Existing Steganalysis Methods Research Articles

A convolutional neural network to detect possible hidden data in spatial domain images

Hiding secret data in digital multimedia has been essential to protect the data. Nevertheless, attackers with a steganalysis technique may break them. Existing steganalysis methods have good results with conventional Machine Learning (ML) techniques; however, the introduction of Convolutional Neural Network (CNN), a deep learning paradigm, achieved better performance over the previously proposed ML-based techniques. Though the existing CNN-based approaches yield good results, they present performance issues in classification accuracy and stability in the network training phase. This research proposes a new method with a CNN architecture to improve the hidden data detection accuracy and the training phase stability in spatial domain images. The proposed method comprises three phases: pre-processing, feature extraction, and classification. Firstly, in the pre-processing phase, we use spatial rich model filters to enhance the noise within images altered by data hiding; secondly, in the feature extraction phase, we use two-dimensional depthwise separable convolutions to improve the signal-to-noise and regular convolutions to model local features; and finally, in the classification, we use multi-scale average pooling for local features aggregation and representability enhancement regardless of the input size variation, followed by three fully connected layers to form the final feature maps that we transform into class probabilities using the softmax function. The results identify an improvement in the accuracy of the considered recent scheme ranging between 4.6 and 10.2% with reduced training time up to 30.81%.

Towards blind detection of steganography in low‐bit‐rate speech streams

To prevent the abuse of low-rate speech-based steganography from threatening cyberspace security, the corresponding steganalysis approaches have been developed and received significant attention from research community. However, most existing steganalysis methods assume that steganography methods are known in advance, which in practice is impractical. That is why, in this paper, we present three blind detection schemes suitable for steganography in low-bit-rate speech streams. The first is based on mixed sample data augmentation. It randomly selects a certain proportion of steganographic samples from the sample set of each steganographic method to form a training set together with the original carrier samples for training to enhance the robustness of the model. The second relies on decision fusion where first step is to train a dedicated classification model for each steganography method and then use a majority voting mechanism in the detection stage to fuse the outputs of each model to give the final detection result. Compared to the other two steganalysis schemes, the third one design the detection model based on self-paced ensemble according to the distribution characteristics of speech samples. Its main idea is to fully train multiple base classifiers through multiple iterations as well as under-sampling processes, and organically fuse them to form a powerful ensemble classifier. In each iteration, differing from the traditional ensemble classifier solution, we put more attention to the steganographic samples at the decision boundary for the under-sampling process of the steganography set composed of multiple steganography methods, rather than randomly selecting steganographic samples. The steganographic samples at the decision boundary are searched using the classification hardness given by the ensemble classifier trained in the last iteration, which is more informative and more conducive to improve the performance of base classifiers. The experimental results show that the proposed three schemes can achieve efficient blind detection for low-bit-rate speech-based steganography, and the steganalysis scheme based on the self-paced ensemble has the best performance. Specifically, when the embedding rate is at 30%, the accuracy of the steganalysis scheme based on self-paced ensemble is more than 85%, while the accuracy of the other two steganalysis method is less than 80%. Additionally, the steganalysis scheme based on the self-paced ensemble learning even outperforms dedicated detectors for specific steganographic methods in terms of recall for steganographic sample detection.

Steganalysis of Compressed Speech Based on Global and Local Correlation Mining

Most of the existing steganalysis methods are designed for specific steganography methods in low-bit-rate compressed speech stream and lack of generalization ability. In practical applications, the steganography methods in compressed speech are various and cannot be predicted in advance. We can only employ numerous possible steganalysis method to detect, which is laborious and time-consuming, and cannot achieve real-time detection. Therefore, it is necessary to develop a general steganalysis method that can detect multiple steganography methods simultaneously for compressed speech. To this end, we propose a steganalysis method based on global and local correlation mining in this paper. Firstly, we introduce a codeword distributed embedding module to transform the compressed codewords into a compact feature representation. Then, we propose global-guided correlation mining module and local-guided correlation mining module to extract the correlation change before and after steganography in the view of global and local. Finally, the detection results can be obtained by the full connection layers. Experimental results show that the proposed method can reach a better detection performance than the existing steganalysis methods at different embedding rates and speech lengths.

