Steganalysis of DCT-Embedding Based Adaptive Steganography and YASS

Steganalyss of DCT-Embeddng Based Adaptve Steganography and YASS Qngzhong Lu Department of Computer Sene Sam Houston State Unversty Huntsvlle, TX 77341, U.S.A. lu@shsu.edu ABSTRACT Reently well-desgned adaptve steganograph systems, nludng ±1 embeddng n the DCT doman wth optmzed osts to aheve the mnmal-dstorton [8], have posed serous hallenges to steganalyzers. Addtonally, although the steganalyss of Yet Another Steganograph Sheme (YASS) was atvely onduted, the deteton of the YASS steganograms by a large B-blok parameter has not been well explored. In ths paper, we am to detet the state-of-the-art adaptve steganograph system n DCT-embeddng and to mprove the steganalyss of YASS. To detet DCT-embeddng based adaptve steganography, we desgn the features of dfferental neghborng jont densty on the absolute array of DCT oeffents between the orgnal JPEG mages and the albrated versons. To dsrmnate YASS steganograms from overs, the anddate bloks that are possbly used for embeddng and the nonanddate blok neghbors that are mpossbly used for nformaton hdng are dentfed frst. The dfferene of the neghborng jont densty between anddate bloks and the nonanddate neghbors s obtaned. Support Vetor Mahne (SVM) and logst regresson lassfers are employed for lassfaton. Expermental results show that our approah s very promsng when detetng DCT-embeddng based adaptve steganography. Compared to the steganalyss based on CC-PEV feature set, our method greatly mproves the deteton auray; the advantage s espeally noteable n the deteton of the steganograms wth low relatve payload. In steganalyss of YASS, our approah s superor to a prevous well-known steganalyss algorthm; our method remarkably mproves the deteton auray espeally n the deteton of the YASS steganograms that are produed wth a large B-blok sze, whh was not well addressed before. Categores and Subjet Desrptors I 4.9 [Image Proessng and Compute r Vson]: Applatons; K.6.m [Msellaneous]: Insurane and Seurty. General Terms Algorthms and Seurty Keywords Steganography, steganalyss, adaptve steganography, YASS, Permsson to make dgtal or hard opes of all or part of ths work for personal or lassroom use s granted wthout fee provded that opes are not made or dstrbuted for proft or ommeral advantage and that opes bear ths note and the full taton on the frst page. To opy otherwse, or republsh, to post on servers or to redstrbute to lsts, requres pror spef permsson and/or a fee. MM&Se 11, September 29 30, 2011, Buffalo, New York, USA. Copyrght 2011 ACM 978-1-4503-0806-9/11/09...$10.00. DCT, JPEG, neghborng jont densty, logst regresson, SVM, CC-PEV. 1. INTRODUCTION Steganography ams to enable overt ommunaton by embeddng data nto dgtal fles and makng the hdden message nvsble. The potental of explotng steganography for overt dssemnaton s great: for example, a reent esponage ssue reveals that steganography has been used by governmental ntellgent ageny [1-3]. For several purposes, t s a heghtened need to realze effetve ountermeasures for steganography. In dgtal mages, to ths date, a few popular steganograph systems suh as LSB embeddng, LSB mathng [35, 41], spread spetrum steganography [34], Outguess [38], F5 [45], modelbased steganography [40], steghde [15], BCH syndrome ode based less detetable JPEG steganography [39], and reently welldesgned hghly undetetable steganography (HUGO) [37], have been suessfully steganalyzed [6, 10-14, 19, 20, 22, 24-26, 28, 33, 36, 42]. Although these remarkable advanes have been aheved, reently well-desgned steganograph systems, suh as Gbbs onstruton-based steganography [7], Syndrome-Trells Codes based steganography [9], have posed new hallenges for steganalyss. Fller and Frdrh reently presented a pratal framework of adaptve steganograph systems [8] by optmzng the parameters of addtve dstorton funtons and mnmzng the dstorton for ±1 embeddng n the DCT doman, whh greatly mproves the pror art of hdng data n wde-spread JPEG mages. The expermental results shown n [8] demonstrated DCTembeddng based adaptve system s undetetable, attaked by a prevous state-of-the-art steganalyss method, whle the relatve payload rato s less than 0.15 bpa. YASS was desgned to be a seure JPEG steganograph algorthm wth randomzed embeddng [43]. However, the loatons of the embeddng host bloks are not randomzed enough. The embeddng n YASS also ntrodues extra zero DCT oeffents nto the embeddng host bloks, and hene leaves a lue to be exposed L et al. presented a smple and effent deteton method by omparng the frequeny of zero oeffents of the embeddng host bloks and the neghborng bloks n DCT doman [23]. The deteton performane s very promsng whle the parameter of the bg blok (B-blok) sze s small (e.g., the sze s set to 9 and 10). However, the deteton performane apparently deterorates whle the parameter of B-blok sze nreases [23]. Reently, Kodovsky et al. desgned 1234 features to detet YASS and tested twelve dfferent onfguratons of YASS. In these twelve onfguratons, the parameter of B-blok sze s not larger than 11 [21]. However, the deteton. 77

performane on the YASS steganograms wth large parameter of B-blok sze (12, 13, 14, and 15) was mssng [21]. Amng to detet the state-of-the-art DCT-embeddng based adaptve steganography [8], we mprove a prevous JPEG steganalyss method [28]. We extrat the neghborng jont densty on the absolute array of DCT oeffents from the JPEG mage under examnaton, and we desgn a albrated algorthm to extrat the referene features; the dfferental features between the orgnal neghborng jont densty and the referene are alulated. Support Vetor Mahnes (SVM) [44] and logst regresson [16] lassfers are appled for lassfaton. Expermental results demonstrate promsng deteton performane of our approah. To mprove the deteton performane n steganalyss of YASS, we frst analyze the advantage and weakness of a prevous YASS deteton art presented n [23]. As ndated by L et al. [23], n YASS embeddng, the seleton of embeddng host blok s not random enough and the embeddng modfes the statsts of embeddng host bloks n DCT doman. However, ther deteton algorthm does not searh all possble anddate bloks that are possbly used for embeddng. Our study also fnds that the YASS embeddng not only nreases the zero oeffents of the host bloks, but t also modfes the neghborng jont densty of the DCT oeffents. Therefore, we desgn a new algorthm to mprove the deteton performane. The remander of the paper s organzed as follows: Seton 2 brefly ntrodues DCT-embeddng based adaptve steganography, YASS and a deteton art, and our prevous JPEG steganalyss method. Seton 3 presents our deteton method for steganalyss of DCT-embeddng based adaptve steganography, and seton 4 desrbes our approah to steganalyss of YASS. Seton 5 shows experments and analyss. Conlusons are made n seton 6. 2. BACKGROUND 2.1 DCT-embeddng based Adaptve Steganography Most steganograph systems am to mnmze the dstorton of orgnal over. In [8], a pratal framework for optmzng the parameters of addtve dstorton funtons to mnmze statstal detetablty was presented by defnng a rh parametr model. To realze DCT-embeddng based adaptve steganography, an nter/ntra-blok ost model was gven, as well as the performane of embeddng algorthms based on the nter/ntra-blok ost model when optmzed usng the L2-regularzed L2-loss (L2R_L2LOSS) rteron, attaked by a prevous state-of the art steganalyss method, whh was expermentally valdated as beng ompletely undetetable at low relatve payload [8]. In what follows, we brefly ntrodue ths pratal framework for DCTembeddng based adaptve steganography. Mnmal-dstorton steganography an be mplemented by mnmzng the followng ost funton where x, y n 1 D(x,y) x, y (1) s the ost hangng the th over pxel x to y. To desgn DCT-embeddng based adaptve steganography, an nter/ntra-blok ost model has been defned by Fller and Frdrh [8]. Let, 2 1 1 21 1 r a be the model parameters desrbng the ost of dsturbng nter- and ntra-blok dependenes wth r = ( r,,, r,, r, ) and a =( a,,, a,, a, ). The ost of hangng any AC DCT oeffents x j to y j s gven by za j xj 1, xj, xj 1 0 f y xj (2) j (x, y) ( y) f yj otherwse 2 2 a, xj z z r, xj z r Where, N a and N r are ntra- and nter-blok neghborhoods. Based on the nter/ntra-blok ost model, whle the embeddng algorthms are optmzed by usng the mult-layered Syndrome- Trells Codes [9] to mnmze the L2R_L2LOSS rteron [8], wth SVM and CC-PEV feature set [20], and Cross-Doman Feature set [21, 8], respetvely, the experments show that proposed DCT-embeddng based adaptve steganography has greatly mproved the state of DCT-embeddng based steganography. More tehnal detals may be referred to [8]. 