A NEW APPROACH FOR BLOCK BASED STEGANALYSIS USING A MULTI-CLASSIFIER

Transcription

1 Internationa Journa on Technica and Physica Probems of Engineering (IJTPE) Pubished by Internationa Organization of IOTPE ISSN IJTPE Journa September 014 Issue 0 Voume 6 Number 3 Pages A NEW APPROACH FOR BLOCK BASED STEGANALYSIS USING A MULTI-CLASSIFIER S.L. Omrani 1 P. Bayat 1. Department of Computer Engineering, Payame Noor University, Iran, omrani_comput@gian.pnu.ac.ir. Department of Software Engineering, Gian Science and Research Branch, Isamic Azad University, Iran peymanebayat@gmai.com Abstract- The aim of the recent bock-based steganaysis approaches, is to detect and differentiate cover and stego images. In this research, the discovering capabiity of the steganography agorithm was used for a sampe stego image by designing a muti cassifier. This kind of cassification was used for the steganaysis of smaer bocks of an image. Because norma images mosty have heterogeneous regions, first, the main image was decomposed into smaer bocks which were simiar. Then, these simiar bocks were put in the same cass. Therefore, severa different casses were obtained, for each of which, an appropriate cassifier was identified. This approach ed to making a decision for identifying the situation of the image bocks that were either cover or stego and identifying the steganography agorithm used in stego images. Keywords: Steganaysis, Steganography, Muti Cassifier, Stego, Cover. I. INTRODUCTION Bind steganaysis identifies stego images from cover images without any knowedge about steganography embedding agorithms [1]. Most of previous works in this fied have focused on extracting features from images for the purpose of steganaysis using a binary cassifier, which identifies stego images from cover images [, 3, [4]. In the muti cassifier scenario, first, bind steganaysis tries to make a decision about the kind of cover or stego of a sampe image. If the image is determined as a stego, the muti cassifier can determine the used steganography agorithm. Pevny et a. [4] used 74 merged features for cassification. In their research, bind steganaysis cassified sampe images into 7 different casses, in which stego images were obtained by 6 different steganography agorithms. A muti cassifier was arranged by combining severa binary cassifiers. To cassify the sampe images into 7 different casses, the "max-wins" strategy (reated to binary Support Vector Machine (SVM) cassifiers) was used for each pair of casses. Experimenta resuts expained that their approach was effective in terms of cassifying the sampe images into 7 different obtained casses. Generay, the performance of bind steganaysis is measured by average detection accuracy as foows [4]: Adetect 1 Perror (1) In this formua, P error is average error probabiity. There are two types of errors reated to this area, which incude fase positive (FP) and fase negatives (FN). To have a higher detection accuracy, the proposed approach tried to minimize the mentioned bock detection errors. When the sampe cover image was determined as a stego, it iustrated that a fase positive error occurred. In contrast, when a stego image was not correcty detected, a fase negative error occurred. Performance of bind steganaysis for a muti cassifier can be evauated through comparing FP and FN errors, as shown in Tabe 1. Decision Cover Stego 1... Stego L Tabe 1. Comparing FP and FN errors [4] Cover Correct(TN) Incorrect(FN)... Incorrect(FN) Stego 1... Incorrect(FP)... Correct(TP) Incorrect(FP)... Stego L Incorrect(FP) Incorrect(FP)... Correct(TP) II. MULTI-CLASSIFIER A muti-cassifier was used to identify which steganography agorithm shoud be appied for creating the fina stego images. If I were a dataset of images, then L+1 woud be the number of images in I and this set woud be obtained as foows: I I1 cover, I stego 1,, IL1 stego L () In this formua, there is one sampe cover image and L stego images in the experimenta dataset. Furthermore, the accuracy of fina detection was obtained by the average cacuation of detection accuracy of the whoe existence images in the dataset, consisting of stego and cover images. The foowing formuate iustrates the fina detection accuracy of a muti cassifier: 1 A detect A 1 L 1 1 I A I A L I (3) where A is the detection accuracy of the composed I muti cassifier when rea images are assigned to image type I by 1,,, L 1. 66

