1 A Markov Process Based Approach to Effective Attacking JPEG Steganography By Y. Q. Shi, Chunhua Chen, Wen Chen NJIT Presented by Hanlin Hu and Xiao Zhang

2 Steganalysis: A Markov Process Based Approach Steganography, Different Approaches & Techniques Steganalysis & Previous Work on Steganalysis Markov Process Feature Construction Experiments and Results Discussion and Conclusion

3 What is Steganography ? Art and science of invisible communication to conceive the very existence of hidden messages Images convey large size of message Because of non-stationarity, Image Steganography is hard to attack JPEG is popularly used format for Staganography as it is possible to compress JPEG images up to 1:10 ratio without significant loss

Modern Stego Techniques Outguess F5 MB(model -based)

5 Modern Stego Techniques Outguess  Stego framework is created by embedding hidden data using redundancy of cover image.  Outguess preserves statistics of the BDCT coefficients histogram  Stego takes two measures before embedding data - Redundant BDCT coefficients, which has least effect on cover image. - Adjusts the untouched coefficients.

6 Modern Stego Techniques (cont’d.) F5 Works on JPEG format only. Two main security actions against steganalysis attacks: - Straddling: scatters message uniformly over the cover image - Matrix Embedding: Improves embedding efficiency (no. of bits/ change of BDCT coeff.)

7 Modern Stego Techniques (cont’d.) MB (Model-based Steganography) Correlates embedded data with cover image Splits cover image into two parts - Models parameter of distribution of second given first part - Encodes second part using model and hidden message - Combine these two parts to form stego image MB1 operates on JPEG images, uses Cauchy distribution to model JPEG histogram

8 Steganalysis: A Markov Process Based Approach Steganography, Different Approaches & Techniques Steganalysis & Previous Work on Steganalysis Markov Process Feature Construction Experiments and Results Discussion and Conclusion

9 Steganalysis Art of detecting hidden messages from stego images

10 Previous Work on Steganalysis Universal Steganalyzer - proposed by Farid Based on Image’s higher order statistics Universal Steganalysis – proposed by Shi et al Based on statistical moments of characteristic functions of image, its prediction-error image and their DWT subbands

11 Previous Work on Steganalysis Fridrich proposed set of distinguishing features from BDCT and spatial domain for detecting messages embedded in JPEG images. Specific Steganalysis with spread spectrum – by Sullivan et al - Inter-pixel dependencies used and Markov chain model is adopted. - Some loss is inevitable due to random feature selection - Markov chains used only in horizontal direction

12 Steganalysis: A Markov Process Based Approach Steganography, Different Approaches & Techniques Steganalysis & Previous Work on Steganalysis Markov Process Feature Construction Experiments and Results Discussion and Conclusion

13 Markov Processes – Wikipedia Named after mathematician Markov for random evolution of memoryless system Definition: A stochastic process whose state at time t is X(t), for t>0 and whose history of states is given by x(s) for times s<t is a Markov process if Probability of its having state y at time t+h conditioned on having particular state x(t) at time t, is equal to conditional probability of its having that same state y but conditioned on its value for all previous times before t, presenting future state is independent of its past states.

14 Steganalysis: A Markov Process Based Approach Steganography, Different Approaches & Techniques Steganalysis & Previous Work on Steganalysis Markov Process Feature Construction Experiments and Results Discussion and Conclusion

15 Feature Construction for Steganalysis To classify as stego or non-stego image In this Steganalysis scheme, second order statistics are used to detect JPEG steganographic method. Steps: - Defining JPEG 2-D array - Introducing Difference JPEG 2-D array in different directions - Modeling this difference array using Markov random process (Transition Probability Matrix) - Thresholding technique to reduce computational cost.

16 Defining JPEG 2-D array Generation of features from 8 x 8 BDCT domain to attack steganography 2-D array of same size as given image with each 8 x 8 block filled up with corresponding JPEG quantized 8 x 8 BDCT coeff. Absolute value is taken resulting array as shown

17 Difference JPEG 2-D array Disturbance caused by Steganographic methods in JPEG images can be enlarged by observing difference between an element and one of its neighbors. 4 JPEG 2-D difference arrays are generated. F h (u, v) = F(u, v) – F(u+1, v) F v (u, v) = F(u, v) – F(u, v+1) F d (u, v) = F(u, v) – F(u+1, v+1) F md (u, v) = F(u+1, v) – F(u, v+1)

18 Defining JPEG 2-D array (Cont’d.) We choose absolute value of coefficients - BDCT coefficients do not obey Gaussian distribution - Power of 8 x 8 block of DCT coefficients is highly concentrated in DC and low freq. - These coefficients are non-increasing along zig-zag order. they are correlated. - difference of absolute values of two immediate neighbors is highly concentrated around 0 having Laplacian-like distibution.

