Presentation is loading. Please wait.

Presentation is loading. Please wait.

1 Steganography Sami Dokheekh. 2 Agenda Research Hierarchy Related Work. Fact about JPEG Compression JPEG – Encoding/Decoding DCT Histogram. Spatial Blockness.

Similar presentations


Presentation on theme: "1 Steganography Sami Dokheekh. 2 Agenda Research Hierarchy Related Work. Fact about JPEG Compression JPEG – Encoding/Decoding DCT Histogram. Spatial Blockness."— Presentation transcript:

1 1 Steganography Sami Dokheekh

2 2 Agenda Research Hierarchy Related Work. Fact about JPEG Compression JPEG – Encoding/Decoding DCT Histogram. Spatial Blockness. F5 algorithm. F5 Attack. How to recover original image? 2 Proposed new F5 attacks. Comparison results. Verification test results. Conclusion. Future work

3 3 Research Hierarchy Content Hiding Existing Hiding Watermarking Video Audio Image Steganography Information Hiding Cryptography BMP TIF JPEG GIF PNG Subject Pyramid

4 4 Related Work JPEG JStigF5OutGuess JSteg sequentially embeds the hidden data in LSBs of quantized DCT coefficients. JSteg disturb AC DCT histogram. Vulnerable to visual attacks. Vulnerable to statistical attacks also.

5 5 Related Work JPEG F5 distribute the message bits randomly by using a user password as a seed to a Random Generator. F5 does not disturb AC DCT histogram. F5 can ’ t be detected by visual attacks. Vulnerable against statistical attacks. JStigF5OutGuess

6 6 Related Work JPEG OutGuess distribute the message bits randomly by using a user password as a seed to a Random Generator. OutGuess preserve AC DCT Histogram. OutGuess can ’ t be detected by visual attacks. Vulnerable against statistical attacks. JStigF5OutGuess

7 7 Fact about JPEG Compression JPEG stands for Joint Photographic Experts Group JPEG compression is used with.jpg and can be embedded in.tiff and.eps files. Used on 24-bit color files. Works well on photographic images. Although it is a lossy compression technique, it yields an excellent quality image with high compression rates.

8 8 JPEG – Encoding/Decoding RGB Image Data ( a Matrix of size NxMx3 ) [0-255] Contain Header, Quantization Tables, Source Coding Tables, and Data. Quantize/Dequantize DCT/IDCT Source Coding/Decoding JPEG File Two Dimension Discrete Cosine Transformation Division By a user define Quality table then integer roundation Huffman coding or arithmetic coding Lossless Lossy Lossless

9 9 JPEG – Encoding/Decoding DCTQuantize Huffman Coding Huffman Decoding DequantizeIDCT DATA Quantization Table H.C. Table RGB Image Data RGB Image Data Encoding ProcessDecoding Process HC Table Q. Table JPEG File

10 10 Frequency Domain JPEG - Encoding DCT Quantize 8x8 block Quality Table Spatial Domain

11 11 Frequency Domain JPEG - Decoding IDCT Dequantize 8x8 block Quality Table Spatial Domain

12 12 JPEG - Encoding e.g. 8x8 block in Spatial Domain 183186 185187185183182 181183182181 184186 174178179 182181183 166170175176179178181182 163164168169171169174176 163164166 164166169 160 161162165162165167 156155154155161165171176 DCT Spatial Domain

13 13 Frequency Domain JPEG - Encoding – e.g. DCT 8x8 block in Frequency Domain -3.27-1.662.491.135.111.0721.941381.90 0.68-0.420.67-2.930.11-5.72-10.8168.10 1.050.111.31-0.22-3.525.14-3.261.33 0.000.43-0.481.060.85-3.65-11.50-3.51 -0.490.49-0.07-0.38-0.75-0.208.340.88 -0.59-0.100.69-0.35-0.87-6.30-2.922.61 0.440.360.73-0.86-0.84-0.64-0.330.94 -0.73-0.660.020.32-1.08-0.70-1.36 Quantize

14 14 Frequency Domain JPEG - Encoding – e.g. Quality Table for 50 6151402416101116 55605826191412 5669574024161314 6280875129221714 771031096856372218 921131048164553524 10112012110387786449 9910310011298959272 Quantize

15 15 Frequency Domain JPEG - Encoding – e.g. Quantized 8x8 Block Quantize 000000286 0000006 00000000 000000 0 00000000 00000000 00000000 00000000

16 16 Frequency Domain JPEG - Decoding – e.g. Quantized 8x8 Block Dequantize 000000286 0000006 00000000 000000 0 00000000 00000000 00000000 00000000

17 17 Frequency Domain JPEG - Decoding – e.g. Quality Table for 50 6151402416101116 55605826191412 5669574024161314 6280875129221714 771031096856372218 921131048164553524 10112012110387786449 9910310011298959272 Dequantize

18 18 Frequency Domain JPEG - Decoding – e.g. IDCT 8x8 block in Frequency Domain Dequantize 000000221376 000000-1272 00000000 000000-170 00000000 00000000 00000000 00000000