2 Internationa Journa on Technica and Physica Probems of Engineering (IJTPE), Iss. 0, Vo. 6, No. 3, Sep. 014 III. METHODOLOGY Instead of using one steganography agorithm, the proposed approach used L different steganography agorithms for creating stego images in testing and training stages. Before appying the major voting rue, for identifying the sampe image, two kinds of weights can infuence the increasing decision accuracy of each bock. A the weights consisted of 1: The weights that depended on different bock casses, and : The weights that depended on different image types. These two weights were used to achieve an appropriate weight for each bock. For decreasing the dimension of vectors of image features and optimizing the performance of steganaysis agorithm in feature extraction stage, optima waveet packet decomposition (WPD) was appied [5]. This stage become after bocking each image, which ed to gathering the simiar regions of image put in a bock. After appying the optima waveet packet decomposition on each bock, the obtained coefficients were more cosed [6]. Figure 1 iustrates the histogram of coefficients after appying the waveet packet decomposition. Figure. (a) From eft to right: Origina image, the image after Haar waveet decomposition [5] Figure. (b) From eft to right: The image after compeete waveet packet decomposition and the image after optima waveet packet decomposition [5] Figure 3. From eft to right: the resuted tree from optima waveet packet decomposition entropy function before bocking, the same tree after bocking [6] Figure 1. histogram of coefficients after appying WPD Therefore, after appying the Shannon Entropy Function (SEF) to the achieved coefficients, some more nodes were eiminated from the tree structure and the obtained optima tree woud have ess optima nodes. Thus, feature dimension was decreased in each bock. This soution caused decreased cacuation compexity and consideraby increased detection accuracy because of choosing the most optima features. Figure (a) and (b) iustrate the stage of WPD according to [5]. Figure 3 iustrates the reduction of feature dimensionaity after bocking as compared to optima waveet packet decomposition [6]. Athough there was a direct reationship between increasing the number of feature dimension and cacuating compexity, the presence of ess optimized features in addition to higher detection accuracy compared with previous approaches, cacuation compexity woud decrease [6]. Consequenty, in the next section, stages of feature extraction about waveet packet decomposition wi be expained in more detais. A. Compete Waveet Packet Decomposition Waveet decomposition decomposes an image into subbands with ow and high frequencies. Frequency areas have different resoutions and the anaysis of these resoutions is one of the most important concepts in waveet transform. From this viewpoint, norma waveet transform with function L R is defined according to the foowing formua [6]: L R J Z W j (4) where W j is waveet space, R and Z are two sets of rea numbers and integers, and L R is the square of integra function in space R. In compete waveet packet decomposition, image coefficients are separated based on various resoutions at different frequencies according to the foowing steps [5]: 1. First, the three-step Haar waveet decomposition is appied to the image; according to Figure 4, this action wi seect 9 detai sub-bands (horizonta H i, vertica V i, and diametrica D i, i=1,,3) and 3 approximation (ow pass) sub bands (L i, i=1,,3). In this stage, these 1 subbands are considered in the first set of features. 67

3 Internationa Journa on Technica and Physica Probems of Engineering (IJTPE), Iss. 0, Vo. 6, No. 3, Sep. 014 Beow, other stages of the proposed steganaysis agorithm wi be expained based on its advantages and improvements in more detais. Figure 4. The sub bands resuted from waveet decomposition [5]. Focus of Haar waveet decomposition is on owfrequency sub bands; but steganographers use higher frequencies of the image to embed their hidden message. Therefore, these frequencies need to anayze in order to obtain more important features. To do so, extra waveetike decomposition is appied to sub band D 1 resuted from Haar waveet decomposition. Sub-band coefficients in Haar waveet decomposition are obtained from the mean difference of the initia image coefficients; but, in waveet-ike decomposition, high frequency sub-band is first decomposed into 4 pixe bocks and the coefficient of each bock is obtained from diametric differences of its pixes. Appying this transformation to D 1 sub-band wi decompose it into 4 equa sub bands [7]. 