Feature-Based Steganalysis for JPEG Images and its Implications for Future Design of Steganographic Schemes

Transcription

1 Feature-Based Steganalysis for JPEG Images and its Implications for Future Design of Steganograpic Scemes Jessica Fridric Dept. of Electrical Engineering, SUNY Bingamton, Bingamton, NY , USA ttp:// Abstract. In tis paper, we introduce a new feature-based steganalytic metod for JPEG images and use it as a bencmark for comparing JPEG steganograpic algoritms and evaluating teir embedding mecanisms. Te detection metod is a linear classifier trained on feature vectors corresponding to cover and stego images. In contrast to previous blind approaces, te features are calculated as an norm of te difference between a specific macroscopic functional calculated from te stego image and te same functional obtained from a decompressed, cropped, and recompressed stego image. Te functionals are built from marginal and joint statistics of DCT coefficients. Because te features are calculated directly from DCT coefficients, conclusions can be drawn about te impact of embedding modifications on detectability. Tree different steganograpic paradigms are tested and compared. Experimental results reveal new facts about current steganograpic metods for JPEGs and new design principles for more secure JPEG steganograpy. Introduction Steganograpy is te art of invisible communication. Its purpose is to ide te very presence of communication by embedding messages into innocuous-looking cover objects. Eac steganograpic communication system consists of an embedding algoritm and an extraction algoritm. To accommodate a secret message in a digital image, te original cover image is sligtly modified by te embedding algoritm. As a result, te stego image is obtained. Steganalysis is te art of discovering idden data in cover objects. As in cryptanalysis, it is assumed tat te steganograpic metod is publicly known wit te exception of a secret key. Steganograpy is considered secure if te stego-images do not contain any detectable artifacts due to message embedding. In oter words, te set of stego-images sould ave te same statistical properties as te set of cover-images. If tere exists an algoritm tat can guess weter or not a given image contains a secret message wit a success rate better tan random guessing, te steganograpic

2 system is considered broken. For a more exact treatment of te concept of steganograpic security, te reader is referred to [,2].. Steganalytic Metods Several trends ave recently appeared in steganalysis. One of te first general steganalytic metods was te ci-square attack by Westfeld [3]. Te original version of tis attack could detect sequentially embedded messages and was later generalized to randomly scattered messages [4,5]. Because tis approac is based solely on te first order statistics and is applicable only to idempotent embedding operations, suc as SB (east Significant Bit) flipping, its applicability to modern steganograpic scemes, tat are aware of te Cacin criterion [2], is rater limited. Anoter major stream in steganalysis is based on te concept of a distinguising statistic [6]. In tis approac, te steganalyst first carefully inspects te embedding algoritm and ten identifies a quantity (te distinguising statistics) tat canges predictably wit te lengt of te embedded message, yet one tat can be calibrated for cover images. For JPEG images, tis calibration is done by decompressing te stego image, cropping by a few pixels in eac direction, and recompressing using te same quantization table. Te distinguising statistic calculated from tis image is used as an estimate for te same quantity from te cover image. Using tis calibration, igly accurate and reliable estimation of te embedded message lengt can be constructed for many scemes [6]. Te detection pilosopy is not limited to any specific type of te embedding operation and works for randomly scattered messages as well. One disadvantage of tis approac is tat te detection needs to be customized to eac embedding paradigm and te design of proper distinguising statistics cannot be easily automatized. Te tird direction in steganalysis is formed by blind classifiers. Pioneered by Memon and Farid [7,5], a blind detector learns wat a typical, unmodified image looks like in a multi-dimensional feature space. A classifier is ten trained to learn te differences between cover and stego image features. Te 72 features proposed by Farid are calculated in te wavelet decomposition of te stego image as te first four moments of coefficients and te log error between te coefficients and teir globally optimal linear prediction from neigboring wavelet modes. Tis metodology combined wit a powerful Support Vector Macine classifier gives very impressive results for most current steganograpic scemes. Farid demonstrated a very reliable detection for J-Steg, bot versions of OutGuess, and for F5 (color images only). Te biggest advantage of blind detectors is teir potential ability to detect any embedding sceme and even to classify embedding tecniques by teir position in te feature space. Among te disadvantages is tat te metodology will always likely be less accurate tan targeted approaces and it may not be possible to accurately estimate te secret message lengt, wic is an important piece of information for te steganalyst. Introducing blind detectors prompted furter researc in steganograpy. Based on te previous work of Eggers [8], Tzscoppe [9] constructed a JPEG steganograpic sceme (HPDM) tat is undetectable using Farid s sceme. However, te same

