Search

Currently, the popular Rich Model steganalysis features usually contain a large number of redundant feature components which may bring “curse of dimensionality” and large computation cost, but the existing feature selection methods are difficult to effectively reduce the dimensionality when there are many strongly correlated effective feature components. This paper proposes a novel selection method for Rich Model steganalysis features. First, the separability of each feature component in the submodels of Rich Model is measured based on the Fisher criterion, and the feature components are sorted in the descending order based on the separability. Second, the correlation coefficient between any two feature components in each submodel is calculated, and feature selection is performed according to the Fisher value of each component and the correlation coefficients. Finally, the selected submodels are combined as the final steganalysis feature. The results show that the proposed feature selection method can effectively reduce the dimensionalities of JPEG domain and spatial domain Rich Model steganalysis features without affecting the detection accuracies.

When embedding secret message into image by steganography with matrix encoding, there are still no effective methods to recover the stego key because it is difficult to statistically distinguish the stego coefficient sequences selected by true and false keys. Therefore, this paper proposes a method for recovering the stego key of a typical JPEG (Joint Photographic Experts Group) image steganography—F5 which composes of the check matrix and shuffling key. Firstly, the check matrix is recovered based on the embedding ratio estimated by quantitative steganalysis. The shuffling key is then recovered based on the distribution difference between the bit sequences extracted by the true and false shuffling keys. Additionally, the cardinality of the shuffling key space is significantly reduced by examining the extracted encoding parameter and message length. Experimental results show that the proposed method can recover the stego key accurately and efficiently, even when the existing Xu’s method fails for the high or very low embedding ratio.

Steganalysis is usually considered as a two-class classification problem of differentiating between covers and stegos. However, in the real world, the cover image may have undergone various operations, which causes two problems that some processed covers tend to be judged as stegos by the steganalyzer and the stegos processed before information embedding may be easily missed, resulting in the high false alarm rate and the high missed detection rate of steganalysis respectively. To address the former problem, this paper proposed a steganalysis framework based on the combination of the image forensics and the steganalysis tools to reduce the false alarms. First, the fragile detection of image manipulations which is not robust to steganography is applied to separate the normally processed images from the investigated images. Then remaining images are fed to the trained classifier for stegnalysis. The experimental results on gamma transformed images validate the effectiveness of the proposed steganalysis framework that the false alarm rates of steganalysis can be reduced when the investigated image dataset contains normally processed images.

For current steganalysis of the image content-adaptive steganography, there are multiple problems to be improved, such as high difficulty and low accuracy, when detecting images with various contents and textures. For this problem, an improved steganalytic method is proposed in this paper based on the pre-classification and feature selection. First, using the features extracted based on the dependency analysis of image adjacent data, the images with various content and texture complexities are pre-classified as multiple clusters by the K-means algorithms. Then, the performance of existing various steganalytic features are analyzed for different clusters of images, and the optimal features for each cluster are selected for final classification. The experimental results show that the detection accuracy could be improved by the proposed method, and the rationality and availability are also verified. At the same time, the analysis and experimental results in this paper also show that the images with rich content and complex texture should be paid more attention both in steganography and in steganalysis.

Cloud services have become an increasingly popular solution to provide different services to clients. More and more data are outsourced to the cloud for storage and computing. With this comes concern about the security of outsourced data. In recent years, homomorphic encryption, blockchain, steganography, and other technologies have been applied to the security and forensics of outsourced data. While encryption technologies such as homomorphic encryption and blockchain scramble data so that they cannot be understood, steganography hides the data so that they cannot be observed. Traditional steganography assumes that the environment is lossless. Robust steganography is grounded in traditional steganography and is proposed based on a real lossy social network environment. Thus, researchers, who study robust steganography, believe that the measurement should follow traditional steganography. However, the application scenario of robust steganography breaks through the traditional default lossless environment premise. It brings about changes in the focus of steganography algorithms. Simultaneously, the existing steganography methods miss the evaluation of applicability and ease of use. In this paper, “default parameters” are observed by comparing the process of robust image steganography with traditional image steganography. The idea of “perfecting default parameters” is proposed. Based on this, the attribute set of measuring robust image steganography is presented. We call it PRUDA (Payload, Robustness, ease of Use, antiDetection, and Applicability). PRUDA perfects default parameters observed in the process of traditional steganography algorithms. Statistics on image processing attacks in mobile social apps and analyses on existing algorithms have verified that PRUDA is reasonable and can better measure a robust steganography method in practical application scenarios.

