Advanced
Steganalysis of adaptive JPEG steganography by selecting DCT coefficients according to embedding distortion
Steganalysis of adaptive JPEG steganography by selecting DCT coefficients according to embedding distortion
KSII Transactions on Internet and Information Systems (TIIS). 2015. Dec, 9(12): 5209-5228
Copyright © 2015, Korean Society For Internet Information
  • Received : April 19, 2015
  • Accepted : September 28, 2015
  • Published : December 31, 2015
Download
PDF
e-PUB
PubReader
PPT
Export by style
Share
Article
Author
Metrics
Cited by
About the Authors
Xiaofeng Song
Fenlin Liu
Chunfang Yang
Xiangyang Luo
Zhenyu Li

Abstract
According to the characteristics of adaptive JPEG steganography which determines the changed DCT coefficients based on embedding distortion, a new steganalysis method by selecting the DCT coefficients with small distortion values is proposed. Firstly, the principle of adaptive JPEG steganography through minimizing distortion is introduced. Secondly, the practicability of selecting the changed DCT coefficients according to distortion values is studied. Thirdly, the proposed steganalysis method is given and the embedding sensitivity of the steganalysis feature extracted from the selected DCT coefficients is analyzed. Lastly, the implement processes of the proposed method are presented and analyzed in details. In the experiments, PQt, PQe and J-UNIWARD steganography are used as examples to verify the effect of the proposed steganalysis method for adaptive JPEG steganography. A serial experimental results show the detection accuracy can be improved obviously, especially when the payload is relatively low.
Keywords
1. Introduction
I mage Steganography is the science and art of convert communication which try to embed the secret messages into innocuous-looking cover image [1] . The countermeasure against steganography technology is steganalysis [2] which focuses on detecting the presence of the secret messages. In recent years, with the development of Internet and steganography technologies, more and more algorithms and softwares are constantly emerging and can be got easily. It enables people to exchange their information conveniently. However, this also provides fertile grounds for illegal parties to disseminate their messages to each other secretly by utilizing steganography technologies. Therefore, image steganalysis which try to develop techniques for detecting this secret messages exchange is becoming more and more important.
JPEG is one of the most popular image formats on the internet, thus the steganography and steganalysis technology about JPEG image attract more attentions. For now, the steganography algorithms for JPEG image can be divided into non-adaptive steganography and adaptive steganography. The former includes Jsteg [3] , MB1 [4] , MB2 [5] , Outguess [6] , F5 [7] , PQ (Perturbed Quantization) [8] , MME (Modified Matrix Encoding) [9] , nsF5 [10] , etc. The latter includes PQt (texture-adaptive PQ), PQe (energy-adaptive PQ) [10] , MOD (Model Optimized Distortion) [11] , NPQ (Normalized Perturbed Quantization) [12] , EBS (Entropy Block Steganography) [13] , UED (Uniform Embedding Distortion) [14] , J-UNIWARD (JPEG UNIversal WAvelet Relative Distortion) [15] , SI-UNIWARD (Side-informed UNIWARD) [15] and so on. Moreover, in literature [16] , a new framework for designing distortion functions of JPEG image is proposed by dividing the DCT coefficients into first-priority-group and first-priority-group. The adaptive JPEG steganography constrains the embedding changes to the textured or perceptual complex image regions, and then a higher level of stego-security can be achieved since the embedding noise is covered by the inhered noise. For the above adaptive JPEG steganography algorithms, the steganographic schemes are similar. They all define a distortion function which is related with statistical undetectability firstly and then the messages are embedded by encoding method. For example, as to PQt and PQe, the distortion function is defined according to the texture and energy measure of 8×8 DCT block respectively, and then the given messages are embedded by wet paper code [17] ; as to MOD, NPQ, EBS, UED, J-UNIWARD and SI-UNIWARD, the different distortion functions are defined respectively and the messages are embedded while minimizing the distortion function by STCs (Syndrome-Trellis Codes) [18] .
For the typical non-adaptive JPEG steganography algorithms, many steganalysis methods have been proposed and achieved high detection accuracies [2] . As to the adaptive JPEG steganographic schemes, different steganalysis methods also have been investigated. In literature [19] , the authors pointed out that the distortion function of MOD steganography has been overtrained to an incomplete cover model. Then, a targeted steganalysis method for MOD is proposed by utilizing the statistical features beyond the optimized model. For other adaptive JPEG steganography, the steganographic security is often evaluated by blind steganalysis. For example, in literature [10] , the 274-dimensional feature vector consisting of 193 extended DCT features and 81Markov features proposed in [20] is used to detect PQt and PQe. The detection accuracy can only reach to 72% when payload is 0.1bpac (bits per non-zero AC DCT coefficient); in literature [14] , the state-of-the-art CC-JRM (Cartesian Calibration JPEG Rich Model) [21] feature is employed to evaluate the security performances of UED steganography and the detection accuracy is about 60% when payload is 0.1bpac and QF (Quality Factor) is 75; in literature [15] , the CC-JRM and SRM (Spatial Rich Model) [22] feature are combined for the detection performance of J-UNIWARD steganography and the detection accuracy is only 55% when payload is 0.1bpac. The steganographic security of SI-UNIWARD is higher than J-UNIWARD because the rounding error of precover image is utilized for the definition of distortion function.