2.2 YASS and A Prevous Deteton Algorthm The orgnal YASS algorthm, presented n [43], nludes the followng steps: 1) Repeat-Aumulate error orreton ode s used to enode the payload; 2) The over mage s dvded nto bg bloks of T T (T =9, 10,, 15), denoted by B-blok; 3) In eah B-blok, an 8 8 blok s randomly seleted for payload embeddng; 4) The embeddng nludes the followng operatons: a) Seleted 8 8 blok s transformed usng a two-dmensonal DCT; b) The DCT oeffents are dvded by a quantzaton table, orrespondng to the hdng qualty fator QF h ; ) By usng QIM, bnary hdden bts are embedded nto the 19 low-frequeny AC DCT oeffents whose values are non-zeros; d) The modfed 8 8 blok s transformed bak to spatal doman; 5) The modfed mage s enoded n JPEG format wth the advertsng qualty fator QF a. Although YASS embeddng s not onfned to the 8 8 blok of the fnal JPEG ompresson n above step 5), the loaton of embeddng blok n B-blok s not random enough. Meanwhle, the QIM-based embeddng ntrodues addtonal zero DCT oeffents n the modfed 8 8 blok, and hene, L et al. desgned the followng algorthm to break YASS [23]. L et al. feature extraton algorthm for YASS deteton [23] Transform a JPEG mage under examnaton to spatal doman, denoted by I 1 ; For T = 9 to 15 For s = 1 to T (a) Dvde I s nto non-overlappng onseutve T T B- bloks; (b) Collet 8 8 bloks from the upper left of all B-bloks and perform 2D DCT; 78

() Quantze the DCT oeffents by usng QF a ; (d) Compute the probablty of zero rounded re-quantzed DCT oeffents n anddate embeddng bands and denote t by Z T (s); (e) Crop the frst s olumns and the frst s rows of I 1 to generate a new mage I s+1 for the next nner-loop; End 1 7 Compute the values of T Z () 1 T and T 7 1 T Z ( ) j T 6 T j as features. 7 End As shown by the above algorthm, the features are extrated from the anddate bloks along the dagonal dreton of B- bloks, not from all possble 8 8 anddate bloks n B-bloks. In a T T B-blok, there are (T-7) (T-7) blok anddates for embeddng. Unfortunately, the above algorthm only selets the (T-7) bloks along dagonal dreton, not all (T-7) (T-7) anddate bloks. As a result, the hane of the anddates along dagonal dreton only hts 1/(T-7). Whle the value of T s large, the ht rato s pretty low. For nstane, T=15, the ht rato s only 1/8 = 0.125. The expermental results n the referene [23] also demonstrate that the deteton auray s not so good wth a large T value. 2.3 Neghborng Jont Densty based JPEG Steganalyss We have shown that nformaton-hdng n DCT doman generally modfes the neghborng jont densty [26, 28]. Aordngly, a JPEG-based steganalyss method based on neghborng jont densty was proposed, whh has been valdated to outperform Markov-proess based steganalyss that was orgnally presented n [6, 42]. Here we brefly ntrodue our pror deteton method. Our prevous study shows that ertan manpulatons suh as JPEG-based double ompresson, nformaton hdng, and resamplng, modfy the neghborng jont densty and leave a lue to reveal the operatons [26-29]. In general, neghborng jont densty of DCT oeffents s symmetr about the orgn. We desgned the neghborng jont densty features on the absolute array of DCT oeffents, desrbed as follows. 2.3.1 Neghborng Jont Densty on Intra-blok Let F denote the quantzed DCT oeffent array onsstng of M N bloks F j ( = 1, 2,, M; j = 1, 2,, N). The ntra-blok neghborng jont densty matrx on horzontal dreton absnj 1h and the matrx on vertal dreton absnj 1v are gven by: absnj ( x, y) 1v 1h absnj ( x, y) M N 8 7 1 j1 m1 n1 M N 7 8 1 j1 m1 n1 ( x, y) jmn 56MN jm( n1) ( x, y) jmn j( m1) n 56MN Where jmn s the DCT oeffent loated at the m th row and the n th olumn n the blok F j ; = 1 f ts arguments are satsfed, otherwse = 0; x and y are ntegers. For omputatonal effeny, we defne absnj 1 as the neghborng jont densty features on ntra-blok, alulated as follows: (3) (4) absnj ( x, y) absnj ( x, y) absnj ( x, y) /2 (5) 1 1h 1v In our pror deteton, the values of x and y are n the range [0, 5], and absnj 1 onssts of 36 features. 