientwithavalueof2xwillonlychangeto2x+1toencodemessagebit1,andacoefcientwithavalue2x+1willonlychangeto2xtoencodemessagebit0. Incontrasttothegeneraltrendofnotchanginganyzerovaluedcoefcients,J4makeschangestothezerocoefcients.ThisisdoneinordertoleveragethepotentialofextremelyhighnumberofzerocoefcientsinatypicalJPEGimage.Sinceweusematrixencoding,usingthezerocoefcientswouldresultinaoverallreductioninthenumberofcoefcientchangesandhencereducedetection.Thisheuristicisprovenbytheextremelylowdetectionratewhichhasbeendiscussedinthesteganalysissection.Coefcientswithvalue0,1and-1haveadifferentembeddingstrategysincetheirfrequencyisveryhighascomparedtoothercoefcientsandformatriplet,()]TJ /F4 11.955 Tf 9.29 0 Td[(1,0,1). 95

PAGE 96

A-1or1coefcientisequivalenttomessagebit1and0isequivalenttomessagebit0.Toencodemessagebit0inacoefcientwithvalue1or-1,wealwayschangeitsvalueto0.Similarly,toencodebit1in0coefcient,wechangeittoeithera1ora-1.Changeofa0toa1or-1woulddependonthetotalnumberofchangesmadeto1and-1before.Thechangesaredoneinsuchawaythattheapproximateratioof-1and1ismaintainedasinthecoverletothwartchi-squareattacks.Thealgorithmkeepstrackoftheimbalancein1and-1.Iftheimbalancein-1exceedsthatof1,azerowouldbechangedtoa-1insteadof1andvice-versa.Hence,theoverallshapeofthehistogramisretainedasinthecoverimage. Theembeddingcoefcientpairsare()]TJ /F4 11.955 Tf 9.29 0 Td[(2n,)]TJ /F4 11.955 Tf 9.29 0 Td[(2n)]TJ /F4 11.955 Tf 11.71 0 Td[(1)()]TJ /F4 11.955 Tf 9.29 0 Td[(2,)]TJ /F4 11.955 Tf 9.29 0 Td[(3),()]TJ /F4 11.955 Tf 9.29 0 Td[(1,0,1),(2,3)(2n,2n+1),where2n+1and)]TJ /F4 11.955 Tf 9.29 0 Td[(2n)]TJ /F4 11.955 Tf 11.48 0 Td[(1arethethresholdlimitsforpositiveandnegativecoefcients,respectively,i.e.j()]TJ /F4 11.955 Tf 9.29 0 Td[(2n,)]TJ /F4 11.955 Tf 9.29 0 Td[(2n)]TJ /F4 11.955 Tf 11.25 0 Td[(1)j=j(2n,2n+1)j=Coeth.Duringtheembeddingprocess,ifthenumberofbitsencodedforaparticularpair,(x,y)iequalstheestimatedvalue,Esti(x,y),westopconsideringpair(x,y)iformatrixembedding.Here(x,y)idenotescoefcientsxandyatindexiinthe1-DDCTarray.Unusedcoefcientsforthatpairwillbeusedlatertocompensatefortheimbalance.Theoreticalestimationensuresthatenoughcoefcientsareleftuntouchedinordertorestoretheglobalanddualhistogramaftertheembeddingprocess.Notethatfullcoefcientrestorationiscrucialasthereceivermustcalculatethesameestimatedcapacityinordertodecodethedataproperlyandtoknowwhentostop.Sincetheestimatedcapacitydependsonthetotalnumberofeachcoefcient,weneedtorestoreeachcoefcientpairforeachindexfully.Ifwecannotrestorethecoefcientfully,weneedtomakesurethatestimationofthecoefcientafterthecompensationwouldyieldthesamevalueasbeforetheembeddingprocess. Thepseudo-codeandanexamplefortheembeddingalgorithmisgiveninSection 5.3 96

PAGE 97

5.3J4EmbeddingAlgorithmInDetail Followingterminologyisusedthroughoutthealgorithmandthechapter. Histi(y)TotalnumberofcoefcientyatindexioftheDCTarrayinitiallypresentinthecoverimage.Therefore,Histi(y)=NBx=1d(Ci=y),whered=1ifCi=y. TRi(y):Remainingnumberofcoefcientsyatindexiwhichareunusedanduntouchedduringembeddingatindexx. TCi(y!y)Totalnumberofcoefcientychangedtoyatindexiduringembedding. i(y)RepresentstheunbalanceincoefcientyatindexiascomparedtoHisti(y). NBTotalnumberofblocksinthecoverimage. CiValueofcoefcientatindexlocationiinthecoverimagewhere1iIndexth. Coetotaltotalnumberofcoefcientsintheimage=64NB. Esti(2y,2y+1):Estimatedcapacityofpair(2y,2y+1)where2yand2y+1onlyoccuratindexiintheDCTarray. Usedi(2y,2y+1):Totalnumberofcoefcientsofpair(2y,2y+1)atindexiwhichhavebeenusedsofarduringthematrixembedding. Example2. Thisexampledemonstratestheembeddingprocessusingtheaboveterminology.Atthestartofembeddingprocess,assumethefollowingvalues: Hist5(2)=500,Hist5(3)=200,Est(2,3)5=400 Assumethefollowingscenarioduringembedding: TC5(2!3)=100,TC5(3!2)=50,Used(2,3)5=400 Since,Est(2,3)5=Used(2,3)5,thealgorithmwouldignoreany(2,3)pairsatindex5formatrixencodingfromthisstage. Attheendoftheembedding,wecalculatethenetimbalanceinthepairsforeachindex.Since1002'shavebeenchangedtoa3and503'shavebeenchangedbackto2,wehaveanimbalanceinthehistogram. 97

PAGE 98

5(2)=TC5(3!2))]TJ /F3 11.955 Tf 10.95 0 Td[(TC5(2!3)=)]TJ /F4 11.955 Tf 9.29 0 Td[(50. 5(3)=TC5(2!3))]TJ /F3 11.955 Tf 10.95 0 Td[(TC5(3!2)=)]TJ /F4 11.955 Tf 9.29 0 Td[(5(2)=50. Thismeanswehave50more3'satindex5ofallDCTarraysthanrequiredand50fewer2'sthanneededtobalancethehistogrampair(2,3)5toitsoriginalvalues.Hence,weneedatleast503'stobalancethepair(2,3)5.Thiscompensationisdoneaftertheembeddingstagebyvisiting50unused3sinrandomorderatindex5andchangingitto2. J4embeddingalgorithmisdividedintosmallersubroutines.Algorithm 5.1 isthemainalgorithmandusesvariousprocedurestoembeddataandcompensateforchanges.Let'sassumethatthecoverimagesisdecodedtoobtainthequantizedDCTcoefcients.EachoftheDCTblockisusedasis,i.e.itisnotzig-zagedandcontains64coefcientsina1-Darray.Algorithm 5.1 rstcalculatestheappropriatenandkformatrixembedding.ItthendeterminedtheestimatedcapacityofeachofthecoefcientpairsusingtheequationsgiveninSection 5.6 .Procedure EmbedHeader isthencalledtoembedtheheaderbits.Thevalueofcoefcientthreshold,Coethandindexthreshold,Indexthisxedonbothsenderandreceiverside.Weembedthesejustforrobustnesssincetheseparametersareimportantinencodinganddecodingthemessage.Procedure GetNextEligibleCoeffIndex returntheindexofthenextrandomunusedeligiblecoefcient.Theeligibilityisdeterminedbytheindexpositionofthecoefcientanditsvalue.IfcoefcientvalueexceedsCoethorthepositionofthecoefcientinthe64elementarrayisgreaterthanIndexth,itismarkedunusable.DCcoefcientsarealsomarkedunusable.Procedure GetNextEligibleCoeffIndex alsokeepstrackofhowmanycoefcientsofeachpairforeveryindexpositionhavebeenusedsofar.Iftheusedcoefcientcountexceedstheestimatedcapacityforthecurrentcoefcientanditcorrespondingpairinconsideration,theagissetforthatpair.Theprocedurewillignoreallcoefcientsofthatpairduringtheentireembeddingprocessoncetheagisset. 98

PAGE 99

Oncetheheaderbitsareembedded,themainalgorithmthenembedsthemessagebitsusingarandomtraversalorderwhichisdeterminedbytheseedgeneratedusingthesharedpassword.Ineachstepoftheembedding,itconsidersncoefcientstoembedkmessagebits.Toembedthemessagebitsusingmatrixembedding,procedure FlipBit iscalledwhichgivestheindexpositionofthecoefcientwhoseLSBistobeipped.Procedure FlipBit alsokeepstrackofthenumberofchangesmadeineachcoefcientpairforeveryindexposition.Onceallthemessagebitshavebeenembedded,procedure Compensate thencalculatesthenetchangeinindividualcoefcientspairsateachindexandrestoresthecounttoitsoriginalvaluesusingtheunusedcoefcientsatthoseindices.Negativecoefcientspairshavenotbeenshowninthealgorithmsbelowforsimplicitybutcanbeincludedwithaslightmodication.Triplet(-1,0,1)areencodedwithoutanycompensationbuttheratioof-1and1ismaintainedasmentionedearlier.ThisisshowninFigure 5-5 whichshowsthatthepercentchangein-1and1isalmostequal. LetPbethesharedpasswordbetweenthesenderandthereceiver.Thispasswordisusedtogeneratetheseedforpseudo-randomnumbersbetween0and64NB.Thesamepasswordisalsousedforencryptinganddecryptingthedata.Let, Enc(M,P)=EncryptionofmessageMusingPaskeywithAESorDESstandard. RNG(P,x)=Uniquerandomnumbergeneratinganumberbetween0andxusingPasgivenseed.Theuniquenesscanbeimplementedusingabitmaptostoretheusedindices. MtotalE=Totalnumberofbitsinencryptedmessage,ME. C[x,y]=CoefcientvalueatindexxinDCTblocky. Used(x)=Totalnumberofxcoefcientsusedirrespectiveoftheirindexposition. Hist(x)=Totalnumberofxcoefcientsintheimageirrespectiveoftheirindexpositioninthearray. 99

PAGE 100

ProcedureEmbedHeader(C) Input: CInputDCTcoefcientarray. Output: ModiedDCTcoefcientarraywithembeddedheaderbits. 1 begin 2changek,ML,Indexth,Coethintobits; 3populatethebitsintoHeaderarray; 4headerLength (4+20+4+2) /* Headerlengthisfixed*/ 5LetHeader[i]representtheithheaderbit; 6forcount 0toheaderLengthdo 7index GetNextEligibleCoeIndex(); /* GetNextEligibleCoeIndex()ismodifiedslightlyforheaderbitsandembedsdatainallthecoefficientsencounteredirrespectiveofIndexth,Coethsincethesehavetobedecodedonthedecoderside.*/ 8FlipBit(C,index,Header[count]) /* embedthenextheaderbitinthecurrentJPEGcoefficient*/ 9count++; 10end 11end Figure5-3. BlockdiagramofJ4extractionmodule. 5.4J4ExtractionModule ThissectiondealswiththeextractionofmessageMfromagivenJ4stegoimage.Theextractionalgorithmissimple,asthereceiverhastoonlycalculatetheestimatedcapacityofeachofpairsusingkfromheaderandstopdecodingthatpairwhentheestimatedcapacityequalthenumberofbitsusedupinthatpair.PasswordPisusedtogeneratetherandomnumbersequenceusedtopermutethecoefcientindicesfor 100

