Steganography Sami Dokheekh.

Steganography Sami Dokheekh

Agenda Research Hierarchy Related Work. Fact about JPEG Compression
JPEG – Encoding/Decoding DCT Histogram. Spatial Blockness. F5 algorithm. F5 Attack. How to recover original image? 2 Proposed new F5 attacks. Comparison results. Verification test results. Conclusion. Future work

Research Hierarchy Information Hiding Existing Hiding Content Hiding
Steganography Watermarking Cryptography Video Image Audio BMP GIF JPEG PNG TIF Subject Pyramid

Related Work JPEG JStig F5 OutGuess
JSteg sequentially embeds the hidden data in LSBs of quantized DCT coefficients. JSteg disturb AC DCT histogram. Vulnerable to visual attacks. Vulnerable to statistical attacks also.

F5 distribute the message bits randomly by using a user password as a seed to a Random Generator. F5 does not disturb AC DCT histogram. F5 can’t be detected by visual attacks. Vulnerable against statistical attacks.

OutGuess distribute the message bits randomly by using a user password as a seed to a Random Generator. OutGuess preserve AC DCT Histogram. OutGuess can’t be detected by visual attacks. Vulnerable against statistical attacks.

Fact about JPEG Compression
JPEG stands for Joint Photographic Experts Group JPEG compression is used with .jpg and can be embedded in .tiff and .eps files. Used on 24-bit color files. Works well on photographic images. Although it is a lossy compression technique, it yields an excellent quality image with high compression rates. JPEG use .jpg and .esp .tiff file extensions 24-bit colors JPEG is lossy and lossless. It obtained excellent quality for high compression rates.

JPEG – Encoding/Decoding
RGB Image Data ( a Matrix of size NxMx3 ) [0-255] DCT/IDCT Lossless Two Dimension Discrete Cosine Transformation Quantize/Dequantize Division By a user define Quality table then integer roundation Lossy Source Coding/Decoding Huffman coding or arithmetic coding Lossless Contain Header, Quantization Tables, Source Coding Tables, and Data. JPEG File

JPEG – Encoding/Decoding
RGB Image Data RGB Image Data Quantization Table DCT Quantize Dequantize IDCT H.C. Table Huffman Coding Huffman Decoding Q. Table HC Table JPEG File DATA Encoding Process Decoding Process

JPEG - Encoding Quality Table DCT Quantize 8x8 block 8x8 block
Spatial Domain Frequency Domain

JPEG - Decoding Quality Table IDCT Dequantize 8x8 block 8x8 block
Spatial Domain Frequency Domain

JPEG - Encoding e.g. DCT 8x8 block in Spatial Domain Spatial Domain
183 186 185 187 182 181 184 174 178 179 166 170 175 176 163 164 168 169 171 160 161 162 165 167 156 155 154 DCT 8x8 block in Spatial Domain Spatial Domain

JPEG - Encoding – e.g. DCT Quantize 8x8 block in Frequency Domain
-3.27 -1.66 2.49 1.13 5.11 1.07 21.94 0.68 -0.42 0.67 -2.93 0.11 -5.72 -10.81 68.10 1.05 1.31 -0.22 -3.52 5.14 -3.26 1.33 0.00 0.43 -0.48 1.06 0.85 -3.65 -11.50 -3.51 -0.49 0.49 -0.07 -0.38 -0.75 -0.20 8.34 0.88 -0.59 -0.10 0.69 -0.35 -0.87 -6.30 -2.92 2.61 0.44 0.36 0.73 -0.86 -0.84 -0.64 -0.33 0.94 -0.73 -0.66 0.02 0.32 -1.08 -1.00 -0.70 -1.36 DCT Quantize 8x8 block in Frequency Domain Frequency Domain

JPEG - Encoding – e.g. Quality Table for 50 Frequency Domain Quantize
61 51 40 24 16 10 11 55 60 58 26 19 14 12 56 69 57 13 62 80 87 29 22 17 77 103 109 68 37 18 92 113 104 81 64 35 101 120 121 78 49 99 100 112 98 95 72 Quantize

JPEG - Encoding – e.g. Quantize Quantized 8x8 Block Frequency Domain 2
2 86 -1 6 Quantized 8x8 Block Frequency Domain

JPEG - Decoding – e.g. Dequantize Quantized 8x8 Block Frequency Domain
2 86 -1 6 Quantized 8x8 Block Frequency Domain

JPEG - Decoding – e.g. Quality Table for 50 Frequency Domain
61 51 40 24 16 10 11 55 60 58 26 19 14 12 56 69 57 13 62 80 87 29 22 17 77 103 109 68 37 18 92 113 104 81 64 35 101 120 121 78 49 99 100 112 98 95 72 Dequantize

JPEG - Decoding – e.g. IDCT Dequantize 8x8 block in Frequency Domain
22 1376 -12 72 -17 IDCT Dequantize 8x8 block in Frequency Domain Frequency Domain

