Steganalysis Method Research Articles

General Frame-Wise Steganalysis of Compressed Speech Based on Dual-Domain Representation and Intra-Frame Correlation Leaching

Frame-wise steganalysis is of significance for active steganography defense. By frame-wise detection, we can accurately find the embedding position of secret information and destroy the covert channel further. However, there is currently no research specifically aiming at frame-wise steganalysis of low-bit-rate compressed speech. Besides, most of the existing steganalysis methods are specifically designed for a specific category of steganography methods. They are difficult to apply to practical scenarios where the steganography algorithms are uncertain. In this paper, a general frame-wise steganalysis method for low-bit-rate compressed speech is proposed. To extract rich feature from a speech frame, we propose a dual-domain representation, which conducts feature extraction both in the compressed domain and the decoded time domain. In addition, we propose an efficient steganalysis network named Stegaformer to leach the intra-frame correlation from the obtained representation to enable steganalysis. In Stegaformer, an adaptive local correlation enhancement module is introduced to effectively models the local characteristics, which compensates for the drawback of traditional Transformer-based models. Experimental results show that our method performs better than the existing steganalysis methods in detecting multiple steganography methods for a speech frame.

Universal Deep Network for Steganalysis of Color Image Based on Channel Representation

Up to now, most existing steganalytic methods were designed for grayscale images, and are not suitable for the color images that are widely used in social networks. In this paper, we design a universal color image steganalysis network (called UCNet) for the spatial and JPEG domains. The proposed method includes preprocessing, convolutional, and classification modules. To preserve the steganalytic features in each color channel, the preprocessing module first separates the input image into three channels based on the corresponding embedding spaces (i.e., RGB in the spatial domain, and YCbCr in the JPEG domain), and then extracts the image residuals with 62 fixed high-pass filters. Finally, all truncated residuals are concatenated for subsequent analysis, rather than adding them together in the first layer as in existing CNN-based steganalyzers. To accelerate network convergence and effectively reduce the number of parameters, the convolutional module contains three carefully designed types of layers with different shortcut connections and group convolution structures, to further learn the high-level steganalytic features. In the classification module, we employ global average pooling and a fully connected layer for classification. We conduct extensive experiments on ALASKA II to demonstrate that the proposed method can achieve state-of-the-art results that are comparable with other modern CNN-based steganalyzers (e.g., SRNet and LC-Net) in both the spatial and JPEG domains, with relatively few memory requirements and short training times. Furthermore, we also provide some necessary descriptions and carry out numerous ablation experiments to verify the rationality of the network design.

SeSy: Linguistic Steganalysis Framework Integrating Semantic and Syntactic Features

With the rapid development of natural language processing technology and linguistic steganography, linguistic steganalysis gains considerable interest in recent years. Current advanced methods dominantly focus on statistical features in semantic view yet ignore syntax structure of text, which leads to limited performance to some newly statistically indistinguishable steganography algorithms. To fill this gap, in this paper, we propose a novel linguistic steganalysis framework named SeSy to integrate both <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">se</b> mantic and <bold xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">sy</b> ntactic features. Specifically, we propose to employ transformer-architecture language model as semantics extractor and leverage a graph attention network to retain syntactic features. Extensive experimental results show that owing to additional syntactic information, the SeSy framework effectively brings about remarkable improvement to current advanced linguistic steganalysis methods.

Steganalysis of neural networks based on parameter statistical bias

Many pretrained deep learning models have been released to help engineers and researchers develop deep learning-based systems or conduct research with minimall effort. Previous work has shown that at secret message can be embedded in neural network parameters without compromising the accuracy of the model. Malicious developers can, therefore, hide malware or other baneful information in pretrained models, causing harm to society. Hence, reliable detection of these vicious pretrained models is urgently needed. We analyze existing approaches for hiding messages and find that they will ineluctably cause biases in the parameter statistics. Therefore, we propose steganalysis methods for steganography on neural network parameters that extract statistics from benign and malicious models and build classifiers based on the extracted statistics. To the best of our knowledge, this is the first study on neural network steganalysis. The experimental results reveal that our proposed algorithm can effectively detect a model with an embedded message. Notably, our detection methods are still valid in cases where the payload of the stego model is low.