PAGE 101

ProcedureGetNextEligibleCoeffIndex(C,Used) Input: (i)CDCTcoefcientarray,(ii)UsedArraywhichkeepstrackofhowmanycoefcientsofeachindexhavebeenused. Output: IndexofthenexteligiblecoefcientintheDCTarray. 1 begin 2whilenumberofunusedcoefcients>0do 3rand RNG(seed,NB64); // Maprandtoblocknumberofimageandpositionofthecoefficientinthatblock 4y rand=64; // yrepresentstheDCTblocknumberoftheimage 5x rand%64; // xrepresentstheindexofcoefficientinblocky 6value1 C[x,y]; 7ifvalue1>Coethorx>Indexthorx=0then 8continue // fetchthenextrandomcoefficient 9elseifvalue12f1,)]TJ /F4 11.955 Tf 9.28 0 Td[(1gthen 10Used(value1)++; 11elseifvalue16=0then 12letvalue2bethecorrespondingpairofvalue1; // Updatethenumberofusedcoefficientforthepairforindexx 13Usedx(value1,value2)++; 14end 15returnrand; 16end 17end visitationorder.Theheaderisdecodedrsttogetthevaluesofk,messagelength,coefcientthresholdandtheindexthreshold. Oncealltheheaderbitshavebeenextracted,theextractionprocessstartsdecodingthemessagebits,takingcaretostopextractionfromacoefcientpaironceitsestimatedcapacityhasbeenreached.Thedecodingalgorithmisgivenbelow.Asexplainedearlier,wewillonlyshowthealgorithmforpositivecoefcients.Similarrulesapplytothenegativecoefcients,withslightmodication.AblockdiagramofJ4extractionmoduleisgiveninFigure 5-3 5.5J4ExtractionAlgorithmDetail Theextractionalgorithmisdividedintotwomodules.Algorithm ExtractHeader rstdecodestheheadertorecoverrequiredinformationfordecodingthemessage.Finally, 101

PAGE 102

ProcedureFlipBit(C,rand,bit) Input: (i)CDCTcoefcientarray,(ii)randIndexoftheDCTcoefcientinwhichthebithastobeembedded,(iii)bitBitvaluetoembedincoefcientatindexrand 1. Output: ModiedcoefcientatindexrandintheDCTarray. 2 begin // Changerandtoblocknumberandcoefficientindexinthe64elementarray 3x rand%64; 4y rand=64; 5ifC[x,y]=0andbit=1then // Calculatetheimbalancein1and-1andchangeaccordingly 6posBal TC(0!1))]TJ /F3 11.955 Tf 10.95 0 Td[(TC(1!0); 7negBal TC(0!)]TJ /F4 11.955 Tf 23.9 0 Td[(1))]TJ /F3 11.955 Tf 10.95 0 Td[(TC()]TJ /F4 11.955 Tf 9.29 0 Td[(1!0); 8ifposBal
PAGE 103

Algorithm5.1:Mainembeddingalgorithm. Input: (i)CInputDCTcoefcientarray.(ii)MMessagetobeembedded.(iii)PSharedpassword. Output: CModiedDCTcoefcientarray. 1 begin 2seed=MD5(P); // GenerateseedusingMD5hashingforRNG 3Calculatethefrequencycountofeachcoefcient,Hist(x)andHisti(x); 4Calculatenandkformatrixembeddingusingequationsgiveninsection 5.6 ; 5Calculatetheestimatedcapacity,Estofeachpairateachindexusingnandk; 6ME=Enc(AES=DES,M,P); // EncryptmessageMwithPasthekeywithAES/DESstandard 7EmbedHeader(C); // Callfunctiontoembedtheheaderbits 8DataIndex=0; 9whileDataIndextotalbitsinMEdo 10foreachUsedi(2x,2x+1)ofarrayUseddo /* checkallthepairstoseeifwecanstillembeddatainit*/ 11getthecorrespondingelement,Esti(2x,2x+1)ofEstarray; 12if(Usedi(2x,2x+1)+n)Esti(2x,2x+1)then 13Markthispair(2x,2x+1)iunusable /* thiscanbeachievedbymaintainingabooleanarrayforthepairs.*/ 14end 15end 16fori 0tondo // getsthenextncoefficientsformatrixembedding 17temp[i++] GetNextEligibleCoeIndex(C,Used) /* storethecoefficientsintemparray*/ 18end 19getthenextkbitsofthemessageME; 20embedkbitsinthencoefcientsbychangingatmost1coefcient; 21extracttheposition,pos,ofcoefcienttochangeintemparray; 22ifpos0then // FliptheLSBofthecoefficientatpos // gettheindexandblocknumberfrompos 23x pos%64; 24y pos=64; 25LetbitbethevalueofLSBofC[x,y]; 26FlipBit(C,pos,bit) /* CallFlipBitfunctiontochangetheLSBofthedesiredcoefficient*/ 27end // incrementthecounterfortotaldatabitsembedded 28DataIndex DataIndex+k; 29end // Calltheprocedureforcompensationofchangedcoefficients 30Compensate(C,TC); 31end 103

PAGE 104

ProcedureCompensate(C,TC) Input: (i)CModiedDCTcoefcientarrayafterembedding.(ii)TCArraywhichstoresthetotalnumberofchangesineachcoefcientcomparedtounmodiedDCTarray. Output: CModiedDCTcoefcientarraywithcompensateddualhistogram. 1 begin /* Calculatenetchangeineachcoefficientpairforeachindex*/ 2fori=1toIndexthdo // traversealltheindicesfrom1onwards 3forx=2tocoethdo // traverseallthecoefficientpairsatindexi 4ifTCi(x!x+1)>TCi(x+1!x)then 5TCi(x!x+1) TCi(x!x+1))]TJ /F3 11.955 Tf 10.95 0 Td[(TCi(x+1!x); 6TCi(x+1!x) 0; 7else 8TCi(x+1!x) TCi(x+1!x))]TJ /F3 11.955 Tf 10.95 0 Td[(TCi(x!x+1); 9TCi(x!x+1) 0; 10end 11x x+2; 12end 13i i+1; 14end /* Calculatethetotalchangeinhistogram*/ 15netChange=Indexthi=1coeth=2x=2TCi(2x!2x+1)+TCi(2x+1!2x) /* Makechangestotheunusedcoefficientstobalance*/ 16whilenumberofunusedcoefcients>0andnetChange>0do 17rand RNG(seed,NB64); // Maprandtoblocknumberofimageandpositionofthecoefficientinthatblock 18y rand=64; // yrepresentstheDCTblocknumberoftheimage 19x rand%64; // xrepresentstheindexofcoefficientinblocky 20value1 C[x,y]; 21letvalue2bethecorrespondingpairofvalue1; 22ifvalue1>Coethorx>Indexthorx=0orvalue12f)]TJ /F4 11.955 Tf 25.88 0 Td[(1,0,1gthen // wedonotbalance1,-1or0valuecoefficient 23continue; // fetchthenextrandomcoefficient 24elseifC[x,y]2evenandTCx(value2!value1)>0then 25TCx(value2!value1))-137()]TJ /F1 11.955 Tf 20.24 0 Td[(,C[x,y]++,netChange)-138()]TJ /F1 11.955 Tf 20.24 0 Td[(; 26elseifC[x,y]2odd^TCx(value2!value1)>0then 27TCx(value2!value1))-137()]TJ /F1 11.955 Tf 20.24 0 Td[(,C[x,y])-138()]TJ /F1 11.955 Tf 20.24 0 Td[(,netChange)-138()]TJ /F1 11.955 Tf 23.56 0 Td[(; 28end 29end 30compareeachcoefcientfrequencybeforeembeddingandaftercompensation.; 31Ifnotequal,reportfailureandexit.; // donotconsider-1,0and1forcompensation 32end 104

PAGE 105

algorithm 5.2 extractstheencryptedmessagebits,whicharethendecryptedtorecovertheactualmessage. ProcedureExtractHeader(C,P) Input: (i)CModiedDCTcoefcientarrayand(ii)Psharedpasswordbetweenthesenderandreceiver. Output: k,ML,Coeth,Indexth 1 begin 2seed=MD5(P); // GenerateseedusingMD5hashingforRNG 3headerLength (4+20+4+2) // Headerlengthisfixed 4LetHeader[i]representtheithheaderbit; 5forcount 0toheaderLengthdo 6rand GetNextEligibleCoeIndex(C,Used); // Maprandtoblocknumberofimageandpositionofthecoefficientinthatblock 7y rand=64; // yrepresentstheDCTblocknumberoftheimage 8x rand%64; // xrepresentstheindexofcoefficientinblocky 9Header[count] LSB(C[x,y]); 10count++; 11end 12Decodevaluesofk,ML,Coeth,IndexthfromHeaderarray; 13end 5.6TheoreticalEstimationOfEmbeddingCapacity ThissectionshowshowtoestimatetheexpectedembeddingcapacityofacoverleusingJ4.Thisisdonebyestimatingthevalueofnformatrixembeddingandusingthatntoestimatethecapacityofeachofthecoefcientpairs.Initially,wehavenotanalyzedthecoefcientpairsintermsoftheirindexpositionforsimplicity,butitwillbeincludedinthenalestimatedresult.Wealsoshowthecalculationforpositivecoefcientsonly.Thecalculationforthenegativecoefcientspairaresimilarwithslightmodications. coeth=Coefcientthresholdtoconsiderforembedding. Pc2x+1=Probabilityofencounteringanoddnumberwithvalue(2x+1)intraversingthecoefcients. Pc2x=Probabilityofencounteringanevennumberwithvalue2xintraversingthecoefcients. 105

PAGE 106

Algorithm5.2:J4extractionalgorithm. 1 begin 2InitializedUsedarrayelementstozero; 3InitializedM,messagebitarraytozero; 4ExtractHeader(C,P) // Callfunctiontoextractheaderinformation 5MtotalE=ML8; /* convertmessagelengthintonumberofbits*/ 6DataIndex 0; 7Calculatethefrequencycountofeachcoefcient,Hist(x)andHisti(x); 8n=2k)]TJ /F4 11.955 Tf 10.95 0 Td[(1 // Calculatenformatrixembeddingfromk 9Calculatetheestimatedcapacity,Estofeachpairateachindexusingnandk; 10whileDataIndexMtotalEdo 11foreachElementUsedi(2x,2x+1)ofarrayUseddo /* checkallthepairstoseeifwecanstillextractdatafromit*/ 12getthecorrespondingelement,Esti(2x,2x+1)ofEstarray; 13if(Usedi(2x,2x+1)+n)Esti(2x,2x+1)then 14Markthispair(2x,2x+1)iunusable; /* thiscanbeachievedbymaintainingabooleanarrayforeachpair*/ 15end 16end 17fori 0tondo /* getsthenextncoefficients*/ 18temp[i++] GetNextEligibleCoeIndex(C,Used); /* storethecoefficientsintemparray*/ 19end 20Mk1 Decodenbitsoftemparrayintokbitsusingmatrixdecoding; 21StoreMk1inthemessagearrayM; // incrementthecounterfortotaldatabitsextracted 22DataIndex DataIndex+k; 23end 24Mout=Dec(AES=DES,M,P); /* DecryptmessageMusingpasswordP.*/ 25end coetotal=Totalnumberofeligiblecoefcientsintheinputimage. Pr(x!y)=Probabilityofcoefcientxbeingchangedtocoefcienty. 106