3. As waveet transform creates strong reationship between the coefficients inter a sub-band and sub-bands, using these reationships in [8], they coud extract PDF (Probabiity Density Function) moments; these features are used in compete waveet packet method. 78 to 34 features are extracted from these three stages atogether [7]. Eventuay, it can be caimed that compete waveet packet decomposition wi create a ibrary of functions as a very good basis for the oca anaysis of high and average frequencies of the image. B. Optima Waveet Packet Decomposition In fact, waveet packet decomposition on image signa I X, Y for 1X M and 1 Y N (which are ength and width of the image, respectivey) is performed to obtain a set of coefficients reated to that signa. Features of image signas are described by these coefficients. Since energy is focused on a set of some specific coefficients and is very sma (cose to zero) for others, these coefficients are not necessary for feature extraction. As a resut, compete waveet packet decomposition is first appied to the image foowing the procedure in Section III. A. Afterwards, Shannon entropy cost function is appied to the obtained coefficients. This function cacuates the vaues of coefficients and creates a tree based on these coefficients. Next, the function focuses on finding the minimum cost and, using a depth-first search on the tree obtained from the coefficients, it seects minimum vaues and ignores maximum ones. The resuted tree has the maximum number of nodes which can deiver the best resut for feature extraction. The number of these features varies from 39 to 55 [9]. C. Training Process In this section, there are a set of cover images and their corresponding stego images. The existing images in the mentioned set incude divided bocks with the same sizes. Because norma images mosty have heterogeneous regions, first, the main image was decomposed into smaer bocks that were simiar [10]. Then, extraction process was appied to the feature of each bock according to the expanations in the previous section. In this stage, because of the arge number of existing bocks and for achieving the same number of samped bocks from L+1 kind of images, some of them were randomy seected. This seection is incuded k L1 k random sampe bocks from the cover images with L1 random sampe bocks from stego images obtained from L different steganography agorithm. In the next step, the extracted feature from K sampe bocks was cassified into C casses. The Tree Structured Vector Quantization (TSVQ) technique was used to cassify image bocks by appying a binary tree structure based on bock simiarity. According to this approach, first, whoe sampe bocks continued to put a the simiar bocks in the same subset. For each stage of cassification, "K-means" custering agorithm was used. This agorithm divided the existent bocks into a cass (S) to two subcasses (S 1, S ) by minimizing the sum of interna energy for each custer. The achieved tree was not necessariy symmetric. If a the bocks existing in a node were the same, the mentioned division woud be stopped [11]. The reated bock diagram is shown in Figure 5. Pre-processing (De-noise) Samping + TSVQ Image Decomposition Bock Cassification Figure 5. Training process [11] Feature Extraction Cassifier Design D. Testing Process For each of the testing images, the image was decomposed into smaer bocks and feature extraction was routiney done as the expained training process. In this stage, average feature vector was obtained for each image bock. Then, the appropriate Bays cassifier identified in training stage was appied to each cass of a bock and used to detect a bock as either cover or stego. The reated bock diagram is demonstrated in Figure 6. 68

4 Internationa Journa on Technica and Physica Probems of Engineering (IJTPE), Iss. 0, Vo. 6, No. 3, Sep. 014 Figure 6. Testing process [11] E. Cacuating Weights by Neura Networks (NN) This stage consider before using to major voting rue. Two types of weights are using to make a decision more accurate for each bock, incuding: 1. The weights that depended on different bock casses, and. The weights that depended on different image types [11]. Both of them were used to determine a bunde of weights to make a decision for each bock in terms of identifying cover or stego status. When the cover or stego status was identified for each bock by its steganography agorithm, a corresponding weight was aocated according to the cass of each bock. An appropriate cassifier was used to cacuate Correct Decision Rate (CDR) for a the C cassifiers. CDR is the