JPEG - Decoding e.g. Round IDCT 8x8 block in Spatial Domain
187 186 185 184 183 182 180 181 173 174 176 178 169 170 171 179 167 168 172 164 165 166 156 157 158 160 163 149 151 154 162 Round IDCT 8x8 block in Spatial Domain Spatial Domain

JPEG – Encoding/Decoding e.g.
183 186 185 187 182 181 184 174 178 179 166 170 175 176 163 164 168 169 171 160 161 162 165 167 156 155 154 Quality 50 187 186 185 184 183 182 180 181 173 174 176 178 169 170 171 179 167 168 172 164 165 166 156 157 158 160 163 149 151 154 162 JPEG Encoding Decoding JPEG FILE A 8x8 block in Spatial Domain A 8x8 block in Spatial Domain They are not the same Spatial Domain

JPEG – AC/DC DCT DC coefficient is a special coefficient, it is equal to the average value of all 64 values in the RGB spatial block divided by 8. AC coefficients is the rest 63 coefficients in the Block. Each type have a coding algorithm in the jpeg encoding process. Show me 8 coefficients AC DC 8 coefficients An 8x8 Block in the Frequency Domain

JPEG - DCT DCT is reversible function:
DCT(X) == IDCT(DCT(X)) DCT Convert RGB Block to Frequency Domain Block. Frequency block can be quantized to produce zero coefficients as much as possible. DCT stand for Discrete cosine transformation. DCT block can be quantized to produce coefficients with zero values as much as possible.

JPEG - Quantization The frequency block is quantized by a user define quality factor. Quality is in the range [ ] 1 means very low quality. 100 means full quality. The looseness rise due to the rounding process. Quantization is the process where the DCT 8x8 block is divided by 8x8 integer matrix to compress the data. The user specify the quality from the range [1:100]. Each quality factor had a 8x8 quantization matrix.

JPEG - Quantization Standard JPEG quantization matrix formula :
Quantization is the process where the DCT 8x8 block is divided by 8x8 integer matrix to compress the data. The user specify the quality from the range [1:100]. Each quality factor had a 8x8 quantization matrix. for Q>50 for Q<50

JPEG – Huffman Coding AC coefficients are arranged in a zigzag order before applying the Huffman coding. This is done so that the coefficients are in order of increasing frequency. The higher frequency coefficients are more likely to be 0 after quantization. The goal is to group all the zeros together, to allow compression. For each quantized block, the coefficients is converted to 1 row matrix by using zigzag order. We do the zigzag order to sort the coefficients in order of increasing frequency. Higher frequencies are more likely to be zero after quantization. The goal is to group all zero’s together to allow run-length compression.

JPEG – Huffman Coding Huffman coding applied on DC coefficients differ from AC coefficients. Example : Zigzag order : 86,2,6,0,-1,0,0,0,0,0,0,-1,0,0,0,0,0,0,0,0,0,0 … 0 Symbols = {0,-1,2,6,86} Probability = {0.9219, , , , } Huffman Decoder : { } = 74 bit Original block = 64 byte Compression ratio = (74/(64*8))*100 = % 2 86 -1 6

JPEG – AC DCT Histogram

JPEG - AC DCT Histogram of Frequency (k,l)
Where ≤ k,l ≥ 8 2 2 2 12 1 5 4 2 7 6 3 9 12 1 5 4 3 7 6 2 9 2 1 12 4 8 3 1 5 7 6 2 9 12 4 8 3 1 5 7 6 2 9 2 Image Histogram Frequency (2,2). Freq 2 A

JPEG – Compression Effect
Quality = 100 Next

Quality = 90 Next

Quality = 80 Next

Quality = 60 Next

Quality = 40 Next

Quality = 20

F5 Was developed by German researchers Pfitzmann and Westfeld in 2001.
Embeds message bits into randomly-chosen DCT coefficients in JPEG images and employs matrix embedding that minimizes the necessary number of changes to embed a message of certain length. comes after a series of past algorithms like F3 and F4. F5 was introduced by Pfitzmann and Westfeld in 2001. F5 uses DCT coefficients as the carrier medium. It embeds the secret message bits in a randomly chosen coefficients. It uses a matrix encoding algorithm to minimize the necessarily number of changes coefficients. It was the final improved version after F3 and F4.

F5 – Process Overview Message 010101 010010 010100 User Quality
Clean image (JPEG)(BMP) Password Compressed Image Embedding Process JPEG Compress Stego Image

F5 – Process Details DCT Quantize 010101 010010 Find k, n 010100
Quality Table Quantized DCT Coefficients Clean image (JPEG)(BMP) DCT Coefficients Non-Zero AC Coefficient Counter DCT Quantize Message Bits Password Random Walk Generator 010101 010010 010100 Repeat Until all Message Bits are embedded Or No more Usable Coefficients left Usable Coefficients Buffer Find k, n n Eliminate BitS From UCB Repeat this iteration Yes Get n Coefficients Buffer k If S = 0 Yes Calculate S Bit Counter No If Shrinkage Get k Message Bits Decrement Buffer BitS No

F5 – Matrix Encoding Simple encoding Introduce very high number of changes. Matrix Encoding was introduced by “Ron Crandall” in 1998. Matrix Encoding minimize the number of changes required by embedding a message. That is reaching high embedding rates. F5 was possibly the first implementation of Matrix Encoding. Matrix Encoding was introduced by “Ron Crandall” in 1998. F5 was possibly the first steganographic algorithm that uses Matrix Encoding. Matrix Encoding enables reaching high embedding rates.