From all above, it can be seen that the detection performance for adaptive JPEG steganography is difficult. This is because the embedding changes are constrained to the complicated image regions which are hard to model. However, the framework of adaptive JPEG steganography make the selection channel of steganography algorithm is public. Furthermore, the stego image is often modified slightly relative to cover image, thus the distortion values of DCT coefficients of stego image will not change or change slightly. Therefore, as to stego image, the steganalyzer can compute the distortion values of DCT coefficients firstly and then the most possibly changed DCT coefficients are selected for the steganalysis feature extraction. In literature [23] and [24] , for UNIWARD [15] and WOW [25] steganography which are adaptive steganography in spatial domain, the effects of public selection channel for steganalysis have been discussed. However, for adaptive JPEG steganography, as far as we know, there has no research which pays attention to the public selection channel that would be utilized to improve the detection accuracy. Therefore, in this paper, the effect of selection channel on steganalysis of adaptive JPEG steganography is discussed and a steganalysis method based on DCT coefficient selection is proposed. Firstly, the principle of adaptive JPEG steganography is introduced. Secondly, the practicability of DCT coefficients selection is studied. Next, the proposed steganalysis method is given and the embedding sensitivity of the steganalysis feature extracted from the selected DCT coefficients is analyzed. Lastly, the implement process is presented in details. In the experiments, a series of experiments are implemented to verify the effectiveness of the proposed steganalysis method for some adaptive JPEG steganography algorithms.
2. Adaptive JPEG steganography by minimizing distortion
Let x = ( x 1 , x 2 ,⋯, xn ) be a cover image and xi specifies the i th cover element (DCT coefficient). The message is binary bit stream and the corresponding stego image is denoted as y = ( y 1 , y 2 ,⋯, yn ). The embedding distortion of stego image y is denoted as D ( y ), π ( y ) specifies the probability of x be modified into y . Then, the expected distortion can be expressed as:
PPT Slide
Lager Image
where Υ denotes the set of all stego images into which x can be modified.
The minimal distortion adaptive steganography expect to embed a given payload of m bits with minimal possible distortion. The problem is to determine a distribution π that communicates a required payload while minimizing the distortion [18] :
PPT Slide
Lager Image
PPT Slide
Lager Image
where
PPT Slide
Lager Image
the entropy of the distribution π ( y ).
The optimal distribution π which satisfies Eq. (2) and (3) should has the Gibbs form [26]
PPT Slide
Lager Image
where Z ( λ ) is the normalizing factor and parameter λ > 0.
PPT Slide
Lager Image
When the distortion function D ( y ) is additive over the cover elements, the distortion caused by embedding changes can be expressed as:
PPT Slide
Lager Image
where 0 ≤ ρi ( yi ) ≤ ∞ specifies the distortion caused by modifying cover element xi into stego element yi . In this case, the embedding changes do not interact and the probability π can be factorized into a product of marginal probabilities of changing the individual cover element.
PPT Slide
Lager Image
where πλ ( yi ) specifies the probability of xi be modified into yi .
Then, the expected distortion and the maximal payload are:
PPT Slide
Lager Image
PPT Slide
Lager Image
In Eq. (7), (8), (9),
PPT Slide
Lager Image
for binary embedding and the bar denotes the operation of flipping the LSB, Ii = { xi -1, x,xi +1} for ternary embedding.
From all above, it can be seen that the adaptive JPEG steganography by minimizing distortion should include distortion function definition and coding method. The former mainly pays attention to measure the distortion caused by embedding changes while the latter should embed the messages and minimize the distortion at the same time. In addition, the cover elements should be modified according to Eq. (7) for simulate embedding [18] .
3. Selecting DCT coefficients based on embedding distortion
For adaptive JPEG steganography, the changed DCT coefficients are selected according to the embedding distortion. Let us suppose the embedding changes do not interact, thus the probability of changing the DCT coefficients can be denoted as:
PPT Slide
Lager Image
Furthermore, the partial derivatives of p ( y ) with respect to distortion ρ is calculated,
PPT Slide
Lager Image
In Eq. (11), the parameter λ > 0 is inverse proportion to embedding payload. Then, from Eq. (11), it can be seen that the changing probability p of DCT coefficient is monotonically decreasing with respect to distortion ρ . In other words, the small embedding distortion means high changing probability while the large embedding distortion means low changing probability. Compared with cover image, the stego image is modified slightly and the distortion values of DCT coefficients will not change or change slightly. Therefore, for the steganalyzers, the distortion values of suspicious image can be calculated firstly and then the most possibly changed DCT coefficients are selected for the steganalysis feature extraction. Next, PQt, PQe and J-UNIWARD steganography are used as examples, the DCT coefficients selection of adaptive JPEG steganography is studied.
PQt and PQe belong to the adaptive PQ steganography and the embedding distortions are defined according to the texture and energy measure respectively while J-UNIWARD steganography defines the embedding distortion by image wavelet decomposition coefficients. For these three adaptive JPEG steganography algorithms, the Lena image 1 is used as cover image and the corresponding stego images are generated with different payloads. As to the stego image, the different percentages of DCT coefficients are selected according to embedding distortion from small to large and the percentages of the changed DCT coefficients which have been selected with respect to all the changed DCT coefficients are given.