19 19 JPEG - Decoding e.g. 8x8 block in Spatial Domain IDCT Spatial Domain Round 187 186185184183182 180181 182183184 185 173174176178180183184185 169170171173176178179180 167168 169170171 172 164 165 166 156157158160163165166167 149151154157162165168170

20 20 JPEG – Encoding/Decoding e.g. A 8x8 block in Spatial Domain Spatial Domain 187 186185184183182 180181 182183184 185 173174176178180183184185 169170171173176178179180 167168 169170171 172 164 165 166 156157158160163165166167 149151154157162165168170 A 8x8 block in Spatial Domain 183186 185187185183182 181183182181 184186 174178179 182181183 166170175176179178181182 163164168169171169174176 163164166 164166169 160 161162165162165167 156155154155161165171176 JPEG Encoding Decoding Quality 50 They are not the same JPEG FILE

21 21 JPEG – AC/DC DCT AC DC AC 8 coefficients An 8x8 Block in the Frequency Domain  DC coefficient is a special coefficient, it is equal to the average value of all 64 values in the RGB spatial block divided by 8.  AC coefficients is the rest 63 coefficients in the Block.  Each type have a coding algorithm in the jpeg encoding process. Show me

22 22 JPEG - DCT DCT is reversible function:  DCT(X) == IDCT(DCT(X)) DCT Convert RGB Block to Frequency Domain Block. Frequency block can be quantized to produce zero coefficients as much as possible.

23 23 JPEG - Quantization The frequency block is quantized by a user define quality factor. Quality is in the range [ 1 2..50..51..100 ]  1 means very low quality.  100 means full quality. The looseness rise due to the rounding process.

24 24 JPEG - Quantization Standard JPEG quantization matrix formula : for Q>50for Q<50

25 25 JPEG – Huffman Coding AC coefficients are arranged in a zigzag order before applying the Huffman coding. This is done so that the coefficients are in order of increasing frequency. The higher frequency coefficients are more likely to be 0 after quantization. The goal is to group all the zeros together, to allow compression.

26 26 JPEG – Huffman Coding Huffman coding applied on DC coefficients differ from AC coefficients. 000000286 0000006 00000000 000000 0 00000000 00000000 00000000 00000000 Example : Zigzag order : 86,2,6,0,-1,0,0,0,0,0,0,-1,0,0,0,0,0,0,0,0,0,0 … 0 Symbols = {0,-1,2,6,86} Probability = {0.9219, 0.0313, 0.0156, 0.0156, 0.0156} Huffman Decoder : {1011001100001100 0000110000000000 0000000000000000 00000000000000000000000} = 74 bit Original block = 64 byte Compression ratio = 100 - (74/(64*8))*100 = 85.5469 %

27 27 JPEG – AC DCT Histogram

28 28 JPEG - AC DCT Histogram of Frequency (k,l) 12155 155 43764276 73927392 34613461 155 155 42764276 73927392 34613461 483 155 85764276 73957392 34613461 155 155 42764276 73927392 34613461 22 Freq 2 2 2 Image Histogram Frequency (2,2). 12155 155 42764276 73927392 34613461 155 155 42764276 73927392 34613461 483 155 83764276 73957392 34613461 155 155 42764276 73927392 34613461 A 2 1 2 2 3 4 5 0 Where 1 ≤ k,l ≥ 8

29 29 JPEG – Compression Effect Quality = 100 Next

30 30 JPEG – Compression Effect Quality = 90 Next

31 31 JPEG – Compression Effect Quality = 80 Next

32 32 JPEG – Compression Effect Quality = 60 Next

33 33 JPEG – Compression Effect Quality = 40 Next

34 34 JPEG – Compression Effect Quality = 20

35 35 F5 Was developed by German researchers Pfitzmann and Westfeld in 2001. Embeds message bits into randomly-chosen DCT coefficients in JPEG images and employs matrix embedding that minimizes the necessary number of changes to embed a message of certain length. comes after a series of past algorithms like F3 and F4.

36 36 F5 – Process Overview JPEG Compress 010101 010010 010100 Password Clean image (JPEG)(BMP) User Quality Compressed Image Stego Image Message Embedding Process

37 37 F5 – Process Details Clean image (JPEG)(BMP) DCT DCT Coefficients Quality Table Quantized DCT Coefficients Password Random Walk Generator 010101 010010 010100 Message Bits Bit Counter Find k, n Non-Zero AC Coefficient Counter Usable Coefficients Buffer Repeat Until all Message Bits are embedded Or No more Usable Coefficients left Quantize Get n Coefficients Buffer Get k Message Bits Yes Decrement Buffer Bit S No Eliminate Bit S From UCB Repeat this iteration Calculate S If S = 0 If Shrinkage Yes No k n

38 38 F5 – Matrix Encoding Simple encoding Introduce very high number of changes. Matrix Encoding was introduced by “Ron Crandall” in 1998. Matrix Encoding minimize the number of changes required by embedding a message. That is reaching high embedding rates. F5 was possibly the first implementation of Matrix Encoding.

