Benjamin M. Rodriguez

Steganalysis Embedding Percentage Determination with Learning Vector Quantization

Steganography (stego) is used primarily when the very existence of a communication signal is to be kept covert. Detecting the presence of stego is a very difficult problem which is made even more difficult when the embedding technique is not known. This article presents an investigation of the process and necessary considerations inherent in the development of a new method applied for the detection of hidden data within digital images. We demonstrate the effectiveness of learning vector quantization (LVQ) as a clustering technique which assists in discerning clean or non-stego images from anomalous or stego images. This comparison is conducted using 7 featuresover a small set of 200 observations with varying levels of embedded information from 1% to 10% in increments of 1%. The results demonstrate that LVQ not only more accurately identify when an image contains LSB hidden information when compared to k-means or using just the raw feature sets, but also provides a simple method for determining the percentage of embedding given low information embedding percentages.

Fusion of Steganalysis Systems Using Bayesian Model Averaging

The increasing use of steganography requires digital forensic examiners to consider the extraction of hidden information from digital images encountered during investigations. The first step in extraction is to identify the embedding method. Several steganalysis systems have been developed for this purpose, but each system only identifies a subset of the available embedding methods and with varying degrees of accuracy. This paper applies Bayesian model averaging to fuse multiple steganalysis systems and identify the embedding used to create a stego JPEG image. Experimental results indicate that the steganalysis fusion system has an accuracy of 90% compared with 80% accuracy for the individual steganalysis systems.

Detecting Steganography Using Multi-Class Classification

When a digital forensics investigator suspects that steganography has been used to hide data in an image, he must not only determine that the image contains embedded information but also identify the method used for embedding. The determination of the embedding methodor stego fingerprint — is critical to extracting the hidden information. This paper focuses on identifying stego fingerprints in JPEG images. The steganography tools targeted are F5, JSteg, Model-Based Embedding, OutGuess and StegHide. Each of these tools embeds data in a dramatically different way and, therefore, presents a different challenge to extracting the hidden information. The embedding methods are distinguished using features developed from sets of stego images that are used to train a multi-class support vector machine (SVM) classifier. For new images, the image features are calculated and evaluated based on their associated label to the most similar class, i.e., clean or embedding method feature space. The SVM results demonstrate that, in the worst case, embedding methods can be distinguished with 87% reliability.

Stego sensitivity measure and multibit plane based steganography using different color models

There are several steganographic methods that embed in palette-based images. In general these schemes are using RGB palette models. The restrictions of palette-based image formats impose limitations on existing models. For example, how to divide colors from a palette-vector for embedding purposes without causing visual degradation to the image. Another crucial intricacy is embedding using multiple bit planes while preserving the images characteristics. Possible solutions to these problems could be: a) using a multi-bit embedding procedure; b) using other color models and c) embedding only in non-informative regions. Therefore we present a new secure high capacity palette based steganographic method used to embed in multiple bit planes using different color models. The performance of the developed algorithm posts the following advantages shown through computer simulations: 1) Fewer modifications are present when compared to BPCS Steganographic method for palette-based images [1]. 2) Provides additional security through a simple selective color and cover image algorithm. 3) The proposed method offers an increased capacity by embedding in multiple bit planes. 4) Finally, the secure media storage system contains an independent steganographic method that provides an additional level of security. The proposed method was proven to be immune to Chi-square and Pairs Analysis steganalysis attacks. In addition, the presented method uses different color model to represent the palettes. Analysis shows that the presented algorithm was also secure against detection from RS Steganalysis when using different color models.

Multi-class classification fusion using boosting for identifying steganography methods

There are over 250 image steganography methods available on the Internet. In digital image steganalysis an analyst has three goals, first determine if an embedded message exists, next determine the embedding method used to create the stego image and finally extract the hidden message. The objective of this paper lies on the second goal, that is, to identify the embedding technique used to create the steganography image. Several detection systems currently exist, so the identification problem becomes one of determining which detection system has correctly identified the embedding method. In this work, the individual detection systems are fused using boosting. Boosting is a powerful technique for combining an ensemble of base classifiers to produce a form of committee with improved performance over any of the single classifiers in the ensemble. The results in this paper show that boosting takes advantage of the individual strengths from each detection systems and classification performance is increased by 10%.