F5 – Matrix Encoding F5 uses Matrix Encoding such as encoding k message bits inside n codeword with no more than 1 change in the codeword if needed. n = 1/2k-1. Change density D(k)= 1/(n+1). Embedding rate R(k)= k/n. Embedding efficiency W(k)= R(k)/D(k). W(k) = 2kxk/2k-1.

F5 - Steganographic interpretation
Positive coefficients: LSB. Negative coefficients: inverted LSB. Decrement positive coefficients. Increment negative coefficients. Shrinkage is the situation where a coefficient had decremented or incremented leading its value to zero Repeat if shrinkage occurs.

F5 – Embedding Process -4 -3 -2 -1 0 1 2 3 4 1 1 1 1 1 1 1 1 … …
1 1 1 1 1 1 1 1 shrinkage shrinkage … … skip

F5 – Matrix Encoding k n Change Density Embedding rate Embedding Efficiency 1 50.00% 100.00% 2 3 25.00% 66.67% 2.67 7 12.50% 42.86% 3.43 4 15 6.25% 26.67% 4.27 5 31 3.12% 16.13% 5.16 6 63 1.56% 9.52% 6.09 127 0.78% 5.51% 7.06 8 255 0.39% 3.14% 8.03 9 511 0.20% 1.76% 9.02 Relations between change densities and embedding rates

F5 – Traditional Embedding
Message Bits 1 Embed 1 Carrier 1 W(k) = 1 bit per change.

F5 – Matrix Encoding x a W(k) = 3 bit per change. Change a5 X 5 SUM X
f(a`) 1 x1 x2 x3 Message Bits x 1 W(k) = 3 bit per change. Embed a 1 1 Carrier Hash Function f(a) = ai . binary(i) i=1 n Change a5 1 X a7 a6 a5 a4 a3 a2 a1 f(a) 1 x1 x2 x3 5 SUM MSG Bit a7 a6 a5 a4 a3 a2 a1 f(a) 1 x1 x2 x3 X 1 1 1 1 2 4 1 4 = = = Xor Xor

F5 - Encoding e.g. DCT Embed Message [AB] In an Image of 8X8 Pixel
29 26 27 15 16 6 20 18 11 13 12 19 14 21 9 17 10 8 22 23 DCT Embed Message [AB] In an Image of 8X8 Pixel 8x8 block in Spatial Domain Spatial Domain

F5 - Encoding – e.g. DCT Quantize 8x8 block in Frequency Domain
0.21 -0.55 -5.24 -2.63 -2.06 8.84 -20.56 133.37 0.38 -7.03 -0.27 0.08 -3.24 -20.50 -0.10 0.83 0.09 -5.55 0.49 2.81 -3.55 2.48 20.64 -0.31 -0.24 0.18 -5.45 2.60 2.03 -4.11 -0.58 -0.48 -0.08 -0.13 -0.52 -12.24 -4.64 -1.63 0.12 -0.46 -0.18 -0.35 -0.38 -3.89 6.11 0.22 -0.20 0.26 0.20 0.14 0.47 0.51 -0.41 -0.14 -0.22 0.30 0.63 DCT Quantize 8x8 block in Frequency Domain Frequency Domain

F5 - Encoding – e.g. Frequency Domain Quality Table for 100 1 Quantize

F5 - Encoding – e.g. Quantize Quantized 8x8 Block Frequency Domain -1
-1 -5 -3 -2 9 -21 133 -7 1 -6 3 -4 2 21 -12 6 Quantized 8x8 Block Frequency Domain

F5 Encoding – e.g. For simplicity : RandomWalkGenerator
*Assume the user password is [mysecretpassword] *Assume the Random Walk Generator generates The walk as column by column. *Assume the k value along with the message bit count will be known by the receiver. Actually F5 embed these two information at the beginning of the message. For simplicity : -1 -5 -3 -2 9 -21 133 -7 1 -6 3 -4 2 21 -12 6 Password RandomWalkGenerator Clean Image Quantized DCT Coefficients 8x8 Block 1 -1 -6 -7 -5 -3 3 -2 -12 2 -4 9 -21 6 21 Usable Coefficients Buffer

F5 Encoding – e.g. Usable Coefficients Buffer Message Bits Count = 28
1 -1 -6 -7 -5 -3 3 -2 -12 2 -4 9 -21 6 21 Message Bits Count = 28 1 A B k n Embedding rate 1 100.00% 2 3 66.67% 7 42.86% 4 15 26.67% 5 31 16.13% 6 63 9.52% 127 5.51% 8 255 3.14% 9 511 1.76% Count = 14 Embedding Rate = (14/28)*100= 50% So we chose k=2, n=3.