It is a potential threat to persons and companies to reveal private or company-sensitive data through the Internet of Things by the color image steganography. The existing rich model features for color image steganalysis fail to utilize the fact that the content-adaptive steganography changes the pixels in complex textured regions with higher possibility. Therefore, this article proposes a variant of spatial rich model feature based on the embedding change probabilities in differential channels. The proposed feature is extracted from the residuals in the differential channels to reduce the image content information and enhance the stego signals significantly. Then, the embedding change probability of each element in the differential channels is added to the corresponding co-occurrence matrix bin to emphasize the interference of the residuals in textured regions to the improved co-occurrence matrix feature. The experimental results show that the proposed feature can significantly improve the detection performances for the WOW and S-UNIWARD steganography, especially when the payload size is small. For example, when the payload size is 0.05 bpp, the detection errors can be reduced respectively by 5.20% and 4.90% for WOW and S-UNIWARD by concatenating the proposed feature to the color rich model feature CRMQ1.

Result-sensitive function is a typical type of security-sensitive function. The misuse of result-sensitive functions often leads to a lot kinds of software defects. Existing defect detection methods based on code mining for result-sensitive functions usually require a gived security rule or an inferred security rule as input. Based on the principle of consistency, we propose a defect detection method based on information entropy. Firstly, the feature vector about usage of function is extracted from every function instance. Then, the information entropy is introduced to measure the abnormal degree of the feature vector. The function instances with high degree of abnormality is regarded as dangerous instances. Experiments show that the proposed method can effectively detect dangerous instances of security defects without a gived security rule.

Digital image steganography is one of the important ways to achieve covert communication to protect users’ data privacy. Steganalysis technology is the key technology to check the security of steganography, and the extraction of embedded messages is an important challenge for image steganalysis technology. Existing methods are for plain text embedding or only for certain special scenarios, they are not applicable to the extraction under the known cover image. To this end, this paper proposes a method of extracting embedded messages under the condition of the known cover images. First, the STCs encoding process is analyzed using the syndrome trellis. Second, a path in the syndrome trellis can be obtained by using the stego sequence and a certain parity-check matrix. Meanwhile, the embedding process can also be partially simulated using the cover sequence and the parity-check matrix. By comparing whether the paths are consistent, the coding parameters can be quickly filtered to find the correct submatrices and extract the correct embedded messages. This algorithm avoids the second embedding of all possible secret messages, which significantly improves the efficiency of coding parameter recognition. The experimental results show that the proposed method can identify STCs parameters of stego images using HUGO steganography in a short time, so as to realize the extraction of embedded messages.

Image forensics technology based on image manipulation detection has aroused great interest of researchers in recent decades. By revealing the traces of image manipulations, it could contribute to the location of tampered areas. This paper addresses the detection of image gamma transformation and its application in image splicing detection. A 5-dimensional feature vector is constructed based on the effects of gamma transformation on the histogram, and then Support Vector Machine (SVM) is trained to detect gamma transformation. For splicing tampered area locating, the investigated image is divided into overlapping blocks based on the sliding window, and then each pixel gets a probability of being gamma transformed according to the detection results in image blocks, based on which the tampered area is located. The experimental results validate the effectiveness of the proposed method when no post-operations are applied. Meanwhile, the proposed method is robust to the attack of rank filtering.

In this paper, a novel linguistic steganography with high imperceptibility and undetectability is proposed via secret message compression and candidate text selection. The length of the practical embedded payload can be reduced by the proposed word indexing compression algorithm(WIC), while a best stego text with high undetectability can be selected from candidates by the stego text selection strategy. WIC algorithm losslessly compresses the secret message by combining a minimum maximum weight algorithm with Huffman coding under the help of the candidate cover text. To improve the anti-steganalysis capability, ten cover texts with small compression ratios are selected from a huge cover text set, and are embedded the corresponding compressed secret message by using synonym substitutions. Only one stego text is selected by a given rule derived from the distance between a cover text and its stego text. Experimental results show that the proposed compression algorithm achieves better compression ratios than Huffman and LZW coding algorithms leading to higher embedding efficiency, and our steganography performs well in anti-steganalysis capability with compression and the stego text selection rule.

The development of steganography technology threatens the security of privacy information in smart campus. To prevent privacy disclosure, a linguistic steganalysis method based on word embedding is proposed to detect the privacy information hidden in synonyms in the texts. With the continuous Skip-gram language model, each synonym and words in its context are represented as word embeddings, which aims to encode semantic meanings of words into low-dimensional dense vectors. The context fitness, which characterizes the suitability of a synonym by its semantic correlations with context words, is effectively estimated by their corresponding word embeddings and weighted by TF-IDF values of context words. By analyzing the differences of context fitness values of synonyms in the same synonym set and the differences of those in the cover and stego text, three features are extracted and fed into a support vector machine classifier for steganalysis task. The experimental results show that the proposed steganalysis improves the average F-value at least 4.8% over two baselines. In addition, the detection performance can be further improved by learning better word embeddings. Published version

