IEEE-WVU, Anchorage  1 Steg in the Real World Two examples that move the work of steganalysis out of the lab –The massive data survey of Provos et al –The distributed steganalysis framework

IEEE-WVU, Anchorage  2 Steg on the Web? Provos et al. 2003* 2 million JPEG images from 1 million JPEG images from Usenet –Images restricted in size between 20KB and 400KB stegdetect –Identified potential hidden content in 1% of the images *N. Provos and P. Honeyman, IEEE Security and Privacy Magazine, May/June 2003

IEEE-WVU, Anchorage  3 Steg on the Web? Percentage of (false) positives –JPHide “detected” most often TestEbayUsenet Jsteg JPHide Outguess

IEEE-WVU, Anchorage  4 Steg on the Web? Verifying hidden content –Stegbreak Dictionary attack against Jsteg, JPHide, and Outguess –Ebay: multi-lingual dictionary of 850,000 words –Usenet: short PIN numbers and pass phrases; 1.8 millions words

IEEE-WVU, Anchorage  5 Steg on the Web? Performance of Stegbreak SystemOne Image (words/second) Fifty Images (words/second) JPHide4,5008,700 Outguess 0.13b18,00034,000 Jsteg36,00047, GHz PIII JPHide: 10 days Outguess: ? Jsteg: 8 days

IEEE-WVU, Anchorage  6 Towards a larger steganalysis framework Disconcert - a distributed computing framework for loosely coupled workstations –Distribute indices into stegbreak’s dictionary Ebay: 60 nodes, 200,000 per second for JPHide Usenet: 230 nodes, 870,000 keys per second

IEEE-WVU, Anchorage  7 Is anything out there??? Conclusions of Provos et al –All steganographic systems users carefully choose passwords that are not susceptible to dictionary attacks –Images from sources not analyzed carry steganographic content –Images carried content embedded by tools that stegdetect does not consider –Messages are too small for detection

IEEE-WVU, Anchorage  8 Distributed Steganalysis: Objective –The development of an architecture for an extensible distributed application for steganalsyis User alerts Facility for content destruction of quarantine SOA to facilitate the inclusion of new and improved steganalysis algorithms

IEEE-WVU, Anchorage  9 Overall Architecture

IEEE-WVU, Anchorage  10 Communications

IEEE-WVU, Anchorage  11 Flexible Network Architectures

IEEE-WVU, Anchorage  12 Flexible Network Architectures

IEEE-WVU, Anchorage  13 User Interface

IEEE-WVU, Anchorage  14 Steganalysis Support Publicly available wrapped tools –Stegdetect (JPEG) –Digital Invisible Ink Toolkit (BMP, PNG) Detects LSB methods –Custom “supertool” Detects via signatures: »In Plain View, S-Tools, Mandelsteg, Hide and Seek v.4 And v.5, Hide4PGP Statistical tests: »  2 and  2 histogram

IEEE-WVU, Anchorage  15 Steganalysis Tool Wrapping Support Full featured tool wrapping API –Tool wrapping support for C/C++, Java, and Matlab programs –Network communication with XML messages between worker clients and server

IEEE-WVU, Anchorage  16 Implementation Details Entire framework written in Java 5 –Tool support in a variety of languages –JNI low-level system support for Linux and Windows –JBOSS backend server –EJB 3 Object Model