Haodong Li

Adaptive steganalysis against WOW embedding algorithm

WOW (Wavelet Obtained Weights) [5] is one of the advanced steganographic methods in spatial domain, which can adaptively embed secret message into cover image according to textural complexity. Usually, the more complex of an image region, the more pixel values within it would be modified. In such a way, it can achieve good visual quality of the resulting stegos and high security against typical steganalytic detectors. Based on our analysis, however, we point out one of the limitations in the WOW embedding algorithm, namely, it is easy to narrow down those possible modified regions for a given stego image based on the embedding costs used in WOW. If we just extract features from such regions and perform analysis on them, it is expected that the detection performance would be improved compared with that of extracting steganalytic features from the whole image. In this paper, we first proposed an adaptive steganalytic scheme for the WOW method, and use the spatial rich model (SRM) based features [4] to model those possible modified regions in our experiments. The experimental results evaluated on 10,000 images have shown the effectiveness of our scheme. It is also noted that our steganalytic strategy can be combined with other steganalytic features to detect the WOW and/or other adaptive steganographic methods both in the spatial and JPEG domains.

A universal image forensic strategy based on steganalytic model

Image forensics have made great progress during the past decade. However, almost all existing forensic methods can be regarded as the specific way, since they mainly focus on detecting one type of image processing operations. When the type of operations changes, the performances of the forensic methods usually degrade significantly. In this paper, we propose a universal forensics strategy based on steganalytic model. By analyzing the similarity between steganography and image processing operation, we find that almost all image operations have to modify many image pixels without considering some inherent properties within the original image, which is similar to what in steganography. Therefore, it is reasonable to model various image processing operations as steganography and it is promising to detect them with the help of some effective universal steganalytic features. In our experiments, we evaluate several advanced steganalytic features on six kinds of typical image processing operations. The experimental results show that all evaluated steganalyzers perform well while some steganalytic methods such as the spatial rich model (SRM) [4] and LBP [19] based methods even outperform the specific forensic methods significantly. What is more, they can further identify the type of various image processing operations, which is impossible to achieve using the existing forensic methods.

Adaptive Steganalysis Based on Embedding Probabilities of Pixels

In modern steganography, embedding modifications are highly concentrated on the textural regions within an image, as such regions are difficult to model for steganalysis. Previous studies have shown that compared with non-adaptive strategies, this content adaptive strategy achieves stronger security against existing steganalysis. Based on the experiments and analyses, however, we found that this embedding property would inevitably lead to a large limitation in existing adaptive steganography. That is, it is possible for steganalyzers to estimate the regions that have probably been modified after data hiding. In this paper, we propose an adaptive steganalytic scheme based on embedding probabilities of pixels. The main idea of our scheme is that we assign different weights to different pixels in feature extraction. For those pixels with high embedding probabilities, their corresponding weights are larger, since they should contribute more to steganalysis and vice versa. By doing so, we can concentrate our attention on the regions that have probably been modified and significantly reduce the impact of other unchanged smooth regions. It is expected that our proposed method is an improvement on the existing steganalytic methods, which usually assume every pixel has the same contribution to steganalysis. The extensive experiments evaluated on four typical adaptive steganographic methods have shown the effectiveness of the proposed scheme, especially for low embedding rates, for example, lower than 0.20 bpp.

Countering anti-JPEG compression forensics

The quantization artifacts and blocking artifacts are the two significant properties in the JPEG compressed images. Most relative forensic techniques usually use such inherent properties to provide some evidences on how image data is acquired and/or processed. A wise attacker, however, may perform some post-operations to confuse the two artifacts to fool current forensic techniques. Recently, Stamm et al. in [1] propose a novel anti-JPEG compression method via adding anti-forensic dither to the DCT coefficients and further reducing the blocking artifacts. In this paper, we found that the dithering operation will inevitably destroy the statistical correlations among the 8 × 8 intrablock and interblock within an image. In the view of JPEG steganalysis, we employ the transition probability matrix of the DCT coefficients to measure such modifications for identifying the forged images from those original JPEG decompressed images and uncompressed ones. On average, we can obtain a detection accuracy as high as 99% on the image database of UCID [2].

