Research On Steganalytic Algorithms In Images

Steganography is the art and science of hiding messages and it can be applied inillegal application and military communications. As the technology of detection ofsteganography, estimation of message length and extraction of hidden data,steganalysis can prevent confidential data from revealing through steganographicschemes and ensure dangerous information not be transfered. Therefore, steganalysis isvery significant for information security and has attracted a great deal of attention.As the most popular formats of images, JPEG, BMP and GIF images are oftenselected as covers for information hiding. In this paper, based on the studies oftraditional theories and algorithms on steganography and steganalysis, applying thethought of cover-related steganalsis, we proposed three kinds of steganalyticalgorithms for detecting embedded data in JPEG, BMP and GIF formats ofcover-images, respecitivly. The results are summarized as follows:(1) Two steganalytic algorithms, MDF_C and MDF_G, were proposed based onmulti-domain features. MDF_C and MDF_G represent multi-domain features in colorimages and in gray images respectively. Multi-domain features were calculated fromstatistics extracted in discrete cosine transform (DCT) domain and in spatial domainthat denote the functional relations between an original image and its calibratedversion. MDF_C extracted one-dimensional (1-D) and two-dimensional (2-D) statisticsof alternating current (AC) coefficients in DCT domain. In spatial domain ofdecompressed versions of the original color JPEG images, MDFC computed 1-Dstatistics of differences of every two colors which located at two sides of borders ofDCT blocks in each channel and in two different channels. Meanwhile, 2-D statisticscounted pairs of differences of two colors distributed at two adjacent locations in eachchannel and in two different channels. Similar statistics in DCT and spatial domainswere collected for the calibrated images. Manhattan Distance formula was used tocalculate features from the same statistics of original and calibrated images and a 36-dimensional feature vector was extracted from a color JPEG image. MDFG collected2-D statistics of pairs of AC coefficients at two same locations distributed in DCTdomains of an original gray JPEG image and its calibrated version. 2-D statistics werealso utilized to count pairs of AC coefficients which located at the same DCT positionsin two adjacent DCT blocks in an image. In spatial domain, MDF_G extracted 2-Dstatistics of intensities and of the first order partial differentiations in twodecompressed images respectively. 26-dimensional feature vector was obtained by calculating centers of mass of histogram character function of these statistics.Support vector machine were utilized to implement steganalytic algorithms basedon the two kinds of feature vectors. Experimental results showed that the falsepositives of MDF_C were 0.54% to 48.23% lower than those of traditional steganalyticschemes. When the false positives were roughly equal with each other, the truepositives of MDF_C were 0.47% to 66% higher than those of traditional steganalyticschemes. Similarly, for MDF_G, the false positives decreased 0% to 24.99% and thetrue positives increased 1.24% to 67.81%. MDF_C and MDF_G algorithms providedbetter detecting performances than traditional schemes.(2) Three steganalytic methods, named as HODF_G, HODF_C and PCF, wereintroduced based on high-order differential features (HODF). HODF_G and HODF_Crepresent HODF in gray images and in color images respectively. PCF was denoted asprincipal-component features. Firstly, HODF_G computed histogram statistics of threeobjects such as intensity, first-order and second-order total differentiations respectively.Secondly, co-occurrence matrix statistics were calculated for each of 6 objects whichare intensity, first-order, second-order and third-order partial differentiations,first-order and second-order total differentiations distributed at two adjacent locationsin images respectively. Features were obtained from these statistics to form a30-dimensional feature vector. HODF_C computed 136-dimensional features fromabove statistics in each of three channels and statistics between every two of threechannels. The method of principal components analysis was utilized in PCF method toreduce dimension of feature vector of HODF_C. Support vector machine was used toimplement steganalytic algorithms.Experimental results demonstrated that the false positives of HODF_G were2.13% to 29.63% lower than those of traditional steganalytic schemes. When the falsepositives were roughly equal with each other, the true positives of HODF_G were3.56% to 14.13% higher than those of traditional steganalytic schemes. Similarly, forHODF_C, the false positives were 5.42% to 18.63% lower and the true positivesincreased to some different extents. PCF method provided more effective and robustdetecting performances than traditional algorithms.(3) Three steganalytic methods, designated as CCSB, CCSB_DP and CCSB_CNC,were proposed based on color complexity in sub-block (CCSB) of images. CCSB_DPdifferentiates CCSB with parity and CCSB CNC classifies CCSB into differentclasses according to the number of different colors in a sub-block. The distance fromone index to another was computed as absolute value of the difference between the twoindexes. In CCSB algorithm, color complexity was defined as the sum of distances from one index to the others in a sub-block of an image. Color complexity wasdifferentiated as positive and negative ones and they were further classified intoprimary and secondary ones. A 28-dimensional feature vector was then extracted froma gray GIF image through collecting one-dimensional and two-dimensional statistics ofabove multiple kinds of color complexities. CCSB_DP differentiated statistics ofCCSB as two classes and got 56-dimensional features according to the concept ofoptimal parity assignment. CCSB_CNC distributed the color complexities into higherdimensional spaces based on the number of different colors in a sub-block andobtained 44-dimensional features. Support vector machine was utilized to designsteganalytic algorithms.Experimental results showed that the false positives of CCSB were 0.07% to81.17% lower than those of traditional steganalytic schemes. When the false positiveswere roughly equal with each other, the true positives of CCSB were 11.24% to50.78% higher than those of traditional steganalytic schemes. CCSB_DP providedworse detecting performance than CCSB, but CCSB_CNC was better than CCSB.