Consensus-Clustering-Based Automatic Distribution Matching for Cross-Domain Image Steganalysis

Image steganalysis is a technique to detect whether an image contains hidden information. Although the existing cross-domain steganalysis methods have been presented to narrow the distribution gap between different domains, it is still challenging to effectively capture the transferable steganalysis representations under the condition of severe distribution shifts. To address this issue, we propose a novel consensus-clustering-based automatic distribution matching scheme, called CADM, which can automatically and accurately match inconsistent distributions in cross-domain steganalysis scenarios. First, the original steganalysis features are clustered by the spatially constrained fuzzy <i>c</i>-means (SCFCM) algorithm with controllable parameters to fully perceive and mine inherent structural relationships. Subsequently, the cluster consensus knowledge is derived from the perspective of intra-domain and inter-domain to facilitate the clustering and the matching. In this way, the representations of weak stego signals can be augmented by identifying cluster centers that can be combined across domains. Ultimately, the cycle-consistent optimization and adaptation is achieved by gradually adjusting the learning strength of well-aligned and poorly-aligned samples to promote the positive transfer of overlapped clusters and prevent the negative transfer of outlier clusters. Furthermore, extensive experiments on various benchmark databases for cross-domain steganalysis demonstrate the superiority of CADM over the current state-of-the-art methods.

Small-Scale Linguistic Steganalysis for Multi-Concealed Scenarios

Recently, due to the considerable feature expression ability of neural networks, deep linguistic steganalysis methods have been greatly developed. However, there are still two issues that need to be ameliorated. First, the prevailing linguistic steganalysis methods rely heavily on massive training data, which is labor-intensive and time-consuming. Second, these methods implement steganalysis only in different weak-concealed scenarios, the stego texts in each of which have only a single language style and payload. But in practice, the intercepted network samples are probably the mixture of the stego texts that possess different language styles and payloads, in which the semantic spatial distribution may be more chaotic than that in weak-concealed scenarios, thus making steganalysis more difficult. To address the above issues, a novel linguistic steganalysis method is proposed in this letter. First, the pre-trained BERT language model is constructed as an embedder to compensate for the shortage of data. Then, in addition to learning local and global semantic features, a feature interaction module is designed for exploring mutual effects between them. Furthermore, besides the typical cross-entropy loss, triplet loss is also introduced for the model training. In this way, the proposed method can refine more comprehensive and discriminative deep features in the intricate semantic space. The performance of the proposed method is compared with the representative linguistic steganalysis methods on datasets of different scales, and the experimental results reveal the superiority of the proposed method.

Aggregating Local and Global Text Features for Linguistic Steganalysis

Existing linguistic steganalysis methods share a similar conceptual learning paradigm: namely, learning specific features derived from a word and its surrounding words, then passing them to the classifier. However, these features are unable to deal with the impact of the association between words and the corpus, which gives rise to significant limitations. In this paper, we discover the missing link between the words and the corpus, and accordingly propose a framework of linguistic steganalysis named LS-BGAT. Specifically, we fine-tune a large-scale pre-training BERT as the local feature extraction model and employ Graph Attention Network (GAT) as the global feature extraction model. Through ensuring collaboration between the local BERT-based features and the global GAT-based features in the joint prediction layer, we combine rich semantic and syntactic information at the sentence level with underlying global information at the corpus level. Furthermore, we extend the binary classification of steganalysis to multi-category classification, thereby enhancing practicality. We empirically substantiate the effectiveness and universality of LS-BGAT on three tasks.