2.3.2 Neghborng Jont Densty on Inter-blok The nter-blok neghborng jont densty matrx on horzontal dreton absnj 2h and the matrx on vertal dreton absnj 2v are onstruted as follows: absnj 2h 2v ( x, y) absnj ( x, y) 8 8 M N1 m1 n1 1 j1 8 8 M1 N m1 n1 1 j1 ( x, y) jmn ( j1) mn 64 M( N 1) ( x, y) jmn ( 1) jmn 64( M 1) N We defne absnj 2 as the neghborng jont densty features on nter-blok, alulated as follows: absnj ( x, y) absnj ( x, y) absnj ( x, y) /2 (8) 2 2h 2v Smlarly, the values of x and y are n [0, 5] and absnj 2 has 36 features. 3. CALIBRATED NEIGHBORING JOINT DENSITY APPROACH TO STEGANALYSIS OF JPEG-BASED ADAPTIVE STEGANOGRAPHY Although DCT-embeddng based adaptve steganography ams to mnmze the dstorton ost through Syndrome-Trells Codes, we fnd that t does modfy the neghborng jont densty features proposed n referene [28], shown by Fgure 1. (a) JPEG over () Dfferene of NJ densty (b) JPEG steganogram (6) (7) (d) Dfferene of absnj densty Fgure 1. An example to demonstrate the modfaton of neghborng jont densty features by DCT-embeddng based adaptve steganography. 79

Fgure 1(a) and (b) show a JPEG over and the JPEG steganogram produed by usng DCT-embeddng based adaptve hdng algorthm [8] wth the hdng rato 0.4 bts per non-zero- AC (bpa). The over mage s downloaded from [4]. The adaptve hdng tool s avalable at [5]. Fgure 1() shows the dfferene of the ntra-blok based neghborng jont densty extrated from (a) and (b). Fgure 1(d) shows the dfferene of the neghborng jont densty on the absolute array of DCT oeffents, defned by equaton (5). Although the modfaton s small, the nformaton-hdng does modfy the neghborng jont densty. Consderng that the jont densty vares aross dfferent dgtal mages, to reflet the modfaton of the densty aused by the embeddng, based on a self-albraton approah that was presented n [11], we desgn a albrated neghborng jont densty, desrbed as follows: 1. The neghborng jont densty features absnj 1 (x,y) and absnj 2 (x,y), defned by equatons (5) and (8), are extrated from a JPEG mage under examnaton; 2. The testng JPEG mage s deoded n spatal doman, and ropped by rows and j olumns (0 <7, 0 j<7, and +j >0). The ropped mage s enoded n JPEG format wth the same quantzaton matrx, and the jont densty features, denoted by absnj 1,j (x,y) and absnj 2,j (x,y), are extrated from the ropped JPEG mages, here (, j) 0,1, 0,2,..., 1,0, 1,1,..., 7,7 ; 3. The mean values of absnj 1 and absnj 2 are alulated by 1 absnj 1 ( x, y) absnj1, j( x, y) 63 (9) (, j) 1 absnj 2 ( x, y) absnj2, j( x, y) 63 (10) (, j) 4. The dfferental jont densty features are gven by D 1 (, ) 1(, ) 1 (, ) (11) D 2 (, ) 2(, ) 2 (, ) (12) absnj x y absnj x y absnj x y absnj x y absnj x y absnj x y 5. The dfferental rato features are obtaned by D absnj (, ) 1 1 1 (, ) (, ) (13) D absnj (, ) 2 2 2 (, ) (, ) (14) R x y absnj x y absnj x y R x y absnj x y absnj x y The rato features are defned n equatons (13) and (14), denoted by dff-absnj-rato, and the features defned by equatons (9) to (12), denoted by ref-dff-absnj, are used to detet DCTembeddng based adaptve steganography. In our study to detet adaptve steganography, the nteger parameters x and y are set from 0 to 5, produng 36 features n (13) and 36 features n (14), so dff-absnj-rato ontans 72 features, and ref-dff-absnj ontans 144 features. 4. NEIGHBORING JOINT DESNITY BASED YASS-DETECTION ALGORITHM By searhng all possble 8 8 anddate bloks n B-bloks, we extrat the neghborng jont densty of the DCT oeffents from all anddate bloks and the 8 8 blok neghbors that mpossbly belong to the anddate set for nformaton hdng, and alulate the dfferene of the jont densty values of the anddates and the non-anddate neghbors. Our algorthm of feature desgn to detet YASS steganogram s desrbed as follows: 1. Deode an nput JPEG mage under srutny to spatal doman, and dvde t nto non-overlappng onseutve T T B-bloks (T = 9, 10,, 15); 2. In eah T T B-blok, searh all 8 8 bloks possbly used for nformaton hdng, total (T-7) 2 anddate bloks. The set of all anddate bloks of the mage under deteton s denoted by C. For eah anddate blok C() (=1,2,, n), subtrat 128 from eah pxel value, then apply two-dmensonal DCT transform, quantze the DCT oeffents by usng the quantzaton matrx orrespondng to QF a and obtan the absolute DCT oeffent array. The neghborng jont densty features, defned by equaton (5), are extrated from the absolute DCT oeffent array, denoted by absnj(; x,y). 