CHAPTER 3. Digital Carriers of Steganography

Transcription

1 CHAPTER 3 Digital Carriers of Steganography 3.1 Introduction It has been observed that all digital file formats can be used as digital carrier for steganography, but the formats those are with a high degree of redundancy are more suitable since the redundant bits can be replaced with secret information without the embedded information being perceivable. The redundant bits of an object are those bits that can thus be altered without the alternation being detected easily (Anderson and Petitcolas, 1998). Image, Text, Audio, Video and Network Protocol often have redundant data present in their binary representation and comply with the requirement of steganography. Thus, these file formats can be used as carrier of steganographic data as shown in figure 3.1. Steganography Text Protocol Audio Image Video Figure 3.1: Main categories of file formats used for steganography Each of these file format categories uses different techniques for hiding information based on the unique characteristics of the file format and the redundancy created in the digital representation of the file (Morkel et al., 2005). 28

2 3.2 Text Steganography In text based steganography data hiding takes place by introducing changes in the structure of the document without making a notable change in the concerned output. Text steganography is the art or process of hiding one text into another text for the purpose of secure communication so that the unauthorized user cannot get trace of the secret message. Text steganography methods are basically classified into three types which consist of subparts as shown in figure 3.2. Figure 3.2: Classification of Text Steganography techniques Format based Format based methods used physical text formatting of text as a place in which to hide information. They do not change any word or sentence, so it does not harm the value of the cover-text (Bhattacharyya et al., 2010). Format Based Method is of four types Line shifting method: In the line shifting method, the lines of the text are vertically shifted to some degree and information is hidden by creating a unique shape of the text (Shirali-Shahreza and Shirali-Shahreza, 2010). In a typical implementation, a line is moved up or down, while the line immediately above or below (or both) are left unmoved (Banerjee et al., 2011). The unmoved adjacent lines serve as reference locations in the decoding process. Though the human eye is particularly adapted at noticing deviations from uniformity, each vertical line can be shifted 1/300 inch up or 29

3 down and such changes less go unnoticed by human eye (Memon et al., 2008).. Word shifting method: In word shifting method, the horizontal alignment of some words are shifted by changing distances between words to embed information in the text and is acceptable for text where the distance between words is varied (Bhattacharyya et al., 2010). Readers accept a wide variation in text setting within a line and each horizontal words can be shifted 1/150 inch and such changes less go unnoticed by human eye (Brassil et al., 1999). In such process, a word is altered left or right, while the words immediately adjacent are left unmoved and these words serve as reference locations in the extracting process. Feature coding: In feature coding method, some of the features of the text are chosen and altered depending on the message to be inserted (Bhattacharyya et al., 2010). Such feature alterations can be a change to a character s height or its position within a given font relative to other characters. In such case document will have the same content and some character features are left unchanged to facilitate decoding process (Brassil et al., 1999). Feature coding method also involves the alterations of vertical lines of the individual characters and the length of those lines may be modified in a way that is imperceptible to the ordinary readers (Memon et al., 2008). White/null /open space: In the open spaces method, extra white/null spaces are added into the text of the cover message for hiding the secret message (Bhattacharyya et al., 2010). These whitespaces can be placed at the end of each line, at the end of each paragraph or sentence or between the words (Memon et al., 2008). This method can be implemented on any arbitrary text and does not raise attention of the reader (Bender et al., 1996). Although a little amount of data can be hidden in a document, this method can be applied to almost all kinds of text without revealing the existence of the hidden data (Banerjee et al., 2011). 30