HGA: Hierarchical Feature Extraction With Graph and Attention Mechanism for Linguistic Steganalysis

Linguistic steganalysis is an important topic in the field of information security and signal processing. In recent years, linguistic steganalysis have mainly utilized deep learning techniques and make great success. But suffer from the following major disadvantages. From the perspective of model structure, current methods only extract coarse features of the text, without focusing on the fine-grained representations. In terms of application, most of the studies only focus on single hidden scene and ignore the more realistic mixed hidden scenes which are more complex and realistic. These weaknesses limit the performance and the application of linguistic steganalysis in reality. In this paper, we propose a novel linguistic steganalysis method to overcome these weaknesses. This proposed method can extract distinguished text representation which fuses hierarchical features and perform excellently in sophisticated conditions. Firstly, we adapt gated graph neural networks as the coarse graph updater to update node representations on the graph level. Then we design a fine graph updater composed of the graph attention mechanism to focus on the highlighted nodes on the node-level. Moreover, we extract the most notable feature on the dimension-level of node by the graph channel attention module. Finally, the readout function is designed to fuse the hierarchical features and make the classification. The experimental results show that our method achieves the best results compared with the previous methods in both single hidden scene and mixed hidden scenes, which prove the effectiveness of the proposed method.

A Novel and Robust Hybrid Blockchain and Steganography Scheme

Data security and data hiding have been studied throughout history. Studies show that steganography and encryption methods are used together to hide data and avoid detection. Large amounts of data hidden in the cover multimedia distort the image, which can be detected in visual and histogram analysis. The proposed method will solve two major drawbacks of the current methods: the limitation imposed on the size of the data to be hidden in the cover multimedia and low resistance to steganalysis after stego-operation. In the proposed method, plaintext data are divided into fixed-sized bits whose corresponding matching bits’ indices in the cover multimedia are accumulated. Thus, the hidden data are composed of the indices in the cover multimedia, causing no change in it, thus enabling considerable amounts of plaintext to be hidden. The proposed method also has high resistance to known steganalysis methods because it does not cause any distortion to the cover multimedia. The test results show that the performance of the proposed method outperforms similar conventional stenographic techniques. The proposed Ozyavas–Takaoglu–Ajlouni (OTA) method relieves the limitation on the size of the hidden data, and hidden data is undetectable by steganalysis because it is no longer embedded in the cover multimedia.

A Novel Technique for Image Steganalysis Based on Separable Convolution and Adversarial Mechanism

Image steganalysis is a technique for detecting the presence of hidden information in images, which has profound significance for maintaining cyberspace security. In recent years, various deep steganalysis networks have been proposed in academia, and have achieved good detection performance. Although convolutional neural networks (CNNs) can effectively extract the features describing the image content, the difficulty lies in extracting the subtle features that describe the existence of hidden information. Considering this concern, this paper introduces separable convolution and adversarial mechanism, and proposes a new network structure that effectively solves the problem. The separable convolution maximizes the residual information by utilizing its channel correlation. The adversarial mechanism makes the generator extract more content features to mislead the discriminator, thus separating more steganographic features. We conducted experiments on BOSSBase1.01 and BOWS2 to detect various adaptive steganography algorithms. The experimental results demonstrate that our method extracts the steganographic features effectively. The separable convolution increases the signal-to-noise ratio, maximizes the channel correlation of residuals, and improves efficiency. The adversarial mechanism can separate more steganographic features, effectively improving the performance. Compared with the traditional steganalysis methods based on deep learning, our method shows obvious improvements in both detection performance and training efficiency.