The image adaptive steganography represented by HUGO (Highly Undetectable steGO) has high anti-detection capabilities. The primary challenge for steganalyzers is how to reliably detect such steganography and extract the embedded message from stego. Although existing steganalysis algorithms based on parameter recognition of STCs (Syndrome-Trellis Codes) can reliably detect adaptive steganography when the embedded message is in plaintext, the steganalysis method is ineffective when the embedded message is in ciphertext. Therefore, a steganalysis algorithm based on partially known plaintext is proposed in this paper. The steganalysis algorithm targets situations wherein in order to facilitate the receiver’s extraction and storage of the embedded message, the file format name and message length may be transported without encryption when HUGO steganography is used to transport the encrypted file. First, the structural characteristics of the parity-check matrix were utilized to simplify the STCs decoding equation. Second, we calculated the submatrix by solving nonhomogeneous linear equations instead of exhausting submatrix, thus, parameter recognition efficiency was significantly improved. Finally, we verified the correctness of the submatrix and extracted the embedded message from stego images. The experimental results show that parameter recognition of STCs can be achieved using an ordinary PC within a short time. Therefore, the embedded message can be extracted when the partly embedded message is known.

In order to improve the JPEG compression resistant performance of the current steganogrpahy algorithms resisting statistic detection, an adaptive steganography algorithm resisting JPEG compression and detection based on dither modulation is proposed. Utilizing the adaptive dither modulation algorithm based on the quantization tables, the embedding domains resisting JPEG compression for spatial images and JPEG images are determined separately. Then the embedding cost function is constructed by the embedding costs calculation algorithm based on side information. Finally, the RS coding is combined with the STCs to realize the minimum costs messages embedding while improving the correct rates of the extracted messages after JPEG compression. The experimental results demonstrate that the algorithm can be applied to both spatial images and JPEG images. Compared with the current S-UNIWARD steganography, the message extraction error rates of the proposed algorithm after JPEG compression decrease from about 50 % to nearly 0; compared with the current JPEG compression and detection resistant steganography algorithms, the proposed algorithm not only possesses the comparable JPEG compression resistant ability, but also has a stronger detection resistant performance and a higher operation efficiency.

To improve the detection accuracy for content-adaptive JPEG steganography, which often constrains the embedding changes to complex texture regions, a new steganalysis feature called the GRF (Gabor Rich Feature) based on two-dimensional (2D) Gabor filters is proposed. First, the diverse 2D Gabor filters are generated and used to filter the decompressed JPEG image. Second, five types of statistical features are extracted from the filtered images and these features are merged according to their respective symmetry. Third, all the features are combined and feature selection is performed to reduce dimensionality. Last, an ensemble classifier is used to assemble the steganalysis feature as well as the final steganalyzer. The experimental results show that the proposed steganalysis feature can achieve a performance that is competitive with the state-of-the-art steganalysis features when used for the detection of the latest content-adaptive JPEG steganography algorithms.

Reverse analysis will lead to the problems of software crack, theft and tamper, where the control flow analysis will reveal the program execution logic. The conditional jump instruction contains the branch conditions and targets, and as the breaking point of control flow analysis, it will easily expose some significant branch information of the program. Based on the exception handling mechanism and encrypted mapping table, this paper proposes a enhanced branch obfuscation, which first introduces the exception code to replace the conditional jump instructions and then constructs the exception handlers to restore execution according to the mapping relation between the branch conditions and targets. Furthermore as supplement and perfect, the method rearranges the basic blocks and inserts some redundant blocks to increase the difficulty against reverse analysis. The method is evaluated from three aspects of validity, space cost and time cost. Finally the experiment results show that the branch obfuscation has a good protection performance and can resist static and dynamic analysis, and also it has an acceptable performance of space and time cost.

It is one of the potential threats to the Internet of Things to reveal confidential messages by color image steganography. The existing color image steganalysis algorithm based on channel geometric transformation measures owns higher accuracy than the others, but it fails to utilize the correlation between the gradient amplitudes of different color channels. Therefore, this article points out that the color image steganography weakens the correlation between the gradient amplitudes of different color channels and proposes a color image steganalysis algorithm based on channel gradient correlation. The proposed algorithm extracts the co-occurrence matrix feature from the gradient amplitude residuals among different color channels and then combines it with the existing color image steganalysis features to train the ensemble classifier for color image steganalysis. The experimental results show that, for WOW and S-UNIWARD steganography, compared with the existing algorithms, the proposed algorithm outperforms the existing algorithms.

To explore the approaches and diagnostic yield of genetic testing for renal disease in children, we describe the genotype and phenotype of the national cohort of children with renal disease from 13 different regions of China recruited from 2014 to 2018 by building up the multicenter registration system (Chinese Children Genetic Kidney Disease Database, CCGKDD). Genetic diagnosis was confirmed in 42.1% of our cohort of 1001 pediatric patients with clinical suspicion of a genetic renal disease. Of the 106 distinct monogenetic disorders detected, 15 accounted for 60.7% of genetic diagnoses. The diagnostic yield was 29.1% in steroid resistant nephritic syndrome (SRNS), 61.4% in cystic renal disease, 17.0% in congenital anomalies of the kidney and urinary tract (CAKUT), 62.3% in renal tubular disease/renal calcinosis, and 23.9% for chronic kidney disease (CKD) 3 to 5 stage with unknown origin. Genetic approaches of target gene sequence (TGS), singleton whole-exome sequencing (WES) and trio-WES were performed with diagnostic rates of 44.8%, 36.2%, and 42.6%, respectively. The early use of trio-WES could improve the diagnostic rate especially in renal tubular disease and calcinosis. We report the genetic spectrum of Chinese children with renal disease. Establishment of the CCGKDD will improve the genetic work on renal disease.

