1. Steganalysis of Block-DCT Image Steganography Ying Wang and Pierre Moulin Beckman Institute, CSL & ECE Department University of Illinois at Urbana-Champaign September 29th, 2003

2. 2 Introduction Steganography is a branch of information hiding, aiming to achieve perfectly secret communication.

3. 3 Steganographer vs. Steganalyzer Steganographer Embedding distortion Various embedding methods can be used. Steganalyzer Trace of embedding? –Is typical of ? Detection methods –Ad hoc –Detection-theoretic

4. 4 Block-DCT Embedding Spatial domain Host image: 2-D stationary process with 0 mean and correlation function DCT domain -DCT coefficients: 64 equal-size channels containing approximately independent data, with variances

5. 5 8 8 8 8 Spatial domain DCT domain

6. 6 Modified Spread Spectrum Data Hiding Model DCT domain Marked DCT coefficients: Constraint and 1-D undetectability constraint: Spatial domain Stego-image:

7. 7 Statistics of the Pixel Differences Block processing introduces discontinuity at the block boundaries Develop steganalysis method based on pixel differences!

8. 8 Host image is a stationary process with zero mean and correlation function The pdfs for all pairs are the same Stego-image is non-stationary The pdfs for inner pairs and border pairs are different

9. 9

10. 10 Binary Hypothesis Testing Problem Two populations Difficulty: pdfs are unknown! We use non-parametric two-sample goodness-of-fit tests such as Komogorov- Smirnov (K-S) test. K-S test: F 0 and F 1 are cumulative density functions. Test statistic:

11. 11 The decision rule with is

12. 12 Discussion With the same embedding strength, stego-images of smooth host images such as Lena and Jet, are more likely to be detected than those of images with noise-like textures, such as Baboon. –The best candidates for steganography are complex images such as Baboon. –Block-DCT steganography is not suitable for smooth images.

13. 13 The key idea of our paper is to find an intrinsic property of natural images, which is modified by the information hiding process. –Another example: detecting wavelet-based information hiding. Upsampling introduces a stationary process in one subband to a non-stationary process in the spatial domain.

14. 14 The K-S test is universal in the sense that the pdfs can be unknown. Comparing the K-S test with the likelihood ratio test, their universality is achieved at the cost of performance degradation.

15. 15 References N. F. Johnson and S. Katzenbeisser, ``A survey of steganographic techniques", in S. Katzenbeisser and F. Peticolas (Eds.): Information Hiding, pp.43-78. Artech House, Norwood, MA, 2000. J. D. Gibbons and S. Chakraborti, Nonparametric statistical inference, Marcel Dekker, New York, 1992. L. Breiman, Probability, SIAM, Philadelphia, 1992. O. Dabeer, K. Sullivan, U. Madhow, S. Chandrasekharan, and B. S. Manjunath, ``Detection of hiding in the least significant bit", Proc. CISS, The Johns Hopkins University, Mar. 2003.

16. 16 Lena Baboon