Image Forgery Localization via Integrating Tampering Possibility Maps

Over the past decade, many efforts have been made in passive image forensics. Although it is able to detect tampered images at high accuracies based on some carefully designed mechanisms, localization of the tampered regions in a fake image still presents many challenges, especially when the type of tampering operation is unknown. Some researchers have realized that it is necessary to integrate different forensic approaches in order to obtain better localization performance. However, several important issues have not been comprehensively studied, for example, how to select and improve/readjust proper forensic approaches, and how to fuse the detection results of different forensic approaches to obtain good localization results. In this paper, we propose a framework to improve the performance of forgery localization via integrating tampering possibility maps. In the proposed framework, we first select and improve two existing forensic approaches, i.e., statistical feature-based detector and copy-move forgery detector, and then adjust their results to obtain tampering possibility maps. After investigating the properties of possibility maps and comparing various fusion schemes, we finally propose a simple yet very effective strategy to integrate the tampering possibility maps to obtain the final localization results. The extensive experiments show that the two improved approaches used in our framework significantly outperform the state-of-the-art techniques, and the proposed fusion results achieve the best

Identification of Various Image Operations Using Residual-Based Features

\mathrm {F_{1}}

Anti-forensics of double JPEG compression with the same quantization matrix

-score in the IEEE IFS-TC Image Forensics Challenge.

Audio Steganalysis with Convolutional Neural Network

Image forensics has attracted wide attention during the past decade. However, most existing works aim at detecting a certain operation, which means that their proposed features usually depend on the investigated image operation and they consider only binary classification. This usually leads to misleading results if irrelevant features and/or classifiers are used. For instance, a JPEG decompressed image would be classified as an original or median filtered image if it was fed into a median filtering detector. Hence, it is important to develop forensic methods and universal features that can simultaneously identify multiple image operations. Based on extensive experiments and analysis, we find that any image operation, including existing anti-forensics operations, will inevitably modify a large number of pixel values in the original images. Thus, some common inherent statistics such as the correlations among adjacent pixels cannot be preserved well. To detect such modifications, we try to analyze the properties of local pixels within the image in the residual domain rather than the spatial domain considering the complexity of the image contents. Inspired by image steganalytic methods, we propose a very compact universal feature set and then design a multiclass classification scheme for identifying many common image operations. In our experiments, we tested the proposed features as well as several existing features on 11 typical image processing operations and four kinds of anti-forensic methods. The experimental results show that the proposed strategy significantly outperforms the existing forensic methods in terms of both effectiveness and universality.

Localization of Diffusion-Based Inpainting in Digital Images

Double JPEG compression detection plays an important role in digital image forensics. Recently, Huang et al. (IEEE Trans Inf Forensics Security 5(4):848–856, 2010) first pointed out that the number of different discrete cosine transform (DCT) coefficients would monotonically decrease when repeatedly compressing a JPEG image with the same quantization matrix, and a strategy based on random permutation was developed to expose such an operation successfully. In this paper, we propose an anti-forensic method to fool this method. The proposed method tries to slightly modify the DCT coefficients for confusing the traces introduced by double JPEG compression with the same quantization matrix. By investigating the relationship between the DCT coefficients of the first compression and those of the second one, we determine the quantity of modification by constructing a linear model. Furthermore, in order to improve the security of anti-forensics, the locations of modification are adaptively selected according to the complexity of the image texture. The extensive experiments evaluated on 10,000 natural images have shown that the proposed method can effectively confuse the detector proposed in Huang et al. (IEEE Trans Inf Forensics Security 5(4):848–856, 2010), while keeping higher visual quality and leaving fewer other detectable statistical artifacts.

Anti-forensics of JPEG Detectors via Adaptive Quantization Table Replacement

In recent years, deep learning has achieved breakthrough results in various areas, such as computer vision, audio recognition, and natural language processing. However, just several related works have been investigated for digital multimedia forensics and steganalysis. In this paper, we design a novel CNN (convolutional neural networks) to detect audio steganography in the time domain. Unlike most existing CNN based methods which try to capture media contents, we carefully design the network layers to suppress audio content and adaptively capture the minor modifications introduced by ±1 LSB based steganography. Besides, we use a mix of convolutional layer and max pooling to perform subsampling to achieve good abstraction and prevent over-fitting. In our experiments, we compared our network with six similar network architectures and two traditional methods using handcrafted features. Extensive experimental results evaluated on 40,000 speech audio clips have shown the effectiveness of the proposed convolutional network.