Since it is difficult to acquire a strong JPEG compression resistant ability while achieving a good detection resistant performance for current information hiding algorithms, a JPEG compression and detection resistant adaptive steganography algorithm using feature regions is proposed. Based on the proposed feature region extraction and selection algorithms, the embedding domain robust to JPEG compression and containing less embedding distortion can be obtained. Utilizing the current distortion functions, the distortion value of DCT coefficients in the embedding domain can be calculated. Combined with error correct coding and STCs, the messages are embedded into the cover images with minimum embedding distortion, and can be extracted with high accuracy after JPEG compression, hence, the JPEG compression and detection resistant performance are enhanced at the same time. The experimental results demonstrate that comparing with current J-UNIWARD steganography under quality factor 85 of JPEG compression, the extraction error rates decrease from above 20 % to nearly 0, while the stego images remain a better detection resistant performance comparing with the current JPEG compression and detection resistant adaptive steganography algorithm.

Current typical adaptive steganography algorithms take the detection resistant capability into account adequately but usually cannot extract the embedded secret messages correctly when stego images suffer from compression attack. In order to solve this problem, a framework of adaptive steganography resisting JPEG compression and detection is proposed. Utilizing the relationship between Discrete Cosine Transformation DCT coefficients, the domain of messages embedding is determined; for the maximum of the JPEG compression resistant ability, the modifying magnitude of different DCT coefficients caused by messages embedding can be determined; in order to ensure the completely correct extraction of embedded messages after JPEG compression, error correct codes are used to encode the messages to be embedded; on the basis of the current distortion functions, the distortion value of DCT coefficients corresponding to the modifying magnitude in the embedding domain can be calculated; to improve the detection resistant ability of the stego images and realize the minimum distortion embedding, syndrome-trellis codes are used to embed the encoded messages into the DCT coefficients that have a smaller distortion value. Based on the proposed framework, an adaptive steganography algorithm resisting JPEG compression and detection is designed, which utilizes the relationship between coefficients in a DCT block and the means of that in three adjacent DCT blocks. The experimental results that demonstrate the proposed algorithm not only has a good JPEG compression resistant ability but also has a strong detection resistant performance. Comparing with current J-UNIWARD steganography under quality factor 85 of JPEG compression, the extraction error rates without pre-compression decrease from about 50% to nearly 0, while the stego images remain a good detection resistant ability comparing with a typical robust watermarking algorithm, which shows the validity of the proposed framework. Copyright © 2016 John Wiley & Sons, Ltd.

The SBWBAMS (Scanned Binary Image Watermarking Based on Additive Model and Sampling) algorithm proposed by Hou et al. owns strong robustness to the process of printing and scanning process. However, because the embedding strength used in the algorithm is set artificially, watermark information may not be correctly embedded into binary image when the embedding strength is low. Firstly, the minimum embedding strength to embed watermark correctly is analyzed in this paper, and then an improved binary image watermarking algorithm based on adaptive embedding strength is proposed. The proposed algorithm adjusts embedding strength adaptively according to image content, ensuring that the embedded watermark information is correct. The experimental results show that the proposed algorithm can not only embed and extract the watermark information correctly, but also still own strong robustness to the process of printing and scanning process.

Image forensics of sharpening has aroused the great interest of researchers in recent decades. The state-of-the-art techniques have achieved high accuracies of strong sharpening detection, while it remains a challenge to detect weak sharpening. This paper proposes an algorithm based on thresholding binary coding for image sharpening detection. The overshoot artifact introduced by sharpening enlarges the difference between the local maximum and minimum of both image pixels and unsharp mask elements, based on which the threshold local binary pattern operator is applied to capture the trace of sharpening. Then the patterns are coded according to the rotation symmetry invariance and the texture type. Features are extracted from the statistical distribution of the coded patterns and fed to the classifier for sharpening detection. In practice, two classifiers are constructed for the lightweight and offline applications respectively, one is a single Fisher linear discriminant (FLD) with 182 features, and the other is an ensemble classifier (EC) with 5460 features. The experimental results on BOSS, NRCS and RAISE datasets show that for weak sharpening detection, the FLD outperforms the CNN and SVMs with EPTC, EPBC, and LBP features, and using EC with TBCs features further improves the performance, which obtains better results than ECs with TLBP and SRM features. Besides, the proposed algorithm is robust to post-JPEG compression and noise addition and could differentiate sharpening from other manipulations.