weight that wi be aocated after identifying the type of an image bock. For K casses where the mentioned bocks are a type of image by 1,,..., L 1, the CDR was cacuated as foows [14]: CDR ( K) P( actua I1 decide I (5) b I 1 1 In this formua, P ( actua I decide I ) is the probabiity of bocks that are decided to be from image type I and are actuay from image type I I. This measurement was different in terms of detection accuracy and used for correct evauation of each decision with the actua type of image. Furthermore, detection accuracy coud be achieved for images in the training set and in a decision making process. The reated weights were assignabe to the decision for each bock. After achieving C different cassifiers in the training set, it coud be used for the same testing set of images to obtain the resuts of detection accuracy. If the detection accuracy of a specia type of an image was ow, the next aocated weight to the mentioned type shoud be increased. In contrast, if the detection accuracy of a specia type of an image were high, the next aocated weight to the mentioned type shoud be decreased. This routine was performed on a mode of a mutiayer perceptron neura network infrastructure [1]. Aso, in this paper some of approaches which are based on neura network used as cassification optimization. Image features are cassified by an unsupervised neura network [13, 14]. The weights for bock decision of image type I were obtained as foows [11]:, W I [1 A ] [1 P ( decide I actua I )] (6) i I e where Image Decomposition Bock Decision I Feature Extraction Weight Computation by Neura Network A, is the detection accuracy of image type and P ( decide I actua I ), is the error probabiity e Bock Cassification and Cassifier Seection Majority Voting Rue Image Decision making of a decision of image type I when this is not true. The weights reating to the bocks with different casses and image types are shown by [11]: I W ( K) W CDR ( k) (7) bi ii bi where Wb I ( K) I represents weights for bocks from image type in the Kth cass. These weights are used to identify the importance of bock decision using majority voting rue. F. Fina Decision Using Majority Voting Rue Assume a pixe sampe image incuding MN / B M N bocks by B B size. Weight of each decision is, which identifies the importance W presented by bi K of the reated decision. Therefore, the tota number of weighted decision that is made by the mentioned soution is equa to MN / B MN / B. After obtaining the vaue of as the weighted decision for a sampe image, a majority voting rue was adapted to make the fina decision on whether a given sampe image was a cover or a stego image created from one of the L mentioned steganography agorithms. The fina decision can be made by seecting a cover image or a stego image with a specific steganography agorithm that had the argest sum of weights. IV. EXPERIMENTAL RESULT There are some issues about the setting of impementation environment that are mentioned in the previous reated works [11]. UCID [15] and INRIA Hoidays [16] databases were used in the impementation of the proposed method. Three (L=3) different steganography agorithms were used to embed a secret message in the cover images to create the corresponding stego images: OutGuess (OG) [17], [18], and Mode- Based Steganography () [19]. Some differences existed between the newy presented approach and that of Cho et a.'s research [8]. In this paper, the number of sampe bocks was 30000, because this number of experiments showed that the resut went to a steady-state behaviour. On the other hand, in this research, the whoe set of sampe bocks was cassified into 16 casses. Furthermore, at feature extraction stage, instead of the Markov and Discrete Cosine Transform (DCT) features, optima waveet packet decomposition was appied to each bock. Utimatey, the embedding ratio in both of the works was the same. V. RESULTS AND DISCUSSION In this section, the accuracy of steganaysis detection was reported based on bocking for a muti cassifier. Tabe shows a comparison between Pevny et a.'s [4] and Cho et a.'s [11] works and the newy presented approach where used to embedding rate equa to 0.. For exampe in this tabe, the comparison shows that the precision of agorithm in Cho et a. was around 10% ess than that in the method by Pevny et a., whie the detection precision of the new proposed method was much higher than both of the above methods. As iustrated in Tabe, the precision of Pevny's, Cho's and the proposed methods was 67.61, 58.8, and 71.35, respectivey. 69