3 sceme is easily detectable [0] using a single scalar feature te calibrated spatial blockiness [6]. Tis suggests tat it sould be possible to construct a very powerful feature-based detector (blind on te class of JPEG images) if we used calibrated features computed directly in te DCT domain rater tan from a somewat arbitrary wavelet decomposition. Tis is te approac taken in tis paper..2 Proposed Researc We combine te concept of calibration wit te feature-based classification to devise a blind detector specific to JPEG images. By calculating te features directly in te JPEG domain rater tan in te wavelet domain, it appears tat te detection can be made more sensitive to a wider type of embedding algoritms because te calibration process (for details, see Sec. 2) increases te features sensitivity to te embedding modifications wile suppressing image-to-image variations. Anoter advantage of calculating te features in te DCT domain is tat it enables more straigtforward interpretation of te influence of individual features on detection as well as easier formulation of design principles leading to more secure steganograpy. Te proposed detection can also be viewed as a new approac to te definition of steganograpic security. According to Cacin, a steganograpic sceme is considered secure if te Kullback-eibler distance between te distribution of stego and cover images is zero (or small for ε-security). Farid s blind detection is essentially a reflection of tis principle. Farid first determines te statistical model for natural images in te feature space and ten calculates te distance between a specific image and te statistical model. Tis distance is ten used to determine weter te image is a stego image. In our approac, we cange te security model and use te stego image as a side-information to recover some statistics of te cover image. Instead of measuring te distance between te image and a statistical model, we measure te distance between certain parameters of te stego image and te same parameters related to te original image tat we succeeded to capture by calibration. Te paper is organized as follows. In te next section, we explain ow te features are calculated and wy. In Section 3, we give te details of te detection sceme and discuss te experimental results for OutGuess [], F5 [3], and Model Based Steganograpy [2,4]. Implications for future design of steganograpic scemes are discussed in Section 4. Te paper is summarized in Section 5. 2 Calibrated Features Two types of features will be used in our analysis first order features and second order features. Also, some features will be constructed in te DCT domain, wile oters in te spatial domain. In te wole paper, scalar quantities will be represented wit a non-bold italic font, wile vectors and matrices will always be in bold italics. Te norm is defined for a vector (or matrix) as a sum of absolute values of all vector (or matrix) elements.

4 All features are constructed in te following manner. A vector functional F is applied to te stego JPEG image J. Tis functional could be te global DCT coefficient istogram, a co-occurrence matrix, spatial blockiness, etc. Te stego image J is decompressed to te spatial domain, cropped by 4 pixels in eac direction, and recompressed wit te same quantization table as J to obtain J 2. Te same vector functional F is ten applied to J 2. Te final feature f is obtained as an norm of te difference f = F. () ( J) F ( J 2) J 4 pixels J 2 F F(J ) F(J 2 ) F Te logic beind tis coice for features is te following. Te cropping and recompression sould produce a calibrated image wit most macroscopic features similar to te original cover image. Tis is because te cropped stego image is perceptually similar to te cover image and tus its DCT coefficients sould ave approximately te same statistical properties as te cover image. Te cropping by 4 pixels is important because te 8 8 grid of recompression does not see te previous JPEG compression and tus te obtained DCT coefficients are not influenced by previous quantization (and embedding) in te DCT domain. One can tink of te cropped /recompressed image as an approximation to te cover image or as a sideinformation. Te use of te calibrated image as a side-information as proven very useful for design of very accurate targeted steganalytic metods in te past [6]. 2. First Order Features Te simplest first order statistic of DCT coefficients is teir istogram. Suppose te stego JPEG file is represented wit a DCT coefficient array d k (i, j) and te quantization matrix Q(i, j), i, j =,,8, k =,, B. Te symbol d k (i, j) denotes te (i, j)-t quantized DCT coefficient in te k-t block (tere are total of B blocks). Te global istogram of all 64k DCT coefficients will be denoted as H r, were r =,, R, = min k,i,j d k (i, j) and R = max k,i,j d k (i, j). Tere are steganograpic programs tat preserve H [8,0,]. However, te scemes in [8,9,] only preserve te global istogram and not necessarily istograms of individual DCT modes. Tus, we add individual istograms for low frequency DCT modes to our set of functionals. For a fixed DCT mode (i, j), let, r ij = r

