Steganalysis Features Research Articles

A Multi-Scale Feature Selection Method for Steganalytic Feature GFR

The Rich Model of the Gabor filter (referred to as the GFR steganalytic feature) can detect JPEG-adaptive steganography objects. However, feature dimensionality that is too high will lead to too much computation and will correspondingly reduce the detection efficiency. To reduce the dimensionality and the operating time of GFR steganalytic features and to improve the stego image detection accuracy, this paper proposes a multi-scale feature selection method for steganalytic feature GFR. First, we use the SNR criterion to measure the uselessness of each feature component and to provide a basis for the removal of useless steganalytic feature components. Second, we improve the Relief algorithm to measure the importance of feature components in detecting stego images, which provides a basis for the selection of important feature components. Then, we set the threshold value for deleting the useless feature components, and we select the important feature components as the final feature. Finally, we conduct experiments on feature selection for GFR with high-dimensional steganalytic features, and we compared the proposed method with the Fisher-based method, the PCA-based method, the SSFC method, and the Steganalysis-α method. The results show that the method proposed in this paper is effective and fast.

Steganographic Security Analysis From Side Channel Steganalysis and Its Complementary Attacks

Side channel steganalysis refers to detecting a steganographer in social websites via behavior analysis. In this paper, we first design a side channel steganalysis based on the correlation between image sequences of social users, which aims to find out the behaviorally anomalous steganographer. According to the experimental results of side channel steganalysis, it is intuitively secure for the steganographer to act identically to normal social users since she can avoid being detected by side channel steganalysis. However, when faced with various detection methods, is it still secure to behave similar to a normal user? To comprehensively consider the detection means and further explore the secure behavior region of the steganographer, we design a complementary attack of side channel steganalysis. Specifically, we take the correlation of contents of images as side information and take the images with similar content as references to calibrate steganalysis features, which helps improve traditional steganalysis. The proposed side channel steganalysis and its complementary attack efficiently detect steganographers from two different aspects. When the average rank of the steganographer is used to measure the performance, side channel steganalysis can rank the steganographer within the top ten in 100 actors, and the complementary attack can raise the average rank of the steganographer by three places compared with the previous method. From the perspective of the steganographer on social networks, it can help her behave in a more secure region, where her behavior should neither deviate from that of normal users nor be too similar to that of normal users.

Towards feature representation for steganalysis of spatial steganography

Feature separability analysis supports the feature selection and reduction and also guides the feature construction. This paper addresses the feature representation for steganalysis of spatial steganography. The paper analyzes the effects of spatial steganography on image residual histogram, and gives the feature separability of histogram features represented in both spatial and frequential domains, which explains the effectiveness of the typical spatial features, such as SRM and TLBP features. Based on the feature separability analysis, TLBP feature is improved by using a new texture pattern mapping to replace the ‘riu2’ mapping in the feature construction. Besides, features in the frequency domain are constructed by applying DFT to the submodels of SRM. Experimental results show that both the two schemes improved the steganalysis performances. Furthermore, features in spatial and frequency domains are merged, which obtains better results than the corresponding single type features for steganalysis of S-UNIWARD, HILL, and MiPOD. For example, using HILL for information embedding with payload 0.4 bpp on BOSSbase dataset, the detection accuracy of the best merged feature is 3.64% and 1.13% higher than the corresponding single type features.

Steganographer Detection via Multi-Scale Embedding Probability Estimation

Steganographer detection aims to identify the guilty user who utilizes steganographic methods to hide secret information in the spread of multimedia data, especially image data, from a large amount of innocent users on social networks. A true embedding probability map illustrates the probability distribution of embedding secret information in the corresponding images by specific steganographic methods and settings, which has been successfully used as the guidance for content-adaptive steganographic and steganalytic methods. Unfortunately, in real-world situation, the detailed steganographic settings adopted by the guilty user cannot be known in advance. It thus becomes necessary to propose an automatic embedding probability estimation method. In this article, we propose a novel content-adaptive steganographer detection method via embedding probability estimation. The embedding probability estimation is first formulated as a learning-based saliency detection problem and the multi-scale estimated map is then integrated into the CNN to extract steganalytic features. Finally, the guilty user is detected via an efficient Gaussian vote method with the extracted steganalytic features. The experimental results prove that the proposed method is superior to the state-of-the-art methods in both spatial and frequency domains.