39 39 F5 – Matrix Encoding F5 uses Matrix Encoding such as encoding k message bits inside n codeword with no more than 1 change in the codeword if needed. n = 1/2 k -1. Change density D(k)= 1/(n+1). Embedding rate R(k)= k/n. Embedding efficiency W(k)= R(k)/D(k). W(k) = 2 k x k/2 k -1.

40 40 F5 - Steganographic interpretation Positive coefficients: LSB. inverted Negative coefficients: inverted LSB. Decrement positive coefficients. Increment negative coefficients. Shrinkage Shrinkage is the situation where a coefficient had decremented or incremented leading its value to zero Repeat if shrinkage occurs.

41 41 F5 – Embedding Process -4 -3 -2 -1 0 1 2 3 4 1 0 1 0 skip 1 0 1 0 0 1 0 1 0 1 0 1 1 0 1 0 1 0 1 0 … … shrinkage shrinkage

42 42 F5 – Matrix Encoding knChange DensityEmbedding rateEmbedding Efficiency 1150.00%100.00%2 2325.00%66.67%2.67 3712.50%42.86%3.43 4156.25%26.67%4.27 5313.12%16.13%5.16 6631.56%9.52%6.09 71270.78%5.51%7.06 82550.39%3.14%8.03 95110.20%1.76%9.02 Relations between change densities and embedding rates

43 43 F5 – Traditional Embedding 0010101 010 Embed Message Bits Carrier 0010010 W(k) = 1 bit per change.

44 44 F5 – Matrix Encoding 0010101 010 Embed Message Bits Carrier a7a7 a6a6 a5a5 a4a4 a3a3 a2a2 a1a1 f(a) 1010101x1x1 1100110x2x2 1111000x3x3 Hash Function f(a) = a i. binary(i) i=1 n a` 7 a` 6 a` 5 a` 4 a` 3 a` 2 a` 1 f(a`) 1010101x1x1 1100110x2x2 1111000x3x3 1 1 1 = 0010101 X a7a7 a6a6 a5a5 a4a4 a3a3 a2a2 a1a1 f(a) 0010101x1x1 0000100x2x2 0010000x3x3 Xor 0 1 0 1 0 1 = 1 2 4 XXXXXX 1 0 4 = SUM 5 Change a 5 0000101 MSG Bit W(k) = 3 bit per change. a x

45 45 F5 - Encoding e.g. 8x8 block in Spatial Domain 2926292715 166 2720 1811131612 2619161512 1413 21191615141296 1617141011 108 192015910141718 22211815 182223 17161721 DCT Spatial Domain Embed Message [AB] In an Image of 8X8 Pixel

46 46 Frequency Domain F5 - Encoding – e.g. DCT 8x8 block in Frequency Domain 0.21-0.55-5.24-2.63-2.068.84-20.56133.37 0.210.38-7.03-0.270.08-3.24-20.50-0.10 0.830.09-5.550.492.81-3.552.4820.64 -0.31-0.240.18-5.452.602.03-4.11-0.58 0.38-0.48-0.08-0.13-0.52-12.24-4.64-1.63 0.12-0.46-0.18-0.350.18-0.38-3.896.11 0.22-0.200.260.200.140.090.470.51 -0.41-0.14-0.220.210.300.630.210.08 Quantize

47 47 Frequency Domain F5 - Encoding – e.g. Quality Table for 100 Quantize 11111111 11111111 11111111 11111111 11111111 11111111 11111111 11111111

48 48 Frequency Domain F5 - Encoding – e.g. Quantized 8x8 Block Quantize 0-5-3-29-21133 00-700-3-210 10-603-4221 000-532-4 0000 -12-5-2 000000-46 00000001 00000100

49 49 F5 Encoding – e.g. 0-5-3-29-21133 00-700-3-210 10-603-4221 000-532-4 0000 -12-5-2 000000-46 00000001 00000100 *Assume the user password is [mysecretpassword] *Assume the Random Walk Generator generates The walk as column by column. *Assume the k value along with the message bit count will be known by the receiver. Actually F5 embed these two information at the beginning of the message. For simplicity : 1-6-7-5 -333-21-122-4-39-4-5-42-21 16-221 R andom W alk G enerator Password Usable Coefficients Buffer Clean Image Quantized DCT Coefficients 8x8 Block

50 50 F5 Encoding – e.g. 1-6-7-5 -333-21-122-4-39-4-5-42-21 16-221 01000011000001 Message Bits Usable Coefficients Buffer knEmbedding rate 11100.00% 2366.67% 3742.86% 41526.67% 53116.13% 6639.52% 71275.51% 82553.14% 95111.76% Count = 28 Count = 14 Embedding Rate = (14/28)*100= 50% So we chose k=2, n=3. AB