4 3.2.2 Random and statistical generation methods Random and statistical generation methods are used to generate cover-text automatically according to the statistical properties of language (Bhattacharyya et al., 2010). This method use example grammars to produce cover-text in a certain natural language and is based on character sequences and words sequences. A probabilistic context-free grammar (PCFG) is used to generate word sequences by starting with the root node and recursively applying randomly chosen rules. The sentences are constructed according to the secret message to be hidden in it. The quality of the generated stego-message depends directly on the quality of the grammars used (Bhattacharyya et al., 2010). Another approach to character generation is to take the statistical properties of wordlength and letter frequency in order to create words (without lexical value) which will appear to have the same statistical properties as actual words in a given language (Shirali-Shahreza and Shirali-Shahreza, 2010). The hiding of information within word sequences, the actual dictionary items can be used to encode one or more bits of information per word using a codebook of mappings between lexical items and bit sequences, or words themselves can encode the hidden information (Banerjee et al., 2011) Linguistic method The final category is linguistic method which specifically considers the linguistic properties of generated and modified text, frequently uses linguistic structure as a place for hidden messages (Bennett, 2004). Linguistic steganography is defined as a technique of data hiding that embeds the secret message within texts based on some linguistic knowledge (Bhattacharyya et al., 2010). They are basically of two types: Semantic method: In the semantic method, the synonyms of certain words are used for hiding information in the text (Bhattacharyya et al., 2010). The synonym substitution may represent a single or multiple bit combination for the secret information. The semantic transformation method is the most sophisticated approach for linguistic steganography and perhaps impractical given the current state-of the- art for NLP technology (Bennett, 2004). 31

5 Syntactic method: In this approach the syntactic structure of the text is used to embed the secret message into text file. Syntactic method is a linguistic steganography method where some punctuation signs like comma (,) and fullstop (.) are placed in proper places in the document to embed data (Bhattacharyya et al., 2010; Memon et al., 2008). Syntactic method is based on the fact that a given sentence may be represented into various syntactic structures without any essential change in meaning. Syntactic methods include changing the diction and structure of text without significantly altering the meaning (Bender et al., 1996). 3.3 Network steganography Network steganography allows users to communicate secretly by embedding information within other messages and network control protocols used by common applications. This is possible because inserting hidden data into a chosen carrier remains unnoticeable for users not involved in steganographic communication (Handel and Sandford, 1996). Data hiding within network protocols were based on the discovery of covert channels and embedding took place in TCP/IP packets also in application layer protocols (Mazurczyk and Lubacz, 2010). Hidden communication network steganography utilizes network protocols and/or relationships between them as a secret message carrier. Handel and Sandford, (1996) described the existence of hidden channels within standard design of network protocols. The OSI model is a standard network model that is used for almost all the networks. In the OSI layers there are some places where secret information may be hidden. Some of the Network Steganography methods are as follows: Steganophony: Voice over IP (VoIP) is a real-time service, which enables users to make phone calls through data networks that use an IP protocol (Mazurczyk et al., 2011). A steganographic technique applied to VoIP traffic steganophony that involves information hiding techniques in any layer of the TCP/IP protocol-stack is proposed by Mazurczyk and Lubacz, (2010). According to them, for VoIP systems, four possible hidden communication 32

6 scenarios may be considered. In the first method, the sender and the receiver perform VoIP conversation while simultaneously exchanging secret messages. In the rest three methods only a part of the VoIP end-to-end path is used for hidden communication and thus the sender and/or receiver are unaware of the steganographic data exchange. TRANSTEG: Mazurczyk et al., (2011) presented a steganographic method for IP telephony called TranSteg (Transcoding Steganography) which is intended for a broad class of multimedia and real-time applications. The main idea of TranSteg is to find a codec that will result in a similar voice quality but smaller voice payload size than the originally selected with the least possible degradation in voice quality. Then, the voice stream is transcoded. At this step the original voice payload size is intentionally unaltered and the change of the codec is not indicated. Instead, after placing the transcoded voice payload, the remaining free space is filled with hidden data. LACK: In case of VoIP, when a packet does not reach the destination point or when it is delayed excessive amount of time, it is considered as packet lost and then discarded. This feature is used to create new steganographic technique called LACK (Lost Audio Packets Steganographic Method) (Mazurczyk and Szczypiorski, 2008). LACK is a hybrid steganographic method which modifies both packets and their time dependencies. Firstly, one packet is selected from the RTP stream and its voice payload is substituted with bits of the secret message (Mazurczyk and Lubacz, 2010). At the transmitter, some selected audio packets are intentionally delayed by a certain time before transmitting. If the delay of such packets at the receiver is considered excessive, the packets are discarded by a receiver which is not aware of the steganographic procedure. If the receiver knows about the hidden communication, then instead of deleting the packet the receiver extracts the payload. For unaware receivers the hidden data is invisible (Mazurczyk and Szczypiorski, 2008). Padding based Steganography: Padding can be found at any layer of the OSI model, but typically it is exploited for covert communications only in the data link, network and transport layers (Mazurczyk and Szczypiorski, 2008).According to Jankowski et al., (2010), Padding based Steganography is 33