In realistic outdoor scenarios, image sensors tend to suffer from various weather conditions (e.g., haze, rain, etc.),which make the images of the same scene taken at different times may be different. Therefore, one should be able to securely embed secret messages into these images by making use of the variations of the weather effects. Inspired by some recent natural steganography algorithms, this paper presents a novel haze image steganography method, which embeds messages through adjusting the weather effects of an input haze image, making it resemble the same image captured under another weather condition. The proposed steganography method consists of three parts: (1) model parameter estimation of the input haze image, (2) haze effects adjustment according to the atmospheric scattering model, (3) message embedding using the floating-point adjusted haze image. 10,000 haze images captured under different haze conditions in various scenarios were used to test the proposed steganography algorithm. The experimental results show that the proposed steganography algorithm is more secure than S-UNIWARD and HILL for steganalyzers who only have raw haze images.

Feature separability analysis supports the feature selection and reduction and also guides the feature construction. This paper addresses the feature representation for steganalysis of spatial steganography. The paper analyzes the effects of spatial steganography on image residual histogram, and gives the feature separability of histogram features represented in both spatial and frequential domains, which explains the effectiveness of the typical spatial features, such as SRM and TLBP features. Based on the feature separability analysis, TLBP feature is improved by using a new texture pattern mapping to replace the ‘riu2’ mapping in the feature construction. Besides, features in the frequency domain are constructed by applying DFT to the submodels of SRM. Experimental results show that both the two schemes improved the steganalysis performances. Furthermore, features in spatial and frequency domains are merged, which obtains better results than the corresponding single type features for steganalysis of S-UNIWARD, HILL, and MiPOD. For example, using HILL for information embedding with payload 0.4 bpp on BOSSbase dataset, the detection accuracy of the best merged feature is 3.64% and 1.13% higher than the corresponding single type features.

In digital steganography, due to difficulties estimating the JPEG cover image, it is still very hard to accurately locate the hidden message embedded in a JPEG image. Therefore, this study proposes a payload location method for a category of pseudo-random scrambled JPEG image steganography. In order to estimate the quantized discrete cosine transform coefficients in the cover JPEG image, a cover JPEG image estimation method is proposed based on co-frequency sub-image filtering. The proposed payload location method defines a general residual, uses the estimated cover JPEG image to compute the residuals, and then employs the mean residuals of multiple stego images embedded along the same path to distinguish the stego positions. The proposed cover JPEG image estimation method constructs 64 co-frequency sub-images, and then filters the sub-image to estimate the cover JPEG image. Finally, using these methods, payload location algorithms are designed for two common JPEG image steganography algorithms: JSteg and F5. Experimental results show that the proposed location algorithms can effectively locate the stego positions in both JSteg and F5 steganography when the investigator possesses multiple stego images embedded along the same path. In addition, the location results can also be used to recover the steganography key to extract the embedded secret messages.

The rich model features used for steganalysis of modern steganography usually have redundant features, which would influence the detection accuracy and performance. To solve this problem, this paper proposes a feature optimization method for rich model features based on the improved Fisher criterion. Based on the principle that “The within-class variance should be smaller and between-class variance should be larger”, the improved Fisher criterion is used in this paper to evaluate the separability of feature component, sub-model features and feature vector, respectively. Then, two strategies are presented to optimize the rich model features. In the experimental analysis, the proposed method is applied to optimize the typical rich model SRM that can be used to detect typical modern steganography HUGO, and the result is compared with existing feature selection methods. Experimental results show that, in addition to significantly reducing the dimensionality and shortening the detection time, the proposed rich model feature optimization method has a better performance on maintaining the detection accuracy of the original rich model features.

With the dimension of steganalysis feature increases rapidly, ensemble steganalysis has become the trend, and its performance is greatly influenced by the selection of feature subspaces. In order to select feature subspaces more effectively to improve the performance of ensemble steganalysis, a feature subspace selection algorithm based on Fisher criterion is proposed. The proposed selection algorithm computes weight for each feature component according to its Fisher criterion value and a base probability value, then selects the feature components with the probabilities in proportion to their weights. When it is used to improve the ensemble steganalysis, the appropriate base probability value is searched by steps. Experimental results show that for J-UNIWARD (JPEG UNIversal WAvelet Relative Distortion) steganography, the proposed feature subspace selection algorithm can select more effective feature subspaces, and enhance the detection performance of GFR (Gabor Filter Residual) feature.

Comparing with the steganalysis methods based on the feature sets assembled as histograms of filtered images, their improved versions incorporating the change probabilities of coefficients in the embedding domain provide more excellent performance for content-adaptive JPEG steganography, the weight allocation of feature statistical samples is the most important. In this paper, we propose a new weight allocation method in which the maximum change probability of corresponding correlation DCT coefficients is calculated as the weight of each filtered coefficient, and the final feature set is obtained by accumulating the weights in corresponding histogram statistical samples. Experimental results conducted on three modern content-adaptive JPEG steganographic schemes and the state-of-the-art steganalysis feature set indicate that the proposed method can improve the detection performance of original feature set markedly and is superior to the selection channel aware feature set.

