Statistical Steganalyis of Images Using Open Source Software

Transcription

1 Statstcal Steganalys of Images Usng Open Source Software Bhargav Kapa, Stefan A. Robla Department of Computer Scence Montclar State Unversty Montclar, NJ Abstract In ths paper we present a novel steganalytc tool based on statstcal pattern recognton. The man am of our project was to desgn and mplement a system able to classfy the mages nto ones wth no hdden message and steganographc mages usng classc pattern classfcaton technques such as Bayesan classfcaton and decson trees. Experments are conducted on a large data set of mages to determne the classfcaton algorthm that performs better by comparng classfcaton success and error rates n each case. We have employed Weka, a data-mnng tool developed n java for ths purpose. We have also developed an applcaton usng Weka Java lbrary for loadng the data of the Images and classfy the mages nto normal mages and steganographc mages. Ths applcaton runs a GUI(Graphcal User Interface) that enables the user to choose the classfer and other optons requred for the classfcaton. Our results are algned wth current state of the art research and have the advantage of usng open source software. Keywords- mage processng, wavelets, steganography, steganalyss I. INTRODUCTION (HEADING 1) The word steganography s derved from the Greek words steganos and graphen, whch mean covered and wrtng. Steganography s often confused wth cryptography snce both are used to protect mportant nformaton. The dfference between the two s that steganography nvolves hdng nformaton n such a way that one cannot easly fnd that nformaton s hdden at all [1]. Hstorcal steganography nvolved technques such as dsappearng nk or mcrodots. Modern steganography nvolves hdng data n computer fles [2]. It s farly easy to hde a secret message n a graphc fle wthout notceably alterng the vsble appearance of that fle. In recent years, steganography has emerged as an ncreasngly actve research area, wth nformaton beng mperceptbly hdden n mages, vdeo, and audo among others. Wth the wde avalablty of dgtal mages, and the hgh degree of redundancy present n them despte compresson, there has been an ncreased nterest n usng dgtal mages as cover-objects for the purpose of steganography. Steganalyss,.e. the scence of dentfyng steganographc data s thus ncreasng n mportance. Whle many approaches to steganalsys have been proposed recently, often such approaches come offered as commercal or freeware packages and do not allow any reasonable accuracy testng. In ths paper, we descrbe the desgn and mplementaton of a system able to classfy non modfed and steganographc mages usng classc pattern recognton technques such as Bayesan classfcaton and decson trees. II. STEGANOGRAPHY AND STEGANALYSIS A generc descrpton of the steganographc process can be gven usng the followng formula : cover_medum + hdden_data + stego_key = stego_medum (1) where the cover_medum s the fle n whch the data s hdden, whch may also be encrypted usng the stego_key.the resultng fle s the stego_medum. The cover_medum (and, thus, the stego_medum) are typcally mage or audo fles. For example the cover mage shown n Fg. 1. was embedded wth the text of the Declaraton of Independence (over 6,600 characters) to obtan the mage on the rght. For ths we used the freely avalable Cryptobola Software that s able to embed encrypted data nto jpeg mages [3]. If presented wth the stego-mage, a human would not be able to realze that the mage ncludes addtonal nformaton. Even comparng sde by sde the stego and the cover medum would probably not help. There are many steganographc technques, ncludng: concealng messages wthn the lowest bts of mages or sound fles, concealng data wthn encrypted data, and embedded pctures n vdeo materal etc. The smplest approach to hdng data wthn an mage fle s called least sgnfcant bt (LSB) nserton. In ths method, we can take the bnary representaton of the hdden_data and overwrte the LSB of each byte wthn the cover mage. If we are usng 24-bt color, the amount of change wll be mnmal and ndscernble to the human eye [4]. Fgure 1. Cover mage on the left, stego-mage on the rght /10/$ IEEE