5 ,, R, denote te individual istogram of values d k (i, j), k =,, B. We only use istograms of low frequency DCT coefficients because istograms of coefficients from medium and iger frequencies are usually statistically unimportant due to te small number of non-zero coefficients. To provide additional first order macroscopic statistics to our set of functionals, we ave decided to include dual istograms. For a fixed coefficient value d, te dual d istogram is an 8 8 matrix g ij g d ij B = k = were δ(u,v)= if u=v and 0 oterwise. In words, δ ( d, d ( i, j)), (2) k is te number of ow many times te value d occurs as te (i, j)-t DCT coefficient over all B blocks in te JPEG image. Te dual istogram captures ow a given coefficient value d is distributed among different DCT modes. Obviously, if a steganograpic metod preserves all individual istograms, it also preserves all dual istograms and vice versa. d g ij 2.2 Second Order Features If te corresponding DCT coefficients from different blocks were independent, ten any embedding sceme tat preserves te first order statistics te istogram would be undetectable by Cacin s definition of steganograpic security [2]. However, because natural images can exibit iger-order correlations over distances larger tan 8 pixels, individual DCT modes from neigboring blocks are not independent. Tus, it makes sense to use features tat capture inter-block dependencies because tey will likely be violated by most steganograpic algoritms. et I r and I c denote te vectors of block indices wile scanning te image by rows and by columns, respectively. Te first functional capturing inter-block dependency is te variation V defined as V = 8 i, j= I r k = d I r ( k) ( i, j) d I r ( k + ) ( i, j) + I r 8 i, j= + I c Ic k = d Ic ( k) ( i, j) d Ic ( k + ) ( i, j). (3) Most steganograpic tecniques in some sense add entropy to te array of quantized DCT coefficients and tus are more likely to increase te variation V tan decrease. Embedding canges are also likely to increase te discontinuities along te 8 8 block boundaries. In fact, tis property as proved very useful in steganalysis in te past [6,0,2]. Tus, we include two blockiness measures B α, α =, 2, to our set of functionals. Te blockiness is calculated from te decompressed JPEG image and tus represents an integral measure of inter-block dependency over all DCT modes over te wole image:

6 ( M ) / 8 N ( N ) / 8 M α α x8i, j x8i +, j + xi,8 j xi,8 j+ i= j= j= i= Bα = N ( M ) /8 + M ( N ) /8. (4) In te expression above, M and N are image dimensions and x ij are grayscale values of te decompressed JPEG image. Te final tree functionals are calculated from te co-occurrence matrix of neigboring DCT coefficients. Recalling te notation, d k (i, j) R, te cooccurrence matrix C is a square D D matrix, D = R +, defined as follows C st = I r 8 δ k= i, j= c 8 ( s, di ( k) ( i, j) ) δ ( t, di ( k ) ( i, j) ) ( s, di ( k) ( i, j) ) ( t, di ( k ) ( i, j) ) r r + + δ δ c c + I r I + I k= i, j= Te co-occurrence matrix describes te probability distribution of pairs of neigboring DCT coefficients. It usually as a sarp peak at (0,0) and ten quickly falls off. et C(J ) and C(J 2 ) be te co-occurrence matrices for te JPEG image J and its calibrated version J 2, respectively. Due to te approximate symmetry of C st around (s, t) = (0, 0), te differences C st (J ) C st (J 2 ) for (s, t) {(0,), (,0), (,0), (0, )} are strongly positively correlated. Te same is true for te group (s, t) {(,), (,), (, ), (, )}. For practically all steganograpic scemes, te embedding canges to DCT coefficients are essentially perturbations by some small value. Tus, te cooccurrence matrix for te embedded image can be obtained as a convolution C P(q), were P is te probability distribution of te embedding distortion, wic depends on te relative message lengt q. Tis means tat te values of te co-occurrence matrix C P(q) will be more spread out. To quantify tis spreading, we took te following tree quantities as our features: N 00 =C 0,0 (J ) C 0,0 (J 2 ) (6) N 0 =C 0, (J ) C 0, (J 2 )+C,0 (J ) C,0 (J 2 )+C,0 (J ) C,0 (J 2 )+C 0, (J ) C 0, (J 2 ) N =C, (J ) C, (J 2 )+C, (J ) C, (J 2 )+C, (J ) C, (J 2 )+C, (J ) C, (J 2 ). Te final set of 23 functionals (te last tree are directly features) used in tis paper is summarized in Table. c (5) 3 Steganalytic Classifier We used te Greenspun image database ( consisting of 84 images of size approximately All images were converted to grayscale, te black border frame was cropped away, and te images were compressed using an 80% quality JPEG. We selected te F5 algoritm [3], OutGuess 0.2 [], and te

7 recently developed Model based Steganograpy witout (MB) and wit (MB2) deblocking [2,4] as tree examples of different steganograpic paradigms for JPEG images. Eac steganograpic tecnique was analyzed separately. For a fixed relative message lengt expressed in terms of bits per non-zero DCT coefficient of te cover image, we created a training database of embedded images. Te Fiser inear Discriminant classifier was trained on 34 cover and 34 stego images. Te generalized eigenvector obtained from tis training was ten used to calculate te ROC curve for te remaining 500 cover and 500 stego images. Te detection performance was evaluated using detection reliability ρ defined below. Table. All 23 distinguising functionals Functional/feature name Global istogram H / H Individual istograms for 5 DCT modes Dual istograms for DCT values ( 5,, 5) 2 g g 2 5 5, 3 3 Functional F, 2 2, g,, 4 g Variation V and 2 blockiness B, B 2 Co-occurrences N 00, N 0, N (features, not functionals), Te reason wy we used in our tests message lengts proportional to te number of non-zero DCT coefficients in eac image was to create stego image databases for wic te detection is approximately of te same level of difficulty. In our experience, it is easier to detect a 0000-bit message in a smaller JPEG file tan in a larger JPEG file. Te testing was done for te following relative embedding rates expressed in bpc (Bits Per non-zero DCT Coefficient), bpc = 0, 0.05, 0., 0.2, 0.4, 0.6, 0.8. If, for a given image, te bpc rate was larger tan te maximal bpc rate bpc max determined by te image capacity, we took bpc max as te embedding rate. Te only exception to tis rule was te MB2 metod, were we took 0.95 bpc max as te maximal rate because, for te maximal embedding rate, te deblocking algoritm in MB2 frequently failed to embed te wole message. Fig. sows te capacity for all tree metods expressed in bits per non-zero DCT coefficient. Te detection results were evaluated using detection reliability ρ defined as g g 4 4 ρ = 2A, (7) were A is te area under te Receiver Operating Caracteristic (ROC) curve, also called an accuracy. We scaled te accuracy in order to obtain ρ = for a perfect detection and ρ = 0 wen te ROC coincides wit te diagonal line (reliability of detection is 0). Te detection reliability for all tree metods is sown in Table , 22 g g 5 5, 3 3