F5 Encoding – e.g. 1st iteration Test Shrinkage
Usable Coefficients Buffer 1 -1 -6 -7 -5 -3 3 -2 -12 2 -4 9 -21 6 21 1st iteration Message Bits Buffer 1 -2 -1 21 Buffer LSB k Message Bits a 1 x 1 Test Shrinkage Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(1 xor 1) xor 1] * 1 + [(0 xor 1) xor 0] * 2 = [0 xor 1] * 1 + [1 xor 0] * 2 = 1 * * 2 = 1+2 = 3 Sum = Change a3 Buffer Buffer -1 21 -1 21 Increment Buffer coefficient # 3 No shrinkage occurred Update this changed coefficients to the original Image Coefficients (8X8)Block. k message bit was embedded with a single change. Proceed to next iteration.

F5 Encoding – e.g. 2nd iteration Test Shrinkage
Usable Coefficients Buffer 1 -1 -6 -7 -5 -3 3 -2 -12 2 -4 9 -21 6 2nd iteration Message Bits Buffer 1 -21 1 6 Buffer LSB k Message Bits a 1 x Test Shrinkage Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(0 xor 0) xor 0] * 1 + [(1 xor 0) xor 0] * 2 = [0 xor 0] * 1 + [1 xor 0] * 2 = 0 * * 2 = 0+2 = 2 Sum = Change a2 Buffer Buffer -21 6 -21 6 Decrement Buffer coefficient # 2 Shrinkage had occurred Update this changed coefficients to the original Image Coefficients (8X8)Block. Eliminate the changed coefficient from the usable coefficients Buffer. Repeat this iteration.

F5 Encoding – e.g. 2nd iteration Usable Coefficients Buffer
1 -1 -6 -7 -5 -3 3 -2 -12 2 -4 9 -21 6 2nd iteration Message Bits Buffer 1 -21 6 Buffer LSB k Message Bits a x Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(0 xor 0) xor 0] * 1 + [(0 xor 0) xor 0] * 2 = [0 xor 0] * 1 + [0 xor 0] * 2 = 0 * * 2 = 0+0 = 0 Sum = No Change k message bit was embedded without a change. Proceed to next iteration.

F5 Encoding – e.g. 3rd iteration Test Shrinkage
Usable Coefficients Buffer 1 -1 -6 -7 -5 -3 3 -2 -12 2 -4 9 3rd iteration Message Bits Buffer 1 -5 -4 2 Buffer LSB k Message Bits a 1 x Test Shrinkage Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(0 xor 0) xor 0] * 1 + [(1 xor 0) xor 0] * 2 = [0 xor 0] * 1 + [1 xor 0] * 2 = 0 * * 2 = 0+2 = 2 Sum = Change a2 Buffer Buffer -5 -3 2 -5 -3 2 Increment Buffer coefficient # 2 No shrinkage occurred Update this changed coefficients to the original Image Coefficients (8X8)Block. k message bit was embedded with a single change. Proceed to next iteration.

F5 Encoding – e.g. 4th iteration Usable Coefficients Buffer
1 -1 -6 -7 -5 -3 3 -2 -12 2 -4 9 4th iteration Message Bits Buffer 1 -3 9 -4 Buffer LSB k Message Bits a 1 x 1 Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(1 xor 0) xor 1] * 1 + [(1 xor 0) xor 1] * 2 = [1 xor 1] * 1 + [1 xor 1] * 2 = 0 * * 2 = 0+0 = 0 Sum = No change. k message bit was embedded without a change. Proceed to next iteration.

F5 Encoding – e.g. 5th iteration Test Shrinkage
Usable Coefficients Buffer 1 -1 -6 -7 -5 -3 3 -2 -12 2 -4 5th iteration Message Bits Buffer 1 -12 2 -4 Buffer LSB k Message Bits a 1 x Test Shrinkage Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(1 xor 1) xor 0] * 1 + [(0 xor 1) xor 0] * 2 = [0 xor 0] * 1 + [1 xor 0] * 2 = 0 * * 2 = 0+2 = 2 Sum = Change a2 Buffer Buffer -12 1 -4 -12 1 -4 Decrement Buffer coefficient # 2 No shrinkage occurred Update this changed coefficients to the original Image Coefficients (8X8)Block. k message bit was embedded with a single change. Proceed to next iteration.

1 -1 -6 -7 -5 -3 3 -2 6th iteration Message Bits Buffer 1 3 -2 1 Buffer LSB k Message Bits a 1 x Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(1 xor 1) xor 0] * 1 + [(1 xor 1) xor 0] * 2 = [0 xor 0] * 1 + [0 xor 0] * 2 = 0 * * 2 = 0+0 = 0 Sum = No change. k message bit was embedded without a change. Proceed to next iteration.