Detecting Multiple Steganography Methods in Speech Streams Using Multi-Encoder Network

With the development of speech steganography technology, steganographers are more and more inclined to realize more secure covert communication by combining a series of steganography methods. Thus, this letter presents a novel multi-encoder network (MENet) to achieve more efficient detection of multiple steganography methods. Differing from the previous work, MENet utilizes multiple private encoders to individually model the private features of each coding element, introduces a shared encoder based on an attention mechanism to fuse multiple private features for achieving better feature representation, and finally exploits a shared decoder to reduce feature dimensionality as well as give predictions. Taking the existing state-of-the-art steganography methods as the detection targets, the performance of the proposed steganalysis method is evaluated comprehensively and compared with the state-of-the-art ones. The experimental results show that the detection performance of MENet is overall better than the existing steganalysis methods, especially with low embedding rates and short speech sample lengths.

General Frame-Wise Steganalysis of Compressed Speech Based on Dual-Domain Representation and Intra-Frame Correlation Leaching

Frame-wise steganalysis is of significance for active steganography defense. By frame-wise detection, we can accurately find the embedding position of secret information and destroy the covert channel further. However, there is currently no research specifically aiming at frame-wise steganalysis of low-bit-rate compressed speech. Besides, most of the existing steganalysis methods are specifically designed for a specific category of steganography methods. They are difficult to apply to practical scenarios where the steganography algorithms are uncertain. In this paper, a general frame-wise steganalysis method for low-bit-rate compressed speech is proposed. To extract rich feature from a speech frame, we propose a dual-domain representation, which conducts feature extraction both in the compressed domain and the decoded time domain. In addition, we propose an efficient steganalysis network named Stegaformer to leach the intra-frame correlation from the obtained representation to enable steganalysis. In Stegaformer, an adaptive local correlation enhancement module is introduced to effectively models the local characteristics, which compensates for the drawback of traditional Transformer-based models. Experimental results show that our method performs better than the existing steganalysis methods in detecting multiple steganography methods for a speech frame.

Detection of Multiple Steganography Methods in Compressed Speech Based on Code Element Embedding, Bi-LSTM and CNN With Attention Mechanisms

Steganographic algorithms in low-bit-rate compressed speech bring convenience to realize covert communication, meanwhile result in safety issues. The existing steganalysis methods are normally designed for one specific category of steganographic methods, thus lacking generalization capability. In this paper, we propose a general steganalysis method based on code element (CE) embedding, Bi-LSTM and CNN with attention mechanisms. Firstly, CEs in each frame are converted to a multi-hot vector. And each multi-hot vector will be mapped into a fixed-length embedding vector to get a more compact representation by utilizing dictionaries. Then, Bi-LSTM and CNN are applied to extract the contextual information and the local characteristics respectively of these embedding vectors. In addition, the attention mechanisms are introduced in different layers of the network to assign different weights to the output feature within each layer. Finally, the prediction results can be generated by the fully connected layer. Experimental results show that our method performs better than the existing steganalysis methods for detecting multiple steganography methods in the low-bit-rate compressed speech streams.

Detection of heterogeneous parallel steganography for low bit-rate VoIP speech streams

This paper considers a new task of detecting heterogeneous parallel steganography (HPS) on streaming media. This task is to detect the existence of the confidential messages hidden in the frames of streaming media with multiple kinds of orthogonal steganographic methods. We target on detecting HPS in this work for low bit-rate Voice over Internet Protocol (VoIP) speech streams, which is a widely-used streaming medium. Specifically, two steganographic methods, i.e., Quantization Index Modulation and Pitch Modulation Steganography, are utilized to form the HPS. Detecting HPS on low bit-rate VoIP speech streams is challenging for existing steganalysis methods. To accomplish the target, we propose a novel deep model named as Steganalysis Feature Fusion Network (SFFN). SFFN consists of three sub-networks, i.e., a feature learning network, a feature fusion network and a classification network. With the three sub-networks, SFFN can effectively extract steganalysis features for the steganographic methods used in HPS and can fuse the features to make credible prediction. The experimental results demonstrate that our method is superior to the state-of-the-art steganalysis methods when detecting HPS. Besides, our method meets the requirement of real-time detection.