7 the steganographic system that utilizes Ethernet (IEEE 802.3), ARP, TCP and other protocols and is designed for LANs only because it utilizes improper Ethernet frame padding in Ethernet. The method stated by them initiates by a process where each host willing to exchange secret messages should be able to locate and identify other hidden hosts. Due to incorrect handling of Ethernet frame padding a memory leakage occurs and is called Etherleak. Thus data is inserted in padding by Etherleak which is considered unlikely to contain any valuable information and does not pose serious threat to network security. However, it creates a perfect candidate for a carrier of the secret messages. SCTP Steganography: Steganographic methods may be applied to Stream Control Transmission Protocol (SCTP) which is a transport layer protocol and its main role is similar to both popular protocols Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) as stated by Fraczek et al., (2010). According to them, information hiding methods that have been proposed for TCP and UDP protocols may be utilized due to several similarities between these transport layer protocols and SCTP. It provides ensuring reliability and transport of messages with congestion control. SCTPspecific steganographic methods can be divided in three groups- methods that modify content of SCTP packets, methods that modify how SCTP packets are exchanged and methods that modify both content of SCTP and the way they are exchanged i.e. hybrid methods. Multi-Level Steganography: Fraczek et al., (2012) proposed Multi-Level Steganography which is based on two steganographic methods. First, the upper-level method uses covert traffic as a secret data carrier. The second, the lower-level method, uses the way the upper-level method operates as a carrier. The indirect carriers for lower-level methods are still packets from covert communication, but the direct carrier is another (upper-level) method. In MLS the bandwidth of the lower-level method is a fraction of the bandwidth of the upper-level method. Also, the lower-level method is potentially harder to detect than the upper-level one. It results from the fact that the lower-level method functioning entirely depends on upper-level one. Thus, the adversary has to detect the upper-level method first in order to look for the lower-level one. 34

8 3.4 Audio Steganography Steganography can be applied to audio files. Audio files may be modified in such a way that they contain hidden information in such a way that it is difficult to remove the hidden data without destroying the original signal. Audio steganography takes advantage of the psycho acoustical masking phenomenon of the human auditory system (HAS) (Dutta et al., 2009). The HAS perceives the additive random noise and also the perturbations in a sound file can also be detected. While the HAS have a large dynamic range, it has a fairly small differential range. As a result, loud sounds tend to mask out quiet sounds. And there are also some distortions that are so common that the HAS ignores them Least significant bit encoding Least significant bit (LSB) coding is the simplest and popular way to embed information in a digital audio file that replaces the least significant bit of the cover audio file to hide a sequence of bytes containing the hidden data (Saroha and Singh, 2010). The technique doesn't cause significant quality degradation in audio and allows for a large amount of data to be encoded (Jayaram et al., 2011). In LSB coding, one LSB of the audio file is replaced with one bit of the message. In some implementations of such coding more LSBs of a sample are replaced with message bits. This increases the amount of data that can be encoded but also increases the amount of resulting noise in the audio file as well. There is also disadvantage associated with the use of methods like LSB coding. If a sound file embedded with a secret message using LSB coding was resampled, the embedded information would be lost (Saroha and Singh, 2010) Phase coding The phase coding method works by substituting the phase of an initial audio segment with a reference phase that represents the data (Jayaram et al., 2011). The phase of subsequent segments is adjusted in order to preserve the relative phase between segments (Malviya et al., 2012). Rather than introducing perturbations, the technique encodes the message bits as phase shifts in the phase spectrum of a digital signal, achieving an inaudible encoding in terms of signal-to-perceived noise ratio (Saroha 35