Multi-Class Classification Averaging Fusion for Detecting Steganography

Multiple classifier fusion has the capability of increasing classification accuracy over individual classifier systems. This paper focuses on the development of a multi-class classification fusion based on weighted averaging of posterior class probabilities. This fusion system is applied to the steganography fingerprint domain, in which the classifier identifies the statistical patterns in an image which distinguish one steganography algorithm from another. Specifically we focus on algorithms in which jpeg images provide the cover in order to communicate covertly. The embedding methods targeted are F5, JSteg, Model Based, OutGuess, and StegHide. The developed multi-class steganalvsis system consists of three levels: (1) feature preprocessing in which a projection function maps the input vectors into a separable space, (2) classifier system using an ensemble of classifiers, and (3) two weighted fusion techniques are compared, the first is a well known variance weighted fusion and an Gaussian weighted fusion. Results show that through the novel addition of the classifier fusion step to the multi-class steganalysis system, the classification accuracy is improved by up to 12%.

New steganalysis technique for the digital media forensics examiner

Steganographic fingerprints are convened with the individuality of the steganographic methods. The basic goals of this article are: 1. To evaluate sequential and randomly embedded steganographic evidence within digital images. 2. To identify the “steganographic fingerprint” of spatial domain based steganographic methods. Steganographic fingerprinting is the next step towards forensic analysis, reachable only if one may localize steganographic content within an image. The presented detection method works equally well for sequential and random embedding. We will show that the new method may improve the message length estimation, detection accuracy and give an indication of the embedding method. In addition we will show the false alarm rate of 0.9 for the proposed method, while the false alarm rate for the commonly used technique RS Steganalysis is 2.4.

Multiple masks based pixel comparison steganalysis method for mobile imaging

Steganalysis has many challenges; which include the accurate and efficient detection of hidden content within digital images. This paper focuses on the development of a new multi pixel comparison method used for the detection of steganographic content within digital images transmitted over mobile channels. The sensitivity of detecting hidden information within a digital image can be increased or decreased to determine if slight changes have been made to the digital image for the target of blind steganalysis. The key thought of the presented method is to increase the sensitivity of features when alterations are made within the bit planes of a digital image. The differences between the new method and existing pixel comparison methods are; multiple masks of different sizes are used to increase the sensitivity and weighted features are used to improve the classification of the feature sets. Weights are also used with the various pixel comparisons to ensure proper sensitivity when detecting small changes. The article also investigates the reliability of detection and estimation length of hidden data within wireless digital images with potential for military applications emphasizing on defense and security.

Classifier dependent feature preprocessing methods

In mobile applications, computational complexity is an issue that limits sophisticated algorithms from being implemented on these devices. This paper provides an initial solution to applying pattern recognition systems on mobile devices by combining existing preprocessing algorithms for recognition. In pattern recognition systems, it is essential to properly apply feature preprocessing tools prior to training classification models in an attempt to reduce computational complexity and improve the overall classification accuracy. The feature preprocessing tools extended for the mobile environment are feature ranking, feature extraction, data preparation and outlier removal. Most desktop systems today are capable of processing a majority of the available classification algorithms without concern of processing while the same is not true on mobile platforms. As an application of pattern recognition for mobile devices, the recognition system targets the problem of steganalysis, determining if an image contains hidden information. The measure of performance shows that feature preprocessing increases the overall steganalysis classification accuracy by an average of 22%. The methods in this paper are tested on a workstation and a Nokia 6620 (Symbian operating system) camera phone with similar results.

Steganalysis feature improvement using expectation maximization

Images and data files provide an excellent opportunity for concealing illegal or clandestine material. Currently, there are over 250 different tools which embed data into an image without causing noticeable changes to the image. From a forensics perspective, when a system is confiscated or an image of a system is generated the investigator needs a tool that can scan and accurately identify files suspected of containing malicious information. The identification process is termed the steganalysis problem which focuses on both blind identification, in which only normal images are available for training, and multi-class identification, in which both the clean and stego images at several embedding rates are available for training. In this paper an investigation of a clustering and classification technique (Expectation Maximization with mixture models) is used to determine if a digital image contains hidden information. The steganalysis problem is for both anomaly detection and multi-class detection. The various clusters represent clean images and stego images with between 1% and 10% embedding percentage. Based on the results it is concluded that the EM classification technique is highly suitable for both blind detection and the multi-class problem.