51 51 F5 Encoding – e.g. 1-6-7-5 -333-21-122-4-39-4-5-42-21 16-221 01000011000001 Message Bits Usable Coefficients Buffer 1 st iteration -221 101 Buffer Buffer LSB 01 k Message Bits Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(1 xor 1) xor 1] * 1 + [(0 xor 1) xor 0] * 2 = [0 xor 1] * 1 + [1 xor 0] * 2 = 1 * 1 + 1 * 2 = 1+2 = 3 Sum = 3 Change a3 a x 21 Buffer Increment Buffer coefficient # 3 21 Buffer Test Shrinkage 1.Update this changed coefficients to the original Image Coefficients (8X8)Block. 2.k message bit was embedded with a single change. 3.Proceed to next iteration. No shrinkage occurred

52 52 F5 Encoding – e.g. 1-6-7-5 -333-21-122-4-39-4-5-42-21 16 010000110000 Message Bits Usable Coefficients Buffer -2116 010 Buffer Buffer LSB 00 k Message Bits Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(0 xor 0) xor 0] * 1 + [(1 xor 0) xor 0] * 2 = [0 xor 0] * 1 + [1 xor 0] * 2 = 0 * 1 + 0 * 2 = 0+2 = 2 Sum = 2 Change a2 a x 2 nd iteration -2106 Buffer Decrement Buffer coefficient # 2 -2106 Buffer Test Shrinkage 1.Update this changed coefficients to the original Image Coefficients (8X8)Block. 2.Eliminate the changed coefficient from the usable coefficients Buffer. 3.Repeat this iteration. Shrinkage had occurred

53 53 F5 Encoding – e.g. 1-6-7-5 -333-21-122-4-39-4-5-42-21 6 010000110000 Message Bits Usable Coefficients Buffer 2 nd iteration -21 6 000 Buffer Buffer LSB 00 k Message Bits Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(0 xor 0) xor 0] * 1 + [(0 xor 0) xor 0] * 2 = [0 xor 0] * 1 + [0 xor 0] * 2 = 0 * 1 + 0 * 2 = 0+0 = 0 Sum = 0 No Change a x 1.k message bit was embedded without a change. 2.Proceed to next iteration.

54 54 F5 Encoding – e.g. 1-6-7-5 -333-21-122-4-39-4-5-42 0100001100 Message Bits Usable Coefficients Buffer 3 rd iteration -5-42 010 Buffer Buffer LSB 00 k Message Bits Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(0 xor 0) xor 0] * 1 + [(1 xor 0) xor 0] * 2 = [0 xor 0] * 1 + [1 xor 0] * 2 = 0 * 1 + 1 * 2 = 0+2 = 2 Sum = 2 Change a2 a x -5-32 Buffer Increment Buffer coefficient # 2 -5-32 Buffer No shrinkage occurred Test Shrinkage 1.Update this changed coefficients to the original Image Coefficients (8X8)Block. 2.k message bit was embedded with a single change. 3.Proceed to next iteration.

55 55 F5 Encoding – e.g. 1-6-7-5 -333-21-122-4-39-4 01000011 Message Bits Usable Coefficients Buffer 4 th iteration -39-4 011 Buffer Buffer LSB 11 k Message Bits Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(1 xor 0) xor 1] * 1 + [(1 xor 0) xor 1] * 2 = [1 xor 1] * 1 + [1 xor 1] * 2 = 0 * 1 + 0 * 2 = 0+0 = 0 Sum = 0 No change. a x 1.k message bit was embedded without a change. 2.Proceed to next iteration.

56 56 F5 Encoding – e.g. 1-6-7-5 -333-21-122-4 010000 Message Bits Usable Coefficients Buffer 5 th iteration -122-4 101 Buffer Buffer LSB 00 k Message Bits Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(1 xor 1) xor 0] * 1 + [(0 xor 1) xor 0] * 2 = [0 xor 0] * 1 + [1 xor 0] * 2 = 0 * 1 + 1 * 2 = 0+2 = 2 Sum = 2 Change a2 a x -121-4 Buffer Decrement Buffer coefficient # 2 -121-4 Buffer Test Shrinkage No shrinkage occurred 1.Update this changed coefficients to the original Image Coefficients (8X8)Block. 2.k message bit was embedded with a single change. 3.Proceed to next iteration.

57 57 F5 Encoding – e.g. 1-6-7-5 -333-21 0100 Message Bits Usable Coefficients Buffer 6 th iteration 3-21 111 Buffer Buffer LSB 00 k Message Bits Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(1 xor 1) xor 0] * 1 + [(1 xor 1) xor 0] * 2 = [0 xor 0] * 1 + [0 xor 0] * 2 = 0 * 1 + 0 * 2 = 0+0 = 0 Sum = 0 No change. a x 1.k message bit was embedded without a change. 2.Proceed to next iteration.

