ECE643 DIGITAL IMAGE PROCESSING Steganalysis versus Splicing detection Paper by: Yun Q. Shi, Chunhua Chen, Guorong Xuan and Wei Su By: Nehal Patel Siddharth Samdani

Agenda Steganography Splicing Relation between stegnalysis and splicing detection Current stegnalysis Method Apply stegnalysis method to detect spliced images Result Conclusion

Steganography From the Greek word steganos meaning “covered”– and the Greek word graphie meaning “writing”  Steganography is the process of hiding of a secret message within an ordinary message and extracting it at its destination  Anyone else viewing the message will fail to know it contains hidden/encrypted data

Splicing  Definition: The spliced image is a composite picture generated by combining image fragments from the same or different images without further post-processing such as smoothing of boundaries among different fragments.  Image splicing is one of the simple & commonly used image tampering schemes & is often used as an initial step for image tampering.  With modern image processing techniques, image splicing can be hardly caught by human visual system (HVS).

Fig.1 A B C B,C : Original Images A : Spliced Image

General comparison (stegnalysis and splicing detection) Different motivation and objectives Steganography encodes information bits and then embeds bits into cover image where as splicing is to replace one or more parts of the host image with fragments from the same host image or other source image. Statistical artifacts are different. Both try to reduce difference between cover image and modified image. Stegnography is more global while splicing is more local ( stegnography often embeds data in a cover image as widely as possible, while splicing just touches the part of host image). Splicing generally change the content of a host image, therefore the relative change between host image and its spliced version is larger. Since stego images and spliced images are touched, the stegnograhic and splicing operation cause disturbance on the smoothes, regularity, continuity, consistency, and periodicity of the image. Above statistical artifacts can be detectable using well designed natural image model.

Measurement The following measurements are used to measure the strength of the change brought to the cover image or host image. Subjective measurement for steganalysis:  HVS (Human visual system) Objective measurement for Steganalysis:  BPP(bits per pixel – for steganography )  MSE(mean square error) or PSNR (peak signal to noise ratio)  For Splicing MSE or PSNR can be an objective measure candidate.  Stegnography and splicing both are detectable by machine learning schemes.

Machine Learing A well designed natural image model can separate stego or spliced images. Image model consists of a feature vector which characterize a given image. With dataset comprising both natural image and non-natural image, universal stegnalysis or splicing detection can be carried out under the machine learning framework.

Image dataset The Columbia Image splicing detction Evaluation dataset can be used. Contains 933 authentic and 912 spliced images size of 128 X 128. These data sets are created by DVMM(digital video and multimedia lab) Columbia university.

Image Dataset

Classifier, classifications and result analysis  Classifier (SVM-support vector machine) 5/6 of authentic and 5/6 of the spliced images are used to train a SVM classifier and remaining 1/6 of these images are used to test the trained classifier.  ROC (receiver operating characteristic ) curve is obtained to demonstrate the performance of trained classifier’s.  AUC (Area under the ROC curve ) or TN (true negative) and TP (true positive) rate methods also can be used to show classifiers performance.

Applying natural image models created in Universal Steganalysis to Splicing Detection Some Universal Steganalysis methods: Hyu and Farid’s Method Shi et al.’s method Zou et al.’s method Chen et al.’s method

An Advanced Natural Image Model to Boost Splicing Detection Capability Novel natural image model

Natural Image Model Components Multi-size Block Discrete Cosine Transform (MBDCT)  Splicing procedure changes the frequency distribution of a host image, these changes are reflected by coefficients of BDCT.  Correlation changes in various patterns and is complicated due to a number of factors ( for ex. Different host images)  These changes cannot be captured effectively by one single block size BDCT but with various block size the MBDCT coefficients can perceive the frequency changes in a variety ways.  The application of is as follows n x n BDCT: The image is divided into n x n non overlapping blocks. Then DCT is applied independently on each block, which gives a 2-D array consisting of BDCT coefficients of all the blocks. Using individual block size corresponding BDCT 2-D array is obtained. Each of this BDCT 2-D array generates corresponding features.

Natural Image Model Components Moment Based Features  The moment based features consist of 1-D and 2-D characteristic functions of image 2-D array, its prediction error 2-D array and all the wavelets sub bands.  Wavelet analysis, prediction error, characteristic functions and 2-D histogram are key features of moment based features.  Wavelet analysis are used due to their superior multi-resolution and space-frequency analytical capabilities. While wavelet transform is suitable to catch local changes in spatial & frequency domains and hence good for splicing detection.  The 2-D prediction error array is used to reduce the influence caused by diversity and enhance the statistical artifacts introduced by splicing.  The 2-D histogram measures the intensity change of pixels with respect to their neighbors and thus can reflect statistical effects of splicing artifacts more efficiently.

Natural Image Model Components Markov based features:  Markov based features are able to reflect the statistical changes.  In this image pixels are predicted with the help of neighboring pixels and the prediction error image is generated by subtracting the prediction value from the pixel value.  The above step gives difference 2-D arrays from the given image 2-D array or coefficient 2-D array.  The difference 2-D array is then applied to a predefined threshold.  These 2-D difference array is modeled by Markov process and then transition probability matrices is calculated for each difference array. The values of this matrices are used to build another part of natural image model.  By predicting an image pixel or a BDCT coefficient using its immediate neighbor assumes that the disturbances caused by splicing can be emphasized by prediction error.  Combining moments based features & markov based features makes this novel natural image model more effective

Results The implementation results of novel natural image model on image dataset : The averaged ROC curve of 20 experiments obtained by applying the proposed natural image model is show below, in which ROC curves from experiments performed using Universal Steganalysis Methods are also included. The implementation of novel approach gave TN rate 91.52%(2.19%), TP rate 92.86%(1.72%), accuracy 92.18%(1.30%)and averaged AUC (0.0112).

Result The ROC curves of applying the natural image model

Detecting Real Images The results of trained classifier from the 20 random experiments was used to test the three images in Fig. 1. The test results are shown in table below, in the table it can be seen that among the 60 image test, 57 provided correct classification.

Conclusion The figure shows that with a well designed natural image model, stego images & spliced images can be separated from natural images in a feature space.

Conclusion Different in target and application, steganography & splicing have some aspects in common. One such aspect is that both cause the touched images to deviate from natural images. A novel natural image model, from the state of art steganalysis schemes was presented & applied to splicing detection, which demonstrated advancement in splicing detection. Lessons learnt from steganalysis can be applied to splicing detection, while steganalysis can learn something from splicing detection as well.