PAGE 107

coetotal=coethx=2Hist(x) (5) Pc2x+1=Hist(2x+1) coetotal (5) Pc2x=Hist(2x) coetotal (5) Anoddcoefcientcanonlydecreaseorretainitsvaluetoembedadatabit.Similarly,anevennumbercanonlyincreaseorretainitsvaluetoembedadatabit,asexplainedinembeddingmodule.Since,weareusingmatrixembedding,onlyatmostonecoefcientwillchangeoutofnin(1,n,k)matrixembedding. Pr(2x+1!2x)=1 (n+1)Pc2x+1 (5) Pr(2x!2x+1)=1 (n+1)Pc2x (5) Pr(2x+1!2x+1)=n (n+1)Pc2x+1 (5) Pr(2x!2x)=n (n+1)Pc2x (5) Letg(2x,2x+1)=Totalnumberofeligiblecoefcientsvisitedsofaratanyinstant.Although,-1,0and1arealsoeligiblecoefcientsinJ4,wedonotconsiderthemforcalculationofg(2x,2x+1)sincewearenotdoinganyestimationorcompensationonthem. LetTCEx(x!y)betheexpectednumberofcoefcientswithvaluexchangedtoytoembedadatabit. 107

PAGE 108

LetTREx(x)betheexpectednumberofcoefcientswithvaluexremainingunchangedandunused.TCEx(2x+1!2x)=g(2x,2x+1)Pr(2x+1!2x) (5)TCEx(2x+1!2x+1)=g(2x,2x+1)Pr(2x+1!2x+1) (5)TCEx(2x!2x+1)=g(2x,2x+1)Pr(2x!2x+1) (5)TCEx(2x!2x)=g(2x,2x+1)Pr(2x!2x) (5)TREx(2x+1)=Hist(2x+1))]TJ /F16 11.955 Tf 10.95 13.27 Td[(hTCEx(2x+1!2x)+TCEx(2x+1!2x+1)i (5)TREx(2x)=Hist(2x))]TJ /F16 11.955 Tf 10.95 13.28 Td[(hTCEx(2x!2x+1)+TCEx(2x!2x)i (5) 5.6.1CalculationOfStopPositionForEachPair LetEx(x)betheexpectednetunbalanceofcoefcientswithvaluex. SincewehaveestimatedTREx(i)forallthecoefcients,wecannowcalculatetheconditionwhenweshouldstopembeddinganydatainacoefcientpair,sincewewillbeleftwithonlyenoughamountofuntouched(remaining)coefcientsinthatpairtobalancethehistogramaftertheembeddingprocess.Theconditionis:Ex(2x+1)=TCEx(2x!2x+1))]TJ /F3 11.955 Tf 10.94 0 Td[(TCEx(2x+1!2x),TCEx(2x!2x+1)TCEx(2x+1!2x) (5)Ex(2x)=TCEx(2x+1!2x))]TJ /F3 11.955 Tf 10.94 0 Td[(TCEx(2x!2x+1),TCEx(2x+1!2x)TCEx(2x!2x+1) (5) Thestopconditionis: TREx(x)=Ex(x) ReplacingLHSofEquation 5 withRHSofEquation 5 ,wegetHist(2x+1))]TJ /F16 11.955 Tf 10.95 13.28 Td[(hTCEx(2x+1!2x)+TCEx(2x+1!2x+1)i=TCEx(2x!2x+1))]TJ /F3 11.955 Tf 10.94 0 Td[(TCEx(2x+1!2x) (5) 108

PAGE 109

UsingEquation 5 5 and 5 ,weget: Hist(2x+1))]TJ /F5 11.955 Tf 10.95 0 Td[(g(2x,2x+1)Pr(2x+1!2x+1)=g(2x,2x+1)Pr(2x!2x+1) (5) Solvingforg(2x,2x+1)usingEquation 5 and 5 ,weget: g(2x,2x+1)=(n+1)Hist(2x+1) (Pc2x+nPc2x+1) (5) SimplifyingusingEquation 5 5 and 5 ,weget: g(2x,2x+1)=(n+1)Hist(2x+1)coetotal Hist(2x)+nHist(2x+1) (5) IfwesolveEquation 5 inasimilarway,wegetanothervalueofg(2x,2x+1)as: g(2x,2x+1)=(n+1)Hist(2x)coetotal nHist(2x)+Hist(2x+1) (5) LetEquation 5 berepresentedasg(2x,2x+1)aandEquation 5 asg(2x,2x+1)bforconvenience. Theorem3. Theestimatedstoppointforpair(2x,2x+1),g(2x,2x+1)min,istheminimumofg(2x,2x+1)aandg(2x,2x+1)b. g(2x,2x+1)min=minng(2x,2x+1)a,g(2x,2x+1)bo Proof. LetthemaximumcoefcientindexberepresentedbyIndexmax.Themaximumindexvalueisequaltothemaximumnumberofeligiblecoefcientsintheimage.Hence, Indexmax=coetotal Anystoppoint,g(2x,2x+1)cannotexceedthetotalnumberofcoefcients.Hence g(2x,2x+1)aIndexmax=)g(2x,2x+1)acoetotal UsingEquation 5 and 5 andsubstitutingforg(2x,2x+1)a,weget (n+1)Hist(2x+1)coetotal Hist(2x)+nHist(2x+1)coetotal(5) SimplifyingEquation 5 ,weget 109

PAGE 110

Hist(2x)Hist(2x+1)(5) AddingnHist(2x)onbothsides,weget, nHist(2x)+Hist(2x)Hist(2x+1)+nHist(2x) (5) =)(n+1)Hist(2x) Hist(2x+1)+nHist(2x)1=)(n+1)Hist(2x) Hist(2x+1)+nHist(2x)coetotalcoetotal (5) FromEquation 5 ,L.H.S.oftheaboveequationisg(2x,2x+1)bandR.H.S.isIndexmax. )g(2x,2x+1)bIndexmax,whichisnotvalid. Similarly,usingg(2x,2x+1)basthestartingpointforproof,weget g(2x,2x+1)aIndexmax Wenowknowthatoneoftheg(2x,2x+1)willbegreaterthanorequaltothecoetotal.Hence,thesmalleroneofthetwoisthelegitimatevalue.Hence,g(2x,2x+1)canbewrittenas g(2x,2x+1)min=minng(2x,2x+1)a,g(2x,2x+1)bo(5) Henceproved. Fromtheabove,weconcludethatthestoppointforthepair(2x,2x+1)wouldlikelybethecoefcientindexatwhichthecurrentvalueofg(2x,2x+1)satises 5 5.6.2CapacityEstimation Theestimatedembeddingcapacity,Est(2x,2x+1),forcoefcientpair(2x,2x+1)is:Est(2x,2x+1)=TCEx(2x!2x+1)+TCEx(2x!2x)+TCEx(2x+1!2x)+TCEx(2x+1!2x+1)Bits (5) 110

PAGE 111

SimplifyingEquation 5 andusingthevalidg,weget Est(2x,2x+1)=g(2x,2x+1)minhPc2x+Pc2x+1iBits (5) Since,wechangea1to0andvice-versawithoutanycompensation,theestimatedcapacityoftriplet(-1,0,1),Est()]TJ /F4 11.955 Tf 9.28 0 Td[(1,0,1),wouldbehHist()]TJ /F4 11.955 Tf 9.29 0 Td[(1)+Hist(0)+Hist(1)i. Totalexpectedcapacityincludingnegativecoefcientsand()]TJ /F4 11.955 Tf 9.29 0 Td[(1,0,1)tripletis: Esttotal=NegativeCoefcientpairsCapacity+Est()]TJ /F4 11.955 Tf 9.29 0 Td[(1,0,1)+Positivecoefcientcapacity.Esttotal=coeth=2x=1hg()]TJ /F4 11.955 Tf 9.29 0 Td[(2x,)]TJ /F4 11.955 Tf 9.29 0 Td[(2x)]TJ /F4 11.955 Tf 10.95 0 Td[(1)min(Pc)]TJ /F19 8.966 Tf 6.96 0 Td[(2x+Pc)]TJ /F19 8.966 Tf 6.96 0 Td[(2x)]TJ /F19 8.966 Tf 6.97 0 Td[(1)i+hHist()]TJ /F4 11.955 Tf 9.29 0 Td[(1)+Hist(0)+Hist(1)i+coeth=2x=1hg(2x,2x+1)min(Pc2x+Pc2x+1)iBits (5) LetMEbethetotalnumberofmessagebits.Since,weareusingmatrixembeddingwithcode(1,n,k),wecanrewriteEquation 5 as: Esttotal ME=n kwheren=2k)]TJ /F4 11.955 Tf 10.95 0 Td[(1 (5) Theappropriatevalueofnandkcanbethendeterminedbyiteratingovereachvalueofk1tillEsttotal MEn k.InthepreviouscalculationswedidnotconsiderthepositionofindividualcoefcientsintheDCTarray.WecanrewriteEquation 5 as: Esti(2x,2x+1)=gi(2x,2x+1)minhPci2x+Pci2x+1iBits (5) whereEsti(2x,2x+1)representstheestimatedcapacityofcoefcientpair(2x,2x+1)occurringatithindexoftheDCTarray.Esti(2x,2x+1)canbecalculatedoncethevalueofnisdeterminedfromEquation 5 111

PAGE 112

5.7Results ThealgorithmwasimplementedinJavawhichincludescodeto,1)decodeaJPEGimagetogettheJPEGcoefcients,2)embeddataineligiblecoefcients,3)balancethedualhistogramstotheiroriginalvalues,andnally,4)re-encodetheimageinJPEGformatwithmodiedcoefcientswhilepreservingtheoriginalquantizationtablesandotherpropertiesoftheimage.Testswereperformedon3000differentJPEGcolorimagesofvaryingsizeandtextureobtainedfromNationalGeographic.Figure 5-4 showssomeoftheimagesusedintheexperiments.Everyimagewasembeddedwithrandomdatabitsusingarandomlygeneratedpassword.Thepasswordisusedtogeneratedthepseudorandomnumbersequencefordeterminingthetraversalsequenceforcoefcients. Figure5-4. SomesampleimagesusedforJ4experiments. 112

PAGE 113

5.7.1IncreaseIn1,-1and0Coefcients J4doesn'tcompensateforchangesmadeto-1,1and0coefcients.However,asmentionedearlier,theratioofthetotalnumberof1and-1coefcientsismaintainedinordertoretaintheshapeofthehistogramandreducedetection.J4doesn'tmakechangestoany0,1and-1coefcientswhichareoutsidetheIndexthrange.Thisisdonetoensurewedon'tchangea0toa1intherightpartoftheDCTarraywheremostofthecoefcientsare0.Figure 5-5 showsthepercentageincreaseintotalnumberof1and-1coefcientsfor0.05bitspernonzerocoefcient.Thegureshowsthattheincreasein1and-1doesn'texceedmorethan2%ofitsinitialcount.Italsoshowsthattheincreaseisalmostidenticalinbothsincethelinesoverlapinmostoftheareas.Thisconrmsthattheratioof1and-1ismaintainedevenaftertheembeddingprocess.Thesecondaryaxisshowsthedecreaseinthenumberofzeros.Thetotalnumberofzeroswilldecreasesincethenumberofzerosismuchlargerthan1and-1andhence,morezeroswillchangetoeither1and-1ascomparedto1and-1beingchangedtozeros.Again,thepercentagedecreaseinnumberofzerosisbelow0.2percentwhichisalmostnegligible.Around3000imageswereusedforthisexperiment,butwehaveonlyshownarandomfractionofthemforsimplicity. 5.7.2EmbeddingEfciency Figure 5-6 showstheembeddingefciencyforbpnzof0.05,0.1,0.2and0.3.Efciencyisdenedastheaveragenumberofbitsembeddedperchange.Again,thesamplehasbeentakenfrom3000imagesbutonlyasmallnumberofthemhavebeenconsideredforclarityofthegraph.Theefciencyfor0.05bpnzisaround8whichmeanswecanembed8bitsofmessagebychangingjustonebit. 5.7.3PayloadAnalysis Figure 5-7 showstheactualamountofdataembeddedatbpnzof0.05and0.1.SteganalysisdiscussedinSection 5.8 wouldshowthatbpnzof0.5and0.1haveaverylowdetectionrate.ThisgraphshowshowmuchdatawecanembedinatypicalJPEG 113

