Professional Documents
Culture Documents
Overview
Introduction
Clandestine Communication Digital Applications of Steganography Uncompressed Images Compressed Images Steganalysis The Images Used
Background
Finding and Extracting Messages from Bitmaps Detecting Messages in jpegs Future Work
Introduction
Clandestine Communication
Cryptography
Steganography
MS Word (doc) Web pages (htm) Executables (exe) Sound files (mp3, wav, cda) Video files (mpeg, avi) Digital images (bmp, gif, jpg)
Background
Character Space 09 AZ az
Length = 12
Message = Hello Stego!
Binary
Uncompressed Images
Grayscale Bitmap images (bmp)
Integer 32 00100000 256 shades of intensity from black to white 48 57 Can be obtained 00110000 - 00111001 from color images Arranged into a 2-D matrix - 01011010 65 90 01000001 Messages are hidden in the least significant bits 97 122 01100001 01111010 (lsb) Matrix values change slightly Interested in patterns that form messages
Background
Compressed Images
Joint Photographic Experts Group (jpeg) Converts image to YCbCr colorspace Divides into 8x8 blocks Uses Discrete Cosine Transform (DCT)
Obtain frequency coefficients Scaled by quantization to remove some frequencies High quality setting will not be noticed
Background
Steganalysis The Images Used
Problem
Messages can be hidden in lsbs May be anywhere in image Cannot see message in image Would take forever to be processed by a human
Define a message (pattern of message characters) Define message characters (used in messages) Use stego stems (patterns)
Observation
Only considered linear unencrypted messages Trial performed on 100 grayscale bitmaps
97 clean 3 stego
Took an average of 9 seconds per image to find with 100% accuracy (no training -- cold)
Clean images had pattern scores of less than 10 Stego images had pattern scores of 31 or more
Conclusion
Messages are detectible and extractible from non-encrypted uncompressed images Linear messages can be found in any direction with more computation This method can be foiled by hashing the message into the image
Problem
Cannot use an enumeration scheme to detect or find a message May only be able to detect because of encoding schemes and encryption Cannot see message in image Statistical properties of an image change when a message is injected
meanV12 0.590963 meanH12 meanD12 varV12 -0.004 17.120 0.050189 120.485 0.059 varH12 0.080103 0.3451660.363 varD12 0.343829 0.332710 0.001311 12 1.041 skwV12 3.809 skwH 0.021374 -0.291 skwD12 0.482941 krtV12 -0.146 838.622 krtH12 0.094929 97.874 krtD12 0.084698 0.887 meanEv12 meanEh12 meanEd12 varEv12 0.4110320.034 0.331954 0.572352 0.260870 0.337264 1.391 3.948 -0.703 varEh12 0.135543 varEd12 -2.200 15627.538skwEv12 skwEh12 skwEd12 krtEv12 krtEh12 krtEd12 0.065238 47.077 0.079329 -1.128 -0.465 2.060 0.542244 0.187500 0.603208 0.306227 0.424866 3.726 -0.738
meanV 0.370270 meanH23 meanD23 varV23 0.01123 15.318 0.032725 90.017 0.025054 0.594 varH23 0.3813170.268 varD23 0.412698 0.385321 0.001666 23 0.969 skwV23 3.877 skwH 0.043085 -0.172
skwD23 0.402427 920.19 krtH23 -0.523 krtV23 0.053992 62.226 krtD23 0.155397 -1.366 meanEv23 meanEh23 meanEd23 varEv23 0.553661-0.146 1.326 0.476190 0.432629 0.237224 0.271698 3.944 -0.705
Procedure
34 34
Obtain the 4-level 2-D wavelet decomposition of the 0.026724meanD varV images182.339 -1.808 varH meanV 0.395349 meanH -0.004 0.935 0.044753 0.7382260.601 varD 0.479060 0.367367 0.073430 0.361345 1.226 skwV 4.692 skwH 0.205 skwD Obtain 0.427911 krtV the 364.874krtD -0.079 193.451 krtH 0.042625 0.055986 -9.569decomposition4.244 varEv 0.558653-0.116 1.133 0.350634 0.332762 0.165738 0.301011 orientation meanEv meanEh meanEd -0.577 of frequency varEh 0.6110573640.213 skwEv 1.899 varEd 0.054988 24.731 0.166710 0.766 0.497393-0.349 1.681 0.518569 0.373766 0.153005 3.426 -0.625 space statistics skwEh skwEd krtEv krtEh krtEd0.320611
varEh 0.422609 varEd23 4.41823 15572.229skwEv23 skwEh23 skwEd23 krtEv23 krtEh23 krtEd23 0.096439 23.531 0.087974 -0.123 -0.541 1.980 0.463496 0.471598 0.242233 0.153389 0.360447 3.571 -0.705
34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34
class 0 72 features plus the class (0 = clean, 1=stego) Includes: mean, variance, skewness and kurtosis of coefficients and error for prediction in subband
Normalize the data by 0-1 min-max Train Fisher Linear Descriptor (FLD) Test the FLD threshold
Observation
Conclusion
Messages of sufficient size can be detected in stego images with great accuracy Improved accuracy may be due to a large training set
Restricted domain
Problems
Other Classifiers
Tests were run on J4.8, SMO, Logistic and Nave Bayes for bior3.1 and rbio5.5 with 80/20 split and default settings Results
Future Work
C/assembly code
References
Petitcolas, F.A.P., Anderson, R., Kuhn, M.G., "Information Hiding - A Survey", July1999, URL: http://www.cl.cam.ac.uk/~fapp2/publications/ieee99-infohiding.pdf (11/26/0117:00) Farid, Hany, Detecting Steganographic Messages in Digital Images Department of Computer Science, Dartmouth College, Hanover NH 03755 Moby Words II, Copyright (c) 1988-93, Grady Ward. All Rights Reserved. Lyu, Siwei and Farid, Hany, Steganalysis Using Color Wavelet Statistics and One-Class Support Vector Machines, Department of Computer Science, Dartmouth College, Hanover, NH 03755, USA Farid, Hany, Detecting Hidden Messages Using Higher Order Statistical Models Department of Computer Science, Dartmouth College, Hanover NH 03755