9 and Singh, 2010). In such coding data hiding starts by breaking the original sound signal into smaller segments whose lengths equal the size of the message to be encoded and a Discrete Fourier Transform (DFT) is applied to each segment to create a matrix of the phases and Fourier transform magnitudes (Dutta et al., 2009). Phase differences between adjacent segments are calculated and phase shifts between consecutive segments are used to embed secret data where the absolute phases of the segments can be changed but the relative phase differences between adjacent segments must be preserved (Jayaram et al., 2011). Then a new phase matrix is created using the new phase of the first segment and the original phase differences. Using the new phase matrix and original magnitude matrix, the sound signal is reconstructed by applying the inverse DFT and then concatenating the sound segments back together (Malviya et al., 2012) Parity coding One of the prior works in audio data hiding technique is parity coding technique. Instead of breaking a signal down into individual samples, the parity coding method breaks a signal down into separate regions of samples and encodes each bit from the secret message in a sample region's parity bit (Malviya et al., 2012). If the parity bit of a selected region does not match the secret bit to be encoded, the process inverts the LSB of one of the samples in the region (Dutta et al., 2009). Parity files are created to accompany data files, and are used to preserve data integrity and assist in data recovery. Here a group of 'parity files' are built that record the structure of the files to be protected. Later, if any of the protected files are lost, the parity files can be used to re-create the missing files. The disadvantage of the method is that the attackers can still find the pattern to break or remove the information from the carrier media Spread spectrum In audio steganography, the basic spread spectrum (SS) method attempts to spread secret information across the frequency spectrum of the audio signal which is similar to a system which uses an implementation of the LSB that spreads the message bits over the entire sound file (Jayaram et al., 2011). However, unlike LSB coding, the Spread Spectrum method spreads the secret information over the frequency spectrum 36

10 of the sound file using a code which is independent of the actual signal (Saroha and Singh, 2010). As a result, the final signal occupies a bandwidth which is more than what is actually required for transmission. The Spread Spectrum can show better performance in some areas compared to LSB coding, phase coding, and parity coding techniques in that it offers a moderate data transmission rate and high level of robustness against removal techniques (Saroha and Singh, 2010). However, the Spread Spectrum method has one main disadvantage that it can introduce noise into a sound file (Jayaram et al., 2011) Echo hiding In echo hiding, information is embedded in a sound file by introducing an echo into the discrete signal (Malviya et al., 2012). Like the spread spectrum method, it too provides advantages in that it allows for a high data transmission rate and provides superior robustness when compared to the noise inducing methods (Dutta et al., 2009). To hide the data successfully, three parameters of the echo are varied: amplitude, decay rate, and offset (delay time) from the original signal (Saroha and Singh, 2010). All three parameters are set below the human hearing threshold so that the echo is not easily resolved. In addition, offset is varied to represent the binary message to be encoded. If only one echo was produced from the original signal, only one bit of information could be encoded (Jayaram et al., 2011). Therefore, the original signal is broken down into blocks before the encoding process begins. Once the encoding process is completed, the blocks are concatenated back together to create the final signal (Malviya et al., 2012). 3.5 Image steganography In the domain of digital images many different image file formats exist. For these different image file formats, different steganographic algorithms exist. Image steganography is about exploiting the limited powers of the human visual system (HVS). Images are the most popular and useful cover image for steganography. Image steganography is basically divided into two categories: Steganography in the Image Spatial Domain and Frequency Domain. 37