Image steganalysis feature selection based on the improved Fisher criterion.

In order to improve the detection accuracy of hidden message in images, steganalysis features are selected as inputs for steganalysers. However, the existing Fisher criterion ignores the contribution of steganalysis feature components in dispersion to classification, which causes the useful feature components to be deleted, and decreases the detection accuracy of steganalysis features. By analyzing the separability of steganalysis feature components, we introduce the sigmoid function into Fisher's criterion and propose an improved Fisher criterion (I-Fisher criterion), which can make up for the traditional Fisher criterion in separability measurement of steganalysis feature components. To optimize the steganalysis feature and reduce its dimension, we employ the improved Fisher criterion as the heuristic function of the decision rough set α-positive region reduction, and propose the feature selection method based on the improved Fisher. Experimental results show that the proposed method can reduce the dimension and memory of the GFR high-dimensional feature and the CC-PEV lowdimensional feature while maintaining or improving the detection accuracy.

Detection of presentation attacks using imaging and liveness attributes

Face biometry is a popular user authentication scheme that is easy to use and tends to be less invasive than other user authentication approaches. Despite the success achieved by face biometrics, face spoofing attacks (or presentation attacks) still pose a challenge to researchers. In practice, fraudsters may deceive a face authentication system by displaying fake copies of an authorised user face, such as photos or videos, and gain unauthorised access to the system. This work proposes a method for detecting unauthorised access attempts using misrepresentations of the identity of an authorised user. The proposed methodology for presentation attack detection relies on the observation of imaging and liveness attributes, such as the detection of liveness using the face deformation energy, and imaging attributes usually found in authentic accesses such as facial and background textures, and steganalysis features. Based on the experimental results, the proposed approach potentially can detect face spoofing attacks at each frame of video sequences with error rates of half total error rate (HTER)= {6.51, 4.93}%, and also in full video sequences with HTER = {5.55, 0}%, for the CASIA and Nanjing University of Aeronautics and Astronautics databases, respectively.

Universal Detection of Video Steganography in Multiple Domains Based on the Consistency of Motion Vectors

Digital video provides various types of embedding domains, which lead to a great diversity in video steganography. However, in the detection of video steganography, the existing video steganalytic features all specialize in a particular domain, and are hardly to detect the steganography in other embedding domains. In this paper, we propose a universal feature set which is capable of detecting the video steganography in multiple domains. Two popular embedding domains, i.e., partition mode (PM) domain and motion vector (MV) domain, are considered for steganalysis. The idea is based on the observation that the MVs of the sub-blocks in the same macroblock are usually different from each other, and they will tend to be consistent in values after the MV modifications or PM modifications. Thus the consistency of MVs can be used as an evidence for the steganographic embedding in two domains, and finally a 12-dimensional feature set is designed for universal detection. Extensive experiments are conducted to demonstrate the effectiveness of the proposed feature set. The results show that our feature set achieves superior universality and accuracy in both PM domain and MV domain, and even performs well in mismatched domains, where the detection model trained in one domain can directly be used to attack the steganography in another domain. Besides, the low complexity of the proposed feature set also indicates its advantage in real-time video steganalysis.

Deep convolutional neural network-based feature extraction for steganalysis of content-adaptive JPEG steganography

Deep learning-based steganalysis techniques have significantly progressed in recent years. Compared with typical steganalysis methods using rich model features and classifiers, deep learning-based steganalysis methods usually train a deep convolutional neural network (CNN) as the steganography detector. One advantage of a deep CNN is the strong capability for discriminative feature learning. The input feature map of the fully connected layer is the steganalysis feature learned using the deep CNN. We can, therefore, extract the steganalysis feature based on the trained deep CNN. Compared with steganalysis features constructed by hand, the extraction of steganalysis features using a deep CNN can take advantage of the strong feature-learning capability of such a network. Therefore, two types of typical steganalysis frameworks are first compared. Then, a deep CNN for steganalysis feature learning is constructed, and the setting of the image preprocessing layer is discussed. Next, the detection performances of the different learned steganalysis features are compared. Finally, the detailed extraction process of the proposed learned steganalysis feature is described. The experiment results show that the proposed steganalysis method, combining learned and handcrafted steganalysis features, can significantly improve the detection performance for content-adaptive JPEG steganography.