8 0.8 F Capacity (bpc) MB2 OG image number Fig.. Capacity for te tested tecniques expressed in bits per non-zero DCT coefficient. Te capacity for MB is double tat of MB2. Te F5 and MB algoritms provide te igest capacity Table 2. Detection reliability ρ for F5 wit matrix embedding (, k, 2 k ), F5 wit turned off matrix embedding (,,), OutGuess 0.2 (OG), Model based Steganograpy witout and wit deblocking (MB and MB2, respectively) for different embedding rates (U = unacievable rate) bpc F5 F5_ OG MB MB U U U U U One can clearly see tat te OutGuess algoritm is te most detectable. Also, it provides te smallest capacity. Te detection reliability is relatively ig even for embedding rates as small as 0.05 bpc and te metod becomes igly detectable for messages above 0. bpc. To guarantee a fair comparison, we ave tested F5 bot wit and witout matrix embedding because some programs could be easily adapted to incorporate it (e.g., OutGuess). Turning off te matrix embedding, te F5 algoritm still performs better tan OutGuess. Te matrix embedding significantly decreases te detectability for sort messages. Tis is understandable because it improves te embedding efficiency (number of bits embedded per cange). Because OutGuess needs

9 to reserve a relatively large portion of coefficients for te correction step, its embedding efficiency is lower compared to F5. Tis seems to ave a bigger impact on te detectability tan te fact tat OutGuess preserves te global istogram of DCT coefficients. Table 3. Detection reliability for individual features for all tree embedding algoritms for fully embedded images (for fully embedded images, F5 wit matrix embedding and witout matrix embedding coincide) Functional/feature Metod F5 OutGuess 0.2 MB MB2 Global istogram Indiv. istogram for (2,) Indiv. istogram for (3,) Indiv. istogram for (,2) Indiv. istogram for (2,2) Indiv. istogram for (,3) Dual istogram for Dual istogram for Dual istogram for Dual istogram for Dual istogram for Dual istogram for Dual istogram for Dual istogram for Dual istogram for Dual istogram for Dual istogram for Variation blockiness blockiness Co-occurrence N Co-occurrence N Co-occurrence N Bot MB and MB2 metods clearly ave te best performance of all tree tested algoritms. MB preserves not only te global istogram, but all marginal statistics (istograms) for eac individual DCT mode. It is quite remarkable tat tis can be acieved wit an embedding efficiency sligtly over 2 bits per cange (compared to.5 bits per cange for F5 and rougly for OutGuess 0.2). Tis is likely because MB does not avoid any oter coefficients tan 0 and its embedding mecanism is guaranteed to embed te maximal number of bits given te fact tat marginal statistics of all coefficients must be preserved. Te MB2 algoritm as te same embedding mecanism as MB but reserves one alf of te capacity for modifications tat bring te blockiness of te stego image to its original value. As a result, MB2 is less detectable tan MB at te expense of a two times smaller embedding capacity. Bot metods perform better tan F5 wit matrix embedding and are significantly better tan F5 witout matrix embedding. Even for messages close to 00% capacity, te

10 detection of MB2 is not very reliable. An ROC wit ρ = 0.82 does not allow reliable detection wit a small false positive rate (c.f., Fig. 2). Never te less, in te strict formulation of steganograpic security, wenever te embedded images can be distinguised from cover images wit a better algoritm tan random guessing, te steganograpy is detectable. Tus, we conclude tat te Model based Steganograpy is detectable using our feature-based approac on our test database. F5 OG MB Fig. 2. ROC curves for embedding capacities and metods from Table 2. MB2 For eac steganograpic metod, we also measured te influence of eac individual feature f as its detection reliability ρ(f) obtained from te ROC curve calculated from te single feature f and no oter features. We acknowledge tat te collection of individual reliabilities ρ(f) does not ave to necessarily capture te performance of te wole detection algoritm in te 23 dimensional space. Tis is because it is possible tat none of te individual features temselves as any distinguising power, yet te collection of all features acieves a perfect detection. Never te less, we use ρ(f) as an indication of ow muc eac feature contributes to te detection. In Table 2, we sow te influence of eac feature for eac steganograpic metod for te maximal bpc rate. In te next section, we interpret te results and draw conclusions concerning te existing and future design principles of steganograpic scemes for JPEG images. We note tat in our tests, we did not include double compressed images. It is likely tat suc images would worsen our detection results. In agreement wit te