PAGE 114

Figure5-5. Percentageincreaseanddecreasein1,-1and0coefcientsat0.05bpnz. imageswithoutbeingdetected.Asshown,wecanembed1KBofdataina64KBimagesor4KBofdatain240KBimages.Since240KBimagesisatypicalsizeforaJPEGimage,wecanembeddecentamountofinformationwithoutbeingdetectedbyanysteganalysisalgorithm.Thegraphalsoshowsthemaximumcapacitywhichistheamountofdatawecanembedwithfullhistogramrestoration.Butthedetectionrateswouldincreasedrasticallyatthemaximumratebecauseofsecondorderstatisticalchangestotheimage.Thesecondorderstatisticalchangesincludeinter-blockandintra-blockcorrelationswhichareverydifculttocompensateforinagivenimage.Thesharpriseandfallinthegraphisduetothenumberofnonzerosinthoseimages.Thefallinthecurveindicatesthatthenumberofnonzerosarelessthanthepreviousimagewhereariseindicatesanincreaseinthenonzeros.Nonzeroswillincreaseinimageswhichhavemorefeaturesandedgesinthemsuchasanimagewithlotsoftress.Thedecreaseindicatesanimagewithlessfeatureslikeaplainskyorimageswithlessedgesinthem. 114

PAGE 115

Figure5-6. EmbeddingefciencyofJ4atdifferentembeddingrates. 5.8SteganalysisOfJ4 SteganalysisexperimentsforJ4arebasedonSupportVectorMachines(SVM)forclassicationofimagesembeddedwiththefollowingstegoalgorithms:F5,nsF5(noshrinkageF5withwetpapercodes),Outguess,Steghide,MB1(model-basedwithoutblockiness),MB2(model-basedwithblockiness),PQ(PerturbedQuantization),PQT(TexturebasedPQ),PQE(Energy-basedPQ)andJ4alongwiththecoverimages.WeusesoftmarginSVM(C-SVM)withRBF(RadialBasisFunction)kernel,whichisoneofthemostpopularchoicesofkerneltypeforSVMs.WeuseLIBSVM[ 51 ]tool,whichisalibraryforSVMclassication.Theexperimentsuseafeatureextractorwhichextracts274mergedMarkovandDCTfeaturesforsteganalysisasmentionedin[ 35 ].WeusedthismergedfeatureextractorsinceitoutperformsDCTorMarkovbasedsteganalysisbyitself,asshownintheauthors'results. 5.8.1Pre-processingOfImagesForSteganalysis Thefollowingstepsarecarriedoutforallclassicationexperiments: 115

PAGE 116

Figure5-7. Actualbytesembeddedat0.05and0.1bpnz. 1. Embedequaldataintheimagesusingthegivenalgorithmswithaxedbpnz. 2. Extractthe274mergedfeaturesfromtheimages. 3. TransformtheextractedfeaturestotheLIBSVMformat. 4. Performsimplescalingonthetransformeddata. 5. Usecrossvalidation(gridsearch)tondthebest(C,g).WeuseacrossvalidationtoolprovidedintheLIBSVMlibraryforthispurpose. 6. Usetheoptimized(C,g)totraintherandomlychosentrainingset. 7. Performpredictiononthetestingdatausingthetrainedmodel.Trainingandtestingdataareexclusive. 8. Randomizethetrainingandtestingsetandrepeatsteps 6 and 7 .(C,g)remainsconstantthroughoutalltheiterations. 9. Calculatetheaverageresultfromalltheiterations. 3000JPEGcolorimageswithdifferenttextureandsizerangingfrom60KBto1000KBwereusedforthesteganalysisexperiment.Everyimagewasembeddedwithrandom 116

PAGE 117

datausingthe10abovementionedalgorithms.Attheendofembeddingprocess,wehave10setsofimagescontaining3000stegoimagesineachset.Eachsetconsistsofallthestegoimagesembeddedwithonlyoneofthe10algorithms.Wealsohaveonesetofcoverimageswithoutanyembedding.70%oftheimagesfromeachsetwereusedfortrainingandtherest30%wereusedfortesting.Thetrainingandtestingsetsaremutuallyexclusive.Weperformed100iterationsofeachexperimentbyrandomizingthetrainingandtestingdatatogetamoreaccurateresult. 5.8.2BinaryClassication Werstperformedabinaryclassicationwhereonlyoneofthestegosetsandthecoversetwereusedfortrainingandtesting.Weperformedthisbinaryclassicationforallthe10algorithms.Theclassicationexperimentwasperformedwith0.05,0.1,0.2and0.3bitspernon-zerocoefcients(bpnz).TheresultsareshowninTable 5-2 Table5-2. Comparisonofdetectionrate(in%)ofJ4withotheralgorithmsusingSVMbinary-classierwith0.05and0.1bpnz.TP=TruePositive,TN=TrueNegative,AR=AverageAccuracy. bpnz=0.05bpnz=0.1AlgorithmTPTNARTPTNAR J447.1051.5549.3358.2857.0857.68F593.4492.0692.7593.6192.8693.24Outguess97.8497.4597.6597.7997.6997.74Steghide83.2686.4184.8493.6695.2794.47nsF547.4348.2147.8259.1960.4059.80MB178.1376.6577.3992.9694.8793.92MB280.7482.4381.5993.5996.1694.88PQ97.1198.7897.9597.1898.8698.02PQT97.6798.1197.8997.7798.8498.31PQE98.1598.4598.3098.9598.7398.84 ResultsinTable 5-2 and 5-3 showthatJ4outperformsotheralgorithms(withtheexceptionofnsF5)byahugemarginintermsofdetectionratewithbpnzof0.05.nsF5doesn'tdoanycompensation.J4incursextracostbycompensatingforalltheindividualDCTmodes.AllthedualhistogramsareexactlythesameasthecoverimageinJ4.TruePositive(TP)herereferstothecorrectpredictionaccuracyforthestegoimages 117

PAGE 118

Table5-3. Comparisonofdetectionrate(in%)ofJ4withotheralgorithmsusingSVMbinary-classierwith0.2and0.3bpnz. bpnz=0.2bpnz=0.3AlgorithmTPTNARTPTNAR J476.4777.8377.1588.9987.9588.47F596.9496.9396.9498.5098.3098.40Outguess97.7397.5197.6297.6597.6497.65Steghide97.2497.6497.4498.4598.0998.27nsF583.7785.4884.6392.8093.7893.29MB197.3498.1897.7698.5298.9598.74MB297.4998.3797.93NANANAPQ98.3299.0598.6998.7699.2198.99PQT98.2399.1298.6899.7899.0199.40PQE98.5599.5499.0599.1498.9799.06 whereasTrueNegative(TN)referstothecorrectpredictionaccuracyofcoverimagesagainstthatparticularstegoalgorithm.Hence,thelowertheTPandTNare,thebetterthestegoalgorithmis.ResultsshowthattheSVMclassierwasonlyabletoclassify47%oftheimagesinJ4categoryat0.05bpnz.Itclassied51%oftheJ4imagesascoverimages,whichprovesthatJ4resemblesthecharacteristicsofacoverimagewhenthepayloadisless.Otheralgorithmsclassicationratewasmorethan80%onaverageatthesameembeddingrate.With0.1bpnz,J4hasatruepositiverateof58%whereasmostalgorithmshaveatruepositiverateofmorethan90%exceptnsF5.ItalsooutperformsnsF5byasmallmarginat0.1,0.2,and0.3bpnz.Since50%detectionrateisclassiedasarandomguess,adetectionrateof50-60%forJ4provesthatJ4couldbeanidealcandidateforaJPEGsteganographyalgorithm. 5.9Conclusion J4isanewJPEGsteganographyalgorithmthatusesLSBencodingtoembeddataandindividualandglobalhistogramcompensationtobalanceallthecoefcientschangedduringtheembeddingprocess.J4makeschangestothecoefcientsinawaythattheindividualhistogramsarepreservedasinthecoverimage.Thepreservationschemedoesnotapplyto1,0and-1coefcients.ThisisdonetoleveragethehighnumberofthesecoefcientsforincreasedefciencysinceJ4usesmatrixembeddingto 118

PAGE 119

decreasethenumberofcoefcientchanges.Allthecoefcientsexcept1,0and-1arechangedinpairs.ThetheoreticalestimationensuresthatenoughcoefcientsareleftaftertheembeddingprocesstocompensateforthechangestothecoefcientsateachindexpositionintheDCTarray. WecomparedJ4with9popularalgorithms:F5,nsF5,Steghide,OutGuess,MB1,MB2,PQ,PQTandPQE.ExtensivesteganalysisperformedonthesealgorithmsprovethatdetectionrateofJ4isaround47%,58%,76%and88%at0.05,0.1,0.2and0.3bitspernon-zerocoefcients(bpnz),respectively.Ontheotherhand,theaveragedetectionrateofotheralgorithmsexceptnsF5were90%,95%,97%and98%forthesamebpnz.Thedetectionrateforotheralgorithmswerearound40%higheronaveragecomparedtoJ4.nsF5performsequallywellasJ4at0.05bpnzbutJ4outperformsnsF5withasmallmarginathigherembeddingrates.Moreover,nsF5doesn'tdoanycompensationincontrasttoJ4.Since,50-60%detectionisclassiedasrandomguessinSVMclassication,theresultsprovethatJ4wouldbeanidealcandidateforembeddingdataatlowrates. Thesteganalysismethodwasbasedon3000colorJPEGimagesdownloadedfromNationalGeographicwebsite.The274mergedDCTandMarkovfeatureextractorusedforsteganalysiswasthebestavailableatthetimeofwritingthisarticleindetectionaccuracy,asclaimedbytheauthorsin[ 35 ].Although,thesteganalysismethod(featureextractor)intheexperimentsusesbothrstandsecondorderstatisticstodetectanomaliesandJ4isarst-orderrestorationscheme,itisstillabletoperformextremelywellonlowerdataratesandbeatthissteganalysissystem. 119

PAGE 120

CHAPTER6HIGHPERFORMANCESTEGANALYSISUSINGTWOSTEPMARKOVMODEL 6.1Introduction Inthepreviouschapters,wetalkedaboutthreenewsteganographyschemestohidedata.J3andJ4wereabletohidedatawithhighstealthinessascomparedtootheralgorithms.Thischapterprovidestheothersideofthestory,i.e.steganalysis.Anewmethodofblindsteganalysishasbeenproposedinthischapterwhichdetectsstegoandcoverimageswithgreataccuracy.Secondorderstatisticalsteganalysisprovidesagreatmethodtodetectstegoimages.ThereasonbehindthisisduetothestatisticalcorrelationamongsttheDCTcoefcientsaswellastheneighboringDCTblocksthemselves.ThesteganalysismethodproposedinthischapterusestwostepMarkovmodeltondthecorrelationbetweenDCTblocksandcoefcientsusinga2-steptransitionprobabilitymatrix.Globalanddualentropyhavealsobeenusedtondthechangeintheentropywhenthecoefcientsaremodied.TherstandsecondorderstatisticaldifferencesbetweenagivenimageanditsestimatedcoverimagehasbeenusedasthefeaturesetfortheSVMclassierwhichclassiesimagesintostegoandcovercategories. 6.2AnalyzingFeatures ThemethodtoextractMarkovfeaturesfromtheJPEGimagesforsteganalysiswasrstdemonstratedbyShietal.[ 34 ].TheauthorscalculatedthedifferencematricesusingtheneighboringblockofDCTcoefcients.Thedifferencesmatriceswerethenusedtoformonesteptransitionprobabilitymatrices.Since,somedifferencecanbelargewhichcouldresultinalargenumberoffeatures,theyusedathresholdof[-4,4]tolimitnumberoffeatures.Anyvaluesoutsidethisrangeinthedifferencematrixwereclippedto[-4,4].Hencethenumberoffeatureswouldbelimitedto9x9=81features.Sincetheyusedfourtransitionmatricesforfourdirections,thetotalnumberoffeatureswouldbe81x4=324.Thefeaturesextractedfromasetofcoverandstegoimageswere 120