In Fig. 1 -(a), (b), for PQt and PQe, the percentage of the changed DCT coefficients which have been selected are shown when different percentage DCT coefficients are selected according to embedding distortion from small to large. From Fig. 1 -(a), (b), it can be seen that the changed DCT coefficients can be got by selecting a small part of the DCT coefficients when the payloads are relative low. In Fig. 1 -(c), for J-UNIWARD, the percentages of the changed DCT coefficients are shown when different percentage DCT coefficients are selected. From Fig. 1 -(c), it also can be seen that the changed DCT coefficients can be got by selecting a small part of the DCT coefficients when payloads are relatively low.
PPT Slide
Lager Image
The percentage of the changed DCT coefficients which have been selected when different percentage DCT coefficients are selected: (a) PQt; (b) PQe; (c) J-UNIWARD.
From the above results, the following conclusions can be drawn for the selection of the changed DCT coefficients.
1) The selection of the changed DCT coefficients according to the embedding distortion is feasible for some adaptive JPEG steganography algorithms. From Fig.1 , it can be seen that the changed DCT coefficients can be got when only a few DCT coefficients have been selected from Lena image with relatively low payload.
2) The number of the selected DCT coefficients which include all the changed DCT coefficients is much more than the number of the changed DCT coefficients. For PQt and PQe, it is because that the DCT coefficient distortion values for embedding are calculated by the texture and energy measure of the single decompressed JPEG image while the distortion values for DCT coefficients selection are calculated according to the double compressed stego image. Therefore, the distortion values will have some difference and this will affect the selection of DCT coefficients. In addition, steganography embedding also will affect the selection of DCT coefficients. For J-UNIWARD, the DCT coefficients are modified according to the probability given in Eq. (7), thus all the changed DCT coefficients can be got only when more DCT coefficients have been selected.
3) For different adaptive JPEG steganography algorithms, the percentages of the selected DCT coefficients which include all the changed DCT coefficients are different. For example, from Fig.1 -(a) and (b), it can be seen that the percentages for selecting all the changed DCT coefficients are different for PQt and PQe. This is possible because that the affect caused by double compression and steganography embedding is more for PQe than for PQt. From Fig.1 -(c), it can be seen that the percentage is higher for selecting all the changed DCT coefficients. This is because that the embedding changes of J-UNIWARD are implemented according to the probability given in Eq. (7) while the selection of DCT coefficients is according to the distortion values from small to large.
Lena image [EB/OL]. http://en.wikipedia.org/wiki/lenna
4. Steganalysis method based on DCT coefficients selection
From the above section, it can be seen that the changed DCT coefficients can be selected according to the embedding distortion. Therefore, the steganalyzer can calculate the distortion values of DCT coefficients according to the embedding distortion function firstly, and then extract the steganalysis feature from the selected DCT coefficients with small distortion values. Lastly, the classifier is trained by the steganalysis feature as well as the final steganalyzer. For steganalysis, the same percentage of DCT coefficients is selected, then the steganalysis feature is extracted and the detection is implemented by the trained classifier. In the following, the structure of the proposed steganalysis method is given firstly, then some analyses are presented and the detailed implement processes are described.
- 4.1 Structure of the proposed steganalysis method
For the steganalysis of adaptive JPEG steganography, the DCT coefficients with small distortion values can be selected for feature extraction and classifier training. However, it should be noticed that the percentage of the selected DCT coefficients varies with payload and the real payload is often unknown for the steganalyzer. Therefore, for a suspicious JPEG image, it is difficult to determine the appropriate percentage of the selected DCT coefficients for feature extraction and steganalysis. In fact, according to the characteristic of adaptive JPEG steganography, we know that it is favorable to the steganalysis of stego image with low payload when the percentage of the selected DCT coefficients is relatively low. On the contrary, the percentage of the selected DCT coefficients should be relatively high for the stego image with high payload.
Thus, the steganalyzer can construct different detector according to the actual demand. In other words, to obtain relatively high detection accuracy for steganography with low payload, relatively few DCT coefficients should be selected to extract steganalysis feature. By contrast, to detect steganography with high payload, much more DCT coefficients should be selected to extracted feature. Furthermore, we can improve the average detection accuracy for adaptive JPEG steganography with different payloads by selecting appropriate percentage of DCT coefficients. Based on the above analysis, a new steganalysis method for adaptive JPEG steganography is proposed, as shown in Fig. 2 .
PPT Slide
Lager Image
The structure of the steganalysis method for adaptive JPEG steganography by selecting DCT coefficients.
From the Fig. 2 , it can be seen that there are two main stages involved in the proposed steganalysis method by selecting the DCT coefficients, namely, the training stage and the testing stage. In the training stage, the training image set is constructed firstly, which includes the cover images and the corresponding stego images with different payloads from α 1 to α m . Then, for each training image, the steganalysis feature is extracted from the DCT coefficients which are selected according to the distortion values from small to large. Lastly, the classifier is trained by the extracted steganalysis feature. In the testing stage, for the suspicious image, the same percentage of DCT coefficients is also selected according to the distortion values firstly, and then the steganalysis feature is extracted from these DCT coefficients. Finally, the extracted feature is tested by the trained classifier to obtain the detection result.
- 4.2 Analysis for the proposed steganalysis method
As shown in Fig. 2 , the proposed steganalysis method extracts the steganalysis feature from the DCT coefficients which are selected according to the embedding distortion from small to large. The selection of DCT coefficients can increase the change rate of feature extraction source and improve the embedding sensitivity of steganalysis feature.