A Coverless Image Information Hiding Algorithm Based on Fractal Theory

To improve the robustness and imperceptibility of the existing coverless image information hiding, a generative coverless image information hiding algorithm based on fractal theory is proposed in this paper. Firstly, four fractal image generation methods are analyzed, and the relationship between the coverless information hiding and these methods is discussed. Secondly, based on the fractal image generation algorithm, secret information is hidden by controlling pixel rendering during the generation process. The robustness, imperceptibility, and capability of resisting steganalysis are balanced by adjusting the rendering distance. As it directly generates stego images, this can resist the detection of most existing steganalysis methods. Meanwhile, different capacities can be achieved by adjusting the size of the generated image. Experimental results and analysis show that the proposed scheme can effectively resist steganalysis and has good robustness against various image attacks. Furthermore, it can achieve large capacity, and it has broad prospects for covert communication.

A Common Method for Detecting Multiple Steganographies in Low-Bit-Rate Compressed Speech Based on Bayesian Inference

Analysis-by-synthesis linear predictive coding (AbS-LPC) is widely used in a variety of low-bit-rate speech codecs. The existing steganalysis methods for AbS-LPC low-bit-rate compressed speech steganography are specifically designed for one certain category of steganography methods, thus lacking generalization capability. In this paper, a common method for detecting multiple steganographies in low-bit-rate compressed speech based on a code element Bayesian network is proposed. In an AbS-LPC low-bit-rate compressed speech stream, spatiotemporal correlations exist between the code elements, and steganography will eventually change the values of these code elements. Thus, the method presented in this paper is developed from the code element perspective. It consists of constructing a code element Bayesian network based on the strong correlations between code elements, learning the network parameters by utilizing a Dirichlet distribution as the prior distribution, and finally implementing steganalysis based on Bayesian inference. Experimental results demonstrate that the proposed method performs better than the existing steganalysis methods for detecting multiple steganographies in the AbS-LPC low-bit-rate compressed speech.

Coverless Image Steganography Using Histograms of Oriented Gradients-Based Hashing Algorithm

The traditional image steganography approaches usually need a cover image so that the secret information can be imperceptibly embedded into it for secret communication. However, by utilizing the embedding traces left in the cover image, the existence of secret information could be successfully determined by steganalysis methods. To resist the existing steganalysis methods, a coverless image steganography approach is proposed using histograms of oriented gradients (HOGs)-based hashing algorithm. More specially, instead of designating a cover image for secret information embedding, the original images whose hash sequences equal to the secret information are directly selected from a large-scale database, which can be used as the stego-images for secret communication. In this approach, each image's hash sequences are obtained from its non-overlapping blocks by using the HOGs-based hashing algorithm. Both the theoretical analysis and experiments demonstrate that our coverless image steganography approach has good resistance to the existing steganalysis methods, and has good security and strong robustness to the common attacks such as resampling, brightness and contrast change, smoothing as well as addition of Gaussian noise.

Multilayer ensemble of ELMs for image steganalysis with multiple feature sets

A multilayer ensemble of extreme learning machines (ELMs) for multi-class image steganalysis is proposed in this paper. The proposed ensemble consists of three levels and uses multiple feature sets extracted from images. The first two layers form sub-ensembles, one sub-ensemble for each of the feature sets. Each feature set is partitioned and used with multiple ELMs at level-1. These feature sets along with the output of the ELMs at level-1 are used by different ELMs at level-2 to classify images into multiple classes. To combine these results from sub-ensembles a stacking technique is used. Results of level-2 ELMs are used as input for the last level ELM. The fast learning process of ELM aids the speedy execution of the proposed method. Performance of the proposed method is compared with existing steganalysis methods based on individual feature sets and on 2-level ensemble. The experimental study demonstrates that the proposed method classifies images into multiple classes with higher accuracy and this has been confirmed using t-test with 99% confidence.

Content‐adaptive steganalysis for color images

AbstractSome steganography methods for gray‐scale image can be extended to true RGB color image by treating each of its three color channels as a gray‐scale image. In modern popular steganography, most embedding changes are highly concentrated on those complex textural regions with smaller embedding distortions. However, the existing steganalysis methods for color images directly extract steganalytic features from the whole image. In this paper, we propose a content‐adaptive steganalysis strategy for color images. The new strategy aims to extract spatial rich model features from each color channel and just extract color rich model features from the pixels that may have been modified. In order to locate those suspected pixels, we first calculate the embedding costs of each channel, and then a subset of pixels with smaller embedding costs is selected. Experimental results show that the proposed strategy performs better than the state‐of‐the‐art color image steganalysis method. Copyright © 2017 John Wiley & Sons, Ltd.