58 58 F5 Encoding – e.g. 1-6-7-5 -33 01 Message Bits Usable Coefficients Buffer 7 th iteration -33 001 Buffer Buffer LSB 01 k Message Bits Sum = [(a1 xor a3) xor x1] * 1 + [(a2 xor a3) xor x2] * 2 = [(1 xor 0) xor 1] * 1 + [(0 xor 0) xor 0] * 2 = [1 xor 1] * 1 + [0 xor 0] * 2 = 0 * 1 + 0 * 2 = 0+0 = 0 Sum = 0 No change. a x 1.k message bit was embedded without a change. 2.K message bit finished -> Stop.

59 59 F5 Encoding – e.g. 0-5-3-29-21133 00-700-3-210 10-603-4221 000-532-4 0000 -12-5-2 000000-46 00000001 00000100 0-5-3-29-21133 00-700-3-210 10-603-4221 000-531-3 0000 -12-5 000000-46 00000000 00000100 Clean Image DCT Block Stego Image DCT Block

60 60 F5 Encoding – e.g. Number of changed Coefficients = 4. Number of shrunken coefficients = 1. So we actually embed 14 bit by only changing 4 coefficients. Estimated embedding efficiency = 2.67 bpc. Actual embedding efficiency = 14/4= 3.5 bpc.

61 61 F5 Encoding – e.g. Clean Image Stego Image Observations: 1.F5 is not does not effect the appearance of the image. 2.The human eye can ’ t distinguish stego image from clean one.

62 62 F5 Encoding – e.g. Clean ImageStego Image 2926292715 166 2721201811131612 2720161412 1412 22191614 1296 1617141011 108 181915910141718 22211815 182223 17 1821 20 2926292715 166 2720 1811131612 2619161512 1413 21191615141296 1617141011 108 192015910141718 22211815 182223 17161721 Unchanged pixel Incremented pixel Decremented pixel Observations: 1.F5 effect in spatial block is light (change by +- 1). 2.Most of the changes occurs at the boundaries. (7 out of 12 changes).

63 63 F5 Decoding – e.g. 0-5-3-29-21133 00-700-3-210 10-603-4221 000-531-3 0000 -12-5 000000-46 00000000 00000100 *Assume the user password is [mysecretpassword] *Assume the Random Walk Generator generates The walk as column by column. *Assume the k value along with the message bit count will be known by the receiver. Actually F5 embed these two information at the beginning of the message. For simplicity : R andom W alk G enerator Password Usable Coefficients Buffer Stego Image Quantized DCT Coefficients 8x8 Block 1-6-7-5 -333-21-121-4-39-4-5-32-21 6 21

64 64 Empty F5 Decoding – e.g. Message Bits Buffer Usable Coefficients Buffer 1 st iteration 21 001 Buffer Buffer LSB 01 k Message Bits x1 = a1 xor a3 = 1 xor 0 = 1 x2 = a2 xor a3 = 0 xor 0 = 0 a x 1.k message bit was recovered from n usable coefficients Buffer. 2.Add k bits to the message bit buffer. 3.Proceed to next iteration. 1-6-7-5 -333-21-121-4-39-4-5-32-21 6 21

65 65 F5 Decoding – e.g. Message Bits Buffer Usable Coefficients Buffer 2 nd iteration -21 6 000 Buffer Buffer LSB 00 k Message Bits x1 = a1 xor a3 = 0 xor 0 = 0 x2 = a2 xor a3 = 0 xor 0 = 0 a x 1.k message bit was recovered from n usable coefficients Buffer. 2.Add k bits to the message bit buffer. 3.Proceed to next iteration. 01 1-6-7-5 -333-21-121-4-39-4-5-32-21 6

66 66 F5 Decoding – e.g. Message Bits Buffer Usable Coefficients Buffer 3 rd iteration -5-32 000 Buffer Buffer LSB 00 k Message Bits x1 = a1 xor a3 = 0 xor 0 = 0 x2 = a2 xor a3 = 0 xor 0 = 0 a x 1.k message bit was recovered from n usable coefficients Buffer. 2.Add k bits to the message bit buffer. 3.Proceed to next iteration. 01 00 1-6-7-5 -333-21-121-4-39-4-5-32

67 67 F5 Decoding – e.g. Message Bits Buffer Usable Coefficients Buffer 4 th iteration -39-4 011 Buffer Buffer LSB 11 k Message Bits x1 = a1 xor a3 = 1 xor 0 = 1 x2 = a2 xor a3 = 1 xor 0 = 1 a x 1.k message bit was recovered from n usable coefficients Buffer. 2.Add k bits to the message bit buffer. 3.Proceed to next iteration. 01 00 00 1-6-7-5 -333-21-121-4-39-4

68 68 F5 Decoding – e.g. Message Bits Buffer Usable Coefficients Buffer 5 th iteration -121-4 111 Buffer Buffer LSB 00 k Message Bits x1 = a1 xor a3 = 1 xor 1 = 0 x2 = a2 xor a3 = 1 xor 1 = 0 a x 1.k message bit was recovered from n usable coefficients Buffer. 2.Add k bits to the message bit buffer. 3.Proceed to next iteration. 01 00 00 11 1-6-7-5 -333-21-121-4