3. From all adjaent 8 8 bloks to the anddate blok C() n the horzontal or vertal dreton but wthout any overlappng to C(), denoted by N(), we dentfy the adjaent 8 8 bloks that do not belong to C, the set of anddate bloks for YASS embeddng. The non-anddate blok neghbors are denoted by NC(). The neghborng jont densty defned by equaton (5) are extrated from these non-anddate neghborng bloks, and the average neghborng jont densty s denoted by avg_nc_absnj(; x, y), the dfferene of the jont densty from the anddate blok C() and the average neghborng jont densty s gven by dff_absnj(; x, y) = absnj(; x, y)-avg_nc_absnj(; x, y) (15) 4. The total number of anddate bloks s n. The mean values of the dfferental jont densty, whh are the features for YASS steganalyss n our algorthm, are gven by the followng dff_absnj(x,y) = dff_ absnj ; x, y n (16) It should be noted that n a T T B-blok, whh s not on the boundary of the mage under examnaton, f an 8 8 blok anddate s loated (a) nsde of the B-blok, t has four non-anddate neghbors, shown by Fgure 2(a); (b) on one of the four boundary borders of the B-blok but not on any orner, t has three non-anddate neghbors, shown by Fgure 2(b); () on one of the four orners of the B-blok, t has two nonanddate neghbors, shown by Fgure 2(); Fgures 2 (a), (b), and () llustrate the above senaros. The square n dash stands for a B-blok, a omplete blok n the B- blok represents a anddate blok for possble hdng and the non-anddate blok neghbors are aross the square. In our YASS deteton, the values of x and y are set n [0, 2] and dff_absnj ontans 9 features, orrespondng to eah value of T. We expet that the dff_absnj features extrated from overs are approxmately zero-valued, but the values of the features from YASS steganograms are not onstraned to zeros. Fgure 3 valdates our onjeture and mples the effetveness of our proposed features. (a) (b) () Fgure 2. A anddate blok s loated n a B-blok (dashed) and the non-anddate neghbors are aross two B-bloks. 80

(a) YASS steganogram (T=9) () YASS steganogram (T=10) (b) dff_absnj features of the over and the left YASS stego-mage (T = 9) (d) dff_absnj features of the over and the left YASS stego-mage (T = 10) steganograms. A logst regresson lassfer [16, 32] and Support Vetor Mahnes (SVM) [42], are used for the deteton. In eah experment, 50% samples are randomly seleted for tranng, and the other 50% samples are used for testng. In eah experment, the testng results an be dvded nto True Negatve (TN), False Negatve (FN), False Postve (FP), and True Postve (TP). Wthout losng a generalty, we measure the deteton auray by 0.5*TN/(TN+FP)+0.5*TP/(TP+FN). To ompare the deteton performane, two hundred experments are operated for eah feature set at eah hdng rato by usng eah lassfer, and the mean deteton auray over 200 experments s obtaned. In the applaton of SVM, we partularly adopt two popular SVM algorthms, LbSVM [46] and SVM_lght [17], and we ompare the deteton performane of these two SVM mplementaton algorthms wth lnear, polynomal, and radal bass funton (RBF) kernels. On average, n our experments, a lnear LbSVM hts the hghest deteton auray. 5.1.2 Expermental Results Table 1 lsts the mean values of deteton auray on testng feature sets over two hundred experments by usng the 72- dmensonal dff-absnj-rato feature set, 144-dmensonal ref-dffabsnj feature set, and 548-dmensonal CC-PEV feature set wth lnear LbSVM and logst regresson (denoted by LogtReg) lassfer. The expermental results show that the dff-absnj-rato and ref-dff-absnj feature sets outperform CC-PEV feature set regardng deteton auray. Espeally at the relatve payload parameter of 0.1 bpa and 0.15 bpa, dff-absnj-rato and ref-dffabsnj feature sets mprove the deteton auray by about 15~20%, ether usng SVM or usng logst regresson lassfer. Table 1. Average deteton auray (%) over 200 experments at dfferent hdng ratos (measured by relatve payload, bpa), by applyng SVM and logst regresson lassfer to 548-dm CC- PEV, 72-dm dff-absnj-rato, and 144-dm ref-dff-absnj. (e) YASS steganogram (T=15) (f) dff_absnj features of the over and the left YASS stego-mage (T = 15) Fgure 3. Modfaton of the dff-absnj features by YASS embeddng (QF h = QF a = 75) wth B-blok sze T=9, 10, and 15, wheren the feature ndes from 1, 2,, to 9 orrespond to the (x, y) pars n equaton (16) from (0, 0), (0, 1),, to (2,2). 