2 Though t s not possble to vsually dstngush between the cover mage and the steganographc mage, they can be dstngushed wth the help of certan steganalyss technques. Even f the secret content s not revealed, the exstence of t can be detected snce modfyng the cover medum results n the change of ts statstcal propertes and these changes cause dstortons n the resultng steganographc medum s statstcal propertes. The dstortons obtaned can then be used to analyze and detect steganographc mages [5]. In recent tme, many steganographc algorthms have also been desgned. Some of them are based on fle type and others, whch are more wdely used are based on embeddng method. Inserton-based technques hde data n sectons of a fle that are gnored by the processng applcaton and do not modfy those bts that determne the contents of a fle that are relevant to an end-user. In a substtuton-based algorthm, the most nsgnfcant bts of nformaton that determne the meanngful content of the orgnal fle are replaced wth new data n a way that causes the least amount of dstorton [6]. Wthn steganographc technques, a specal concern s gven to compressed nformaton such as Jpeg pctures. The Jpeg fle format s compact and does not sgnfcantly degrade the qualty of an mage so t s frequently used on the nternet. The Jpeg format uses a dscrete cosne transform (DCT) to dentfy 64 DCT coeffcents n successve 8x8 pxel blocks. Of these quantzed coeffcents, the least sgnfcant bts are used to embed data. Because modfcatons to these bts affect pxel frequency as opposed to spatal structure no obvous dstorton s present [7]. Most Jpeg Steganography methods replace the least sgnfcant bts (LSB) of the frequency coeffcents (DCT) skppng 0s and 1s after quantzaton (e.g. J-Steg, JP Hde&Seek, OutGuess) [8]. Other methods decrement the coeffcents absolute values when the LSBs do not match, except coeffcents wth value zero (e.g. F3, F4, F5) [2]. Steganalyss s not an easy task because of the dversty of natural mages and the wde varaton of data embeddng algorthms. However, an orgnal cover medum and ts stegoverson (wth hdden message nsde) always dffer from each other n some aspects snce the cover medum s modfed durng the data embeddng. Although all embeddng technques utlze redundances n the cover mage for the embeddng process, they dffer on ther approach, and the mage type they operate on. For example more recent technques such as F5, Outguess, and Perturbed quantzaton embeddng operate on Jpeg mages by modfyng the DCT coeffcents. Although changng the DCT coeffcents wll cause unnotceable vsual artfacts, they do cause detectable statstcal changes. These statstcal changes are used by steganalyss technques to detect any embedded messages. Essentally there are two approaches to the problem of steganalyss. One s to come up wth a steganalyss method specfc to a partcular steganographc algorthm. The other s developng unversal steganalyss technques whch are ndependent of the steganographc algorthm beng analyzed [7]. Each of the two approaches have ther own advantages and dsadvantages. A steganalyss technque specfc to an embeddng method would gve very good results when tested only on that embeddng method, and mght fal on all other steganographc algorthms. On the other hand, a steganalyss method whch s ndependent of the embeddng algorthm mght perform less accurately overall but stll provde acceptable results on new and unseen embeddng algorthms. Based on whether an mage contans hdden message, mages can be classfed nto two classes: the mage wth no hdden message and the correspondng steganogrphc mage (the very mage but wth message hdden n t). Steganalyss can thus be consdered as a pattern recognton process to decde whch class a test mage belongs to. The key ssue for steganalyss just lke for pattern recognton s feature extracton. The features should be senstve to the data hdng process. In other words, the features should be rather dfferent for the mage