69 69 F5 Decoding – e.g. Message Bits Buffer Usable Coefficients Buffer 6 th iteration 3-21 111 Buffer Buffer LSB 00 k Message Bits x1 = a1 xor a3 = 1 xor 1 = 0 x2 = a2 xor a3 = 1 xor 1 = 0 a x 1.k message bit was recovered from n usable coefficients Buffer. 2.Add k bits to the message bit buffer. 3.Proceed to next iteration. 01 00 00 11 00 1-6-7-5 -333-21

70 70 F5 Decoding – e.g. Usable Coefficients Buffer 7 th iteration -33 001 Buffer Buffer LSB 01 k Message Bits x1 = a1 xor a3 = 1 xor 0 = 1 x2 = a2 xor a3 = 0 xor 0 = 0 a x 1.k message bit was recovered from n usable coefficients Buffer. 2.Add k bits to the message bit buffer. 3.Terminate loop. {all message bits were recovered}. 000011000001 Message Bits Buffer 1-6-7-5 -33

71 71 F5 Decoding – e.g. Message Bits Buffer 01000011000001 AB AB Original Message = AB AB Recovered Message = AB

72 72 F5 – Implementing the algorithm. We implement the F5 algorithm on Matlab 7. F5 was implemented without a random walk generator. (no need for password) Inputs is gray image matrix. Output is DCT coefficients matrix. JPEG compression/decompression process is not included. Only the F5 embedding and extraction process is implemented.

73 73 Shifted Image Fridrich claim that spatial shifting of the stego image will restore the original image histogram. Fridrich stated that this process will destroy all previous JPEG compression effect on the image. She recommended a low-pass filter after shifting the stego image.

74 74 Shifted Image 8 pixels 4 pixels

75 75 F5 Facts- Histogram

76 76 F5 Facts-Continues Embedding Original ImageImage After 30 F5 Embedding Maximum Capacity. Image After 190 F5 Embedding Maximum Capacity.

77 77 F5 Facts-Continues Embedding

78 78 F5 Facts - Blockness

79 79 F5 Facts - Blockness

80 80 F5 Facts – Cross Blockness SB = |a-b| + |c-d| + |a-c| + |b-d| + |a-d| + |c-b| For each 4 disjoint blocks

81 81 F5 Facts - Blockness

82 82 F5 Facts – Cross Blockness

83 83 F5 Attack Based on the fact that F5 increases the total number of zero coefficients and decreases the non-zero ones. The cover image (baseline) is evaluated to compare the two histograms. Baseline image is evaluated by cropping the stego image by 4 pixels and apply a low- pass filter to the cropped image.

84 84 F5 Attack Decompression Crop By 4 pixel Filtering Compression Stego Image Quality Baseline image Calculate DCT Histogram Calculate DCT Histogram Stego Image

85 85 F5 Attack Baseline HistogramStego Histogram -4 -3 -2 -1 0 1 2 3 4 h(d), d = 0,1,2 …, is the total number of AC coefficients in the cover-image with absolute value equal to d after the image has been compressed inside the F5 algorithm. h kl (d) the total number of AC DCT coefficients corresponding to the frequency (k, l), 1 ≤ k, l ≤ 8, whose absolute value is equal to d. H(d) & H kl (d) are the same for the stego image.

86 86 F5 Attack h(d) H(d) 0 1 2 3 4 Let us suppose that the F5 embedding process changes n AC coefficients. The probability that a non-zero AC coefficient will be modified is β = n/P, where P is the total number of non-zero AC coefficients (P = h(1) + h(2) + … ). Because the selection of the coefficients is random in F5, the expected values of the histograms H kl of the stego-image are: H kl (d) = (1 – β) h kl (d) + β h kl (d+1), for d>0, H kl (0) = h kl (0) + β h kl (1), for d=0,

87 87 F5 Attack h(d)H(d) 01234 We can calculate an estimate h ^ kl (d) of the cover image histogram (baseline), so based on the previous formula we can estimate β very easily. We know stego histogram H kl (d) and we have h ^ kl (d)  We can evaluate β. They have experimented with different formulas for β and the best performance was obtained using the least square approximation. We calculate β as the value that minimizes the square error between the stego-image histogram H kl, and the expected values h ^ kl (d) calculated from the estimated histogram h ^ kl using last equation.

88 88 F5 Attack h(d)H(d) 01234 Because the first two values in the histogram (d=0 and d=1) experiences the largest change during the embedding, We can write: β kl = arg min β [H kl (0) – h ^ kl (0) – β h ^ kl (1) ] 2 +[H kl (1) – (1 – β) h ^ kl (1) – β h ^ kl (2) ] 2 Which led to the following equation for β :

89 89 F5 Attack h(d) H(d) 0 1 2 3 4 β We calculate β as the average against the three frequencies [1,2],[2,1],[2,2] ββββ β = (β 12 + β 21 + β 22 ) / 3

90 90 F5 Attack – Double compression JPEG Compress 010101 010010 010100 Embedding Process Password Clean image (JPEG) User Quality (Q2) Compressed Image Stego Image Message Old Quality (Q1) Double Compression

91 91 F5 Attack – Double compression Double compression take place when the image sent to F5 is already a JPEG compressed image. Their detection algorithm can’t detect such stego images correctly. They adds a double correction step to their algorithm to eliminate the problem.

