Andrew H. Sung

Feature mining and pattern classification for steganalysis of LSB matching steganography in grayscale images

In this paper, we present a scheme based on feature mining and pattern classification to detect LSB matching steganography in grayscale images, which is a very challenging problem in steganalysis. Five types of features are proposed. In comparison with other well-known feature sets, the set of proposed features performs the best. We compare different learning classifiers and deal with the issue of feature selection that is rarely mentioned in steganalysis. In our experiments, the combination of a dynamic evolving neural fuzzy inference system (DENFIS) with a feature selection of support vector machine recursive feature elimination (SVMRFE) achieves the best detection performance. Results also show that image complexity is an important reference to evaluation of steganalysis performance.

Temporal Derivative-Based Spectrum and Mel-Cepstrum Audio Steganalysis

To improve a recently developed mel-cepstrum audio steganalysis method, we present in this paper a method based on Fourier spectrum statistics and mel-cepstrum coefficients, derived from the second-order derivative of the audio signal. Specifically, the statistics of the high-frequency spectrum and the mel-cepstrum coefficients of the second-order derivative are extracted for use in detecting audio steganography. We also design a wavelet-based spectrum and mel-cepstrum audio steganalysis. By applying support vector machines to these features, unadulterated carrier signals (without hidden data) and the steganograms (carrying covert data) are successfully discriminated. Experimental results show that proposed derivative-based and wavelet-based approaches remarkably improve the detection accuracy. Between the two new methods, the derivative-based approach generally delivers a better performance.

Image complexity and feature mining for steganalysis of least significant bit matching steganography

The information-hiding ratio is a well-known metric for evaluating steganalysis performance. In this paper, we introduce a new metric of image complexity to enhance the evaluation of steganalysis performance. In addition, we also present a scheme of steganalysis of least significant bit (LSB) matching steganography, based on feature mining and pattern recognition techniques. Compared to other well-known methods of steganalysis of LSB matching steganography, our method performs the best. Results also indicate that the significance of features and the detection performance depend not only on the information-hiding ratio, but also on the image complexity.

An improved approach to steganalysis of JPEG images

Steganography secretly embeds additional information in digital products, the potential for covert dissemination of malicious software, mobile code, or information is great. To combat the threat posed by steganography, steganalysis aims at the exposure of the stealthy communication. In this paper, a new scheme is proposed for steganalysis of JPEG images, which, being the most common image format, is believed to be widely used for steganography purposes as there are many free or commercial tools for producing steganography using JPEG covers. First, a recently proposed Markov approach [27] is expanded to the inter-block of the discrete cosine transform (DCT) and to the discrete wavelet transform (DWT). The features on the joint distributions of the transform coefficients and the features on the polynomial fitting errors of the histogram of the DCT coefficients are also extracted. All features are called original ExPanded Features (EPF). Next, the EPF features are extracted from the calibrated version; these are called reference EPF features. The difference between the original and the reference EPF features is calculated, and then the original EPF features and the difference are merged to form the feature vector for classification. To handle the large number of developed features, the feature selection method of support vector machine recursive feature elimination (SVM-RFE) and a method of multi-class support vector machine recursive feature elimination (MSVM-RFE) are used to select features for binary classification and multi-class classification, respectively. Finally, support vector machines are applied to the selected features for detecting stego-images. Experimental results show that, in comparison to the Markov approach [27], this new scheme remarkably improves the detection performance on several JPEG-based steganographic systems, including JPHS, CryptoBola, F5, Steghide, and Model based steganography.

Revealing real quality of double compressed MP3 audio

MP3 is the most popular format for audio storage and a de facto standard of digital audio compression for the transfer and playback. The flexibility of compression ratio of MP3 coding enables users to choose their customized configuration in the trade-off between file size and quality. Double MP3 compression often occurs in audio forgery, steganography and quality faking by transcoding an MP3 audio to a different compression ratio. To detect double MP3 compression, in this paper, we extract the statistical features on the modified discrete cosine transform, and apply support vector machines and a dynamic evolving neuron-fuzzy inference system to the extracted features for classification. Experimental results show that our method effectively and accurately detects double MP3 compression for both up-transcoded and down-transcoded MP3 files. Our study also indicates the potential for mining the audio processing history for forensic purposes.