- 4.2.1 Change rate of feature extraction source
In Fig. 3 , the relation between the average change rate and the percentage of the selected DCT coefficients are given for J-UNIWARD steganography with different payloads.
PPT Slide
Lager Image
The relation between change rate and percentage of the selected DCT coefficients.
From Fig. 3 , it can be seen that the average change rate of the selected DCT coefficients will decrease when more DCT coefficients are selected. Therefore, in contrast to select all the DCT coefficients, the average change rate of feature extraction source can be increased markedly when only partial DCT coefficients with small distortion values are selected.
As we all know, in general, the high change rate of feature extraction source means high embedding sensitivity of steganalysis feature. Therefore, the detection accuracy would be improved by selecting the DCT coefficients according to the embedding distortion. In addition, we should notice that a certain amount of DCT coefficients is necessary for feature extraction even through the change rate will decrease when more much DCT coefficients are selected.
- 4.2.2 Analysis for embedding sensitivity of steganalysis Feature
For the sensitivity comparison of various features in steganalysis, the rate of the larger value to the smaller value of features before and after embedding is used to measure the sensitivity in [27] and [28] . Suppose a statistical feature before steganography is f , after embedding, it becomes f′ . Then, the sensitivity measure value s of it to steganography is:
PPT Slide
Lager Image
For two types of statistical features f 1 and f 2 , after embedding, they are f′ 1 and f′ 2 respectively. Denote their sensitivities as s 1 and s 2 , respectively. Then, the sensitivity measure values of them to steganography can be calculated using Eq. (12).
For the sensitivity comparison in [27] and [28] , they let
PPT Slide
Lager Image
If A > 1, then the feature f 1 is considered superior to f 2 , in other words, f 1 is more sensitive to embedding change than f 2 , and is more suitable for steganalysis. If A < 1, then f 2 is superior to f 1 . Otherwise, these two types of features are comparable, i.e., they will get approximately equal accuracy when used for steganalysis.
By the above feature comparision method, the co-occurrence matrix feature extracted from the changed DCT coefficients is compared with the same feature extracted from all the DCT coefficients.
Let the DCT coefficient matrix of a JPEG image be represented with D = ( Dij ), where Dij denotes the ( i, j )-th quantized DCT coefficient. Furthermore, let Z denotes the set of the changed DCT coefficients after embedding while P denotes the set of the unchanged DCT coefficients. Then, the set of the adjacent two DCT coefficients along the horizontal direction can be divided into two classes. One is S 1 = {( Dij , Di,j +1 )| Dij P and Di,j +1 P } and the other is S 2 = {( Dij , Di,j +1 )| Dij Z or Di,j +1 Z or Dij Z , Di,j +1 Z }.
Then, the co-occurrence matrix feature F All ( a, b ) and F Sel ( a, b ) can be represented as:
PPT Slide
Lager Image
PPT Slide
Lager Image
where
PPT Slide
Lager Image
δ ( u, v ) is a checking function (if and only if u = v, δ ( u, v ) = 1; otherwise, δ ( u, v ) = 0), a,b ∈ [- T,T ], T denotes the truncation threshold. Moreover, M denotes the number of the elements which belong to the set S 1 and S 2 while N denotes the number of the elements which belong to the set S 2 .
According to the sensitivity measure method shown in Eq. (12), the sensitivity measure value of F All ( a,b ) and F Sel ( a,b ) can be denoted as the follows:
PPT Slide
Lager Image
PPT Slide
Lager Image
Furthermore, if suppose
PPT Slide
Lager Image
PPT Slide
Lager Image
We can get,
PPT Slide
Lager Image
So, the feature F Sel ( a,b ) is more sensitive to embedding changes than F All ( a,b ).
Similarly, if suppose
PPT Slide
Lager Image
we also can get the feature F Sel ( a,b ) more sensitive than the feature F All ( a,b ).
From the above analysis, it can be seen that the co-occurrence matrix feature extracted from the changed DCT coefficients is more sensitive to embedding than the same feature extracted from all the DCT coefficients. For the other steganalysis feature, the similar analyses can be implemented. Noticed that, even through we can not select the changed DCT coefficients alone, the embedding sensitivity of the steganalysis feature extracted from the selected DCT coefficients also would be better. In Fig. 4 , for PQt steganography with payload 0.05bpac, the sensitivity measure value (SMV) of the steganalysis feature F All and F Sel is given. Here, the feature F Sel is extracted from the selected DCT coefficients (the percentage is 5%) and the threshold T = 4. So, the parameters a,b ∈ [-4,4] and the feature dimension is 81. From Fig. 4 , it can be seen that the steganalysis feature F Sel is more sensitive to F All .
PPT Slide
Lager Image
Comparison for the sensitivity measure values of the steganalysis feature FSel and FAll.
- 4.3 Implement processes of the proposed steganalysis method
The detailed implement processes can be described as the following:
Step1: Constructing the training image set
The training image set is formed by cover images and stego images. One cover image and the corresponding stego image with certain payload is a training sample pair. All the training sample pairs are used for feature extraction.
Step2: Extracting the steganalysis feature
For each image of the training samples, the following processes are implemented:
1) The distortion values of all the DCT coefficients of the sample image are computed according to the distortion function of adaptive JPEG steganography algorithm;
2) The DCT coefficients are sorted according to the distortion values from small to large;
3) A given percentage of DCT coefficients are selected from the DCT coefficients with the smallest distortion;
4) The steganalysis feature is extracted from the selected DCT coefficients.