Generic attack against robust steganography based on spring transform and geometrization

There have been many robust image steganography methods that are invented in recent decades. However, this technique also may be used by malicious users to transmit dangerous information through the Internet beyond the control of the security agencies. How to detect and/or block potentially dangerous information transmission on the Internet through billions of images while not affecting the normal digital images becomes a challenging problem. Existing steganalysis methods or steganography attacking methods cannot be used for analyzing a large volume of digital images in a short time. In this paper, we propose an effective steganography attacking method that is not limited by the types of the steganography method. The proposed method can process the digital images to remove the potentially dangerous hidden information while keeping the digital image in a high visual quality. Inspired by the way in which printers and scanners work, our method decouples the human visual perception and the digital image's numerical values. It causes the numerical values of the image to change dramatically, and then the hidden information are largely damaged, while at the same time, the visual image quality can be maintained. Our experimental results have demonstrated that the peak signal-to-noise ratio of images can be above 32dB while the stego data are destroyed. Copyright © 2016 John Wiley & Sons, Ltd.

Steganalysis against substitution-based linguistic steganography based on context clusters

Linguistic steganalysis has been an increasing interest stimulated by the emerging research area of linguistic steganography during the past few years. However, due to limitations of computer natural language processing capability, linguistic steganalysis is a challenging task. Existing steganalysis methods are inefficient to analyze most substitution-based linguistic steganography methods which preserve the syntactic and semantic correctness of cover texts. This paper provides a new steganalysis scheme against substitution-based linguistic steganography based on context clusters. In this scheme, we introduce context clusters to estimate the context fitness and show how to use the statistics of context fitness values to distinguish between normal texts and stego texts. Finally, under this scheme, we present the steganalysis method for synonym substitution-based linguistic steganography. Our experimental results show that the proposed steganalysis method can analyze synonym substitution-based linguistic steganography efficiently and the steganalysis accuracy reaches as high as 98.86%.

Steganalysis of adaptive image steganography in multiple gray code bit-planes

For detecting the MBPIS (multiple bit-planes image steganography), which embeds the messages into the multiple Gray code bit-planes, a steganalysis method is proposed to estimate the embedding ratios based on sample pairs analysis. The proposed method combines appropriate trace sets of a more elegant and pellucid sample pair analysis model to estimate the modification ratio of each natural binary bit-plane. Then the modification ratios in Gray code bit-planes are estimated from the modification ratios in natural binary bit-planes based on the relationship between natural binary bit-planes and Gray code bit-planes. Finally, considering the matrix encoding in MBPIS, the embedding ratios are obtained from the modification ratios in Gray code bit-planes. Experimental results show that compared with existing steganalysis methods, the proposed method can not only detect the stego images of MBPIS more reliably, but also estimate the embedding ratios of MBPIS with smaller errors. When the embedding ratio in the first Gray code bit-plane is not less than 0.1, the average absolute error of the proposed method will less than it of the ID3SPA by 0.04 at least.

REAL-TIME STEGANALYSIS OF LSB-REPLACEMENT IN DIGITAL AUDIO STREAMS

Data hiding in the LSB of audio signals is an appealing steganographic method. This is due to the large volume of real-time production and transmission of audio data which makes it difficult to store and analyze these signals. Hence, steganalysis of audio signals requires online operations. Most of the existing steganalysis methods work on stored media files. In this paper, we present a steganalysis technique that can detect the existence of embedded data in the least significant bits of natural audio samples. The algorithm is designed to be simple, accurate, and to be hardware implementable. Hence, hardware implementation is presented for the proposed algorithm. The proposed hardware analyzes the histogram of an incoming stream of audio signals by using a sliding window strategy without needing the storage of the signals. The algorithm is mathematically modeled to show its capability to accurately predict the amount of embedding in an incoming stream of audio signals. Audio files with different amounts of embedded data were used to test the algorithm and its hardware implementation. The experimental results prove the functionality and high accuracy of the proposed method.