PAGE 121

thenusedtotrainandtestthedatausingaSVMclassier.Pevnyetal.[ 35 ]improveduponthedetectionratebyaddingtheDCTfeaturesalongwiththeMarkovfeatures.Toreducethenumberoffeatures,theytookanaverageofthefeaturesfromthefourmatriceslimitingthetotalnumberto81.TheDCTandmarkovfeaturesresultedinanoverall274features.Theproposedsteganalysismethodisbasedonasimilarideawheretwostepinterandintrablocktransitionprobabilitymatriceshavebeenusedforamorereneddetectionrate.Thefeaturesusedinthisnewsteganalysismethodhavebeendiscussedinthefollowingsections. 6.2.1Inter-blockTransitions Inter-blocktransition,asthenamesuggests,aimstondcorrelationsbetweentheneighboringblocksbycalculatingthetransitionprobabilityofJPEGcoefcientsinhorizontal,vertical,anddiagonaldirections.SincetheneighboringblocksinatypicalJPEGimageexhibitsimilarproperties,anychangeinthesecoefcientswillviolatethecorrelationamongstthem.ConsiderapartofimagewhereDCTblockarearrangedasinthenaturalimage.LetBu,Bvbethetotalnumberofblocksinhorizontalandverticaldirectionrespectively,whereBu=widthofImage/8,Bv=heightofimage/8.Toillustratethemethodandforsimplicity,weconsiderafewneighboringblocksarrangedintheimagewhereC(x,y)(i,j)representsacoefcientatithrowandjthcolumnforblockatxthrowandythcolumnintheimage.where0(i,j)8,1xBv,1yBu.C(x,y)(i,j)C(x,y+1)(i,j)C(x,u)(i,j)C(x+1,y)(i,j)C(x+1,y+1)(i,j)C(x+1,u)(i,j)C(v,y)(i,j)C(v,y+1)(i,j)C(v,u)(i,j) Wecalculatethedifferencematricesinthehorizontal,vertical,majordiagonalandminordiagonaldirections.Thehorizontaldifferencematrixfortheabovematrixwouldbe: 121

PAGE 122

C(x,y)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(x,y+1)(i,j)C(x,y+1)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(x,y+2)(i,j)C(x,u)]TJ /F19 8.966 Tf 6.97 0 Td[(1)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(x,u)(i,j)C(x+1,y)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(x+1,y+1)(i,j)C(x+1,y+1)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(x+1,y+2)(i,j)C(x+1,u)]TJ /F19 8.966 Tf 6.97 0 Td[(1)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(x+1,u)(i,j)C(v,y)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(v,y+1)(i,j)C(v,y+1)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(v,y+2)(i,j)C(v,u)]TJ /F19 8.966 Tf 6.97 0 Td[(1)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(v,u)(i,j) Theinter-blockdifferencematrixshownaboveisforcoefcientatindexi,jonly.Thedifferencematricesarecalculatedforallthecoefcientindices,i.e.63positions.TherstindexisignoresinceDCcoefcientsareleftuntouchedbymodernJPEGsteganography.Verticaldifferencematrixwouldbe: C(x,y)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(x+1,y)(i,j)C(x,y+1)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(x+1,y+1)(i,j)C(x,u)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(x+1,u)(i,j)C(x+1,y)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(x+2,y)(i,j)C(x+1,y+1)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(x+2,y+1)(i,j)C(x+1,u)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(x+2,u)(i,j)C(v)]TJ /F19 8.966 Tf 6.96 0 Td[(1,y)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(v,y)(i,j)C(v)]TJ /F19 8.966 Tf 6.97 0 Td[(1,y+1)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(v,y+1)(i,j)C(v)]TJ /F19 8.966 Tf 6.97 0 Td[(1,u)(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(v,u)(i,j) Similarly,wecalculatethediagonalandminordiagonaldifferencematrices.LetF(u,v)representaDCTblockatuthcolumnandvthrowforacoefcientataparticularindex.Thedifferencesaretakenbetweenneighboringblocksforeachcoefcientindex.Inotherwords,thefourdifferencematrices,horizontal,vertical,diagonalandminordiagonal(denotedasFh(u,v),Fv(u,v),Fd(u,v),Fm(u,v)respectively),arecalculatedasfollows:Fh(u,v)=F(u,v))]TJ /F3 11.955 Tf 10.95 0 Td[(F(u+1,v)Fv(u,v)=F(u,v))]TJ /F3 11.955 Tf 10.95 0 Td[(F(u,v+1)Fd(u,v)=F(u,v))]TJ /F3 11.955 Tf 10.95 0 Td[(F(u+1,v+1)Fm(u,v)=F(u,v))]TJ /F3 11.955 Tf 10.95 0 Td[(F(u)]TJ /F4 11.955 Tf 10.95 0 Td[(1,v+1) 122

PAGE 123

Inordertolimitthenumberoffeatures,weapplyathresholdtothevaluesinthedifferencematrices.Thethresholdisappliedtovaluesoutsidetherange[-3,3],i.e.,anyvalueoutsidethisrangeisconvertedtothenearestthresholdvalue.Forexample,anyelementinthematrixhavingavaluegreaterthan3willbeconvertedto3.Similarly,valuessmallerthan-3willbeconvertedto-3.Fromthefourdifferencematrices,wecalculatethefourtwosteptransitionprobabilitymatrices,Mh,Mv,Md,Mm:Mh(i,j,k)=Bu)]TJ /F19 8.966 Tf 6.97 0 Td[(3u=1Bvv=1dFh(u,v)=i,Fh(u+1,v)=j,Fh(u+2,v)=k Bu)]TJ /F19 8.966 Tf 6.97 0 Td[(2u=1Bvv=1dFh(u,v)=i,Fh(u+1,v)=jMv(i,j,k)=Buu=1Bv)]TJ /F19 8.966 Tf 6.97 0 Td[(3v=1dFv(u,v)=i,Fv(u,v+1)=j,Fv(u,v+2)=k Buu=1Bv)]TJ /F19 8.966 Tf 6.97 0 Td[(2v=1dFv(u,v)=i,Fv(u,v+1)=jMd(i,j,k)=Bu)]TJ /F19 8.966 Tf 6.97 0 Td[(3u=1Bv)]TJ /F19 8.966 Tf 6.97 0 Td[(3v=1dFd(u,v)=i,Fd(u+1,v+1)=j,Fd(u+2,v+2)=k Bu)]TJ /F19 8.966 Tf 6.96 0 Td[(2u=1Bv)]TJ /F19 8.966 Tf 6.97 0 Td[(2v=1dFd(u,v)=i,Fd(u+1,v+1)=jMm(i,j,k)=Buu=3Bv)]TJ /F19 8.966 Tf 6.97 0 Td[(3v=1dFm(u,v)=i,Fm(u)]TJ /F4 11.955 Tf 10.95 0 Td[(1,v+1)=j,Fm(u)]TJ /F4 11.955 Tf 10.95 0 Td[(2,v+2)=k Buu=2Bv)]TJ /F19 8.966 Tf 6.97 0 Td[(2v=1dFm(u,v)=i,Fm(u)]TJ /F4 11.955 Tf 10.95 0 Td[(1,v+1)=j whereBuandBvdenotethewidthandheightofimageintermsofblocks,i.e.,thenumberofblocksinhorizontalandverticaldirection.d=1iftheargumentsaresatises.Whattheaboveequationdoesistondallthe2steptransitionsinthematrixforaparticularnumbersanddividethatwiththetotalnumberofoccurrencewhichledtothattransition.Forexample,ifthetherearetotalofxtransitionsfor1)]TJ /F15 11.955 Tf 12.16 0 Td[(>2)]TJ /F15 11.955 Tf 12.15 0 Td[(>1andatotalofytransitionsfor1)]TJ /F15 11.955 Tf 11.95 0 Td[(>2,thentheprobabilitytransitionM(1,2,1)wouldbex/y. Toreducethenumberoffeatures,wetakeanaverageofthetransitionmatrices.Theaverageofthefourinter-blocktransitionmatrixisdenotedby: M=Mh+Mv+Md+Mm 4 (6) Theinter-blocksfeaturesarecalibratedbeforebeingusedforsteganalysis.Thecalibrationisdonebytakingthefeaturedifferencesofthecroppedimagewiththe 123

PAGE 124

originalimage.Agivenimageisrstconvertedtospatialdomain,croppedby4rowsand4columnsandthenre-encodedintheJPEGformat.Theideaistoestimatethecoverimagefromthegivenimage.Bycroppingandre-encodingtheimage,wecanobtainasmootherDCTmatrixoftheimage.Thiscroppedimagewhencomparedtothegivenimageswillhavemoredifferencesiftheimagewasmodiedtoembeddata.Ifthegivenimagewasnotmodiedinanyway,thedifferencebetweentheimageanditscroppedversionwouldnothavesignicantdifferencesintheirfeatures.TheestimationofcoverimageisillustratedinFigure 6-1 Figure6-1. Illustrationofcoverimageestimationbycropping4rowsand4columnsfromthetopleft. LettheinterblockaveragefeaturesofthegivenimageberepresentedbyMo.Let,theinterblockfeaturesofthecroppedimageberepresentedbyMc.Thenalfeatures,representedby M,arecalculatedbytakingthedifferenceofthesetwoaveragematrices.Mo=Moh+Mov+Mod+Mom 4 (6)Mc=Mch+Mcv+Mcd+Mcm 4 (6) Minter=Mo)]TJ /F20 11.955 Tf 10.94 0 Td[(Mc (6) whereoandcsuperscriptsforMoandMcrepresentthefeaturematricesoftheoriginalandtheestimatedcoverimage.Since,thetransitionmatricesrepresentatransitionintherange[-3,3],totalnumberoffeaturesfromthistransitionmatrixwouldbe7x7x7=343. 124

PAGE 125

6.2.2Intra-blockTransitions Intra-blocktransitionscorrespondtothetransitionstakingplacewithinaDCTblock.DCTblocksinaJPEGimagehaveadenedpattern.IfthecoefcientsinsidetheseDCTblocksarechangestoembeddata,thesecorrelationsaredistortedleadingtoanomaliesintheoverallstatisticalcorrelation.TondthecorrelationbetweenthecoefcientsinaDCTblock,wetakethedifferencebetweentheneighboringcoefcientsandthencalculatethetransitionprobabilitymatricesfromthem.Thedifferencesaretakeninallfourdirectionsforeach8x8DCTblock.Thedifferencematricesarecalculatedforeachblockwhicharethenlatertransformedtotransitionprobabilitymatrix.LetC(i,j)beacoefcientatithcolumnandjthrowofa8x8DCTblock.Thecalculationofhorizontaldifferencematrixisdemonstratedbelow:C(1,1))]TJ /F3 11.955 Tf 10.95 0 Td[(C(2,1)C(2,1))]TJ /F3 11.955 Tf 10.95 0 Td[(C(3,1)C(7,1))]TJ /F3 11.955 Tf 10.95 0 Td[(C(8,1)C(1,2))]TJ /F3 11.955 Tf 10.95 0 Td[(C(2,2)C(2,2))]TJ /F3 11.955 Tf 10.95 0 Td[(C(3,2)C(7,2))]TJ /F3 11.955 Tf 10.95 0 Td[(C(8,2)C(1,8))]TJ /F3 11.955 Tf 10.95 0 Td[(C(2,8)C(2,8))]TJ /F3 11.955 Tf 10.95 0 Td[(C(3,8)C(7,8))]TJ /F3 11.955 Tf 10.95 0 Td[(C(8,8) Thevertical,diagonalandminordiagonalmatricesforeachblockarecalculatedinasimilarwaywherewesubtracttheelementsverticallyanddiagonallyinsteadofhorizontally.IfCh,Cv,CdCmdenotethehorizontal,vertical,majordiagonalandminordiagonalmatricesrespectively,thenCh(i,j)=C(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(i+1,j)Cv(i,j)=C(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(i,j+1)Cd(i,j)=C(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(i+1,j+1)Cm(i,j)=C(i,j))]TJ /F3 11.955 Tf 10.95 0 Td[(C(i)]TJ /F4 11.955 Tf 10.95 0 Td[(1,j+1) Wealsoapplyathresholdof[-3,3]fortheseintra-blockdifferencematricestolimitthenumberoffeatures.Thetransitionprobabilitymatricesarethencalculatedfromthe 125