11 conclusion reaced in [6], te double compression needs to be first estimated and ten corrected for during te feature calibration. Altoug we ave not tested tis, we believe tat te feature-based blind steganalysis would work in tis case as well. 4 Implications for Steganograpy Te F5 algoritm uses a non-idempotent embedding operation (subtracting ) to prevent te attacks based on te ci-square attack and its generalizations [3 5]. It also makes sure tat te global stego image istogram is free of any obvious artifacts and looks natural. In fact, it as been argued by its autors [3] tat te stego image looks as if te cover image was originally compressed wit a lower JPEG quality factor. However, te F5 predictably modifies te first order statistics and tis is wy te first six functionals are so influential (see Table 2). It is also not surprising tat te dual istogram for 0 as a big influence because of te srinkage. Note tat te second-order statistics significantly contribute to te detection as well. Most features wit te exception of dual istograms ave ig influence on detection. OutGuess 0.2 was specifically designed to preserve te global coefficient istogram. However, OutGuess does not ave to necessarily preserve te individual istograms or te dual istograms, wic is reflected by a relatively large influence for tese functionals in Table 2. Te most influential functional is te dual istogram for te values and 2. Tis is again, understandable, considering te embedding mecanism of OutGuess. Te values and 2 determine te maximum correctable capacity of te metod and tus form te most canged pair of values during te embedding (and te correction step). Altoug te coefficient counts are preserved, teir positions in te JPEG file are igly disturbed, wic is wy we see a very ig influence of features based on dual istograms for values and 2. Anoter reason wy OutGuess is more detectable tan F5 is its low embedding efficiency of bit per cange compared to.5 for F5. Considering te large influence of te dual istogram, it seems feasible tat one could design a targeted steganalytic sceme of te type described in [6] by using te dual istograms for values and 2 as te distinguising statistic. Tis is an example ow te blind analysis may, in turn, give us direct ideas ow to estimate te lengt of te embedded message. Wat is somewat surprising is tat te global istogram also as quite a large influence on detection, despite te fact tat it is preserved by OutGuess. We will revisit tis peculiar finding wen we discuss te results for Model Based Steganograpy below. Anoter seemingly surprising fact is tat altoug blockiness proved very useful in designing successful attacks against OutGuess [6], its influence in te proposed detection sceme is relatively small (0.6). Tis fact is peraps less surprising if we realize tat te distinguising statistic in [6] was te increase of blockiness after full re-embedding rater tan te blockiness itself, wic appears to be rater volatile. ooking at te results in Table and 2, tere is no doubt tat te Model Based Steganograpy [2,4] is by far te most secure metod out of te tree tested paradigms. MB and MB2 preserve not only te global istogram but also all istograms

12 of individual DCT coefficients. Tus, all dual istograms are also preserved. Moreover, MB2 also preserves one second-order functional te blockiness. Tus, we conclude tat te more statistical measures an embedding metod preserves, te more difficult it is to detect it. Consequently, our analysis indicates tat it is possible to increase te security of JPEG steganograpic scemes by identifying a set of key macroscopic statistical features tat sould be preserved by te embedding. It is most likely not necessary to preserve all 23 features to substantially decrease te detectability because many of te features are not independent. One of te most surprising facts revealed by te experiments is tat even features based on functionals tat are preserved by te embedding may ave substantial influence. One migt intuitively expect tat suc features would ave very small influence. However, as sown in te next paragrap, preserving a specific functional does not automatically mean tat te calibrated feature will be preserved. et us take a closer look at te blockiness as an example. Preserving te blockiness along te original 8 8 grid (solid lines) does not mean tat te blockiness along te sifted grid will also be preserved (see Fig. 2). Tis is because te embedding and deblocking canges are likely to introduce distortion into te middle of te blocks and tus disturb te blockiness feature, wic is te difference between te blockiness along te solid and dased lines. Consequently, it is not surprising tat features constructed from functionals tat are preserved still ave some residual (and not necessarily small) influence in our feature-based detection. Tis is seen in Table 2 for bot OutGuess 0.2 and te Model Based Steganograpy. Terefore, te designers of future steganograpic scemes for JPEG images sould consider adding calibrated statistics into te set of quantities tat sould be preserved during embedding. We furter point out tat te features derived from te co-occurrence matrix are very influential for all tree scemes. For te Model based Steganograpy, tese features are, in fact, te most influential. Te MB2 metod is currently te only JPEG steganograpic metod tat takes into account inter-block dependencies between DCT coefficients by preserving te blockiness, wic is an integral measure of tese dependencies. Not surprisingly, te scalar blockiness feature does not capture all iger-order statistics of DCT coefficients. Tus, it seems tat te next generation of steganograpic metods for JPEG images sould preserve bot te marginal statistics of DCT coefficients and te probability distribution of coefficient pairs from neigboring blocks (te co-occurrence matrix). Eventually, if te stego algoritm preserved all possible statistics of te cover image, te embedding would be presumably undetectable. Altoug tis goal will likely never be acieved, as te embedding algoritm preserves more ortogonal or independent statistics, its detectability will quickly decrease. We firmly believe tat incorporating a model for te cooccurrence matrices and preserving it would probably lead to significantly less detectable scemes. Te Model based Steganograpy [4] seems to be an appropriate guiding principle to acieve tis goal. However, te embedding operation sould not be idempotent, oterwise targeted attacks based on re-embedding (c.f., te attack on OutGuess [6]) could likely be mounted.