5. EXPERIMENTS 5.1 Steganalyss of DCT-Embeddng based Adaptve Steganography 5.1.1 Setup 1000 BOSSRank over mages downloaded from [4] are frst onverted nto JPEG mages wth the qualty fator 75. The JPEG-based adaptve steganograms are produed by usng the DCT-embeddng based hdng tool [5], and the parameter of hdng bts per non-zero-ac (bpa) s set from 0.1 to 0.4 wth the step of 0.05 bpa. We extrat 72-dmensonal rato features, defned by (13) and (14), or dff-absnj-rato, and 144- dmensonal features, or ref-dff-absnj, from the JPEG overs and the adaptve steganograms. To ompare our feature sets and a reently well-desgned feature set, CC-PEV [20, 36], we also extrat the 548-dmensonal CC-PEV features from the overs and bpa CC-PEV dff-absnj-rato ref-dff-absnj SVM LogtReg SVM Logt Reg SVM LogtReg 0.1 57.7 58.0 76.8 76.7 77.2 74.6 0.15 67.7 70.0 88.5 88.3 89.3 85.5 0.2 76.9 79.6 94.2 92.8 94.8 91.9 0.25 84.8 88.3 97.4 96.9 97.5 97.0 0.3 88.9 92.5 98.8 98.3 98.7 98.3 0.35 94.2 96.0 99.6 99.2 99.5 99.1 0.4 96.9 98.0 99.8 99.4 99.7 99.3 Addtonally, the mean and the standard devaton (STD) values of true negatve rate (TNR) and true postve rate (TPR) over 200 experments are gven by Fgure 4. Whle we onsder the mean deteton auray wth the standard devaton together, n deteton of the steganograms at low relatve payload, ether usng SVM or logst regresson lassfer, the deteton auray wth CC-PEV s not mpressve, but the orrespondng standard devaton are pretty hgh, whh means that the deteton performane by usng CC-PEV s very unstable aross dfferent experments. It also lams the undetetabllty of DCTembeddng based adaptve steganography aganst CC-PEV feature set. In omparson to CC-PEV, our feature sets demonstrate the superorty, ether n terms of deteton auray or the deteton stablty aross dfferent experments. 81

(a) Mean TNR wth LbSVM (b) Mean TPR wth LbSVM () Mean TNR wth LogtReg (d) Mean TPR wth LogtReg (e) Std(TNR) wth LbSVM (f) Std(TPR) wth LbSVM (g) Std(TNR) wth LogtReg (h) Std(TPR) wth LogtReg Fgure 4. The mean and standard devaton of true negatve rate (TNR) and true postve rate (TPR) by applyng LbSVM and logst regresson to dff-absnj-rato, ref-dff-absnj, and CC-PEV feature sets. 5.2 Steganalyss of YASS 5.2.1 Setup Smlarly, the orgnal 1000 BOSSRank over mages downloaded from [4] are used for YASS embeddng. We set QF h = QF a = 75 and QF h = QF a = 50 respetvely. Aordngly, we enode the 1000 BOSSRank over mages n JPEG format at the qualty fator of 75 and 50 respetvely, whh are used as JPEG overs. In reaton of YASS steganograms, QF h and QF a are set to the same quantzaton fator n order to avod double JPEG ompresson, beause the YASS steganograms ould be deteted by usng the deteton method to expose double JPEG ompresson. In our experments, the embeddng parameter T of B-blok sze s set from 9 to 15. To ondut a omparatve study, we extrat the dff_absnj features defned n (16), and the zero-valued probablty features presented by L et al. [23]. A lnear LbSVM and logst regresson lassfer are used for lassfaton (smlar to the steganalyss of DCT-embeddng based adaptve steganography, we ompared LbSVM and SVM_lght wth lnear, polynomal and RBF kernels and fnally seleted LbSVM wth lnear kernel n these experments). In eah experment, 50% samples are randomly seleted for tranng, and the other 50% samples are used for testng; 200 experments are operated for eah feature set at eah B-blok sze by usng eah learnng lassfer. 5.2.2 Expermental Results The mean value and standard devaton of the deteton auray on testng feature sets over 200 experments are lsted n Tables 2 and 3. The deteton auray on testng set s alulated by the half of the sum of true postve rate and true negatve rate, or 0.5*TP/(TP+FN)+0.5*TN/(TN+FN). Expermental results show that the deteton method presented n [23] delvers good performane n deteton of the YASS steganograms that are produed wth small B-blok sze (e.g., T = 9, the deteton auray s over 99%). However, the deteton performane apparently deterorates whle the parameter of B- blok sze nreases (e.g., T = 15, ether usng SVM or logst regresson lassfer, the deteton auray s less than 70%). As a omparson, our method performs well ether n small or large parameter of B-blok sze, usng SVM or logst regresson lassfer. Whle T=9, 10, and 11 n the ase QF h = QF a = 75, and T=9, 10, 11, 12, and 13, n the ase QF h = QF a = 50, all