1 -1 -6 -7 -5 -3 3 7th iteration Message Bits Buffer 1 -3 -1 3 Buffer LSB k Message Bits a 1 x 1 Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(1 xor 0) xor 1] * 1 + [(0 xor 0) xor 0] * 2 = [1 xor 1] * 1 + [0 xor 0] * 2 = 0 * * 2 = 0+0 = 0 Sum = No change. k message bit was embedded without a change. K message bit finished -> Stop.

F5 Encoding – e.g. Clean Image DCT Block Stego Image DCT Block -1 -5
-1 -5 -3 -2 9 -21 133 -7 1 -6 3 -4 2 21 -12 6 -1 -5 -3 -2 9 -21 133 -7 1 -6 3 -4 2 21 -12 6 Clean Image DCT Block Stego Image DCT Block

F5 Encoding – e.g. Number of changed Coefficients = 4.
Number of shrunken coefficients = 1. So we actually embed 14 bit by only changing 4 coefficients. Estimated embedding efficiency = 2.67 bpc. Actual embedding efficiency = 14/4= 3.5 bpc.

F5 Encoding – e.g. Clean Image Stego Image Observations:
F5 is not does not effect the appearance of the image. The human eye can’t distinguish stego image from clean one.

F5 Encoding – e.g. Clean Image Stego Image Observations:
29 26 27 15 16 6 20 18 11 13 12 19 14 21 9 17 10 8 22 23 29 26 27 15 16 6 21 20 18 11 13 12 14 22 19 9 17 10 8 23 Clean Image Stego Image Unchanged pixel Incremented pixel Decremented pixel Observations: F5 effect in spatial block is light (change by +- 1). Most of the changes occurs at the boundaries. (7 out of 12 changes).

F5 Decoding – e.g. For simplicity : RandomWalkGenerator
*Assume the user password is [mysecretpassword] *Assume the Random Walk Generator generates The walk as column by column. *Assume the k value along with the message bit count will be known by the receiver. Actually F5 embed these two information at the beginning of the message. For simplicity : -1 -5 -3 -2 9 -21 133 -7 1 -6 3 -4 2 21 -12 6 Password RandomWalkGenerator Stego Image Quantized DCT Coefficients 8x8 Block 1 -1 -6 -7 -5 -3 3 -2 -12 -4 9 2 -21 6 21 Usable Coefficients Buffer

F5 Decoding – e.g. 1st iteration x1 = a1 xor a3 = 1 xor 0 = 1
Usable Coefficients Buffer 1 -1 -6 -7 -5 -3 3 -2 -12 -4 9 2 -21 6 21 1st iteration Message Bits Buffer Buffer Empty -1 21 Buffer LSB a 1 k Message Bits x1 = a1 xor a3 = 1 xor 0 = 1 x2 = a2 xor a3 = 0 xor 0 = 0 x 1 k message bit was recovered from n usable coefficients Buffer. Add k bits to the message bit buffer. Proceed to next iteration.

F5 Decoding – e.g. 2nd iteration x1 = a1 xor a3 = 0 xor 0 = 0
Usable Coefficients Buffer 1 -1 -6 -7 -5 -3 3 -2 -12 -4 9 2 -21 6 2nd iteration Message Bits Buffer Buffer 1 -21 6 Buffer LSB a k Message Bits x1 = a1 xor a3 = 0 xor 0 = 0 x2 = a2 xor a3 = 0 xor 0 = 0 x k message bit was recovered from n usable coefficients Buffer. Add k bits to the message bit buffer. Proceed to next iteration.

F5 Decoding – e.g. 3rd iteration x1 = a1 xor a3 = 0 xor 0 = 0
Usable Coefficients Buffer 1 -1 -6 -7 -5 -3 3 -2 -12 -4 9 2 3rd iteration Message Bits Buffer Buffer 1 -5 -3 2 Buffer LSB a k Message Bits x1 = a1 xor a3 = 0 xor 0 = 0 x2 = a2 xor a3 = 0 xor 0 = 0 x k message bit was recovered from n usable coefficients Buffer. Add k bits to the message bit buffer. Proceed to next iteration.

F5 Decoding – e.g. 4th iteration x1 = a1 xor a3 = 1 xor 0 = 1
Usable Coefficients Buffer 1 -1 -6 -7 -5 -3 3 -2 -12 -4 9 4th iteration Message Bits Buffer Buffer 1 -3 9 -4 Buffer LSB a 1 k Message Bits x1 = a1 xor a3 = 1 xor 0 = 1 x2 = a2 xor a3 = 1 xor 0 = 1 x 1 k message bit was recovered from n usable coefficients Buffer. Add k bits to the message bit buffer. Proceed to next iteration.