92 92 F5 Attack – Double compression Decompression Crop By 4 pixel Filtering Compression Stego Image Quality Baseline image Calculate DCT Histogram Calculate DCT Histogram Stego Image Jpeg Image Old Quality Decompression Compression

93 93 F5 Attack – Double compression β We calculate β for fixed of quantization tables {Q 1,…Q t }. For each Q i, 1 ≤ i ≤ t, we run the detection algorithm with a little change. After shifting and filtering process we compress the image with Q i and immediately decompress it again after going throw the rest of the algorithm.

94 94 F5 Attack – Double compression β i Now we have a set of calculated β i, 1≤ i ≤ t. β = β i For each i and for each DCT mode k, l, we calculate the L 2 distance E (i) kl between H kl and h ^ kl with β = β i : β β = β t The final β is obtained as β = β t where :

95 95 F5 Attack – Estimating the True Message Length Let n be the total number of changes in quantized DCT coefficients introduced by the F5 algorithm. We can write n as n = s + m, where s is the shrinkage, and m is the number of changes due to actual message bit embedding. The probability of selecting a coefficient that may lead to shrinkage is P ٍٍ S = h(1)/P. Since the coefficients are selected at random, the expected value of s is nP S. Thus, we obtain the following formula: m + nP S = n

96 96 F5 Attack – Estimating the True Message Length which gives m=n(1–P S ) for the number of changes due to message embedding. Assuming the (1,2k−1, k) matrix embedding, the expected number of bits per change W(k) is: Thus, the unknown message length M can be calculated as: Where:

97 97 F5 Attack – Implementing the algorithm We Implement the algorithm on Matlab 7. We add a GUI to the tool. Ability to chose the difficulty of the algorithm. (Shifting + Old Quality estimate). Ability to see progress at progress bar.

98 98 F5 Attack Tool

99 99 F5 Attack – Results Comparison We compare our implemented algorithm results with their results. 20 test images. Using averaging shifting from 3:5 Using Old Quality rang from 80:2:100. β Results is β and n.

100 100 F5 Attack – Results Comparison Score: Paper : 5/20 = 25 % Project : 15/20 = 75 %

101 101 F5 Attack – Results Comparison Score: Paper : 4/20 = 20 % Project : 16/20 = 80 %

102 102 New Methodology As we mention before, most of F5 changes on spatial domain effect the boundaries of each 8x8 block. Clean ImageStego Image 2926292715 166 2721201811131612 2720161412 1412 22191614 1296 1617141011 108 181915910141718 22211815 182223 17 1821 20 2926292715 166 2720 1811131612 2619161512 1413 21191615141296 1617141011 108 192015910141718 22211815 182223 17161721 Unchanged pixel Incremented pixel Decremented pixel

103 103 New Methodology - Blockness The Blockness value of the stego image is much more than the clean image. The Blockness increases almost linearly with the size of the embedded message. We have collect a set of 30 JPEG images with deferent dimensions and for each image we embedded deferent message size from 1KB to 30KB. We test both normal Blockness and cross Blockness.

104 104 New Methodology - Blockness 2 0

105 105 New Methodology - Continues Embedding Blockness value increases also linearly when continuing embedding messages. Normal Blockness show better linearity than cross Blockness. We have tested 10 images with deferent dimensions on continually embedding process of 1KB message each step.

106 106 New Methodology - Continues Embedding 2 0

107 107 Proposed Algorithm 1 Lets assume the B(I) is the blockiness value of image I. I s is the stego image. I c is the cover or clean image. I f is the stego image using full capacity. We calculate the linear equation of blockiness increasement against number of changed coefficients as: y = m*x + c first we calculate the mean: m = (B(I f ) - B(I c ))/(N(I f ) - N(I c )) N is the number of changed coefficients. we know that I c don't have changed coefficients, so we can write: m = (B(I f ) - B(I c ))/N(I f )

108 108 Proposed Algorithm 1 Now we can calculate the constant c value: c = B(I c ) so now we have the linear equation, y = m*x + c we want to calculate x : x = y - c / m now we change x and y by relative values from stego image I s : N(I s ) = (B(I s ) - B(I c ))/(B(I f ) - B(I c ))/N(I f ) which gives: N(I s ) = N(I f )*(B(I s ) - B(Ic))/(B(If) - B(Ic)) Now we have N(I s ), to calculate Beta, we count all non-zero coefficients from I c, let it P : β = N(I s )/P(I c ) we estimate the true message length in the same way

109 109 Proposed Algorithm 1 Unfortunately, the results was disappointed. Estimated Message Length is far away from the actual message length. This because the recovered baseline image blockiness value is less far away from actual clean image blockiness value.