13 Embedding Cover image Stego image 8 pixels Fig. 2. Blockiness is preserved along te solid lines but not necessarily along te dased lines 5 Summary and Future Researc In tis paper, we developed a new blind feature-based steganalytic metod for JPEG images. Eac feature is calculated as te norm of te difference between a specific functional of te stego image and its cropped/recompressed version. Tis calibration can be interpreted as using te stego image as side information to approximately recover some parameters of te cover image. As a result, te calibration decreases image-to-image variations and tus enables more accurate detection. Te features were calculated directly in te DCT domain as first and iger order statistics of DCT coefficients. Tis enables easier explanation of te impact of embedding modifications on detection as well as direct interpretation of te detection results and easy formulation of design principles for future steganograpic metods. We ave applied te detection to several current steganograpic scemes some of wic are aware of te Cacin criterion [2]. Te experimental results were carefully evaluated and interpreted. Conclusions concerning current and future steganograpic scemes for JPEGs were also drawn. In particular, we concluded tat. Secure steganograpic scemes must preserve as many statistics of DCT coefficients as possible. It is not enoug to preserve te marginal statistics, e.g., te istograms. DCT coefficients exibit block-to-block dependencies tat must be preserved as well. 2. A sceme tat preserves more statistics is likely to be more secure tan a sceme tat preserves fewer statistics. Surprisingly, preserving more statistics may not necessarily lead to small capacity, as sown by Model Based Steganograpy. Tis is also because many statistical features one can identify in an image are likely to be dependent. 3. Even toug a sceme may preserve a specific statistic ζ(x) of te cover JPEG image X, te calibrated statistic ζ(compress(crop(x))) calculated from te cropped/recompressed image may not necessarily be preserved, tus opening te door for attacks. Future steganograpic scemes sould add calibrated statistics to teir set of preserved statistics.