For analyzing the multiple least-significant bits (MLSB) steganography, a pixel group trace model is presented. Based on this model and some statistical characteristics of images, two quantitative steganalysis methods are proposed for two typical MLSB steganography paradigms. The pixel group trace model simulates the MLSB embedding by exclusive or operation, and traces the transition relationship among the possible structures of the pixel group's value by some trace pixel group subsets. Then, the estimation equations of embedding ratio are derived from the transition probability matrix among trace subsets and the symmetry of regular and singular pixel group sets. Finally, a series of experimental results for the case of triple pixel group show that the proposed steganalysis methods can estimate the low embedding ratio with smaller error, especially, for some cases, the interquartile range of the estimation errors is smaller than the best one of the others by more than 45%.

An increasing number of images in the Internet brings forward a higher requirement on the speed of steganalysis. For the problem of real-time detection of stego images, a rapid images steganalysis method based on identifiable features is proposed, where the identifiable features are specific character sequences left in stego images by steganography tools. The stego and cover images are distinguished according to whether the identifiable features are found in the detected images. Meanwhile, for the case of that multiple identifiable features appeared on the same location of an image, the AC (Aho-Corasick) multi-features matching algorithm is applied to improve the detection speed. In experiments, the detection method is used to detect eight steganography tools such as Invisible Secrets, E-Show, BMP Secrets and so on. The results show that the proposed steganalysis method can achieve a nearly perfect detection precision, and the detection speed can be improved significantly comparing with traditional methods (matching bytes one by one).

According to the characteristics of adaptive JPEG steganography which determines the changed DCT coefficients based on embedding distortion, a new steganalysis method by selecting the DCT coefficients with small distortion values is proposed. Firstly, the principle of adaptive JPEG steganography through minimizing distortion is introduced. Secondly, the practicability of selecting the changed DCT coefficients according to distortion values is studied. Thirdly, the proposed steganalysis method is given and the embedding sensitivity of the steganalysis feature extracted from the selected DCT coefficients is analyzed. Lastly, the implement processes of the proposed method are presented and analyzed in details. In the experiments, PQt, PQe and J-UNIWARD steganography are used as examples to verify the effect of the proposed steganalysis method for adaptive JPEG steganography. A serial experimental results show the detection accuracy can be improved obviously, especially when the payload is relatively low.

For hiding messages into multiple least significant bit (MLSB) planes, a new weighted stego-image (WS)\ steganalysis method is proposed to estimate the ratio of messages hidden into each bit plane. First, a new WS with multiple weights is constructed, and it is proved that when the squared Euclidean distance between the WS and the cover image is minimal, the weight parameters are equal to the embedding ratios in MLSB planes. Afterward, based on this result and an estimation of cover image, a simple estimation equation is derived to estimate the embedding ratio in each bit plane. Experimental results show that the new steganalysis method performs more stably with the change of embedding ratios than typical structural steganalysis, and outperforms the typical structural steganalysis method on the estimation accuracy when the embedding ratio in any bit plane is larger than 0.4.

Steganalysis is the reasonable method to detect whether the transmitted media content contains secret messages (e.g. business secrecy). This paper proposes two steganalysis methods to estimate the modification ratio of F5 steganography and its improved version that are popularly used to hide secrecy in images. The proposed methods measure the distance between the coefficient histogram of a given image and that of an estimated stego image. The distance is measured based on relative entropy that has the superiority of measuring the distance between two distributions. The estimated modification ratio can be used to distinguish the stego images marked by F5 steganography or its improved version from the original images. Experimental results are given to show that the proposed methods outperform the existing quantitative steganalysis methods against F5 steganography and its improved version.

Multimedia content is a suitable carrier for secret communication. This paper focuses on the steganalysis technique which aims to get the forensic of secrecy existing in multimedia carriers. A key concern for designing a blind steganalysis algorithm is the selection of statistic features. The Probability Density Function (PDF) moment and Characteristic Function (CF) moment are two typical kinds of statistic features commonly used in blind steganalysis. And generally, the features are computed from the subbands of transform domains, such as the wavelet coefficient subbands, the prediction subbands of wavelet coefficients, the prediction error subbands of wavelet coefficients, the wavelet coefficient subbands of image noise, and the log prediction error subbands of wavelet coefficients. To decide which feature is more sensitive to message embedding and useful for steganalysis is important and urgent. Till now, few works have focused on this topic, and they can only give some experimental results without theoretical analysis. Additionally, few frequency subbands have been investigated. To solve this problem, this paper reviews existing feature computing algorithms, compares the two kinds of features, the PDF moments and the CF moments, by analyzing the change trends of the statistic distribution parameters of various frequency subbands before and after message embedding, and so that provides a theoretical basis for the steganalysis feature selection and extraction. These theoretical results are further confirmed by experimental results. This is the first work to provide thorough theoretical analysis on so many feature computing algorithms. It is expected to provide valuable information to researchers or engineers working in the field of steganography forensics or steganalysis.