deteton auray values obtaned by our approah are over 99%; whle T= 15, our approah hts the deteton auray over 90% for QF h = QF a = 75, and 95% for QF h = QF a = 50, ether usng SVM or logst regresson lassfer. The standard devaton values by usng the dff_absnj feature set are smaller than the values obtaned by ompared method, whh mples that our method s more stable than the ompared method. In summary, the expermental results shown by tables 2 and 3 ndate that our method s more effetve and relable ompared to the pror deteton art based on zero-valued DCT densty feature set. Table 2. The average deteton auray ± standard devaton (%) over 200 experments wth dff_absnj and zero-valued DCT densty feature set [23], usng LbSVM and LogtReg for the deteton of YASS steganograms (QF h = QF a = 75) T Dff_absNJ Zero-valued DCT densty SVM LogtReg SVM LogtReg 9 99.9±0.1 99.9±0.1 99.8±0.3 99.9±0.6 10 99.8±0.1 99.8±0.1 99.0±0.4 99.1±0.5 11 99.0±0.3 99.2±0.4 93.6±2.3 97.5±0.6 12 98.2±0.4 98.4±0.3 74.3±3.9 94.3±0.7 13 96.7±0.6 97.0±0.4 61.7±2.1 86.4±1.0 14 94.7±0.6 95.1±0.6 53.2±4.0 76.8±1.0 15 90.8±0.8 91.0±0.7 48.2±1.5 69.8±1.2 82

Table 3. The average deteton auray ± standard devaton (%) over 200 experments wth dff_absnj and zero-valued DCT densty feature set [23], usng LbSVM and LogtReg for the deteton of YASS steganograms (QF h = QF a = 50) T Dff_absNJ Zero-valued DCT densty SVM LogtReg SVM LogtReg 9 99.7±0.2 99.6±0.3 99.8±0.3 99.9±0.5 10 99.8±0.2 99.9±0.1 99.3±0.4 99.0±0.7 11 99.7±0.2 99.8±0.2 99.3±0.5 97.6±0.5 12 99.5±0.2 99.3±0.3 92.6±1.3 94.3±0.9 13 99.1±0.3 99.3±0.4 88.2±3.4 86.3±0.9 14 97.9±0.4 97.9±0.4 73.0±3.9 76.9±1.0 15 95.0±0.8 95.0±0.5 62.2±2.4 69.6±1.1 5.3 Dsusson In steganalyss of DCT-embeddng based adaptve steganography, to obtan the albrated neghborng jont densty features, the JPEG mage under srutny s ropped 63 tmes ndvdually wth the shftng from (0, 1) to (7,7), the neghborng jont densty features are extrated from these 63 ropped versons, and the mean values of the features are used as albrated features. Compared to the albraton that only takes one-roppng (e.g., only shftng by 4 rows and 4 olumns), the omputaton ost s relatvely hgh. However, the albrated neghborng jont densty obtaned by 63-roppng s generally loser to the neghborng jont densty of orgnal over, shown by Fgure 5, wheren the mean absolute values of the dfferene of the neghborng jont densty between 1000 overs and the albrated versons are gven. Fgure 6 plots the mean values of the relatve dfferene on the 1000 overs and the albrated versons. Relatve dfferene s absnj x, y absnj x, y absnj x, y alulated by wheren absnj x,y and absnj x, y stand for the neghborng jont densty from un-albrated mage and from the albrated verson respetvely. Beause DCT-embeddng based adaptve steganography has been well desgned to reman orgnal statstal property through Syndrome-Trells Codes and mnmze the dstorton ost, the dfferenes of the features from a over and from the steganogram are very small; n suh ase, f the albrated features are loser to those from orgnal over, t s better to mprove the deteton auray. Our experments show that f we only take one-roppng (ropped by 4 rows and 4 olumns) to obtan albrated features, ompared to the deteton by 63-tmes-roppng, the deteton auray dereases by about 6% n detetng the steganograms at relatve payload 0.1 bpa. It s worth notng that 63-tmes-roppng s not only useful to produe albrated features, but also very effetve to expose msalgned-roppng and reompresson-based forgery n JPEG mages. We have desgned shft-reompresson-based forgery deteton, whh s very promsng to reveal the relevant forgery manpulatons n JPEG mages [31]. Fgure 5. A omparson of the dfferene of neghborng jont densty between one-roppng and 63-tmes-roppng. Fgure 6. A omparson of the relatve dfferene of neghborng jont densty between one-roppng and 63-tmes-roppng. 83