Derivative-based audio steganalysis

This article presents a second-order derivative-based audio steganalysis. First, Mel-cepstrum coefficients and Markov transition features from the second-order derivative of the audio signal are extracted; a support vector machine is then applied to the features for discovering the existence of hidden data in digital audio streams. Also, the relation between audio signal complexity and steganography detection accuracy, which is an issue relevant to audio steganalysis performance evaluation but so far has not been explored, is analyzed experimentally. Results demonstrate that, in comparison with a recently proposed signal stream-based Mel-cepstrum method, the second-order derivative-based audio steganalysis method gains a considerable advantage under all categories of signal complexity--especially for audio streams with high signal complexity, which are generally the most challenging for steganalysis-and thereby significantly improves the state of the art in audio steganalysis.

Novel stream mining for audio steganalysis

In this paper, we present a novel stream data mining for audio steganalysis, based on second order derivative of audio streams. We extract Mel-cepstrum coefficients and Markov transition features on the second order derivative, a support vector machine is applied to the features for discovery of the existence of covert message in digital audios. We also explore the relation between signal complexity and detection performance on digital audios, which has not been studied previously. Our study shows that, in comparison with a recently proposed signal stream based Mel-cepstrum steganalysis, our method prominently improves the detection performance, which is not only related to information-hiding ratio but also signal complexity. Generally speaking, signal stream based Mel-cepstrum audio steganalysis performs well in steganalysis of audios with low signal complexity; it does not work so well on audios with high signal complexity. Our stream mining approach for audio steganalysis gains significant advantage in each category of signal complexity - especially in audios with high signal complexity, and thus improves the state of the art in audio steganalysis.

Improved detection and evaluation for JPEG steganalysis

Detection of information-hiding in JPEG images is actively delivered in steganalysis community due to the fact that JPEG is a widely used compression standard and several steganographic systems have been designed for covert communication in JPEG images. In this paper, we propose a novel method of JPEG steganalysis. Based on an observation of bi-variate generalized Gaussian distribution in Discrete Cosine Transform (DCT) domain, neighboring joint density features on both intra-block and inter-block are extracted. Support Vector Machines (SVMs) are applied for detection. Experimental results indicate that this new method prominently improves a current art of steganalysis in detecting several steganographic systems in JPEG images. Our study also shows that it is more accurate to evaluate the detection performance in terms of both image complexity and information hiding ratio.

Steganalysis of MP3Stego

In this article, we propose a scheme for detecting hidden messages in compressed audio files produced by MP3Stego, as our literature search has found no previous work on successful steganalysis of MP3Stego. We extract moment statistical features on the second derivatives, as well as Markov transition features and neighboring joint density of the MDCT coefficients based on each specific frequency band on MPEG-1 Audio Layer 3. A support vector machine is applied to different feature sets for classification. Experimental results show that our approach is successful to discriminate MP3 covers and the steganograms generated by using MP3Stego.

Feature Mining and Intelligent Computing for MP3 Steganalysis

MP3 allows a high compression ratio while providing high fidelity. As it has become one of the most popular digital audio formats, MP3 is also conceivably a most utilized carrier for audio steganography, therefore, MP3 steganalysis is a topic deserving attention. In this paper, we propose a scheme for steganalysis of MP3Stego based on feature mining and pattern recognition techniques. We first extract the moment statistical features of GGD shape parameters of the MDCT sub-band coefficients, as well as the moment statistical features, neighboring joint densities, and Markov transition features of the second order derivatives of the MDCT coefficients on MPEG-1 Audio Layer 3. Support Vector Machines (SVM) are applied to these features for detection. Experimental results show that our method can successfully discriminate the steganograms created by using MP3stego from their MP3 covers, even with fairly low embedding ratio.