5 Internationa Journa on Technica and Physica Probems of Engineering (IJTPE), Iss. 0, Vo. 6, No. 3, Sep. 014 This optimization can be expained from different perspectives. The first reason may refer to the advantage of waveet packet transformation and higher precision of this method in seecting more appropriate features for the cassifier, as expained in [8]. The second reason can be reated to error detection. As mentioned in introduction, there are two types of errors in the decision-making process which are statisticay important: The first one is fase-positive (FP) and the second one is fase-negative (FN). FP happens when a secret message is detected in the cover image and FN occurs when a hidden message is not recognized in the stego image. Moreover, truenegative (TN) is the correct detection of the absence of hidden message in the cover image and true-positive (TP) occurs when a hidden message is correcty detected in the stego image. Tabe 1 iustrates the occurrence of these states. Universa steganaysis agorithm attempts to push the occurrence of these two types of errors to have a minimum rate in order to obtain higher accuracy. Accordingy, comparing FP and FN vaues coud be used to justify the increased accuracy of the proposed method. For exampe, as iustrated in Tabe, FP error in Pevny et a.'s [4] method was 18.3 on average; in Cho et a. [11], it was averagey 8.95; and, it was 4.51 on average in the proposed method. The proposed method's detection error rate was decrease in comparison to Pevny's and Cho's ethods in the same condition and same ratios. Aso, as iustrated in Tabe, FN error in Pevny et a.'s [4] method had the average of 9.3; in Cho et a. [11], it was averagey 1.5; and it had the average of 6.78 in the proposed method. The proposed method's detection error rate was increase in comparison to Pevny's and Cho's methods; i.e. accuracy of the proposed method was higher than that of the mentioned above methods by the same proportions. In addition, accuracy of the proposed method for stego images created by OutGuess and agorithms increased by more than 15%. Finay, the overa accuracy increased from 63.63%, 70.93%, and 80.04% in Peveny et a.'s [4], Cho et a.'s [11] and the new proposed method respectivey. Figure 7 iustrates the improvement accuracy detection of proposed method in embedding rate 0. according to Tabe. Tabe 3 compares the proposed method with those of Pevny et a. [4] and Cho et a. [11] with the embedding rate of 0.3. As observed, the accuracy detection for this embedding rate was higher. Cassification of testing images into different casses was easier when the ength of the embedded hidden messages was onger. Recognition accuracy of a stego images was improved by the proposed method. Maximum improvement occurred when embedding rate was 0. and OutGuess steganography agorithm was appied to embed the message. Recognition accuracy of the proposed method was improved atogether, as compared to that of Pevny et a.'s and Cho et a.'s methods. Comparison of the proposed method with that of Cho et a.'s indicated a significant improvement in both 0. and 0.3 embedding rates, which may be because the bocking procedure had the advantage of decomposing reativey simiar bocks in the image into smaer sized bocks. According to the generated casses from the bocks, a variety of cassifiers was designed to extract the features of the bocks in different casses. Furthermore, weights were derived based on the casses of different bocks and, eventuay, a the images used in the majority voting rue improved the overa precision of the proposed method. Tabe. Comparing detection accuracy (embedding rate: 0.) Evauation of Detection Accuracy in Pevny et.a. [4] 's approach :% Evauation of Decision Accuracy in Cho et.a. [11] 's approach :% Evauation of Decision Accuracy in proposed approach :% Accuracy Detection Percentage Figure 7. improvment accuracy detection of proposed method by embedding rate 0. Tabe. Comparing detection accuracy (embedding rate: 0.3) Evauation of Detection Accuracy in Pevny et.a. [4] 's approach: 76.79% Evauation of Decision Accuracy in Cho et.a. [11] 's approach: 86.3% Evauation of Decision Accuracy in proposed approach; 90.40%