Step3: Training the classifier
After the steganalysis features have been extracted, the classifier is trained as the final steganalyzer. It should be noticed that different classifiers should be trained for different detection performance. For example, as to J-UNIWARD steganography with payload 0.1bpac, the training image set should only include the cover image and the corresponding stego image with payload 0.1bpac, and then the classifier is trained by the feature extracted from the selected DCT coefficients with certain percentage. Moreover, for different steganography and payload, the training set and classifier are all different.
Step4: Steganalysis
In the steganalysis stage, for the suspicious image, the same percentage of DCT coefficients are selected according to the distortion values from small to large firstly, and then the steganalysis feature is extracted from these DCT coefficients. Finally, the extracted feature is tested by the trained classifier to obtain the detection result.
For the proposed method, the DCT coefficients for feature extraction are selected according to the embedding distortion function. Therefore, in contrast to blind steganalysis, the proposed method belongs to the targeted steganalysis in some sense. In addition, for a suspicious image, the payload is often unknown and we can not determine the optimal percentage parameter for the selection of DCT coefficients. However, we can improve the average detection accuracy for adaptive JPEG steganography with payload in a given range by selecting appropriate percentage of DCT coefficients. That is to say, the payload of a suspicious image is not needed. Certainly, we can get better detection performance if the payload of the suspicious image can be got. However, estimating the payload is rather difficult especially for modern schemes whose detection requires high-dimensional statistical features.
5. Experimental results and analysis
- 5.1 Image Database and Experiment setup
In the experiments, the original images are from BossBase-1.01 [29] . For PQt and PQe, all these grayscale images are converted into JPEG image with QF 85, and then stego images are generated with payload 0.05, 0.1, 0.15, 0.2, 0.3, 0.4, and 0.5bpac (bits per non-zero AC DCT coefficient) respectively, the QF of double-compression is 70. For J-UNIWARD, all these original grayscale images are converted into JPEG image with QF 75. Then, the stego images are generated with the same seven payloads. In all experiments, ensemble classifier [30] is used for the training and testing. The proportion of training set to test set is 7:3, the detection accuracy is defined as ( PTP + PTN )/2, PTP , PTN denotes the probability of true positive and true negative respectively. The final detection accuracy is the average value of ten duplicate experiments. In subsection 5.4, for each steganography algorithm, the training set contains 7000 cover images and corresponding stego images with different payloads. The testing set contains the remaining 3000 cover images and corresponding stego images. The proportion of stego images with different payloads is same for the training and testing set.
- 5.2 Effect of selecting possibly changed DCT coefficients
In the section, CC-JRM [21] feature extracted from the selected DCT coefficients is utilized to detect the adaptive JPEG steganography PQt, PQe and J-UNIWARD with certain payload.
- 5.2.1 Steganalysis of PQt and PQe steganography
As to PQt, the embedding distortion is defined according to the texture measure of DCT blocks. So the given percentage of DCT coefficients should be selected from the highest texture measure to the lowest texture measure. Furthermore, CC-JRM is extracted from these selected DCT coefficients and used to detect PQt. The relations between the detection accuracies and the percentages of the selected DCT coefficients are shown in Table 1 .
Detection accuracies for PQt when different percentages of DCT coefficients are selected
PPT Slide
Lager Image
Detection accuracies for PQt when different percentages of DCT coefficients are selected
From the experimental results in Table 1 , it can be seen that the detection accuracy for PQt will be improved by selecting the DCT coefficients. Moreover, the improvement is quite obvious when payload is relatively low.
For PQe, the embedding distortion is defined according to the energy measure of DCT blocks. So the given percentage of DCT coefficients should be selected from the highest energy measure to the lowest energy measure. Then, CC-JRM is extracted from these selected DCT coefficients. The detection performances for PQe steganography are shown in Table 2 .
Detection accuracies for PQe when different percentages of DCT coefficients are selected
PPT Slide
Lager Image
Detection accuracies for PQe when different percentages of DCT coefficients are selected
From the experimental results in Table 2 , it can be seen that the detection accuracy for PQe also can be improved by extracting feature from the selected DCT coefficients. Contrast to PQt, more DCT coefficients should be selected in order to obtain the high detection accuracy for the same payload. This is because the changed DCT coefficients can be got only when more DCT coefficients have been selected (as shown in Fig. 1 -(a) and (b)).
- 5.2.2 Steganalysis of J-UNIWARD steganography
For J-UNIWARD, the relations between the detection accuracies and the percentages of the selected DCT coefficients with respect to all DCT coefficients are shown in Table 3 .
Detection accuracies for J-UNIWARD when different percentages of DCT coefficients are selected
PPT Slide
Lager Image
Detection accuracies for J-UNIWARD when different percentages of DCT coefficients are selected
From the experimental results in Table 3 , it can be seen that the detection accuracies for J-UNIWARD also can be improved by selecting the DCT coefficients.
- 5.3 Detection performances of different steganalysis features
In this part, the CC-PEV [31] , CC-CHEN [32] and CC-JRM features extracted from the selected DCT coefficients are compared with the same features extracted from all the DCT coefficients for the steganalysis of PQt, PQe and J-UNIWARD.
