Matthias Carnein

Predictable rain?: steganalysis of public-key steganography using wet paper codes

Symmetric steganographic communication requires a secret stego-key pre-shared between the communicating parties. Public-key steganography (PKS) overcomes this inconvenience. In this case, the steganographic security is based solely on the underlying asymmetric encryption function. This implies that the embedding positions are either public or hidden by clever coding, for instance using Wet Paper Codes (WPC), but with public code parameters. We show that using WPC with efficient encoding algorithms may leak information which can facilitate an attack. The public parameters allow an attacker to predict among the possible embedding positions the ones most likely used for embedding. This approach is independent of the embedding operation. We demonstrate it for the case of least significant bit (LSB) replacement and present two new variants of Weighted Stego-Image (WS) steganalysis specifically tailored to detect PKS using efficient WPC. Experiments show that our WS variants can detect PKS with higher accuracy than known methods, especially for low embedding rates. The attack is applicable even if a hybrid stegosystem is constructed and public-key cryptography is only used to encapsulate a secret stego-key.

An Empirical Comparison of Stream Clustering Algorithms

Analysing streaming data has received considerable attention over the recent years. A key research area in this field is stream clustering which aims to recognize patterns in a possibly unbounded data stream of varying speed and structure. Over the past decades a multitude of new stream clustering algorithms have been proposed. However, to the best of our knowledge, no rigorous analysis and comparison of the different approaches has been performed. Our paper fills this gap and provides extensive experiments for a total of ten popular algorithms. We utilize a number of standard data sets of both, real and synthetic data and identify key weaknesses and strengths of the existing algorithms.

Forensics of high-quality JPEG images with color subsampling

Detecting prior compression is an essential task in image forensics and can be used to detect forgery in digital images. Many approaches focus on grayscale images and assume compressions with a low quality factor which often leave visible artifacts in the image. In practice, however, color images and high quality compression are much more relevant and widespread. Block convergence has been proposed to estimate the number of JPEG compressions with quality factor 100 for grayscale images and has been shown to produce accurate results [1]. This paper extends block convergence to the more relevant case of color images where chrominance subsampling and color conversion make the estimation more complex. By observing block convergence for macro-blocks over multiple recompressions we are able to produce accurate estimates for color images. Oftentimes block convergence for color images enables similar accuracy and allows to detect more recompressions compared to grayscale images, while maintaining a good distinction between never and once compressed images.