wthout hdden message and for the steganographc mage. The larger the dfference, the better the features are. The features should be as general as possble,.e., they are effectve to all dfferent types of mages and dfferent data hdng schemes [2]. III. PROPOSED METHOD A. Overall Approach The Methodology that s adopted for the project mplementaton has the sequence flow as shown n Fg. 2. A collecton of stego and plan mages s beng frst processed for extracton of features. The features are then reduced n number through an extracton process and the remnangn values are fed to a classfer. B. Feature Selecton Jpeg steganographc algorthms usually embed message bts nto randomly chosen DCT coeffcents. Hence the hstogram of the DCT coeffcents of a stego mage s dfferent from the hstogram of the DCT coeffcents of the cover mage, allowng the selecton of the coeffcents as features. Fg. 3 provdes an example of a cover and stego mage wth ther correspondng DCT coeffcent hstograms. The features were computed usng the tool ImageJ. ImageJ s an open source mage processng tool wrtten n Java. It s downloadable on any computer wth Java 1.4 or later vrtual machne [9]. In the current format, our applcaton requres manual processng of each mage through ImageJ. However, t can be easly envsoned that the DCT and the hstogram coeffcents can be computed automatcally wthout human nterventon. Data Set Feature Extracton Classfcaton Result analyss Fgure 2. Classfcaton of steganographc mages

3 C x) x C ) C ) x) = (3) As x) s constant, eq. 2 reduces to maxmzng P x C ) C ) (4) ( Whle ths approach s computatonally expensve for large n, to ease the burden class condtonal ndependence s assumed resultng n: Fgure 3. Cover mage on the left, stego-mage on the rght and the correspondng DCT hstograms below. C. Classfcaton Classfcaton of the mages s done usng Weka [10]. Weka stands for Wakato Envronment for Knowledge Analyss. Weka s a collecton of machne learnng algorthms for data mnng tasks. The algorthms can ether be appled drectly to a dataset or called from Java code. Weka contans tools for data pre-processng, classfcaton, regresson, clusterng, assocaton rules, and vsualzaton. It s also wellsuted for developng new machne learnng schemes. Weka s developed by the machne-learnng group of Computer Scence Department, Unversty of Wakato, New Zealand. To classfy we used the standard supervsed classfcaton approach. Here, the set of mages s splt n tranng and valdaton subsets. The tranng subset together wth nformaton on whether they are cover or stego mages s used to tran the classfer. The task of the supervsed classfer s to predct the label (stego or cover) for any mage after havng seen a number of tranng examples (.e. pars of nput and target output). To acheve ths, the classfer has to generalze from the presented data to new possble nputs [11]. Two dfferent classfcaton approaches were employed. The frst uses Naïve Bayesan classfcaton whle the second uses decson trees. The naïve Bayes classfer s based on the Bayesan theorem. It s partcularly suted when dmensonalty of the nputs s hgh. Parameter estmaton for nave Bayes models uses the method of maxmum lkelhood. In spte of over smplfed assumptons, t often performs better n many complex real-world stuatons. The man advantage s that t requres a small amount of tranng data to estmate the parameters. In a nutshell, the classfer works as follows: Gven a set D of n dmensonal vectors x (x 1, x 2, x 3,..., x n ), and m classes : C 1, C 2,..., C m the Naïve Bayes classfer predcts x belongs to class C m f: C x) > C j x) for all j between 1 and m (2) The above condtonal probablty can be expressed usng the Bayes theorem: P C ) = n k = 1 x k C ) (x (5) Overall, naïve Bayes classfcaton performs extremely well for a large number of problems. It s smplcty ensures wdespread use and the relatvely small number of exemplars needed for tranng s another supportng factors. Nevertheless, recent studes have shown that Bayesan classfcaton s outperformed by most modern classfers [12]. The second approach s based on