Usable Coefficients Buffer 1 -1 -6 -7 -5 -3 3 -2 -12 -4 5th iteration Message Bits Buffer Buffer 1 1 -12 1 -4 Buffer LSB a 1 k Message Bits x1 = a1 xor a3 = 1 xor 1 = 0 x2 = a2 xor a3 = 1 xor 1 = 0 x k message bit was recovered from n usable coefficients Buffer. Add k bits to the message bit buffer. Proceed to next iteration.

Usable Coefficients Buffer 1 -1 -6 -7 -5 -3 3 -2 6th iteration Message Bits Buffer Buffer 1 1 3 -2 1 Buffer LSB a 1 k Message Bits x1 = a1 xor a3 = 1 xor 1 = 0 x2 = a2 xor a3 = 1 xor 1 = 0 x k message bit was recovered from n usable coefficients Buffer. Add k bits to the message bit buffer. Proceed to next iteration.

Usable Coefficients Buffer 1 -1 -6 -7 -5 -3 3 7th iteration Message Bits Buffer Buffer 1 -3 -1 3 Buffer LSB a 1 k Message Bits x1 = a1 xor a3 = 1 xor 0 = 1 x2 = a2 xor a3 = 0 xor 0 = 0 x 1 k message bit was recovered from n usable coefficients Buffer. Add k bits to the message bit buffer. Terminate loop. {all message bits were recovered}.

F5 Decoding – e.g. Original Message = AB Recovered Message = AB
Message Bits Buffer 1 A B Original Message = AB Recovered Message = AB

F5 – Implementing the algorithm.
We implement the F5 algorithm on Matlab 7. F5 was implemented without a random walk generator. (no need for password) Inputs is gray image matrix. Output is DCT coefficients matrix. JPEG compression/decompression process is not included. Only the F5 embedding and extraction process is implemented. We implement F5 algorithm using matlab 7. Only the core embedding and extraction process is implemented. We implement F5 without random walk generator. Accept only grayscale images. Output is dequantized DCT coefficient matrix.

Shifted Image Fridrich claim that spatial shifting of the stego image will restore the original image histogram. Fridrich stated that this process will destroy all previous JPEG compression effect on the image. She recommended a low-pass filter after shifting the stego image.

Shifted Image 4 pixels 4 pixels 8 pixels

F5 Facts- Histogram

F5 Facts-Continues Embedding
Original Image Image After 30 F5 Embedding Maximum Capacity. Image After 190 F5 Embedding Maximum Capacity.

F5 Facts-Continues Embedding

F5 Facts - Blockness

F5 Facts – Cross Blockness
SB = |a-b| + |c-d| + |a-c| + |b-d| + |a-d| + |c-b| For each 4 disjoint blocks

F5 Facts - Blockness

F5 Facts – Cross Blockness

F5 Attack Based on the fact that F5 increases the total number of zero coefficients and decreases the non-zero ones. The cover image (baseline) is evaluated to compare the two histograms. Baseline image is evaluated by cropping the stego image by 4 pixels and apply a low-pass filter to the cropped image. 1. F5 increases the total number of zero coefficients and decreases the non-zero ones. 2. (baseline) is evaluated to compare the two histograms. 3. (baseline) is evaluated by cropping the stego image by 4 pixels and apply a low-pass filter to the cropped image.

F5 Attack Calculate DCT Histogram Decompression Stego Image
Crop By 4 pixel Calculate DCT Histogram Filtering Stego Image Quality Compression Baseline image

F5 Attack Baseline Histogram Stego Histogram
Baseline Histogram Stego Histogram h(d) , d = 0,1,2 … , is the total number of AC coefficients in the cover-image with absolute value equal to d after the image has been compressed inside the F5 algorithm. hkl(d) the total number of AC DCT coefficients corresponding to the frequency (k, l), 1 ≤ k, l ≤ 8, whose absolute value is equal to d. H(d) & Hkl(d) are the same for the stego image.

F5 Attack h(d) H(d) Let us suppose that the F5 embedding process changes n AC coefficients. The probability that a non-zero AC coefficient will be modified is β = n/P, where P is the total number of non-zero AC coefficients (P = h(1) + h(2) + …). Because the selection of the coefficients is random in F5, the expected values of the histograms Hkl of the stego-image are: Hkl(d) = (1 – β) hkl(d) + β hkl(d+1) , for d>0, Hkl(0) = hkl(0) + β hkl(1) , for d=0,

F5 Attack 01234 01234 h(d) H(d) We can calculate an estimate h^kl(d) of the cover image histogram (baseline) , so based on the previous formula we can estimate β very easily. We know stego histogram Hkl(d) and we have h^kl(d)  We can evaluate β. They have experimented with different formulas for β and the best performance was obtained using the least square approximation. We calculate β as the value that minimizes the square error between the stego-image histogram Hkl, and the expected values h^kl(d) calculated from the estimated histogram h^kl using last equation.