For detecting the MBPIS (multiple bit-planes image steganography), which embeds the messages into the multiple Gray code bit-planes, a steganalysis method is proposed to estimate the embedding ratios based on sample pairs analysis. The proposed method combines appropriate trace sets of a more elegant and pellucid sample pair analysis model to estimate the modification ratio of each natural binary bit-plane. Then the modification ratios in Gray code bit-planes are estimated from the modification ratios in natural binary bit-planes based on the relationship between natural binary bit-planes and Gray code bit-planes. Finally, considering the matrix encoding in MBPIS, the embedding ratios are obtained from the modification ratios in Gray code bit-planes. Experimental results show that compared with existing steganalysis methods, the proposed method can not only detect the stego images of MBPIS more reliably, but also estimate the embedding ratios of MBPIS with smaller errors. When the embedding ratio in the first Gray code bit-plane is not less than 0.1, the average absolute error of the proposed method will less than it of the ID3SPA by 0.04 at least.

Feature extraction is very important for steganalysis of content-adaptive JPEG steganography. The scale co-occurrence matrix feature based on a two-dimensional (2-D) Gabor filter is proposed, and diverse quantization for filter residuals is utilized to improve the detection performance. First, the definition of scale co-occurrence matrix based on a 2-D Gabor filter is given and the rules for feature merge are analyzed. Then, the influence of the scale parameter and quantization step on the detection performance of the scale co-occurrence matrix feature is discussed and verified. Next, the effect of diverse quantization strategy is presented. Last, the detailed extraction process of the proposed steganalysis feature is described. The experimental results show that the proposed steganalysis feature can achieve a performance that is competitive with the state-of-the-art steganalysis features when used for the detection of the latest content-adaptive JPEG steganography algorithms.

In order to synthetically utilize multiple steganalytic algorithms, and further improve the detection accuracy and enhance detection reliability, United-Judgment methods are researched and analyzed in this paper. According to the performance of each algorithm, United-Judgment methods for both blind and specific steganalysis are proposed based on parameter-estimation and algorithm-selection. Experiments are carried out for the former with seven typical blind detections and the latter one with five typical spatial domain steganalytic methods. Experimental results show that the proposed methods can synthetically utilize the existing multiple algorithms effectively, and achieve more reliable detection.

Using digital signals as covers for steganography has attracted more and more interests in the past decades. Nowadays, patents on digital steganography mainly focus on the applications and the new steganography methods. In this paper, the U.S. patents concerning about typical digital steganography methods are reviewed based on the basic principles and their functions. Then the future challenges and potential research directions are given briefly.

Based on the best wavelet packet decomposition of images, a new universal steganalysis method with high detection correct ratio is proposed. First, the best wavelet packet decomposition of image based on the Shannon entropy information cost function is made. Second, high order absolute characteristic function moments of histogram extracted from the coefficient subbands obtained by best wavelet packet decomposition are regarded as features. Finally, these features are processed and a back-propagation (BP) neural network is designed to classify original and stego images. Three different steganalysis algorithms for three different cases of background and application condition are presented. To validate the performance of the proposed method, a series of experiments are made for six kinds of typical steganography methods, i.e. LSB, LTSB, PMK, Jsteg, F5 and JPHide. Results show that, the average detection accuracy of the proposed method exceeds at least 6.4% and up to 15.4% and has a better universal performance than its closest competitors. Furthermore, the proposed method can provide reference for designing the pattern recognition and classification algorithm based on best wavelet packet decomposition.

Replacement of least-significant bit plane is one of the popular steganography techniques in digital images because of its extreme simplicity. But it is more difficult to precisely estimate the rate of secret message embedded by replacement of multiple least-significant bit (MLSB) planes of a carrier object. In order to model the MLSB embedding, a lemma is introduced to prove the transition relationships among some trace subsets. Then, based on these transition relationships, two novel steganalysis frameworks are designed to detect two kinds of distinct MLSB embedding methods. A series of experiments show that the proposed steganalysis frameworks are highly sensitive to MLSB steganography, and can estimate the rate of secret message with higher accuracy. Furthermore, these frameworks can fully meet the need to distinguish stego images under low false positive rate, especially when the embedded message is short.

stage-wise steganalysis system that utilizes the collusion scheme among sucessive video frames is proposed. The effect of local motion interfering detection precision is studied. The local motion and message embedded in video frame is treated as a bimodal noise. To detect the existence of the embedded message, blockwise correlation-based feature extraction scheme is proposed to reduce the local motion interfering effect. The video steganalysis process is divided into two stages. In the first stage, suspicious video frames will be recognized by decision module employing features extracted with a light-weight collusion scheme, for the real-time requirement. In the second stage, suspicious frames will be analyzed critically by the present powerful image steganalysis algorithms. Moreover, the determined principle is also studied to reduce the false positive rate in the first stage. Experimental results show the satisfying performance of the proposed system. Copyright © 2008 John Wiley & Sons, Ltd.