Feature selection for blind image steganalysis using neighborhood rough sets

Feature extraction for blind image steganalysis produces much features or high dimensional data, which bring about time consuming and even a low detection percentage. As being one of the most important phases of preprocessing, feature selection can reduce these extracted features, and improve the p erformance of steganalysis. Firstly, we introduce the Neighborhood Rough Sets (NRS) to the field of blind image steganalysis. Then, some concepts of feature significance and feature reduct are presented based on NRS. Furthermore, we propose a Feature Selection approach by NRS for blind image steganalysis (FSNRS). The FSNRS has the ability to delete redundant features, meanwhile maintaining the classification accuracy of a steganalysis system. The FSNRS is a filter feature selection technique for blind image steganalysis, which filtrates extracted features depending on a positive region preserving in NRS. The compact feature subset with a shortest feature dimension for blind image steganalysis is selected. Moreover, some experiments for blind steganalysis using SVM and KNN classifiers on selected feature subset are carried out. The experimental results show that our proposed approach can obtain compact features for blind image steganalysis and the performances of classifiers on those selected features are improved. Since the FSNRS is used with an adjustable neighborhood parameter, as a result, the classification performance of selected features is better than that of original whole features in most cases.

CNN-Based Adversarial Embedding for Image Steganography

Historically, steganographic schemes were designed in a way to preserve image statistics or steganalytic features. Since most of the state-of-the-art steganalytic methods employ a machine learning (ML) based classifier, it is reasonable to consider countering steganalysis by trying to fool the ML classifiers. However, simply applying perturbations on stego images as adversarial examples may lead to the failure of data extraction and introduce unexpected artefacts detectable by other classifiers. In this paper, we present a steganographic scheme with a novel operation called adversarial embedding, which achieves the goal of hiding a stego message while at the same time fooling a convolutional neural network (CNN) based steganalyzer. The proposed method works under the conventional framework of distortion minimization. Adversarial embedding is achieved by adjusting the costs of image element modifications according to the gradients backpropagated from the CNN classifier targeted by the attack. Therefore, modification direction has a higher probability to be the same as the sign of the gradient. In this way, the so called adversarial stego images are generated. Experiments demonstrate that the proposed steganographic scheme is secure against the targeted adversary-unaware steganalyzer. In addition, it deteriorates the performance of other adversary-aware steganalyzers opening the way to a new class of modern steganographic schemes capable to overcome powerful CNN-based steganalysis.

A Novel Convolutional Neural Network for Image Steganalysis With Shared Normalization

Deep learning based image steganalysis has attracted increasing attentions in recent years. Several Convolutional Neural Network (CNN) models have been proposed and achieved state-of-the-art performances on detecting steganography. In this paper, we explore an important technique in deep learning, the batch normalization, for the task of image steganalysis. Different from natural image classification, steganalysis is to discriminate cover images and stego images which are the result of adding weak stego signals into covers. This characteristic makes a cover image is more statistically similar to its stego than other cover images, requiring steganalytic methods to use paired learning to extract effective features for image steganalysis. Our theoretical analysis shows that a CNN model with multiple normalization layers is hard to be generalized to new data in the test set when it is well trained with paired learning. To hand this difficulty, we propose a novel normalization technique called Shared Normalization (SN) in this paper. Unlike the batch normalization layer utilizing the mini-batch mean and standard deviation to normalize each input batch, SN shares same statistics for all training and test batches. Based on the proposed SN layer, we further propose a novel neural network model for image steganalysis. Extensive experiments demonstrate that the proposed network with SN layers is stable and can detect the state of the art steganography with better performances than previous methods.

Distortion Design for Secure Adaptive 3-D Mesh Steganography

We propose a novel technique for steganography on 3-D meshes so as to resist steganalysis. The majority of existing methods modulate vertex coordinates to embed messages in a nonadaptive way. We take account of complexity of local regions as joint distortion of a triple unit (vertice) and coding method such as syndrome trellis codes to adaptively embed messages, which owns stronger security with respect to existing steganalysis. Key to the distortion is a novel formulation of adaptive steganography, which relies on some effective steganalytic features such as variation of vertex normal. We provide quantitative and qualitative comparisons of our method with several baselines against steganalytic features LFS64, LFS76, and ensemble classifiers, and show that it outperforms the current state of the art. Meanwhile, we proposed an attacking method on steganography proposed by Chao et al. (2009) with a high detection rate.