decson trees. A decson tree s a predctve model that maps observatons about an tem wth conclusons about ts target value. The machne learnng technque for nducng a decson tree from data s called decson tree learnng [13]. More descrptve names for such tree models are classfcaton tree (dscrete outcome) or regresson tree (contnuous outcome). In these tree structures, leaves represent classfcatons and branches represent conjunctons of features that lead to those classfcatons. The machne learnng technque for nducng a decson tree from data s called decson tree learnng, or decson trees. Decson trees are herarchcal tree structures that can be used to classfy based on a seres of questons (or rules) about the attrbutes of the class. The attrbutes of the classes can be any type of varables from bnary, nomnal, ordnal, and quanttatve values, whle the classes must be qualtatve type (categorcal or bnary, or ordnal). In short, gven a data of attrbutes together wth ts classes, a decson tree produces a sequence of rules (or seres of questons) that can be used to recognze the class. There are several most popular decson tree algorthms such as ID3, C4.5 and CART (classfcaton and regresson trees). In general, the actual decson tree algorthms are recursve. In our case we used C4.5 developed by Ross Qunlan [14], as an extenson of an earler approach (ID3). The decson trees generated by C4.5 can be used for classfcaton, and for ths reason, C4.5 s often referred to as a statstcal classfer. C4.5 bulds decson trees from a set of tranng data, usng the concept of nformaton entropy. IV. APPLICATION Weka Java lbrary s leveraged to develop the applcaton. All the classes needed for the applcaton are mported from Weka Java lbrary to our applcaton. Java Code s wrtten n Eclpse IDE to load the data nto the applcaton, buld the classfer and evaluate the classfer. GUI s also developed n

4 eclpse IDE. Three sets of classes are needed for the applcaton: loadng data, buldng the classfer and evaluatng t. Our GUI based nterface allows us to load the features for a set of mages and tran the classfer usng ether naïve Bayes or decson trees. Next, the applcaton allows classfcaton of new mages usng ether of the classfers. V. RESULTS A data set of 1400 mages s created by frst takng 900 mages from the web. To create the setgo mages, we devlopped a java applcaton that generated random length text and embedded t usng the F5 algorthm [15], resultng n 500 stego mages. Experments are conducted by repeatng 10 tmes the followng: splt the data n 70%-30% rato for tran/ test data that s 70% of the data s used for tranng the classfer and the remanng 30% s used for testng. The results obtaned are n Tables 1 and 2. The average results are provded n Fg. 4. Decson tree classfer performed consstently well by correctly classfyng up to 70%-73% of the mages. From the results obtaned from Weka as well as our applcaton we can say that the performance of decson tree classfer s better than naïve Bayes classfer. To further understand the ablty of each approach to classfy correctly we looked at the confuson matrx. A confuson matrx contans nformaton about actual and predcted classfcatons done by the classfcaton system [16]. Performance of the classfer can be evaluated usng the data n the matrx. The entres n the confusonn matrx have the followng meanng n the context of our study: a s the fracton of correct predctons that an nstance s negatve, b s the fracton of ncorrect predctons that an nstance s postve, c s the fracton of ncorrect predctons that an nstance negatve, and d s the fracton of correct predctons that an nstance s postve (see Table 3). Table 4 presents the confuson matrces for both approaches. The data suggest that naïve Bayes s based towards detecton of stego mages whle decson trees s more accurate for cover mages. VI. CONCLUSION A system that can classfy the mages nto mages wth no hdden message and steganographc mages usng classc pattern recognton technques such as Bayesan classfcaton and decson trees was desgned, developed and mplemented