110 110 Proposed Algorithm 2 This proposed algorithm is actually an improvement of the original F5 attack we had described before. The original algorithm calculates β value for deferent shift values. In the description of the algorithm, we stated that the shift is by 4 pixels in both directions. Actually, the original algorithm results was an average value of deferent estimated β calculated using deferent shift values.

111 111 Proposed Algorithm 2 This proposed algorithm calculates β value as the value calculated from a shift having minimum E value among all shifts. E value is calculated in the original algorithm to tackle the double compression problem.

112 112 Proposed Algorithm 2

113 113 Proposed Algorithm 2 Current Shift Calculating E value for old quality range Current Old Quality Min(E), β Crop Stego image Apply Low-pass Filter Calculate β Calculate E Average ()Select with β minimum E 2 nd proposed algorithm original algorithm

114 114 Verification We generate test data of 432 images from 12 images was taken from mobile camera. 12 150x200300x400 100 50 ….…. 100 50 ….…. 1 KB 2 KB 1 KB 2 KB 144 clean 144 stego 1 KB 144 stego 2 KB

115 115 Test Results

116 116 Test Results

117 117 Test Results

118 118 Test Results

119 119 Test Results

120 120 Test Results

121 121 Test Results

122 122 Test Results True NegativeTrue PositiveFalse NegativeFalse Positive 68.06%71.18%31.94%28.82%Original 63.19%81.60%36.81%18.40%Improved T = 0.025.

123 123 Test Results variance(AAE)Std(AAE)Min(AAE)Max(AAE)AAEβ 0.007610.0872600.5280.084Tool 0.007520.0867200.8190.067Improved variance (AAE)Std(AAE)Min(AAE)Max(AAE)AAEn 1828130242760290803378Tool 648580725470176092091Improved variance (AAE)Std(AAE)Min(AAE)Max(AAE)AAEML 1.331.150.008.810.88Tool 0.520.720.005.750.58Improved

124 124 Conclusion Our improved F5 attack tool have better detection classification of stego images than the original tool. Our improved F5 attack tool showed less average absolute error values of estimated β, n, and secret message length compared with same values obtained by original F5 attack tool results.

125 125 Conclusion Our improved F5 attack tool showed less true negative value than the original tool using the threshold T = 0.025. Our improved F5 attack tool had more average absolute error values of estimated β than the original tool for stego images with actual β values less than 0.05. Our improved F5 attack tool had more average absolute error values of estimated β than the original tool for test images that have been compressed -before sending it to the F5 algorithm- with old JPEG quality = 100. We can use the original algorithm as a classifier and the proposed algorithm as a estimator for stego images.

126 126 Future Work For 1 st proposed algorithm:  trace out the problem of bad results.  The blockiness value of the estimated cover image is less than the blockiness value of the original cover image.  We have observed that this deference ratio is the same for images with similar size.  We want to figure out how we can estimate this ratio for a given image to correct the blockiness value.

127 127 Future Work For 2 nd proposed algorithm:  improve the way that we evaluate the baseline estimate. (Shifting + Filtering).  reduce the processing time. (parallel processing ).  threshold value must be related to each stego image. (Based on size and Old quality …)

128 128 Any Questions ?

129 129 Discrete cosine transform (DCT) Back DCT IDCT M = N = 8 Pixel Value in location m, nCoeff. Value in location p, q Pixel Value in location m, nCoeff. Value in location p, q

130 130 Discrete cosine transform (DCT) DC Back B 00 = α 0 α 0 A mn cos cos 7 m=0 n=0 Π (2m+1)0 Π (2n+1)0 16 N = M = 8 B 00 = ⅛ A mn cos(0) cos(0) 7 m=0 n=0 B 00 = ⅛ A mn 7 m=0 n=0

131 131 JPEG Quantization 1520 1630 32 54 / 510 37 = 1520 1528 32 54 * 510 37 = Quantization Process Dequantization Process round Image DCT BlockJPEG Quality TableJPEG Quantized Block JPEG Quality Table Image DCT Block Back

132 132 JPEG Quality Tables 11111111 11111111 11111111 11111111 11111111 11111111 11111111 11111111 1210853223 1112 54322 11141185333 121617106433 1521221411744 18232116131175 2024 2117161310 2021202220191814 JPEG Standard Table For Quality 100 JPEG Standard Table For Quality 90 Back

133 133 JPEG Quality Tables JPEG Standard Table For Quality 50 JPEG Standard Table For Quality 20 1611101624405161 12 141926586055 1413162440576956 1417222951878062 182237566810910377 243555648110411392 49647887103121120101 7292959811210010399 4028254060100128153 30 354865145150138 35334060100143173140 35435573128218200155 455593140170273258193 6088138160203260283230 123160195218258303300253 180230238245280250258248 Back


Download ppt "1 Steganography Sami Dokheekh. 2 Agenda Research Hierarchy Related Work. Fact about JPEG Compression JPEG – Encoding/Decoding DCT Histogram. Spatial Blockness."

Similar presentations


Ads by Google