Color image steganalysis based on channel gradient correlation

It is one of the potential threats to the Internet of Things to reveal confidential messages by color image steganography. The existing color image steganalysis algorithm based on channel geometric transformation measures owns higher accuracy than the others, but it fails to utilize the correlation between the gradient amplitudes of different color channels. Therefore, this article points out that the color image steganography weakens the correlation between the gradient amplitudes of different color channels and proposes a color image steganalysis algorithm based on channel gradient correlation. The proposed algorithm extracts the co-occurrence matrix feature from the gradient amplitude residuals among different color channels and then combines it with the existing color image steganalysis features to train the ensemble classifier for color image steganalysis. The experimental results show that, for WOW and S-UNIWARD steganography, compared with the existing algorithms, the proposed algorithm outperforms the existing algorithms.

Spatial-domain steganalytic feature selection based on three-way interaction information and KS test

To select informative features from steganalytic features, a spatial-domain steganalytic feature selection method based on three-way interaction information and Kolmogorov–Smirnov (KS) test is proposed. Three-way interaction information is employed to rank all the features, and KS test is exploited to remove redundant features. Feature selection process of the proposed method is presented as follows: It calculates mutual information between features and the class label and selects the feature with the maximum value. Then, it loops to calculate three-way interaction information among each candidate feature, the previously selected feature and the class label and select the candidate feature with the maximum value. Following that, it calculates KS test between features and compares an obtained parameter with the predefined significance level for eliminating redundant features. To validate the performance of the proposed method, several typical feature ranking methods based on information measure and spatial-domain steganalytic feature selection methods are adopted for performance comparisons. Experimental results demonstrate that the proposed method can achieve better feature selection performance.

Research on image steganography analysis based on deep learning

Although steganalysis has developed rapidly in recent years, it still faces many difficulties and challenges. Based on the theory of in-depth learning method and image-based general steganalysis, this paper makes a deep study of the hot and difficult problem of steganalysis feature expression, and tries to establish a new steganalysis paradigm from the idea of feature learning. The main contributions of this paper are as follows: 1. An innovative steganalysis paradigm based on in-depth learning is proposed. Based on the representative deep learning method CNN, the model is designed and adjusted according to the characteristics of steganalysis, which makes the proposed model more effective in capturing the statistical characteristics such as neighborhood correlation. 2. A steganalysis feature learning method based on global information constraints is proposed. Based on the previous research of steganalysis method based on CNN, this work focuses on the importance of global information in steganalysis feature expression. 3. A feature learning method for low embedding rate steganalysis is proposed. 4. A general steganalysis method for multi-class steganography is proposed. The ultimate goal of general steganalysis is to construct steganalysis detectors without distinguishing specific types of steganalysis algorithms.

Selection of Rich Model Steganalysis Features Based on Decision Rough Set <inline-formula> <tex-math notation="LaTeX">$\alpha$ </tex-math> </inline-formula>-Positive Region Reduction

Steganography detection based on Rich Model features is a hot research direction in steganalysis. However, rich model features usually result a large computation cost. To reduce the dimension of steganalysis features and improve the efficiency of steganalysis algorithm, differing from previous works that normally proposed new feature extraction algorithm, this paper proposes a general steganalysis feature selection method based on decision rough set $\alpha$ -positive region reduction. First, it is pointed out that decision rough set $\alpha$ -positive region reduction is suitable for steganalysis feature selection. Second, a quantization method of attribute separability is proposed to measure the separability of steganalysis feature components. Third, steganalysis feature components selection algorithm based on decision rough set $\alpha$ -positive region reduction is given; thus, stego images can be detected by the selected feature. The proposed method can significantly reduce the feature dimensions and maintain detection accuracy. Based on the BOSSbase-1.01 image database of 10 000 images, a series of feature selection experiments are carried on two kinds of typical rich model features (35263-D J+SRM feature and 17000-D GFR feature). The results show that even though these two kinds of features are reduced to approximately 8000-D, the detection performance of steganalysis algorithms based on the selected features are also maintained with that of original features, which will remarkably improve the efficiency of feature extraction and stego image detection.