PAGE 126

differencematrices.Wecalculateatwosteptransitionprobabilitymatrixbecauseitcanndabettercorrelationbetweentheneighboringcoefcients.LetTh,Tv,Td,Tmdenotethesematricesinthefourdirections:Th(i,j,k)=Btb=16u=18v=1dCh(u,v)=i,Ch(u+1,v)=j,Ch(u+2,v)=k Btb=17u=18v=1dCh(u,v)=i,Ch(u+1,v)=jTv(i,j,k)=Btb=18u=16v=1dCv(u,v)=i,Cv(u,v+1)=j,Cv(u,v+2)=k Btb=18u=17v=1dCv(u,v)=i,Cv(u,v+1)=jTd(i,j,k)=Btb=16u=16v=1dCd(u,v)=i,Cd(u+1,v+1)=j,Cd(u+2,v+2)=k Btb=17u=17v=1dCd(u,v)=i,Cd(u+1,v+1)=jTm(i,j,k)=Btb=18u=36v=1dCm(u,v)=i,Cm(u)]TJ /F4 11.955 Tf 10.95 0 Td[(1,v+1)=j,Cm(u)]TJ /F4 11.955 Tf 10.95 0 Td[(2,v+2)=k Btb=18u=27v=1dCm(u,v)=i,Cm(u)]TJ /F4 11.955 Tf 10.95 0 Td[(1,v+1)=j whereBtdenotesthetotalnumberofDCTblockintheJPEGimage,d=1iftheconditionsmatch. Similartointer-blocktransitionmatrixfeaturecalculation,wecalibratethefeatureswiththehorizontaldifferencematricestoo,i.e.,wetakethedifferenceofthetransitionmatrixforthegivenimagewiththatofthecroppedimage.LettheintrablockaveragefeaturesofthegivenimageberepresentedbyTo.Let,theintrablockfeaturesofthecroppedimageberepresentedbyTc.Thenalfeatures,representedby T,arecalculatedbytakingthedifferenceofthesetwoaveragematrices.To=Toh+Tov+Tod+Tom 4 (6)Tc=Tch+Tcv+Tcd+Tcm 4 (6) Tintra=To)]TJ /F20 11.955 Tf 10.95 0 Td[(Tc (6) whereoandcsuperscriptinToandTcrepresenttheintrablockfeaturematricesoftheoriginalimageandtheestimatedcoverimage.Since,thethresholdissetto[-3,3],totalnumberoffeaturesfromthistransitionmatrixwouldbe7x7x7=343. 126

PAGE 127

6.2.3GlobalEntropy Entropyofanimageisameasureoftheinformationcontentororderlinessofanimage.Thisentropymeasurestheorderlinessforagivenimagewiththatofitsestimatedcoverimage.Hence,wecomparethedifferenceoftheentropyofthegivenimagewithitsestimatedcoverimage.Theestimationofthecoverimagefromthegivenimageisdonebycropping4rowsand4columnsoftheimageinthespatialdomainandre-encodingitbacktothefrequencydomain.Letp(x)betheprobabilityofoccurrenceofsomecoefcientxoveralltheDCTmatrices.p(x)=Btb=18u=18v=1d)]TJ /F3 11.955 Tf 5.47 -9.69 Td[(C(u,v)=x 64Bt (6) Theoverallentropy,Et,ofthegivenimageisthencalculatedas:Et=)]TJ /F19 8.966 Tf 20.23 12.77 Td[(10x=)]TJ /F19 8.966 Tf 6.97 0 Td[(10p(x)log2p(x) (6) Weonlyconsiderthecoefcientvaluesintherange[-10,10]sincemostofthecoefcientchangedinastegoprogramfallwiththisrange.Thisentropyiscalculateforthegivenimage,denotedbyEtoanditsestimatedcoverimage,denotedbyEtc.Thedifferenceofthesetwoentropyisusedasafeatureinthisalgorithm. Et=Eto)]TJ /F3 11.955 Tf 10.95 0 Td[(Etc (6) 6.2.4DualEntropy Dualentropyisdenedastheentropyoftheimageforagivenindexlocationinthe8x8DCTmatrices.Thedualentropyforindex(u,v),denotedbyEt(u,v),istheentropyoftheimageconsideringalltheDCTcoefcientwhicharelocatedatindex(u,v)intheDCTmatrix.Letp(x,c,v)betheprobabilityofthecoefcientxoverallthecoefcientsat 127

PAGE 128

index(u,v).Followingequationshowsthefeaturecalculationfordualentropy.p(x,u,v)=Btb=1d)]TJ /F3 11.955 Tf 5.48 -9.69 Td[(C(u,v)=x Bt (6)Et(u,v)=)]TJ /F19 8.966 Tf 20.24 12.77 Td[(10x=)]TJ /F19 8.966 Tf 6.97 0 Td[(10p(x,u,v)log2p(x,u,v) (6) Et(u,v)=Eto(u,v))]TJ /F3 11.955 Tf 10.95 0 Td[(Etc(u,v) (6) Weonlycalculatethedualentropyfortherst10locationinthe2-DDCTarrayexcludingtheDCcoefcient,i.e.,wecalculatetheentropyforlocations(1,1),(1,2),(1,3),(2,1),(2,2),(3,3),(3,1),(3,2),(3,3),(1,4)inthe2-D8x8DCTmatrix,where(u,v)representcolumnandrowrespectively. 6.3SummaryOfFeatures ThefeaturessetfortheproposedsteganalysissystemisshowninTable 6-1 .Thisfeaturesetincludestheglobalentropy,dualentropyforindividualcoefcientpositions,2-stepinter-blocktransitionand2-stepintra-blocktransitionmatrices.Thethresholddeterminesthesizeofthetransitionprobabilitymatrices.Thethresholdof[-2,2]hasalsobeenincludedsincethatwillgreatlyreducethenumberoffeaturesfrom697to261forsteganalysis. Table6-1. Summaryoffeaturesetsfortheproposedsteganalysissystem. DimensionalityFeatureThreshold=[-2,2]Threshold=[-3,3] GlobalEntropy, Et11DualEntropy, Et(u,v)10102-stepintra-blockMarkovfeatures, Tintra7x7x7=3435x5x5=1252-stepinter-blockMarkovfeatures, Minter7x7x7=3435x5x5=125TotalFeatures697261 6.4Results Asetof3000imageswereusedforthesteganalysisexperimentswhereaSVMclassierwasusedtotrainandpredictthegivensetofimages.Theimagesarerstembeddedwithrandomdatawithatthesamebpnzusingallthealgorithms. 128

PAGE 129

Thefeaturesarethenextractedfromtheseimageswhichareusedfortrainingandclassifyingtheimages.50%oftheimageswereusedfortrainingwhiletherestwereusedfortestingtheimages.Thetrainingandtestingsetsaremutuallyexclusive.Foreachexperiment,100iterationwereperformedwherethetrainingandtestingsetsarerandomlypickedfromthewholeset.TheresultsareshowninTables 6-2 6-3 and 6-4 forbpnzof0.05,0.1and0.2respectively.TheresultsoftheproposedsteganalysismethodhavebeencomparedagainstthestateofartsteganalysisproposedbyFridrichetal.[ 35 ]whichuses274features. Table6-2. Comparisonofdetectionrate(in%)ofalgorithmsusingSVMbinary-classierwith0.05bpnz.TP=TruePositive,TN=TrueNegative,AR=AverageAccuracy. Fridrich's ProposedTh=[)]TJ /F4 11.955 Tf 9.29 0 Td[(2,2] ProposedTh=[)]TJ /F4 11.955 Tf 9.29 0 Td[(3,3]Algorithm TPTNAR TPTNAR TPTNAR J3 59.7943.2451.51 43.4739.3341.40 91.0993.7692.38J4 47.1051.5549.33 54.0056.0055.00 91.0191.4791.23F5 93.4492.0692.75 96.8789.6093.23 98.1895.6496.91Outguess 97.8497.4597.65 97.3397.2797.30 99.3399.3399.33Steghide 83.2686.4184.84 71.8065.0068.40 88.9187.9488.42nsF5 47.4348.2147.82 52.5342.1347.33 38.4234.9736.70MB1 78.1376.6577.39 73.0062.7367.86 82.1278.6180.36MB2 80.7482.4381.59 65.4057.4061.40 82.8579.9481.40PQ 97.1198.7897.95 99.0799.2099.13 99.6099.8099.70PQT 97.6798.1197.89 98.6098.6498.62 99.3999.3999.39PQE 98.1598.4598.30 98.9398.8798.90 99.8099.9999.90 Table 6-2 showsthattheproposedsteganalysissystemhasabetterdetectionrateascomparedtotheFridrich'sforallthealgorithmsexceptnsF5.Itisalsoabletodetecttheproposedsteganographicsystems,J3andJ4,withgreataccuracy.Fridrich'ssystemcandetectJ3andJ4withonly50-60%accuracywhereastheproposedsystemcandetectitwithmorethan90%accuracyevenat0.05bpnz.For0.1bpnz,asshowninTable 6-3 ,theproposedsystemcandetectJ3andJ4with94%accuracyascomparedto60-70%accuracywithFridrich'smethod.Thetablesalsoshowtheproposedmethodwith[-2,2]thresholdwhichdoesn'tperformaswellaswiththresholdof[-3,3]except 129