In Table 4 , the detection performances with different features are compared for PQt. The features CC-PEV-S, CC-CHEN-S and CC-JRM-S denote the three typical steganalysis features extracted from the selected DCT coefficients according to the embedding distortion.
Detection performances for PQt with different features
PPT Slide
Lager Image
Detection performances for PQt with different features
From Table 4 , it can be seen that the detection accuracy can be improved only if the features are extracted from the selected DCT coefficients. For example, when payload is 0.05bpac, the detection accuracy of CC-PEV, CC-CHEN and CC-JRM is 54.17%, 54.22%, and 62.11% while the detection accuracy of the corresponding features extracted from the selected DCT coefficients is 66.67%, 64.33%, and 74.94%.
The detection performances for PQe with different features are shown in Table 5 . From Table 5 , it also can be found that the detection accuracy for PQe can be improved by extracting feature from the selected DCT coefficients. This is particularly obvious when the payload is relative low.
Detection performances for PQe with different features
PPT Slide
Lager Image
Detection performances for PQe with different features
The detection performances for J-UNIWARD are shown in Table 6 . From Table 6 , it can be seen that the detection accuracies of CC-PEV, CC-CHEN and CC-JRM are poor when payload is low. However, if the same features are extract from the selected DCT coefficients, the detect accuracy can be improved greatly. For example, when payload is 0.05bpac, the detection accuracy of the three original features is only 50%, 50.33%, and 50.61% while it can reach 65.00%, 59.00% and 68.72% if the same features are extracted from the selected DCT coefficients.
Detection performances for J-UNIWARD with different features
PPT Slide
Lager Image
Detection performances for J-UNIWARD with different features
- 5.4 Detection performances of the proposed steganalysis method
For real steganalysis, the payload is often unknown, and the appropriate percentage of the selected DCT coefficients is difficult to be determined for steganalysis feature extraction. However, we can construct different detector to meet the demand. For example, if we want to make good average detection accuracy for PQt steganography with payload from 0.05bpac to 0.5bpac, we should extract the feature from cover images and the corresponding stego images by selecting the appropriate percentage of DCT coefficients. Then, classifier is trained by the extracted feature to get the detector for PQt steganography. In Table 7 , the detection accuracies of CC-JRM-S extracted from different percentages of DCT coefficients are given for PQt steganography with payload from 0.05bpac to 0.5bpac.
Detection accuracies of CC-JRM-S extracted from different percentage of DCT coefficients
PPT Slide
Lager Image
Detection accuracies of CC-JRM-S extracted from different percentage of DCT coefficients
From Table 7 , it can be seen that the average detection accuracy is best for PQt steganography with 0.05 to 0.5bpac when 5% DCT coefficients are selected. Similarly, the detector can be constructed for other demand. The difference lies in the construction of the training set and the percentage of the selected DCT coefficients. For example, if we want to make good average detection accuracy for PQt steganography whose payloads are from 0.1 to 0.5bpac. Then, the training set should include the cover images and the corresponding stego images whose payloads are from 0.1bpac to 0.5bpac. Furthermore, the percentage of the selected DCT coefficients for feature extraction will be high.
In the following, the steganalysis method by selecting DCT coefficients (SBSD) is compared with the steganalysis method based on all the DCT coefficients (SBAD). In the experiments, the CC-JRM-S is used for steganalysis. The detection accuracies of the two steganalysis method for PQt, PQe and J-UNIWARD are shown in Table 8 - 10 , the symbols ‘—‘ denotes the stego images with the corresponding payload are not used for training and testing. The “5%”, “6%” and so on in Table 8 - 10 specify the percentage of the selected DCT coefficients with respect to all the DCT coefficients of JPEG image.
Performance comparisons for steganalysis of PQt based on SBAD and SBSD
PPT Slide
Lager Image
Performance comparisons for steganalysis of PQt based on SBAD and SBSD
Performance comparisons for steganalysis of PQe based on SBAD and SBSD
PPT Slide
Lager Image
Performance comparisons for steganalysis of PQe based on SBAD and SBSD
Performance comparisons for steganalysis of J-UNIWARD based on SBAD and SBSD
PPT Slide
Lager Image
Performance comparisons for steganalysis of J-UNIWARD based on SBAD and SBSD
From Table 8 , it can be seen that the average detection accuracy of SBSD is 84.71% when the payloads of stego images are from 0.05 to 0.5bpac. The average detection accuracy can reach 97.63% when the payloads are from 0.4 to 0.5bpac. For the same payloads, the average detection accuracies of SBAD are 79.98% and 97.36% respectively. In other words, the SBSD can achieve better average detection accuracy than the SBAD. Especially, contrast to SBAD, the SBSD can make much better detection accuracy for PQt with low payload. For example, for PQt with payload 0.05bpac, the detection accuracy of SBSD is 68.33% while it is only 55.50% achieved by SBAD.
From Table 9 , it can be seen that the SBSD also can improve the average detection accuracy for PQe. In addition, for the PQe steganography with low payload, the improvement of detection accuracy is more obvious. For example, for PQe with payload 0.05bpac, the detection accuracy of SBSD is 74.88% while it is only 58.38% achieved by SBAD.
From Table 10 , it can be seen that the SBSD also can improve the average detection accuracy for J-UNIWARD. As to the low payload, the improvement is more obvious. For example, for J-UNIWARD with payload 0.1bpac, the detection accuracy of SBSD is 67.11% while it is only 52.88% achieved by SBAD.