As the present fusing strategies cannot utilize the correlation of different detection results for image steganography effectively, a steganalysis method is proposed based on fusing SVM classifiers. Firstly, different feature subsets are used for the training of SVM classifiers. Secondly, the detection results of multi-classifiers are utilized to train a fusing classifier, the fusing classifier can learn the correlation and diversity of detection results of sub-classifiers. From the experimental result, it can be seen that the proposed steganalysis method can achieve better detection performance for J-UNIWARD steganography compared with voting and Bayesian methods.

Adaptive JPEG steganographic schemes are difficult to preserve the image texture features in all scales and orientations when the embedding changes are constrained to the complicated texture regions, then a steganalysis feature extraction method is proposed based on 2 dimensional (2D) Gabor filters. The 2D Gabor filters have certain optimal joint localization properties in the spatial domain and in the spatial frequency domain. They can describe the image texture features from different scales and orientations, therefore the changes of image statistical characteristics caused by steganography embedding can be captured more effectively. For the proposed feature extraction method, the decompressed JPEG image is filtered by 2D Gabor filters with different scales and orientations firstly. Then, the histogram features are extracted from all the filtered images.Lastly, the ensemble classifier is used to assemble the proposed steganalysis feature as well as the final steganalyzer. The experimental results show that the proposed steganalysis feature can achieve a competitive performance by comparing with the other steganalysis features when they are used for the detection performance of adaptive JPEG steganography such as UED, JUNIWARD and SI-UNIWARD.

A steganalysis feature extraction method based on Gauss partial derivative filter bank is proposed in this paper to improve the detection performance for content-adaptive JPEG steganography. Considering that the embedding changes of content-adaptive steganographic schemes are performed in the texture and edge regions, the proposed method generates filtered images comprising rich texture and edge information using Gauss partial derivative filter bank, and histograms of absolute values of filtered subimages are extracted as steganalysis features. Gauss partial derivative filter bank can represent texture and edge information in multiple orientations with less computation load than conventional methods and prevent redundancy in different filtered images. These two properties are beneficial in the extraction of low-complexity sensitive features. The results of experiments conducted on three selected modern JPEG steganographic schemes—uniform embedding distortion, JPEG universal wavelet relative distortion, and side-informed UNIWARD—indicate that the proposed feature set is superior to the prior art feature sets—discrete cosine transform residual, phase aware rich model, and Gabor filter residual.

For the LSB steganography, a fusion method is proposed to fuse two typical quantitative steganalysis methods based on support vector regression (SVR). This paper first gives some main factors influencing the errors of structural steganalysis and weighted stego image steganalysis, viz. the local variance and saturation. Then, the estimated embedding ratios of above two methods, the local variance, the histogram of local variance and saturation are fed to the SVR to train the fusion rule which is used to fusing these two methods. Experimental results show that the proposed fusion method can estimate the embedding ratio with higher accuracy than the individual method.

Reliable identification of steganography software is an important research direction of steganography forensics, how to identify the steganography software based on the characteristics of steganography algorithm is the difficulty in the research of identifying the steganography software. In this paper, based on the principles of LSB Steganography algorithm (include LSB Replacement and LSB Matching), we propose an approach to identify steganography software by Feature Matching. First, we take the process of change operations to the pixels in the LSB steganography algorithm as Core Instructions which are taken as the feature of the software, and we have analyzed the implementation of Core Instructions in a variety of typical steganography software based on LSB Steganography algorithm, then build the corresponding feature for each of implementations. And then we would determine whether the software is a LSB steganography software according to the existence of codes matched with the feature. The experimental results show that the method in this paper can reliably identify a variety of common steganography software based on LSB Steganography algorithm.

A robust software watermarking scheme under which the watermark can resist against various attacks includ-ing collusion attacks is proposed based on obfuscated interpretation. The obfuscated interpretation technique can not only hide the functionality of a given program, but also provide an alternative simple way to modify the code. Thus in the proposed scheme translation rules defined in obfuscated interpretation are used for code substitution, and a water-mark encoded by error-correcting coding is embedded during the translation procedure of obfuscated interpretation. A series of experimental results show that the proposed watermark can resist against automatic attacks that modify the program code. Moreover due to the randomness introduced in the program translation, the watermark is robust to collusion attacks as well.

The replacement steganography in each bit plane of two least-significant bits (2LSB) in digital images may be independent and the secret message length in each bit plane can be different. Based on the principle of the weighted stego-image, a new weighted stego-image model for 2LSB replacement steganography is given in this paper, and a new steganalytic method is based on the weighted stego-image model. The method firstly introduces the proposed least significant bits (LSB) detection method into estimating the embedding ratio of hyper-LSB after deleting the lowest bit plane, and then the embedding ratio of LSB is given based on the Weighted Stego-image model. Experimental results show that new method is an effective method.