PAGE 130

Table6-3. Comparisonofdetectionrate(in%)ofalgorithmsusingSVMbinary-classierwith0.1bpnz. Fridrich's ProposedTh=[)]TJ /F4 11.955 Tf 9.29 0 Td[(2,2] ProposedTh=[)]TJ /F4 11.955 Tf 9.29 0 Td[(3,3]Algorithm TPTNAR TPTNAR TPTNAR J3 75.3576.1475.68 64.0056.9360.46 94.0094.4894.24J4 58.2857.0857.68 66.0065.3365.66 92.7291.3092.01F5 93.6192.8693.24 97.2791.0094.13 97.3394.6295.97Outguess 97.7997.6997.74 96.5397.9397.23 99.4298.6599.03Steghide 93.6695.2794.47 90.4790.6790.57 96.0094.9195.45nsF5 59.1960.4059.80 59.4747.1353.30 53.7051.2152.45MB1 92.9694.8793.92 86.8784.4085.63 93.3995.9094.64MB2 93.5996.1694.88 84.4784.5384.50 92.6194.5593.58PQ 97.1898.8698.02 99.2799.2099.23 99.4499.3199.37PQT 97.7798.8498.31 99.3398.3398.83 99.5899.5899.58PQE 98.9598.7398.84 98.9098.6798.78 99.2899.7199.50 Table6-4. Comparisonofdetectionrate(in%)ofalgorithmsusingSVMbinary-classierwith0.2bpnz. Fridrich's ProposedTh=[)]TJ /F4 11.955 Tf 9.29 0 Td[(2,2] ProposedTh=[)]TJ /F4 11.955 Tf 9.29 0 Td[(3,3]Algorithm TPTNAR TPTNAR TPTNAR J3 96.3897.4796.92 90.8088.9389.86 97.8897.8297.85J4 76.4777.8377.15 85.2082.5383.86 93.8794.6794.27F5 96.9496.9396.94 96.6095.6796.13 97.0098.0097.50Outguess 97.7397.5197.62 96.7398.2097.46 99.4798.8099.13Steghide 97.2497.6497.44 97.4796.6797.07 98.8096.1397.46nsF5 83.7785.4884.63 78.5377.7378.13 90.5392.2791.40MB1 97.3498.1897.76 93.8096.4795.13 96.6797.8797.27MB2 97.4998.3797.93 93.5996.1694.87 98.5697.4598.00PQ 98.3299.0598.69 98.8798.8098.83 99.3399.4799.40PQT 98.2399.1298.68 98.7798.8498.80 99.4699.5499.50PQE 98.5599.5499.05 98.9298.7498.83 99.5499.1299.31 fornsF5.However,thenumberoffeaturesarealmostonethirdfor[-2,2]thresholdascomparedto[-3,3]threshold.Hence,thecomputationalcomplexityislesswithlowernumberoffeatures.Theproposedmethodwith[-2,2]thresholdisabletogivegoodperformancewithotheralgorithmsexceptJ3andJ4. 6.5Conclusion Thischapterproposedanewsteganalysissystemwherea2-stepMarkovmodelwasusedasfeaturesetforblindsteganalysis.Existingtechniqueshavefocussed 130

PAGE 131

ononestepMarkovmodelandDCTfeatures.Theproposedmethodtakesthisideaonestepfurthertoextractfeaturesbasedon2-steptransitionprobabilitymatrices.The2-stepMarkovfeaturesarebasedonbothintraandinter-blocktransitionsinhorizontal,vertical,diagonalandminordiagonaldirection.Since,neighboringblocksandcoefcientsinaDCTmatrixarerelatedtoeachother,achangeinthesecoefcientswouldresultinstatisticalanomalies.TheMarkovstatisticalfeaturesarerstextractedfromthegivenimageandthencomparedagainstthestatisticsoftheestimatedcoverimage.Thisdifferencewouldbegreaterforastegoimagewherecoefcientshavebeenchangedascomparedtoacoverimage(withoutanycoefcientchange). 3000imageswereusedfortheexperimentwhichconsistedofextractingthefeaturesfromagivenimagesetembeddedwithdifferentalgorithms.ThesefeatureswerethenusedwithaSVMclassierfortrainingandtestingwhere50%oftheimageswereusedfortrainingandtherestfortesting.TheresultsshowthattheproposedsteganalysisalgorithmoutperformsFridrichetal'sstateofartsteganalysisalgorithmwhichuses274DCTandMarkovfeatures.Fridrichetal'smethodwasthestateofartsteganalysistoolbeforethisproposedalgorithm.ItoutperformsFridrich'smethodinallcasesexceptnsF5wheretheproposedalgorithm'sdetectionratewasaround36%at0.05bpnz.Thehighperformanceofthisalgorithmsshowsthatitcanbeusedasanimportanttoolintheworldofsteganalysisforblinddetectionofstegoimages. 131

PAGE 132

CHAPTER7CONCLUSION Steganographyhasbeenwidelyusedinhistoricaltimesandthepresentday.InworldwarII,Frenchusedtheinvisibleinktoexchangemessages.Steganographyhasalsobeenusedinrecenttimestohidedatainsideimagesandpostthoseimagesonacommonwebsitesothattherelevantreceivercandownloadtheimageandextractthesecretmessage.Somepeopleclaimthepresenceofsteganographyimagesonebayalthoughthereisnodeniteproofofthat.Steganographyhasalsobeenprimarilyusedbythedefenseorganizationstopassinformationtotheiragents.Theadvantageofsteganographyovercryptographyisthatitdoesn'traiseanysuspicionandthemessagecanbeexchangedoverapubliccommunicationchannel.Whencryptographyaloneisused,itcanraisesuspicionaboutsomesecretinformationbeingexchanged.Modernsteganographyincorporatescryptographyaswellwheredataisencryptedbeforebeingembeddedinadigitalmedium.Steganographycanalsobeusedtoenforceaccesscontrolonadigitalmedium.Forexample,steganographycanbeusedtohideaccesscontrolinformationinamusicle.Whenanunauthorizeduserplaysthele,theaccesscontrolinformationcanbeextractedandcheckedagainstthepermissionforthatle.Inotherwords,itcanbeusedtoenforcedigitalrightmanagement(DRM)policies.Ifausertamperswiththele,thesteganographycontentswillbedestroyedandtheDRMplayercanthendisableplayingthatparticularle.Integrationofsteganographywithaccesscontrolisapartofmyfutureresearch. Thisdissertationfocussesontheanalysisanddevelopmentofnovelsteganographytechniqueswhichcanhidedatawithalowdetectionrateandhighpayload.Since,increasingpayloadandreducingdetectionisnotpossibleatthesametime,experimentalresultshaveshownthatarateof0.05to0.1bitspernonzerocoefcientwouldbeidealtohidedatawithasignicantlylowerdetectionrate.Threenewsteganographyalgorithms,(J2,J3andJ4)andonesteganalysisalgorithmhavebeendiscussed, 132

PAGE 133

analyzedanddevelopedtowardscompletionofthisdissertation.Eachalgorithmhasitsownadvantagesintermsofstealthinessandpayload. J2isabaselinestegoembeddingmethodintroducedinapriorworktocircumventdetectionbytheJPEGcompatiblesteganalysismethod.Itdiscussessomeshortcomingsofthebaselineapproach,anddescribesamodiedversionthatovercomestheseproblems(tosomeextent).J2stillcannotbedetectedbyJPEG-compatibilitysteganalysis,andthechangestothespatialdomainandtotheJPEGcoefcienthistogramsaresosmallthatwithouttheoriginal,itwouldbeverydifculttodetectanyabnormalities.Themethodisquitefragile,andanychangetoaspatialdomainblock(ortoaJPEGblock)willcertainlyrandomizethecorrespondingextractedbits.Hence,itisexpectedthatthemethodwillbeverydifculttodetect,butrelativelyeasytoscrubusingactivemeasures. J3isacompletelydifferentmethodthanJ2toembedandextractdata.J3removesalltheshortcomingsofJ2.IncontrasttoJ2,J3operatesentirelyinthefrequencydomain.ItchangestheLSBoftheDCTcoefcientstoembedthemessagebits.However,theadvantagewithJ3isitsabilitytorestoretheglobalhistogramcompletelyasthecoverimage.Ifasteganalyzercomparesthehistogramofcoverandthestegoimage,heorshewon'tbeabletodistinguishonefromtheother.TheabilityofJ3torestorethehistogramcomesfromthestoppoints.Stoppointsaretheindiceswhichtelltheextractionalgorithmwhentostopdecodingaparticularpair.Coefcientsarealwayschangedinpairs.Duringtheembeddingprocess,thealgorithmcontinuouslycheckifthereareenoughuntouchedcoefcientsofthatpairlefttorestorethehistogramcompletely.Ifnot,itstoresthecurrentindexasthestoppointforthatpair.Thestoppointinformationisstoredintheheadersectionofthemessagewhichcanbedecodedbytheextractorbeforehestartsdecodingthemessage.Theoreticalanalysisshowsthattheestimatedcapacityandstoppointsfollowcloselytotheexperimentalvalues.Matrixencodingtechniquewasalsousedtominimizeoverallcoefcientchanges.Tocheckthe 133

PAGE 134

performanceofthealgorithm,steganalysisexperimentswereperformedon3000JPEGimagesusingaSVMclassier.TheresultsshowthatJ3performsextremelywellagainstotherpopularalgorithmssuchasOutguess,F5andSteghide.J3hasadetectionrateof50%(randomclassication)incontrastto80-95%forotheralgorithms.ThusJ3canbeusedasanimportanttooltohidedatainJPEGimageswithgreatstealthiness. Thenextalgorithm,J4,isanimprovementoverthemethodsusedinJ3.ComparedtoJ3,J4restoresglobalaswellasindividualhistogramsafterembeddingdata.TheindividualhistogramshererefertothehistogramforeachindexinaDCT8x8matrix.Thehistogramrestorationschemedoesnotapplyto1,0and-1coefcients.ThisisdonetoleveragethehighnumberofthesecoefcientsforincreasedefciencysinceJ4usesmatrixembeddingtodecreasethenumberofcoefcientchanges.Allthecoefcientsexcept1,0and-1arechangedinpairs.ThetheoreticalestimationensuresthatenoughcoefcientsareleftaftertheembeddingprocesstocompensateforthechangestothecoefcientsateachindexpositionintheDCTarray.IncontrasttoJ3,J4doesnotuseanystoppointstostopembeddinginaparticularpair.Instead,ittheoreticallyestimatesthecapacityofeachcoefcientpairandstopsembeddingoncethecapacityisreached.Since,thehistogramisrestoredcompletelyforthepairs,thereceivercanthenestimatethecapacityaccuratelyandstopextractingfromapaironceitscapacityisused.Forperformanceanalysis,J4wascomparedwith9algorithms:F5,nsF5,Steghide,Outguess,MB1,MB2,PQ,PQTandPQE.ExtensivesteganalysisperformedonthesealgorithmsprovethatdetectionrateofJ4isaround47%,58%,76%and88%at0.05,0.1,0.2and0.3bitspernon-zerocoefcients(bpnz),respectively.Ontheotherhand,theaveragedetectionrateofotheralgorithmsexceptnsF5were90%,95%,97%and98%forthesamebpnz.Thedetectionrateforotheralgorithmswerearound40%higheronaveragecomparedtoJ4.nsF5performsequallywellasJ4at0.05bpnzbutJ4outperformsnsF5withasmallmarginathigherembeddingrates.Moreover,nsF5doesn'tdoanycompensationincontrasttoJ4.Thesteganalysiswas 134

PAGE 135

basedon3000colorJPEGimagesdownloadedfromNationalGeographicwebsite.The274mergedDCTandMarkovfeatureextractorusedforsteganalysiswasthebestavailableatthetimeofwritingthisarticleindetectionaccuracy,asclaimedbytheauthorsin[ 35 ].Although,thesteganalysismethodinourexperimentsusesbothrstandsecondorderstatisticstodetectanomaliesandJ4isarst-orderrestorationscheme,J4isstillabletoperformextremelywellonlowerdataratesandbeatthissteganalysissystem.Since,50-60%detectionisclassiedasrandomguessinSVMclassication,theresultsprovethatJ4wouldbeanidealcandidateforembeddingdataatlowrates. Anewsteganalysissystemhasalsobeenproposedinchapter 6 wherea2-stepMarkovmodelwasusedasfeaturesetforblindsteganalysis.ExistingtechniqueshavefocussedononestepMarkovmodelandDCTfeatures.Theproposedmethodtakesthisideaonestepfurthertoextractfeaturesbasedon2-stepMarkovmodel.The2-stepMarkovfeaturesarebasedonbothintraandinter-blocktransitionsinhorizontal,vertical,diagonalandminordiagonaldirections.TheotherfeaturesincludedtheglobalanddualentropyoftheDCTcoefcientsbringingthetotalnumberoffeaturesto697usingathresholdof[-3,3].Thestatisticalfeaturesarerstextractedfromthegivenimageandthencomparedagainstthestatisticsoftheestimatedcoverimage.Thisdifferencewouldbegreaterforastegoimagewherecoefcientshavebeenchangedascomparedtoacoverimage(withoutanycoefcientchange).3000imageswereusedfortheexperimentwhichconsistedofextractingthefeaturesfromagivenimagesetembeddedwith10differentstegoalgorithmsincludingJ3andJ4.ThesefeatureswerethenusedwithaSVMclassierfortrainingandtestingwhere50%oftheimageswereusedfortrainingandtherestfortesting.TheresultsshowthattheproposedsteganalysisalgorithmoutperformsFridrich'sstateofartsteganalysisalgorithmbymorethan40%fordetectionofJ3andJ4at0.05bpnz.ItalsooutperformsFridrich'ssteganalysismethodfordetectingotherstegoalgorithmswithanexceptionofnsF5wheretheproposed 135