From all above it can be found that the SBSD method can improve the average detection accuracy for PQt, PQe and J-UNIWARD. When payload is low, the improvement is quite obvious. Notice that, for PQt, when less DCT coefficients are selected for feature extraction, the detection accuracy for high payload such as 0.3, 0.4, 0.5bpac will decrease possibly even if the average accuracy will be improved. It is similar for PQe and J-UNIWARD. However, in actual application, the payload is often relatively low, so the proposed steganalysis method is appropriate for PQt, PQe and J-UNIWARD.
6. Conclusions
In this paper, a steganalysis method by selecting the possibly changed DCT coefficients is proposed to enhance the sensitivity of steganalysis feature and improve the detection accuracy. The experimental results show the proposed method can improve the average detection accuracy for the three adaptive JPEG steganography with different payloads. Especially, the improvements are obvious for low payloads. For other adaptive JPEG steganography, such as UED, the changed DCT coefficients are relatively large when the payload is low. Therefore the detection accuracy only will be improved slightly because the embedding changes of large DCT coefficients can not be captured effectively by the existing feature. As to NPQ, EBS and SI-UNIWARD, the changed DCT coefficients are relatively scattered and are difficult to be selected accurately because the rounding error of precover is unknown for steganalyzer, so the improvement is also not obvious by selecting DCT coefficients. In the future, the new steganalysis method should be developed for these adaptive JPEG steganography.
BIO
Xiaofeng Song received the B.S. degree from the School of Information and Technology, Zhengzhou University, Zhengzhou, China, in 2002, and M.S. degree from the School of Computer Science, Xidian University, Xi’an, China, in 2009. Now, he is a PhD Candidates of the State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou Science and Technology Institute, China. His current research interest includes steganography, steganalysis and digital image forensic.
Fenlin Liu received the B.S. degree from Zhengzhou Information Science and Technology Institute, Zhengzhou, China, in 1986, the M.S. degree from Harbin Institute of Technology, Harbin, Heilongjiang, in 1992, and the Ph.D. degree from the Northeast University, Shenyang, Liaoning, in 1998. He is currently a professor of State Key Laboratory of Mathematical Engineering and Advanced Computing, and Zhengzhou Science and Technology Institute. His research interests include information hiding and security theory. He is the author or co-author of more than 100 refereed international journal and conference papers. He obtained the support of the National Natural Science Foundation of China and the Found of Innovation Scientists and Technicians Outstanding Talents of Henan Province.
Chunfang Yang received the M.S. degree and Ph.D. degree from Zhengzhou Information Science and Technology Institute, Zhengzhou, China, in 2008 and 2012, respectively. Currently, he is a lecturer of Zhengzhou Science and Technology Institute. He is the author or co-author of more than 40 refereed international journal and conference papers. His research interest includes image steganography and steganalysis technique
Xiangyang Luo received the M.S. degree and the Ph.D. degree from Zhengzhou Information Science and Technology Institute, Zhengzhou, China, in 2004 and 2010, respectively. He is the author or co-author of more than 70 refereed international journal and conference papers. He is currently an associate professor of State Key Laboratory of Mathematical Engineering and Advanced Computing, and Zhengzhou Science and Technology Institute. In addition, he also recently served as guest editor of some special issues of International Journal "Multimedia Tools and Applications" and “International Journal of Internet”. His research interest includes multimedia security, image steganography/steganalysis.
Zhenyu Li received the M.S. degree from Zhengzhou Information Science and Technology Institute, Zhengzhou, China, in 2014. Currently, he is a PhD Candidates of Zhengzhou Science and Technology Institute. His research interest includes image steganography and steganalysis technique.
References
Cheddad A. , Condell J. , Curran K. , Kevitt P. M. 2010 “Digital image steganography: Survey and analysis of current methods,” Signal Processing 90 (3) 727 - 752    DOI : 10.1016/j.sigpro.2009.08.010
Luo X.Y. , Wang D. S. , Wang P. , Liu F. L. 2010 “A review on blind detection for image steganography,” Signal Processing 88 (9) 2138 - 2157    DOI : 10.1016/j.sigpro.2008.03.016
Upham D. “Steganographic algorithm Jsteg,” Software available at Article
Sallee P. “Model-based steganography,” in Proc. of 2nd Int. Workshop Digital Watermarking October 20-22, 2003 154 - 167
Sallee P. 2005 “Model-based methods for steganography and steganalysis,” International Journal of Image Graphics 5 (1) 167 - 190    DOI : 10.1142/S0219467805001719
Provos N. “Defending against statistical steganalysis,” in Proc. of 10th Usenix Security Symposium August 13-17, 2001 323 - 335