14 4. For all tested scemes, one of te most influential features of te proposed detection was te co-occurrence matrix of DCT coefficients (5), wic is te probability distribution of coefficient pairs from neigboring blocks. We ypotesize tat a sceme tat preserves marginal statistics of DCT coefficients and te co-occurrence matrix (wic captures block-to-block dependencies) is likely to exibit improved resistance to attacks. For tis purpose, we propose te Model Based Steganograpy paradigm [2,4] expanded by te model for joint probability distribution of neigboring DCT coefficients. Altoug te calibration process is very intuitive, we currently do not ave a quantitative understanding of ow muc information about te cover image can be obtained from te stego image by calibration. For example, for images tat contain periodic spatial structures wit a period tat is an integer multiple of 8, te calibration process may give misleading results (c.f., te spatial resonance penomenon [6]). In tis case, it may be more beneficial to replace te cropping by oter operations tat will also break te block structure of JPEG images, suc as sligt rotation, scaling, or random warping. Furter investigation of tis issue will be part of our future researc. In te future, we also plan to replace te Fiser inear Discriminant wit more sopisticated classifiers, suc as Support Vector Macines, to furter improve te detection reliability of te proposed steganalytic algoritm. We also plan to develop a multiple-class classifier capable of recognizing stego images produced by different embedding algoritms (steganograpic program identification). Acknowledgements Te work on tis paper was supported by te Air Force Researc aboratory, Air Force Material Command, USAF, under researc grant number F Te U.S. Government is autorized to reproduce and distribute reprints for Governmental purposes notwitstanding any copyrigt notation tere on. Te views and conclusions contained erein are tose of te autors and sould not be interpreted as necessarily representing te official policies, eiter expressed or implied, of Air Force Researc aboratory, or te U. S. Government. Special tanks belong to Pil Sallee for many useful discussions during preparation of tis paper and for providing te code for Model Based Steganograpy. References. Anderson, R. J. and Petitcolas, F.A.P.: On te imits of Steganograpy. IEEE Journal of Selected Areas in Communications. Special Issue on Copyrigt and Privacy Protection, vol. 6(4) (998) Cacin, C.: An Information-Teoretic Model for Steganograpy. In: Aucsmit, D. (ed.): Information Hiding. 2 nd International Worksop. ecture Notes in Computer Science, Vol. 525, Springer-Verlag, Berlin Heidelberg New York (998) pp

15 3. Westfeld, A. and Pfitzmann, A.: Attacks on Steganograpic Systems. In: Pfitzmann A. (eds.): 3rd International Worksop. ecture Notes in Computer Science, Vol.768. Springer-Verlag, Berlin Heidelberg New York (2000) Westfeld, A.: Detecting ow Embedding Rates. In: Petitcolas, F.A.P. (ed.): Information Hiding. 5 t International Worksop. ecture Notes in Computer Science, Vol Springer-Verlag, Berlin Heidelberg New York (2002) Provos, N. and Honeyman, P.: Detecting Steganograpic Content on te Internet. CITI Tecnical Report 0- (200) 6. Fridric, J., Goljan, M., Hogea, D., and Soukal, D.: Quantitative Steganalysis: Estimating Secret Message engt. ACM Multimedia Systems Journal. Special issue on Multimedia Security, Vol. 9(3) (2003) Farid H. and Siwei,.: Detecting Hidden Messages Using Higer-Order Statistics and Support Vector Macines. In: Petitcolas, F.A.P. (ed.): Information Hiding. 5 t International Worksop. ecture Notes in Computer Science, Vol Springer-Verlag, Berlin Heidelberg New York (2002) Eggers, J., Bäuml, R., and Girod, B.: A Communications Approac to Steganograpy. In Proc. EI SPIE Electronic Imaging SPIE Vol (2002) Tzscoppe, R., Bäuml, R., Huber, J.B., and Kaup, A.: Steganograpic System based on Higer-Order Statistics. Proc. EI SPIE Electronic Imaging. Santa Clara (2003) Tzscoppe, R.: Personal communication. February (2003). Provos, N.: Defending Against Statistical Steganalysis. 0t USENIX Security Symposium. Wasington, DC (200) 2. Sallee, P.: Model Based Steganograpy. International Worksop on Digital Watermarking. Seoul, October (2003) Westfeld, A. and Pfitzmann, A.: Hig Capacity Despite Better Steganalysis (F5 A Steganograpic Algoritm). In: Moskowitz, I.S. (eds.): Information Hiding. 4 t International Worksop. ecture Notes in Computer Science, Vol.237. Springer-Verlag, Berlin Heidelberg New York (200) Sallee, P.: Model-based metods for steganograpy and steganalysis. Submitted to International Journal of Image and Grapics. Special issue on Image Data Hiding (2004) 5. I. Avcibas, N. Memon, and B. Sankur, Steganalysis using Image Quality Metrics, SPIE Security and Watermarking of Multimedia Contents II, Electronic Imaging, San Jose, CA, Jan. 200.