Steganalysis of the methods of concealing information in graphic containers

Aim. Today, there is a pressing matter of protection against steganography-based attacks against information systems. These attacks present a danger as they use the most common data files – especially graphics files – as containers that deliver malicious code to a system or cause a leak of sensitive information. Developing methods of detecting such hidden information is the responsibility of a special subsection of steganography, the steganalysis. Such methods should be extensively used in computer forensics as part of security incident investigation, as well as in automated security systems with integrated modules for analyzing data files for malicious or dangerous information. An important feature of such activities is the need to examine a wide variety of elements and containing files. In particular, it is required to verify not only the colour values of the pixels in images, but their frequency characteristics as well. This raises a number of important questions associated with the best practices of applying steganalysis algorithms and making correct conclusions based on the outputs. The paper aims to briefly analyse the most important and relevant methods of steganalysis, both spatial and frequency, as well as to make conclusions regarding their performance and ways to analyse the outputs based on the test results of the software that implements such methods. Methods. The steganalysis of concealment within the least significant bits of an image’s pixels uses Pearson’s Chi-square statistical analysis, as well as the Regular-Singular method that involves signature analysis of pixel groups and analytical geometry tools for estimating the relative volume of the hidden message. The Koch-Zhao method of steganalysis is used for the purpose of detecting information embedded in the frequency-domain image representation. It also allows identifying the parameters required for extracting the hidden message. Results. A software suite was created that includes the software implementations of the analysed methods. The suite was submitted to a number of tests in order to evaluate the outputs of the examined methods. For the purpose of testing, a sample of images of various formats was compiled, in which information was embedded using a number of methods. Based on the results of the sample file analysis, conclusions were made regarding the efficiency of the analysed methods and interpretation of the outputs. Conclusion. Based on the test results, conclusions were made on the accuracy of the steganalysis methods in cases of varied size of the embedded message and methods of its concealment. The patterns identified with the help of the analysis outputs allowed defining a number of rules for translating the outputs into conclusions on the identification of the fact of detection of hidden information and estimation of its size.

F3SNet: A Four-Step Strategy for QIM Steganalysis of Compressed Speech Based on Hierarchical Attention Network

Traditional machine learning-based steganalysis methods on compressed speech have achieved great success in the field of communication security. However, previous studies lacked mathematical modeling of the correlation between codewords, and there is still room for improvement in steganalysis for small-sized and low embedding rate samples. To deal with the challenge, we use Bayesian networks to measure different types of correlations between codewords in linear prediction code and present F3SNet—a four-step strategy: embedding, encoding, attention, and classification for quantization index modulation steganalysis of compressed speech based on the hierarchical attention network. Among them, embedding converts codewords into high-density numerical vectors, encoding uses the memory characteristics of LSTM to retain more information by distributing it among all its vectors, and attention further determines which vectors have a greater impact on the final classification result. To evaluate the performance of F3SNet, we make a comprehensive comparison of F3SNet with existing steganography methods. Experimental results show that F3SNet surpasses the state-of-the-art methods, particularly for small-sized and low embedding rate samples.

A Fast Selection Based on Similar Cross-Entropy for Steganalytic Feature

The mutual confrontation between image steganography and steganalysis causes both to iterate continuously, and as a result, the dimensionality of the steganalytic features continues to increase, leading to an increasing spatio-temporal overhead. To this end, this paper proposes a fast steganalytic feature selection method based on a similar cross-entropy. Firstly, the properties of cross-entropy are investigated, through the discussion of different models, and the intra-class similarity criterion and inter-class similarity criterion based on cross-entropy are presented for the first time. Then, referring to the design principles of Fisher’s criterion, the criterion of feature contribution degree is further proposed. Secondly, the variation of the cross-entropy function of a univariate variable is analyzed in principle, thus determining the normalized range and simplifying the subsequent analysis. Then, within the normalized range, the variation of the cross-entropy function of a binary variable is investigated and the setting of important parameters is determined. Thirdly, the concept of similar cross-entropy is further presented by analyzing the changes in the value of the feature contribution measure under different circumstances, and based on this, the criterion for the feature contribution measure is updated to decrease the complexity of the calculation. Remarkably, the contribution measure criterion devised in this paper is a symmetrical structure, which equitably measures the contribution of features in different situations. Fourth, the feature component with the highest contribution is selected as the final selected feature based on the result of the feature metric. Finally, based on the Bossbase 1.01 image base that is a unique standard and recognized base in steganalysis, the feature selection on 8 kinds of low and high-dimensional steganalytic features is carried out. Through extensive experiments, comparison with several classic and state-of-the-art methods, the method designed in this paper attains competitive or even better performance in detection accuracy, calculation cost, storage cost and versatility.