Westfeld A. “High capacity despite better steganalysis (F5–A steganographic algorithm),” in Proc. of 4th Int. Workshop on Information Hiding April 25-27, 2001 289 - 302
Fridrich J. , Goljan M. , Soukal D. 2005 “Perturbed Quantization Steganography,” ACM Multimedia System Journal 11 (2) 98 - 107    DOI : 10.1007/s00530-005-0194-3
Kim Y. , Duric Z. , Richards D. “Modified matrix encoding technique for minimal distortion steganography,” in Proc. of 8th Int. Workshop Information Hiding July 10-12, 2006 314 - 327
Fridrich J. , Pevný T. , Kodovský J. “Statistically undetectable JPEG steganography: dead ends, challenges, and opportunities” in Proc. of 9th ACM Multimedia and Security Workshop September 20-21, 2007 3 - 14
Filler T. , Fridrich J. “Design of adaptive steganographic schemes for digital images,” in Proc. of SPIE, Electronic Imaging,Security and Forensics of Multimedia XIII January 23-26, 2011 volume 7880, pp. OF 1-14
Huang F. , Huang J. , Shi Y. Q. 2012 “New Channel Selection Rule for JPEG Steganography,” IEEE Transactions on Information Forensics and Security 7 (4) 1181 - 1191    DOI : 10.1109/TIFS.2012.2198213
Wang C. , Ni J. Q. “An efficient JPEG steganographic scheme based on the block–entropy of DCT coefficients,” in Proc. of IEEE International Conference on Acoustics, Speech and Signal Processing March 25-30, 2012 1785 - 1788
Guo L. J. , Ni J. Q. , Shi Y.Q. “An efficient JPEG steganographic scheme using uniform embedding,” in Proc. of 4th IEEE International Workshop on Information Forensics and Security December 2-5, 2012 169 - 174
Holub V. , Fridrich J. “Digital image steganography using universal distortion,” in Proc. of 1st ACM Information Hiding and Multimedia Security Workshop June 17-19, 2013 59 - 68
Huang F. , Luo W. , Huang J. , Shi Y. Q. “Distortion Function Designing for JPEG Steganography with Uncompressed Side-image,” in Proc. of 2nd ACM Information Hiding and Multimedia Security Workshop June 17-19, 2013 69 - 76
Fridrich J. , Goljan M. , Soukal D. 2006 “Wet paper codes with improved embedding efficiency,” IEEE Transactions on Information Forensics and Security 1 (1) 102 - 110    DOI : 10.1109/TIFS.2005.863487
Filler T. , Judas J. , Fridrich J. 2011 “Minimizing additive distortion in steganography using syndrome-trellis codes,” IEEE Transactions on Information Forensics and Security 6 (3) 920 - 935    DOI : 10.1109/TIFS.2011.2134094
Kodovský J. , Fridrich J. , Holub V. “On dangers of overtraining steganography to incomplete cover model,” in Proc. of the 13th ACM Multimedia & Security Workshop September 29-30, 2011 69 - 76
Pevný T. , Fridrich J. “Merging Markov and DCT features for multi-class JPEG steganalysis,” in Proc. of SPIE, Electronic Imaging, Security, Steganography, and Watermarking of Multimedia Contents IX January 29-February 1, 2007 volume 6505 3 1 - 3 14
Kodovský J. , Fridrich J. “Steganalysis of JPEG images using rich models,” in Proc. of SPIE, Electronic Imaging, Media Watermarking, Security, and Forensics of Multimedia XIV January 22-26, 2012 volume 8303 0A 1 - 13
Fridrich J. , Kodovský J. 2011 “Rich models for steganalysis of digital images,” IEEE Transactions on Information Forensics and Security 7 (3) 868 - 882    DOI : 10.1109/TIFS.2012.2190402
Denemark T . , Fridrich J. , Holub V. “Further Study on the Security of S-UNIWARD,” in Proc. of SPIE, Electronic Imaging, Media Watermarking, Security, and Forensics 2014 February 3-5, 2014 volume 9028 5 1 - 5 13
Tang W. X. , Li H. D. , Luo W. Q. , Huang J. W. “Adaptive Steganalysis Against WOW Embedding Algorithm,” in Proc. of the 2nd ACM Workshop on Information Hiding and Multimedia Security June 11-13, 2014 Article (CrossRef Link). 91 - 96
Holub V. , Fridrich J. “Designing steganographic distortion using directional filters,” in Proc. of the 4th IEEE International Workshop on Information Forensics and Security December 2-5, 2012 234 - 239
Filler T. , Fridrich J. 2010 “Gibbs construction in Steganography,” IEEE Transactions on Information Forensics and Security 5 (4) 705 - 720    DOI : 10.1109/TIFS.2010.2077629
Wang Y. , Moulin P. 2007 “Optimized feature extraction for learning based image steganalysis,” IEEE Transactions on Information Forensics and Security 2 (1) 31 - 45    DOI : 10.1109/TIFS.2006.890517
Luo X. Y. , Liu F. L. , Lian S. G. , Yang C. F. 2011 “On the typical statistic features for image blind steganalysis,” IEEE Journal on Selected Areas in Communications 29 (7) 1404 - 1422    DOI : 10.1109/JSAC.2011.110807
Filler T. , Pevný T. , Bas P. “Break Our Steganographic System”: The Ins and Outs of Organizing BOSS,” in Proc. of 13th Int. Workshop Information Hiding May 18-20, 2011 59 - 70
Kodovský J. , Fridrich J. , Holub V. 2012 “Ensemble classifiers for steganalysis of digital media,” IEEE Transactions on Information Forensics and Security 7 (2) 432 - 444    DOI : 10.1109/TIFS.2011.2175919
Kodovský J. , Fridrich J. “Calibration revisited,” in Proc. of 11th ACM Workshop Multimedia and Security September 7-8, 2009 63 - 74
Chen C. H. , Shi Y. Q. “JPEG image steganalysis utilizing both intrablock and interblock correlations,” in Proc. of IEEE International Symposium on Circuits and Systems May 18-21, 2008 3029 - 3032