Telltale Watermarks for Counting JPEG Compressions

Telltale watermarks allow to infer how a watermarked signal has been altered on the channel by analyzing the distortion applied to the watermark. We propose a new kind of telltale watermark for digital images that tracks the number of JPEG (re-)compressions. Our watermarks leverage peculiarities in the convergence behavior of JPEG images. We show that it is possible to generate or find combinations of pixel values which form so called “counter blocks”. Counter blocks cycle predictably through a fixed number of states in subsequent JPEG compression and decompression operations. By combining counter blocks with different cycle lengths in one image, we are able to track the number of JPEG (re-)compressions in extended ranges. We evaluate the accuracy of counter blocks, discuss pitfalls when embedding them, and study the construction of counter blocks with specified cycle lengths. Introduction When repeatedly compressing and decompressing digital images with the popular JPEG standard, we typically observe that the pixel values converge after a certain number of compressions. This phenomenon has been previously used in image forensics to estimate the number of times an image has been (re-)compressed. However, for color images, using chrominance subsampling with a linear interpolation of chrominance values, we observe that some blocks do not converge. Instead they cycle through a fixed number of states. This is because the chrominance interpolation introduces an error which can interfere with the convergence of blocks. Such cyclic blocks enable interesting application scenarios. In this paper we explore the usage of these cyclic blocks as a new form of telltale watermark. In contrast to fragile watermarks, where detection of the watermark fails as soon as the image is illegitimately modified, telltale watermarks are used to track the kind of modification a watermarked image has undergone. Our telltale watermark is able to accurately count how often an image has been JPEG compressed. This is accomplished by placing cyclic blocks of different cycle length in an image. By observing in which state these blocks are, it is possible to determine how often the image has been (re-)compressed up to a very large number. Depending on the appearance of the blocks, they can either be embedded into the content of the image or placed as control blocks in a dedicated area. Alternatively, it is possible to find already existing cyclic blocks in a given image and use them as a completely non-intrusive watermark. Tracking JPEG compressions up to a very large number gives way for new applications. For example, one can create a hop count based on the number of JPEG compressions or a fingerprinting algorithm where each copy is JPEG compressed a different number of times. Furthermore, one could imagine a versioning application where an image is JPEG compressed every time a new version is committed or forwarded in social media platforms. Finally, the number of compressions is interesting to the field of image forensics, as it can indicate how often an image has been opened and saved with image editing software. We show that the cyclic blocks can track the number of compressions very accurately for up to thousands of JPEG compressions. Further, we evaluate the proposed counter blocks regarding their robustness against spill-over effects, i.e. distortions that can occur during JPEG compressions with chrominance subsampling. We show that by properly padding the counter blocks, they can be successfully protected from spill-over. Finally, we evaluate how robust the watermark is against active tampering. The remainder of this paper is organized as follows: Section 2 introduces the notation and describes different types of digital watermarks and their use case. Additionally, the phenomenon of block convergence is described. Section 3 describes the discovered peculiarity in block convergence and uses it to construct a telltale watermark that allows to count the number of JPEG compressions. Then, Section 4 evaluates the proposed watermark regarding its robustness against compression errors and tampering. Finally, Section 5 concludes with a summary of the results and an outlook on future research. Related Work Notation In the following, matrices and vectors are denoted by boldface symbols. The inverse of a matrix x is denoted x−1 and its transposition xT . Throughout this paper, images are JPEG compressed and decompressed various times. To indicate the number of compressions, the superscript (t) is used to denote an object of the t-th JPEG compression and decompression cycle. Digital Watermarks Digital watermarks have been traditionally used to protect the authenticity of media data in order to enforce copyright and indicate the ownership of a digital multimedia signal. The main security property of such watermarks is their robustness against tampering or noise. Attempts to remove or distort a robust watermark should lead to a degradation of quality of the media data itself to the point where it is no longer usable and all its value is lost. This ensures that the watermark always remains present in the multimedia signal and the only way to remove it without knowledge of the secret key, is to destroy the signal altogether. Additionally, watermarks can be used to protect the integrity of media data, i.e. to verify that the multimedia signal has not been modified or tampered with. This is typically achieved by using fragile watermarks, which are designed to be destroyed if the media data undergoes any form of modification. This ensures that the watermark can only be detected if the signal is complete and unmodified, whereas the probability that a tampered signal contains the watermark is negligible. Fragile watermarks are useful to prevent any form of modification on the watermarked signal. However, it is often helpful to prevent only specific operations while allowing others. For example, the author of an image likely approves that the image is compressed in order to achieve a smaller file size. However, the author most likely wants to prevent that parts of the image are removed or added. Such a selective approach can be achieved by using semi-fragile watermarks that distinguish between legitimate and illegitimate distortions. Semi-fragile watermarks are designed to survive legitimate distortion while being destroyed by illegitimate. Therefore, only signals that have undergone legitimate transformations will contain the watermark. Another type of watermark that shares a similar goal as semifragile watermarks but allows a more informed decision making is a telltale watermark. Its aim is to detect how an image was modified rather than whether it was modified [5]. Telltale watermarks utilize the fact that the watermark undergoes the same transformation as the host signal [1]. By analyzing the distortion applied to the watermark, it is possible to estimate which operation and distortion was applied to the signal and by this, to decide whether the distortion can be considered legitimate or not. Despite its usefulness, very limited research has been done on telltale watermarks. This is mostly because it is difficult to design a watermark that allows to draw meaningful conclusions from the distortion. Additionally, there appears to be disagreement on how to classify telltale watermarks among the existing literature. While some see telltale watermarks as a separate category alongside (semi-)fragile and robust watermarks [5], it was originally introduced as a form of fragile watermark [11]. The general notion and first example of a telltale watermark has been introduced by Kundur and Hatzinakos [10, 11] in 1998. The authors propose to embed a watermark in the discrete wavelet domain by quantizing selected wavelet coefficients in different subbands. By analyzing in which subbands the watermark bits have been corrupted, it is possible to hypothesize which operation was performed. This is because different operations affect different subbands. For example, JPEG compression neglects information of higher frequencies and therefore corrupts the watermark bits in those frequency ranges [10]. On the other hand, if regions are replaced or changed, the lower frequencies will also differ. Other examples of telltale watermarks are localization watermarks that allow to identify the regions of the signal that have been corrupted [5, p. 410]. We believe that the best way to classify telltale watermarks is to see them as a sub-category or extension of semi-fragile watermarks. This seems intuitive since both types of watermarks are destroyed by certain distortions. The main difference is that semifragile watermarks merely survive legitimate distortions, i.e. are binary detectors. Telltale watermarks, on the other hand, further allow to derive information based on the condition of the modified watermark, i.e. are parametric detectors. JPEG Block Convergence Digital watermarks can generally be embedded in any digital signal. In this paper, we focus on the common case of digital images. More precisely we investigate images that are compressed with the popular image compression standard JPEG. JPEG speciJPEG JPEG JPEG Block

Towards Efficient and Informative Omni-Channel Customer Relationship Management

Nowadays customers expect a seamless interaction with companies throughout all available communication channels. However, many companies rely on different software solutions to handle each channel, which leads to heterogeneous IT infrastructures and isolated data sources. Omni-Channel CRM is a holistic approach towards a unified view on the customer across all channels. This paper introduces three case studies which demonstrate challenges of omni-channel CRM and the value it can provide. The first case study shows how to integrate and visualise data from different sources which can support operational and strategic decision. In the second case study, a social media analysis approach is discussed which provides benefits by offering reports of service performance across channels. The third case study applies customer segmentation to an online fashion retailer in order to identify customer profiles.

evoStream - Evolutionary Stream Clustering Utilizing Idle Times

Abstract Clustering is an important field in data mining that aims to reveal hidden patterns in data sets. It is widely popular in marketing or medical applications and used to identify groups of similar objects. Clustering possibly unbounded and evolving data streams is of particular interest due to the widespread deployment of large and fast data sources such as sensors. The vast majority of stream clustering algorithms employ a two-phase approach where the stream is first summarized in an online phase. Upon request, an offline phase reclusters the aggregations into the final clusters. In this setup, the online component will idle and wait for the next observation in times where the stream is slow. This paper proposes a new stream clustering algorithm called evoStream which performs evolutionary optimization in the idle times of the online phase to incrementally build and refine the final clusters. Since the online phase would idle otherwise, our approach does not reduce the processing speed while effectively removing the computational overhead of the offline phase. In extensive experiments on real data streams we show that the proposed algorithm allows to output clusters of high quality at any time within the stream without the need for additional computational resources.

Stream Clustering of Chat Messages with Applications to Twitch Streams

This paper proposes a new stream clustering algorithm for text streams. The algorithm combines concepts from stream clustering and text analysis in order to incrementally maintain a number of text droplets that represent topics within the stream. Our algorithm adapts to changes of topic over time and can handle noise and outliers gracefully by decaying the importance of irrelevant clusters. We demonstrate the performance of our approach by using more than one million real-world texts from the video streaming platform Twitch.tv.