F5 Attack 01234 01234 h(d) H(d) Because the first two values in the histogram (d=0 and d=1) experiences the largest change during the embedding, We can write: βkl = arg minβ [Hkl(0) – h^kl(0) – β h^kl(1) ]2+[Hkl(1) – (1 – β) h^kl(1) – β h^kl(2) ]2 Which led to the following equation for β :

F5 Attack h(d) H(d) We calculate β as the average against the three frequencies [1,2],[2,1],[2,2] β = (β 12 + β 21 + β 22) / 3

F5 Attack – Double compression
Message 010101 010010 010100 User Quality (Q2) Clean image (JPEG) Password Compressed Image Embedding Process JPEG Compress Double Compression Old Quality (Q1) Stego Image

Double compression take place when the image sent to F5 is already a JPEG compressed image. Their detection algorithm can’t detect such stego images correctly. They adds a double correction step to their algorithm to eliminate the problem.

Calculate DCT Histogram Jpeg Image Decompression Stego Image Crop By 4 pixel Calculate DCT Histogram Filtering Old Quality Compression Stego Image Quality Decompression Compression Baseline image

We calculate β for fixed of quantization tables {Q1,…Qt}. For each Qi, 1 ≤ i ≤ t, we run the detection algorithm with a little change. After shifting and filtering process we compress the image with Qi and immediately decompress it again after going throw the rest of the algorithm.

Now we have a set of calculated βi ,1≤ i ≤ t. For each i and for each DCT mode k, l, we calculate the L2 distance E(i)kl between Hkl and h^kl with β = βi : The final β is obtained as β = βt where :

F5 Attack – Estimating the True Message Length
Let n be the total number of changes in quantized DCT coefficients introduced by the F5 algorithm. We can write n as n = s + m, where s is the shrinkage, and m is the number of changes due to actual message bit embedding. The probability of selecting a coefficient that may lead to shrinkage is PٍٍS = h(1)/P. Since the coefficients are selected at random, the expected value of s is nPS. Thus, we obtain the following formula: m + nPS = n

F5 Attack – Estimating the True Message Length
which gives m=n(1–PS) for the number of changes due to message embedding. Assuming the (1,2k−1, k) matrix embedding, the expected number of bits per change W(k) is: Thus, the unknown message length M can be calculated as: Where:

F5 Attack – Implementing the algorithm
We Implement the algorithm on Matlab 7. We add a GUI to the tool. Ability to chose the difficulty of the algorithm. (Shifting + Old Quality estimate). Ability to see progress at progress bar.

F5 Attack Tool

F5 Attack – Results Comparison
We compare our implemented algorithm results with their results. 20 test images. Using averaging shifting from 3:5 Using Old Quality rang from 80:2:100. Results is β and n.

Score: Paper : 5/20 = 25 % Project : 15/20 = 75 %

Score: Paper : 4/20 = 20 % Project : 16/20 = 80 %

New Methodology As we mention before, most of F5 changes on spatial domain effect the boundaries of each 8x8 block. 29 26 27 15 16 6 20 18 11 13 12 19 14 21 9 17 10 8 22 23 29 26 27 15 16 6 21 20 18 11 13 12 14 22 19 9 17 10 8 23 Clean Image Stego Image Unchanged pixel Incremented pixel Decremented pixel

New Methodology - Blockness
The Blockness value of the stego image is much more than the clean image. The Blockness increases almost linearly with the size of the embedded message. We have collect a set of 30 JPEG images with deferent dimensions and for each image we embedded deferent message size from 1KB to 30KB. We test both normal Blockness and cross Blockness.

New Methodology - Blockness
2

New Methodology - Continues Embedding
Blockness value increases also linearly when continuing embedding messages. Normal Blockness show better linearity than cross Blockness. We have tested 10 images with deferent dimensions on continually embedding process of 1KB message each step.

New Methodology - Continues Embedding
2

Proposed Algorithm 1 Lets assume the B(I) is the blockiness value of image I. Is is the stego image. Ic is the cover or clean image. If is the stego image using full capacity. We calculate the linear equation of blockiness increasement against number of changed coefficients as: y = m*x + c first we calculate the mean: m = (B(If) - B(Ic))/(N(If) - N(Ic)) N is the number of changed coefficients. we know that Ic don't have changed coefficients, so we can write: m = (B(If) - B(Ic))/N(If)

Proposed Algorithm 1 Now we can calculate the constant c value:
c = B(Ic) so now we have the linear equation, y = m*x + c we want to calculate x: x = y - c / m now we change x and y by relative values from stego image Is: N(Is) = (B(Is) - B(Ic))/(B(If) - B(Ic))/N(If) which gives: N(Is) = N(If)*(B(Is) - B(Ic))/(B(If) - B(Ic)) Now we have N(Is),to calculate Beta, we count all non-zero coefficients from Ic, let it P: β = N(Is)/P(Ic) we estimate the true message length in the same way

Proposed Algorithm 1 Unfortunately, the results was disappointed.
Estimated Message Length is far away from the actual message length. This because the recovered baseline image blockiness value is less far away from actual clean image blockiness value.