Nested Two-Layer RGB Based Reversible Image Steganography Method

In this study, a new reversible image steganography method based on Red-Green-Blue (RGB) which hides thecolored image into the colored images in two layers nested is proposed. The proposed method hides the 24-bitimage to be hidden by hiding two layers of data firstly in the resized version of the cover image with the LSBmethod, and then hides the resized cover image to the original cover image with the 4-bit method. The proposedmethod offers a secure communication environment as it hides the hidden image in two layers. When thirdparties extract data by using the LSB method, they only access the resized version of the cover image. The 4-bitmethod divides the image to be hidden into 8-bit segments. While the first 4 bits, which are the most importantbits of 8-bit data, are hidden directly, 4 bits that can be neglected with less significance are completed by roundingat approximate value through the method function. In this way, since the 8-bit data is reduced to 4-bits, themethod performs lossy hiding, but doubles the hiding capacity. Peak signal to noise ratio (PSNR), structuralsimilarity quality criterion (SSIM) and chi-square steganalysis method, which are frequently used in the literature,are used to measure the immunity level of the proposed method. When it is concealed at the same ratewith the LSB method and the proposed method, a higher measurement value is obtained in the PSNR imagecriterion, which is 1.2 dB, SSIM 0.0025, BER 0.0129 and NCC image criterion 0.00027. In additional, it wasshown that the proposed method achieved more successful results in chi-square steganalysis and histogramtests compared to the traditional LSB method.

Steganographic Analysis of Blockchains.

Steganography is one of the ways to hide data between parties. Its use can be worrisome, e.g., to hide illegal communications. Researchers found that public blockchains can be an attractive place to hide communications; however, there is not much evidence of actual use in blockchains. Besides, previous work showed a lack of steganalysis methods for blockchains. In this context, we present a steganalysis approach for blockchains, evaluating it in Bitcoin and Ethereum, both popular cryptocurrencies. The main objective is to answer if one can find steganography in real case scenarios, focusing on LSB of addresses and nonces. Our sequential analysis included 253 GiB and 107 GiB of bitcoin and ethereum, respectively. We also analyzed up to 98 million bitcoin clusters. We found that bitcoin clusters could carry up to 360 KiB of hidden data if used for such a purpose. We have not found any concrete evidence of hidden data in the blockchains. The sequential analysis may not capture the perspective of the users of the blockchain network. In this case, we recommend clustering analysis, but it depends on the clustering method’s accuracy. Steganalysis is an essential aspect of blockchain security.

A HEVC Video Steganalysis Against DCT/DST-Based Steganography

The development of video steganography has put forward a higher demand for video steganalysis. This paper presents a novel steganalysis against discrete cosine/sine transform (DCT/DST)-based steganography for high efficiency video coding (HEVC) videos. The new steganalysis employs special frames extraction (SFE) and accordion unfolding (AU) transformation to target the latest DCT/DST domain HEVC video steganography algorithms by merging temporal and spatial correlation. In this article, the distortion process of DCT/DST-based HEVC steganography is firstly analyzed. Then, based on the analysis, two kinds of distortion, the intra-frame distortion and the inter-frame distortion, are mainly caused by DCT/DST-based steganography. Finally, to effectively detect these distortions, an innovative method of HEVC steganalysis is proposed, which gives a combination feature of SFE and a temporal to spatial transformation, AU. The experiment results show that the proposed steganalysis performs better than other methods.