6 Internationa Journa on Technica and Physica Probems of Engineering (IJTPE), Iss. 0, Vo. 6, No. 3, Sep. 014 VI. CONCLUSIONS Since the purpose of steganaysis is to distinguish cover images from stego ones and as this is ony a sma part of steganaysis, by designing a muti-objective cassifier after defining a typica image as stego, in this research aso detected the steganography agorithm appied to create the stego image. This type of cassification operates according to the resuts from the steganaysis of smaer bocks. Thus, by using bocking method, images were divided into smaer bocks with reativey simiar areas. In addition, by increasing the accuracy of decisions about each bock, before appying the majority voting rue, two types of weighting were used for the bocks which consisted of: 1) Weights reated to different casses, and ) Weights associated with different steganography methods. Using these two types of weighting can hep in making a more accurate decision on each bock. Overa accuracy of the proposed method, as compared with the previous techniques, increased and reached to 90.40%. REFERENCES [1] I.J. Cox, M. Mier, J. Boom, J. Fridrich, T. Kaker, Digita Watermarking and Steganography, Morgan Kaufmann Pubication, 007. [] J. Fridrich, Feature-Based Steganaysis for JPEG Images and its Impications for Future Design of Steganographic Schemes, Proceeding ACM Internationa Workshop on Information Hiding, Toronto, Canada, May 004. [3] Y.Q. Shi, C. Chen, W. Chen, A Markov Process Based Approach to Effective Attacking JPEG Steganography, ACM Internationa Workshop on Information Hiding, Od Town Aexandria, Virginia, Juy 006. [4] T. Pevny, J. Fridrich, Merging Markov and DCT Features for Muticass JPEG Steganaysis, SPIE Conference Security, Watermarking, and Steganography, Vo. 6505, San Jose, Caifornia, Feb 007. [5] X.Y. Luo, F. Liu, C. Yang, D. WANG, Image Universa Steganaysis Based on Best Waveet Packet Decomposition, Science China Information Sciences, Vo. 53, No. 3, pp , Berin, Germany, March 010. [6] L. Omrani, K. Faez, JPEG Image Steganaysis Using Bock Based Optima Waveet Packet Decomposition", 6'th Internationa Symposium on Teecommunications (IST'01), Tehran, Iran, November, 01. [7] X.Y. Luo, F. Liu, D. Wang, WPD Based Bind Image Steganaysis, Journa on Communications, Issue 9, Vo. 9., No. 10, pp , 008,. [8] Y. Wang, P. Mouin, Optimized Feature Extraction for Learning Based Image Steganaysis, IEEE Transaction Information Forensic Security, Issue 1, Vo., No. 4, pp , 007. [9] H. Farid, Detecting Hidden Messages Using Higher Order Statistica Modes, IEEE Internationa Conference on Image Processing, Vo., pp , New York, USA, 00. [10] S. Cho, B. Cha, J. Wang, C.C. Jay Kuo, Bock- Based Image Steganaysis: Agorithm and Performance Evauation, IEEE Internationa Symposium Circuits and Systems, pp , Paris, France, May 010. [11] S. Cho, J. Wang, C.C. Jay Kuo, B. Cha, Bock Based Image Steganaysis for a Muti-Cassifier, IEEE Internationa Conference on Mutimedia and Expo, pp , Singapore, 011. [1] K.L. Du, Custering: A Neura Network Approach, Esevier Neura Networks, Issue 1, Vo. 3, pp , January 010. [13] I. Kaneopouos, G.G. Wikinson, Strategies and Best Practice for Neura Network Image Cassification, Internationa Journa of Remote Sensing, Issue 4, Vo. 18, pp , 010. [14] W. Hachicha, A. Ghorbe, A Survey of Contro Chart Pattern Recognition Literature ( ) Based on a New Conceptua Cassification Scheme, Esevier Computers & Industria Engineering, Issue 1, Vo. 63, pp. 04-, August 01. [15] G. Schaefer, M. Stich, UCID - An Uncompressed Coour Image Database, SPIE Storage and Retrieva Methods and Appications for Mutimedia, Vo. 5307, pp , 004. [16] H. J egou, M. Douze, C. Schmid, Hamming Embedding and Weak Geometric Consistency for Large Scae Image Search, 10th European Conference on Computer Vision, pp , Marseie, France, October 008. [17] N. Provos, Defending Against Statistica Steganaysis, 10th USENIX Security Symposium, Vo. 10, pp , Citeseer, 001. [18] A. Westfed, - A Steganographic Agorithm: High Capacity Despite Better Steganaysis, ACM Internationa Workshop on Information Hiding, Pittsburgh, PA, Apri 001. [19] P. Saee, Mode Based Steganography, Internationa Workshop on Digita Watermarking, pp , Seou, Korea, October 003. BIOGRAPHIES Seyedeh Leia Omrani received her B.Sc. and M.S.E. degrees in Computer Engineering from IAU of Qazvin in 007 and 01, respectivey. Currenty, she is a Lecturer at Department of Computer Engineering, Payame Noor University, Iran. Her researches are focused on steganography and steganaysis techniques. She has pubished severa papers and performed some projects in the mentioned area since 010. Peyman Bayat received his and B.Sc. and M.Sc. degrees from Isamic Azad University, Iran in 1998 and 003, respectivey, and the Ph.D. degree in Computer Engineering Systems from University Putra Maaysia, Maaysia in