PAGE 136

schemewasonlyabletodetect36%oftheimagesascomparedto47%withFridrich'sschemeat0.05bpnz.Fridrichetal'smethodwasthestateofartsteganalysistoolbeforethisproposedalgorithm.ThehighperformanceofthisalgorithmagainstFridrich'smethodshowsthatitcanbeusedasanimportanttoolintheworldofsteganalysisforblinddetectionofstegoimages. 136

PAGE 137

LISTOFREFERENCES [1] H.Wu,N.Wu,C.Tsai,andM.Hwang,Imagesteganographicschemebasedonpixel-valuedifferencingandLSBreplacementmethods,IEEProceedings-Vision,ImageandSignalProcessing,vol.152,no.5,pp.611,2005. [2] A.C.Hung.(1993,November)Pvrg-jpegcodec1.1.[Online].Available: http://www.dclunie.com/jpegge/jpegpvrg.pdf [3] ITU-T,ITU-TT.81(JPEG-1)-basedstill-imagecodingusinganalternativearithmeticcoder,September2005. [4] G.Wallaceetal.,TheJPEGstillpicturecompressionstandard,CommunicationsoftheACM,vol.34,no.4,pp.30,1991. [5] R.ChandramouliandN.Memon,AnalysisofLSBbasedimagesteganographytechniques,inImageProcessing,2001.Proceedings.2001InternationalConferenceon,vol.3,2001. [6] Y.LeeandL.Chen,Highcapacityimagesteganographicmodel,IEEProceedings-Vision,ImageandSignalProcessing,vol.147,no.3,pp.288,2000. [7] J.FridrichandM.Long,SteganalysisofLSBencodingincolorimages,in2000IEEEInternationalConferenceonMultimediaandExpo,vol.3,2000. [8] A.WestfeldandA.Ptzmann,Attacksonsteganographicsystems,inInformationHiding.Springer,1999,pp.61. [9] J.KodovskyandJ.Fridrich,Quantitativestructuralsteganalysisofjsteg,InformationForensicsandSecurity,IEEETransactionson,vol.5,no.4,pp.681,2010. [10] A.WestfeldandA.Ptzmann,Attacksonsteganographicsystems,Lecturenotesincomputerscience,pp.61,2000. [11] A.Latham.(1999,August)Jphide&seek.[Online].Available: http://linux01.gwdg.de/alatham/stego.html [12] A.Westfeld,F5-asteganographicalgorithm,inIHW'01:Proceedingsofthe4thInternationalWorkshoponInformationHiding.Springer-Verlag,2001,pp.289. [13] J.Fridrich,M.Goljan,andD.Hogea,SteganalysisofJPEGimages:BreakingtheF5algorithm,LectureNotesinComputerScience,pp.310,2003. [14] N.Provos,Defendingagainststatisticalsteganalysis,inProceedingsofthe10thconferenceonUSENIXSecuritySymposium-Volume10.USENIXAssociationBerkeley,CA,USA,2001,pp.24. [15] Y.Shi,C.Chen,andW.Chen,AMarkovprocessbasedapproachtoeffectiveattackingJPEGsteganography,LECTURENOTESINCOMPUTERSCIENCE,vol.4437,p.249,2007. 137

PAGE 138

[16] J.Fridrich,M.Goljan,andD.Hogea,NewmethodologyforbreakingsteganographictechniquesforJPEGs,SubmittedtoSPIE:ElectronicImaging,2003. [17] S.HetzlandP.Mutzel,Agraph-theoreticapproachtosteganography,LectureNotesinComputerScience,vol.3677,p.119,2005. [18] L.Marvel,C.BonceletJr,andC.Retter,Spreadspectrumimagesteganography,IEEETransactionsonImageProcessing,vol.8,no.8,pp.1075,1999. [19] F.Brundick,L.Marvel,A.R.L.A.P.G.M.A.Computational,andI.S.Directorate.,ImplementationofSpreadSpectrumImageSteganography,2001. [20] J.SmithandB.Comiskey,Modulationandinformationhidinginimages,LectureNotesinComputerScience,vol.1174,pp.207,1996. [21] R.ChandramouliandK.Subbalakshmi,Activesteganalysisofspreadspectrumimagesteganography,inCircuitsandSystems,2003.ISCAS'03.Proceedingsofthe2003InternationalSymposiumon,vol.3,2003. [22] K.Sullivan,U.Madhow,S.Chandrasekaran,andB.Manjunath,Steganalysisofspreadspectrumdatahidingexploitingcovermemory,inProc.SPIE,vol.5681,2005,pp.38. [23] P.Sallee,Model-basedsteganography,DigitalWatermarking,pp.254,2004. [24] K.Solanki,K.Sullivan,U.Madhow,B.Manjunath,andS.Chandrasekaran,Statisticalrestorationforrobustandsecuresteganography,inIEEEInternationalConferenceonImageProcessing,2005.ICIP2005,vol.2,2005. [25] E.Franzetal.,Steganographypreservingstatisticalproperties,Lecturenotesincomputerscience,pp.278,2003. [26] J.Fridrich,T.Pevny,andJ.Kodovsky,Statisticallyundetectablejpegsteganography:deadendschallenges,andopportunities,inProceedingsofthe9thworkshoponMultimedia&security.ACMNewYork,NY,USA,2007,pp.3. [27] A.Sarkar,K.Solanki,U.Madhow,S.Chandrasekaran,andB.Manjunath,Securesteganography:Statisticalrestorationofthesecondorderdependenciesforimprovedsecurity,inAcoustics,SpeechandSignalProcessing,2007.ICASSP2007.IEEEInternationalConferenceon,vol.2.IEEE,2007. [28] R.Crandall,Somenotesonsteganography,Postedonsteganographymailinglist,1998. [29] R.Hamming,Errordetectinganderrorcorrectingcodes,BellSystemTechnicalJournal,vol.29,no.2,pp.147,1950. [30] R.BohmeandA.Westfeld,BreakingCauchymodel-basedJPEGsteganographywithrstorderstatistics,ComputerSecurityESORICS2004,pp.125,2004. 138

PAGE 139

[31] V.Vapnik,Anoverviewofstatisticallearningtheory,NeuralNetworks,IEEETransactionson,vol.10,no.5,pp.988,Sep.1999. [32] S.LyuandH.Farid,Detectinghiddenmessagesusinghigher-orderstatisticsandsupportvectormachines,inInformationHiding.Springer,2003,pp.340. [33] J.Fridrich,Feature-basedsteganalysisforJPEGimagesanditsimplicationsforfuturedesignofsteganographicschemes,inInformationHiding.Springer,2004,pp.67. [34] Y.Shi,C.Chen,andW.Chen,AMarkovprocessbasedapproachtoeffectiveattackingJPEGsteganography,inInformationHiding.Springer,2006,pp.249. [35] T.PevnyandJ.Fridrich,MergingMarkovandDCTfeaturesformulti-classJPEGsteganalysis,Security,Steganography,andWatermarkingofMultimediaContentsIX,pp.1,2007. [36] H.Farid,Detectinghiddenmessagesusinghigher-orderstatisticalmodels,inProc.IEEEInt.Conf.ImageProcessing,NewYork.Citeseer,2002,pp.905. [37] S.LyuandH.Farid,Detectinghiddenmessagesusinghigher-orderstatisticsandsupportvectormachines,inInformationHiding.Springer,2003,pp.340. [38] H.FaridandS.Lyu,Steganalysisusinghigher-orderimagestatistics,InformationForensicsandSecurity,IEEETransactionson,vol.1,no.1,pp.111,2006. [39] J.Fridrich,Feature-basedsteganalysisforJPEGimagesanditsimplicationsforfuturedesignofsteganographicschemes,inInformationHiding.Springer,2005,pp.67. [40] T.PevnyandJ.Fridrich,Towardsmulti-classblindsteganalyzerforJPEGimages,DigitalWatermarking,pp.39,2005. [41] J.FridrichandT.Pevny,Multi-classblindsteganalysisforJPEGimages,inProceedingsofSPIE,vol.6072,2006,p.60720O. [42] C.HsuandC.Lin,Acomparisonofmethodsformulticlasssupportvectormachines,NeuralNetworks,IEEETransactionson,vol.13,no.2,pp.415,2002. [43] C.ChenandY.Shi,JPEGimagesteganalysisutilizingbothintrablockandinterblockcorrelations,inCircuitsandSystems,2008.ISCAS2008.IEEEInternationalSymposiumon.IEEE,2008,pp.3029. [44] Z.ZhouandM.Hui,SteganalysisforMarkovfeatureofdifferencearrayinDCTdomain,inFuzzySystemsandKnowledgeDiscovery,2009.FSKD'09.SixthInternationalConferenceon,vol.7.IEEE,2009,pp.581. 139

PAGE 140

[45] D.Fu,Y.Shi,D.Zou,andG.Xuan,JPEGsteganalysisusingempiricaltransitionmatrixinblockDCTdomain,inMultimediaSignalProcessing,2006IEEE8thWorkshopon.IEEE,2007,pp.310. [46] R.Newman,I.Moskowitz,andM.Kumar,J2:renementofatopologicalimagesteganographicmethod,Proc.CNIS,Berkeley,CA,2007. [47] R.Newman,I.Moskowitz,L.Chang,andM.Brahmadesam,AsteganographicembeddingundetectablebyJPEGcompatibilitysteganalysis,inInformationHiding.Springer,2003,pp.258. [48] J.Fridrich,M.Goljan,andR.Du,SteganalysisbasedonJPEGcompatibility,inSPIEmultimediasystemsandapplicationsIV.Citeseer,2001,pp.275. [49] I.Moskowitz,L.Chang,andR.Newman,Capacityisthewrongparadigm,inProceedingsofthe2002workshoponNewsecurityparadigms.ACM,2002,pp.114. [50] M.KumarandR.Newman,J3:HighPayloadHistogramNeutralJPEGSteganography,inProceedingsofthe2010conferenceonPrivacy,SecurityandTrust-PST2010,2010. [51] C.-C.ChangandC.-J.Lin.(2001)LIBSVM:alibraryforsupportvectormachines.[Online].Available: http://www.csie.ntu.edu.tw/cjlin/libsvm 140

PAGE 141

BIOGRAPHICALSKETCH Mahendrareceivedhisbachelor'sinelectricalengineeringfromIndianInstituteofTechnology,Roorkeein2003andtheM.S.andPh.D.incomputerengineeringfromtheUniversityofFlorida(UF)inthesummerof2011.PriortojoiningUF,heworkedasasoftwareengineerinIndiaforoneyearinareasrelatedtosmartcardapplications.Hisresearchinterestsareintheeldofsteganography,steganalysis,accesscontrol,informationsecurityandcollaborativecomputing.DuringhisPh.D.,healsoco-authoredseveralarticlesintheareaofaccesscontrolandsteganographyinleadingconferencesandjournals.Hispasttopicsincludecovertchannels,mixrewallsandad-hocnetworksforruralareasusingWi-Max. 141