Low-complexity JPEG steganalysis via filters optimation from symmetric property

Steganalysis is a technique for detecting existence of secret data hidden in digital media. Researchers are often concentrated in minimizing the misclassification rate. Many steganalysis methods try to choose high-dimension features to reveal subtle changes due to data embedding. By exploring properties of the filter bases, we steer the filters to capture tiny embedding traces in different scales and directions. There are redundant filters due to the horizontal and vertical symmetric properties. To select proper filters, the constructed framework selects a filter subset used in feature extraction and can improve the classification performance. The proposed algorithm is compared with several high-dimension features including Gabor filter residual (GFR) and maximum diversity cascade filter residual (MD-CFR) features. The following steganographic algorithms are used in the comparison experiment to test the steganalytic performance: uniform embedding revisited distortion (UERD) and JPEG universal wavelet relative distortion (J-UNIWARD). Experimental results show that, compared with the MD-CFR method, the proposed method can increase the detection rate by up to 0.7% with low feature dimension. It is shown that the proposed method is suitable for detecting data embedding in JPEG images.

Chi-square-based steganalysis method against modified pixel-value differencing steganography

Pixel-value differencing (PVD) steganography can embed a large quantity of information and effectively resist regular/singular (RS) detection. Recent steganography techniques that are based on PVD have only focused on improving embedding capacity and image quality. In terms of security, PVD steganography has typically only been tested against well-known RS detection analysis or pixel difference histogram attacks. Modified PVD (MPVD) is an improved method that eliminates certain detectable features of PVD, thereby increasing security. State-of-the-art studies in steganalysis have attempted to detect MPVD steganography by using features of the differences between cover images and stego images, and they have generated models to test suspicious images. However, these methods have low accuracy when the embedding capacity is low. In this study, we propose a chi-square goodness-of-fit-based steganalysis technique that can be applied to MPVD steganography. Experimental results demonstrate that the method effectively detects MPVD steganography even when the embedding ratio is low. Furthermore, the accuracy, precision, and implementation of the method are better than those of existing state-of-the-art techniques in detecting data hidden using MPVD steganography. Therefore, the proposed method contributes to the security analysis of PVD-extended steganography.

A novel linguistic steganalysis method for hybrid steganographic texts

Most of the existing linguistic steganalysis methods mainly focus on detecting steganographic texts which are generated by embedding secret information into a type of text medium using one steganographic algorithm. But in practical applications, a large number of the steganographic texts may be hybrid ones which are generated by embedding secret information into different types of text media using different steganographic algorithms. In this paper, inspired by transfer learning, a novel linguistic steganalysis method is proposed to detect hybrid steganographic texts. The proposed method first uses the pre-trained BERT language model to obtain initial context-dependent word representations. Then the extracted features are fed into attentional Long Short-Term Memory (LSTM) to get the final contextual representations of sentences. The experimental results show that the proposed method can better satisfy the practical application demands than the existing linguistic steganalysis methods.

Hybrid convolutional neural network architecture driven by residual features for steganalysis of spatial steganographic algorithms

The goal of steganalysis is to unearth a concealed message hidden inside an innocent carrier by steganography. Steganography in the hands of unlawful people can pose a great threat to society. Secret message is embedded as a noise (residue) which silently disrupts the statistical nature of the carrier without visual transformation. For the purpose of unearthing covert communication, modeling this noise (residue) is a crucial factor. In this paper, a hybrid deep learning framework is proposed with convolutional neural network (CNN) to emphasize the need for residual based investigation for digital image steganalysis. In order to model the noise residuals, five types of handcrafted features are extracted, in which the first four types rely on acquiring noise residuals based on filtering by linear and nonlinear filters, and the fifth type relies on residual acquisition method based on Empirical Mode Decomposition (EMD). The extracted features are categorized using a robust CNN with a new parallel architecture that is capable of learning intricate details from input features to classify it as cover or stego. Mostly CNNs are trained with raw images, but in the proposed method, the 1-dimensional residual features are stacked into 2-dimensional grid and are then used to train the CNN. Three spatial content-adaptive and four spatial non-content-adaptive algorithms are used to evaluate the performance of the proposed architecture. The experimental results show the versatility and robustness of the proposed hybrid architecture towards these algorithms when compared to existing state-of-the-art steganalytic methods. A practical issue prevalent in deploying steganalysis in real-world is ‘mismatch scenario,’ and based on the experimentation done in this paper, the proposed architecture performs well under stego algorithm mismatch and payload mismatch scenarios.