successfully. Experments were conducted on a large data set of mages to determne the classfcaton algorthm thatt performs better by comparng classfcaton success and error rates n each case. We have employed Weka, a data mnng tool developed n java for ths purpose. We have also developed an applcaton usng Weka Java lbrary for loadng the data of the Images and classfy the mages nto normal mages and steganographc mages. Ths applcaton runs a GUI (Graphcal User Interface) that enables the user to choose the classfer and other optons requred for the classfcaton. TABLE I. Correctly classfed Instances % % % % % % % % % TABLE II. Correctly classfed Instances % % % % % % % % % % Real Cover Real Stego 80.00% 60.00% 40.00% 20.00% 0.00% NAÏVE BAYES B RESULTS DECISION TREEE CLASSIFIER RESULTS Fgure 4. Average classfcaton results. TABLE III. Actual Predct Cover Correct TABLE IV. Negatve Postve Naïve Bayes Predct Stego 13.34% 86.66% 20.73% 79.27% Incorrect CONFUSION MATRIX Predcted Negatve Postve a b c Incorrectly classfed nstances % % % % % % % % % % Incorrectly classfed nstances % % % % % % % % % % CONFUSION MATRIX Steganography algorthms contnue to evolve and add new devatons such as ncreased encrypton strength, vared message length or random postonng of the data. At each step, steganalyss technques focused on a sngle approach become obsolete snce they cannot detect the new d Bayes Decson Tree Decson Tree Predct Cover Predct Stego 87.27% 12.73% 63.41% 36.59%

5 steganographc methods. Technques lke the one we provde are consdered blnd,.e. ndependent of the steganographcal approach, and hold the very exctng potental to transcend the current fragle nature of modern steganalyss. They allow the detecton that a fle has a hdden message, even f t s hdden usng a new, prevously unseen steganography algorthm snce some or the other alteratons are made by these algorthms after embeddng the data. Whle not hghly accurate, blnd steganalyss remans an rreplaceable tool n the chase wth recent steganography approaches. REFERENCES [1] Y. Wang and P. Mouln, Optmzed feature extracton for learnngbased mage steganalyss, IEEE Transactons on Informaton Forenscs and Securty, vol. 2, 2007, pp [2] X.Y. Luo, D.S. Wang, P. Wang, and F.L. Lu, A revew on blnd detecton for mage steganography, Sgnal Processng, [3] CryptoBola, CryptoBola, [4] J. Zhang, Y. Hu, and Z. Yuan, Detecton of LSB Matchng Steganography usng the Envelope of Hstogram, Journal of Computers, vol. 4, 2009, p [5] C. Zhou, J. Feng, and Y. Yang, Blnd Steganalyss Based on Features n Fractonal Fourer Transform Doman. [6] M. Wess, Prncples of Steganography. [7] M. Kharraz, H.T. Sencar, and N. Memon, Image steganography: Concepts and practce, Lecture Note Seres, Insttute for Mathematcal Scences, Natonal Unversty of Sngapore, [8] G. Berg, I. Davdson, M.Y. Duan, and G. Paul, Searchng for hdden messages: Automatc detecton of steganography, Proceedngs of the 15th Innovatve Applcatons of AI Conference, 2003, pp [9] M.D. Abramoff, P.J. Magalhaes, and S.J. Ram, Image processng wth ImageJ, Bophotoncs Internatonal, vol. 11, 2004, pp [10] I.H. Wtten, E. Frank, L. Trgg, M. Hall, G. Holmes, and S.J. Cunnngham, Weka: Practcal machne learnng tools and technques wth Java mplementatons, ICONIP/ANZIIS/ANNES, Cteseer, 1999, pp [11] S.B. Kotsants, Supervsed machne learnng: A revew of classfcaton technques, EDITORIAL BOARDS, PUBLISHING COUNCIL, vol. 31, 2007, pp [12] R. Caruana and A. Nculescu-Mzl, An emprcal comparson of supervsed learnng algorthms, Proceedngs of the 23rd nternatonal conference on Machne learnng, ACM, 2006, p [13] R.O. Duda, P.E. Hart, and D.G. Stork, Pattern classfcaton, Cteseer, [14] J.R. Qunlan, C4. 5: programs for machne learnng, Morgan Kaufmann, [15] J. Frdrch, M. Goljan, and D. Hogea, Steganalyss of JPEG mages: Breakng the F5 algorthm, Lecture notes n computer scence, 2003, pp [16] F. Provost, T. Fawcett, and R. Kohav, The case aganst accuracy estmaton for comparng nducton algorthms, Proceedngs of the Ffteenth Internatonal Conference on Machne Learnng, Cteseer, 1998, pp