Steganalysis of Content-Adaptive Steganography Based on Massive Datasets Pre-Classification and Feature Selection

For current steganalysis of the image content-adaptive steganography, there are multiple problems to be improved, such as high difficulty and low accuracy, when detecting images with various contents and textures. For this problem, an improved steganalytic method is proposed in this paper based on the pre-classification and feature selection. First, using the features extracted based on the dependency analysis of image adjacent data, the images with various content and texture complexities are pre-classified as multiple clusters by the K-means algorithms. Then, the performance of existing various steganalytic features are analyzed for different clusters of images, and the optimal features for each cluster are selected for final classification. The experimental results show that the detection accuracy could be improved by the proposed method, and the rationality and availability are also verified. At the same time, the analysis and experimental results in this paper also show that the images with rich content and complex texture should be paid more attention both in steganography and in steganalysis.

Steganalysis of AMR Speech Based on Multiple Classifiers Combination

In this paper, we focus on steganalysis in adaptive multi-rate (AMR) speech streams, whose goal is to detect covert communication behaviors effectively to prevent illegal uses of AMR steganography. Differing from the existing methods for speech steganalysis, we present a novel steganalysis scheme based on multiple classifiers combination. Specifically, we design a new combined classifier model, whose main idea is as follows. First of all, steganalysis features are respectively inputted into two different classifier sets to obtain the first and second types of prediction results. Then, the second type of prediction results are viewed as a special type of features and fed into another classifier set to obtain the third type of prediction results. Finally, all the three types of prediction results are fused to achieve a final detection result. The presented steganalysis scheme is comprehensively evaluated using two types of state-of-the-art features for fixed codebook (FCB) parameters, namely, pulse-pair characteristics-based features and pulse-correlation based features, and compared with the existing methods based on support vector machines (SVM). The experimental results demonstrate that the proposed scheme is feasible and effective, and significantly outperforms the previous SVM-based methods for detecting steganography in FCB domains in every case.

Controversial ‘pixel’ prior rule for JPEG adaptive steganography

Currently, the most successful model for image adaptive steganography is the framework of minimal distortion, in which a reasonable definition of costs can improve the security level. In the authors' previous work, they developed a rule for cost reassignment in spatial domain called the `controversial pixel prior (CPP)' rule, which defines controversial pixels by utilizing the controversies among several comparable schemes. The CPP rule gives controversial pixels higher modification priorities. In this study, they investigate migrating the CPP rule from the spatial domain to the joint photographic experts group (JPEG) domain and name it the J-CPP rule. In JPEG images, the cover elements are discrete cosine transform (DCT) coefficients and variant factors mayinfluence the distortion definition includingquantisation step, inter-blocks correlation and block energy. However, there is no evidence to reveal which factor is of highest priority for promoting security. In this work, they investigate which factor is more helpful in promoting J-CPP rule, and they finally determine to set the spatial block residual as a penalty to perfect J-CPP rule. Through extensive experiments on different JPEG steganographic algorithms and steganalysis features, they demonstrate that the J-CPP rule can improve the security of JPEG adaptive steganography.

Digital Image Steganalysis Based on Visual Attention and Deep Reinforcement Learning

Recently, the adaptive steganography methods have been developed to embed secret information with the minimal distortion of images. As the opposite art, steganalysis methods, especially some convolutional neural network-based steganalysis methods, have been proposed to detect whether an image is embedded with secret information or not. The state-of-the-art steganography methods hide secret information in different regions of an image with different probabilities. However, most of the current steganalysis methods extract the steganalysis features from different regions without discrimination, which reduces the performance of the current deep-learning-based steganalysis methods when attacking the adaptive steganography methods. In this paper, we propose a new self-seeking steganalysis method based on visual attention and deep reinforcement learning to detect the JPEG-based adaptive steganography. First, a region is selected from the image by a visual attention method, and a continuous decision is then made to generate a summary region by reinforcement learning. Thereby, the deep learning model is guided to focus on these regions that are favorable to steganalysis and ignore those regions that are unfavorable. Finally, the quality of training set and the detection ability of steganalysis are improved by replacing the mis-classified training images with their corresponding summary regions. The experiments show that our method obtains the competitive detection accuracy, compared with the other state-of-the-art advanced detection methods.