19 Difference JPEG 2-D array Distribution of difference array elements is Laplacian with most values close to 0 Most of the elements is difference array are in [-T, T] as long as T is large enough.

20 Transition Probability Matrix We use Markov Random Process with one-step transition probability matrix. Second order statistics are used in order to reduce computational complexity dramatically In order to reduce complexity further, thresholding technique is used. Hence dimensionality of matrix is reduced to (2T+1)X(2T+1) By choosing proper ‘T’ value, good steganalysis capability with manageable computational complexity is achieved.

21 Transition Probability Matrix (Cont’d.) From equations beside, we have 4 X (2T+1) X (2T+1) elements Choosing proper value of T gives steganalysis capability with manageable computational complexity

22 Feature Formation Procedure

23 Support Vector Machine Classifier for pattern Recognition. Easy to use than Neural Networks of Image analysis and Performance is comparable. SVM is based on idea hyperplane classifier. Optimal separation hyperplane is calculated by Langrangian multipliers. SVM can be used for both linear and nonlinear separable case. In linear case SVM, looks for Hyperplane (H) and two planes (H1 & H2 M) parallel to H. It maximizes distance b &w these two planes With no data points in between. In nonlinear case SVM uses kernels ( Polynomial kernel) functions to locate linear hyperplane.

24 Steganalysis: A Markov Process Based Approach Steganography, Different Approaches & Techniques Steganalysis & Previous Work on Steganalysis Markov Process Feature Construction Experiments and Results Discussion and Conclusion

25 Experiments and Results Images used were 7560 JPEGs with QF ranging from Each one is cropped to 768*512 or 512*768 dimension Chrominance set to zero and Luminance untouched before embedding.

26 Experiments and Results (Cont’d.) Stego Images Generation Embedding rate is ratio of message length to non-zero elements in JPEG 2-D array measured in bpc Considered embedding rates are - For OutGuess: 0.05, 0.1, 0.2 bpc and stego images generated are 7498, 7452, 7215 resp. - For F5 and MB1: 0.05, 0.1, 0.2, 0.4 bpc and 7560 stego images are generated. Step size equal to two for MB1

27 Results obtained using SVM Half of non-stego and stego image pairs selected to train SVM classifier and others are using trained classifier 4 steganalysis schemes compared as shown to detect OutGuess, F5 and MB Result: The proposed steganalyzer outperforms the prior-arts by significant margin F5 has low detection rate on same embedding rate than MB1

28 Result with features from one direction at a time Contributions made from horizontal and vertical direction are more than that from main and minor diagonal directions. Contribution Contribution made from main diagonal larger than that from the minor diagonal direction.

29 Steganalysis: A Markov Process Based Approach Steganography, Different Approaches & Techniques Steganalysis & Previous Work on Steganalysis Markov Process Feature Construction Experiments and Results Discussion and Conclusion

30 Discussion Taking absolute values in JPEG 2-D array is an advantage - Not taking absolute value degrades performance - Dynamic range of JPEG 2-D array will be increased - Following table shows performance comparison with and without absolute values for MB1

31 Discussion (Cont’d.) Detection Rates of F5 Detection rates for MB1 are higher than F5 for same embedding rates Reasons: - F5 reduces magnitude of non-zero DCT AC coefficients by 1 in order to embed a bit and has larger probability to keep difference JPEG 2-D array elements unchanged after data embedding - Following statistics show that at low rates F5 changes fewer DCT co-eff. Than MB1 but reverse case for higher rate.

32 Conclusion Taking absolute value in JPEG 2-D array reduces computation complexity and raises analysis capability Difference JPEG 2-D Arrays along horizontal, vertical, diagonal and minor diagonal directions have enlarged changes caused by Steganographic methods Thresholding technique greatly reduces dimensionality of feature vectors to a manageable extent Markov process to model difference JPEG 2-D arrays and using all elements in transition probability matrices as features, the second order statistics have been used

33 References C. J. C. Burges. “A tutorial on support vector machines for pattern recognition”, Data Mining and Knowledge Discovery, 2(2): , 1998 H. Farid, “Detecting hidden messages using higher-order statistical models”, International Conference on Image Processing, Rochester, NY, USA, 2002 Y. Q. Shi, G. Xuan, D. Zou, J. Gao, C. Yang, Z. Zhang, P. Chai, W. Chen, and C. Chen,“Steganalysis based on moments of characteristic functions using wavelet decomposition, prediction-error image, and neural network,” International Conference on Multimedia and Expo, Amsterdam, Netherlands,