Proposed Algorithm 2 This proposed algorithm is actually an improvement of the original F5 attack we had described before. The original algorithm calculates β value for deferent shift values. In the description of the algorithm, we stated that the shift is by 4 pixels in both directions. Actually, the original algorithm results was an average value of deferent estimated β calculated using deferent shift values.

Proposed Algorithm 2 This proposed algorithm calculates β value as the value calculated from a shift having minimum E value among all shifts. E value is calculated in the original algorithm to tackle the double compression problem.

Proposed Algorithm 2

Calculating E value for old quality range
Proposed Algorithm 2 Average () Select with β minimum E Current Shift original algorithm 2nd proposed algorithm Min(E), β Crop Stego image Apply Low-pass Filter Calculating E value for old quality range Current Old Quality Calculate β Calculate E

Verification We generate test data of 432 images from 12 images was taken from mobile camera. 144 clean 12 144 stego 1 KB 144 stego 2 KB 150x200 300x400 100 …. 50 100 …. 50 1 KB 1 KB 2 KB 2 KB

Test Results

Test Results T = 0.025. True Negative True Positive False Negative
False Positive 68.06% 71.18% 31.94% 28.82% Original 63.19% 81.60% 36.81% 18.40% Improved T =

Test Results variance(AAE) Std(AAE) Min(AAE) Max(AAE) AAE β 0.00761
0.528 0.084 Tool 0.819 0.067 Improved variance (AAE) n 4276 29080 3378 2547 17609 2091 ML 1.33 1.15 0.00 8.81 0.88 0.52 0.72 5.75 0.58

Conclusion Our improved F5 attack tool have better detection classification of stego images than the original tool. Our improved F5 attack tool showed less average absolute error values of estimated β, n, and secret message length compared with same values obtained by original F5 attack tool results.

Conclusion Our improved F5 attack tool showed less true negative value than the original tool using the threshold T = Our improved F5 attack tool had more average absolute error values of estimated β than the original tool for stego images with actual β values less than 0.05. Our improved F5 attack tool had more average absolute error values of estimated β than the original tool for test images that have been compressed -before sending it to the F5 algorithm- with old JPEG quality = 100. We can use the original algorithm as a classifier and the proposed algorithm as a estimator for stego images.

Future Work For 1st proposed algorithm:
trace out the problem of bad results. The blockiness value of the estimated cover image is less than the blockiness value of the original cover image. We have observed that this deference ratio is the same for images with similar size. We want to figure out how we can estimate this ratio for a given image to correct the blockiness value.

Future Work For 2nd proposed algorithm:
improve the way that we evaluate the baseline estimate. (Shifting + Filtering). reduce the processing time. (parallel processing ). threshold value must be related to each stego image. (Based on size and Old quality …)

Any Questions ? ?

Discrete cosine transform (DCT)
Coeff. Value in location p, q Pixel Value in location m, n M = N = 8 DCT Pixel Value in location m, n Coeff. Value in location p, q M = N = 8 IDCT Back

Discrete cosine transform (DCT) DC
B00 = α0 α Amn cos cos Π(2m+1)0 Π(2n+1)0 N = M = 8 16 16 m=0 n=0 B00 = ⅛ Amn cos(0) cos(0) m=0 n=0 B00 = ⅛ Amn m=0 n=0 Back

JPEG Quantization Quantization Process Image DCT Block JPEG Quality Table JPEG Quantized Block 15 20 16 30 3 2 5 4 5 10 3 7 / round = Dequantization Process JPEG Quantized Block JPEG Quality Table Image DCT Block 5 10 3 7 3 2 5 4 15 20 28 * = Back

JPEG Quality Tables JPEG Standard Table JPEG Standard Table
1 12 10 8 5 3 2 11 4 14 16 17 6 15 21 22 7 18 23 13 20 24 19 JPEG Standard Table For Quality 100 JPEG Standard Table For Quality 90 Back

JPEG Quality Tables JPEG Standard Table JPEG Standard Table
16 11 10 24 40 51 61 12 14 19 26 58 60 55 13 57 69 56 17 22 29 87 80 62 18 37 68 109 103 77 35 64 81 104 113 92 49 78 121 120 101 72 95 98 112 100 99 40 28 25 60 100 128 153 30 35 48 65 145 150 138 33 143 173 140 43 55 73 218 200 155 45 93 170 273 258 193 88 160 203 260 283 230 123 195 303 300 253 180 238 245 280 250 248 JPEG Standard Table For Quality 50 JPEG Standard Table For Quality 20 Back

Steganography Sami Dokheekh.

Similar presentations

Presentation on theme: "Steganography Sami Dokheekh."— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Steganography Sami Dokheekh.

Similar presentations

Presentation on theme: "Steganography Sami Dokheekh."— Presentation transcript:

Similar presentations

About project

Feedback