11 3.5.1 Spatial domain based Spatial domain based steganographic method involves modification of the secret data in the spatial domain of the cover image, which is the embedding of the Least Significant Bits (LSBs).This method is based on the fact that the least significant bits of an image can be considered as random noise and thus they do not cause any changes to any modifications on the image Frequency domain based In the frequency domain cover images are transformed using a frequency-oriented mechanism such as discrete cosine transform (DCT), discrete wavelet transform (DWT) or similar mechanisms, after which the secret messages can be combined with the coefficients in the frequency-form images to achieve embedding. Frequency Domain are also known as transform domain. As this thesis is concentrated on image based methods a more detailed study of the image based methods is done in Chapter Video steganography A digital video is basically collection of images and audio, thus most of the steganographic techniques related to images and audio can be applied to video files too. Data hiding in videos is similar to that of data hiding in images, apart from information is hidden in each frame of the video (Bhaumik et al., 2009). The great advantages of video are the large amount of data that can be hidden inside and the fact that it is a moving stream of images and sounds. Therefore, any small but otherwise noticeable distortions might go by unobserved by humans because of the continuous flow of information. In video steganography the cover video is then broken down into frames and the secret data is embedded in these frames. The size of the message does not matter in video steganography as the message can be embedded in multiple frames. Although video based steganography can afford large volume of secret data, but the main problem is the size of such file and also the time computation is too high in such method. According to the working domain, video steganography techniques 38

12 are classified into): Spatial domain, Frequency domain and Format-specific (Jayamalar and Radha, 2010) Spatial domain The spatial domain techniques embed the secret data by modifying the pixel values of the host video directly. Least Significant Bit (LSB) method is the common and most simple approach for embedding information in a cover video and is used most frequently for data hiding (Chae and Manjunath, 1999). This method hides the secret message directly into the least significant bit of each color channel of the host video and thus a large amount of data can be hidden into the video file. This technique is most-straight forward method and uses the entire cover image to embed the secret message (Bhaumik et al., 2009). In spatial domain, it is possible to hide a significant amount of information in the covert file, by using the LSB of each color channel to carry the secret information (Swathi and Jilani, 2012). After concealing data in multiple frames of the carrier video, they are grouped together to form a stego video which to be used as normal sequence of streaming (Hanafy et al., 2008). The main advantage of the LSB coding method is a very high data hiding channel bit rate and a low computational complexity. With such a small variation in the colors of the video image it would be very difficult for the human eye to discern the difference thus providing high robustness to the system (Chae and Manjunath, 1999). In case of LSB method an attack that is set on a pixel to pixel basis can fully uncover the secret message, which is the major drawback of the system Frequency domain In frequency domain, host video is transformed to frequency components by transformation techniques and then messages are embedded in some or all of the transformed coefficients (Jayamalar and Radha, 2010). Embedding may be bit level or in block level. In frequency domain technique, the message is embedded distributively in overall domain of an original data. In this domain, DCT alters values of certain parts of the images by rounding them up. The digital video is composed of frames and the host frame is transformed to the DCT domain and each block of 8x8 host frame pixels is quantized by scaling the DCT coefficients using the quantization matrix (Bhaumik et al., 2009). The secret bits are then replaced with the bits of the 39

13 texture components of quantized DCT coefficients to form a fused block of DCT coefficients. The fused coefficients are then transformed inverse to produce an embedded frame. According to Chae and Manjunath, (1999) the human visual system is more sensitive to the changes in low frequency regions than in highly textured regions and so, insertions in the textured regions are less likely to result in visible distortions compared to less textured regions Format specific Techniques based on MPEG-2 and -4 have been proposed that involved modification for high frequency DCT coefficient manipulation and DCT block classification. Video steganography techniques that use MPEG-1, -2 and -4 coding structures as primitive components are primarily motivated by the goal of integrating data hiding and compression to reduce overall real-time video processing complexity (Morkel et al., 2005). In MPEG-4, video object (VO) is an area of the video scene and an instance of a VO at a particular point in time is a video object plane (VOP) (Vassaux et al., 2002). A compressed video stream is mainly composed of DCT coefficients, motion vectors, and other information (Mansouri and Khademi, 2009). Video compression is used to reduce redundancy in video file and operates on square-shaped groups of neighboring pixels, often called macro blocks. These pixel groups or blocks of pixels are compared from one frame to the next and the video compression code sends only the differences within those blocks. Data embedding can take place in DCT coefficients and motion vectors (Mansouri and Khademi, 2009). Data can be embedded in the high or low textured area of DCT Coefficients of the VOP. In case of motion vectors embedding of secret data takes place in horizontal and vertical components of motion vector of the VOP. 40