In steganalyss of YASS, although L et al ndated that the weakness of the YASS steganograph system, ther deteton algorthm does not searh all anddate host bloks that are possbly used for nformaton hdng, and the deteton performane s not so well whle the B-blok sze s large. By searhng all possble anddate bloks and omparng the neghborng jont densty of these anddate bloks and the nonanddate neghborng bloks, we have greatly mproved the deteton performane. We should menton that n YASS embeddng, f the embeddng postons of bnary hdden bts are not lmted nto the 19 low-frequeny AC DCT oeffents (e.g., the AC DCT oeffents are randomly seleted for embeddng), our approah s stll effetve for the deteton, beause our feature extraton s not lmted to the poston of 19 lowfrequeny AC oeffents. In the orgnal YASS embeddng algorthm, the upper-left of the frst B-blok s overlapped wth the upper-left of the frst 8 8 blok. If the frst B-blok randomly s msplaed from the upperleft pont of the frst 8 8 blok, we an searh all possblty of msmathng. There are 64 ombnatons nludng the orgnal exat mathng, aordngly we an retreve the dff_absnj features n eah msmathng, n order to detet suh polymorphsm of YASS steganograph system. In addton to SVM and logst regresson lassfer [32], other learnng lassfers, suh as evolvng neuro-fuzzy nferene system [18] and ensemble lassfer have been appled to steganalyss [12-14, 22, 24]. In terms of both deteton auray and omputaton ost, logst regresson s one good opton. The expermental results also demonstrate that the deteton auray under low ompresson qualty QF h = QF a = 50 s generally hgher than the deteton auray under hgh ompresson qualty QF h = QF a = 75. From our standpont, the low ompresson qualty fator takes large quantzaton steps durng JPEG ompresson to obtan quantzed DCT oeffents, and hene produes a smaller magntude of quantzed DCT oeffents. The hane of the modfaton to these small magntude quantzed DCT oeffents by YASS QIM embeddng aordngly nreases, and the amount of relatve modfaton nreases. As a result, the deteton auray on the YASS steganograms that are produed at low qualty s generally hgher than the results on the hgh qualty fator. To desgn undetetable steganography n JPEG mages, based on the relatonshp between mage omplexty and deteton performane [24, 25], and our pror study of JPEG steganalyss [28], we have desgned a JPEG-based statstally nvsble steganography by ±1 embeddng n the large magntude of quantzed DCT oeffents n the 8 8 bloks wth omplated texture, whh s smple and straghtforward [30]. By ombnng ths method wth the methodology of adaptve steganography [8], we surmse that the steganograph system of beng hghly undetetable an be desgned n DCT doman. 6. CONCLUSIONS In ths paper, we propose an mproved approah based on neghborng jont densty to detet a well-desgned adaptve steganography n DCT doman, whh has greatly mproved earler DCT-embeddng arts. We also propose a new approah to steganalyss of YASS, by omparng the neghborng jont densty of all anddate host bloks that are possbly used for data embeddng and the non-anddate neghborng bloks. Support vetor mahne and logst regresson lassfers are employed for lassfaton Experments show that, n steganalyss of DCT-embeddng based adaptve steganography, our approah has ganed onsderable good deteton performane ompared to a prevous state-of-the art JPEG steganalyss; the advantage of our approah s espeally noteable when detetng the steganograms at low payload embeddng. In steganalyss of YASS, our method has sgnfantly mproved a prevous deteton method, espeally n the deteton of YASS steganograms that are produed by adoptng a large B-blok sze, whh was not well addressed before. 7. ACKNOWLEDGMENTS Ths projet was supported by Award No. 2010-DN-BX-K223 awarded by the Natonal Insttute of Juste, Offe of Juste Programs, U. S. Department of Juste. The opnons, fndngs, and onlusons or reommendatons expressed n ths publaton/program/exhbton are those of the authors and do not neessarly reflet those of the Department of Juste. Part of the support for ths study from a 2011 Sam Houston State Unversty (SHSU) Researh Enhanement grant s also greatly appreated. We are grateful to Dr. Bn L for provdng us ther feature extraton ode and to anonymous revewers for ther nsghtful omments and suggestons to mprove our work. In addton to BOSSRank mages [4], the hdng tool of DCT-embeddng based adaptve steganography [5], the ode to extrat CC-PEV features [47], MATLABArsenal [48] and PRtools [49] are used n ths study. We are truly grateful to these authors and provders. Speal thanks go to Mrs. Sharla Mles and Mrs. Dela Gallnaro at SHSU for ther proofreadng. 8. REFERENCES [1] http://www.msnb.msn.om/d/38028696/ns/tehnology_and _sene-sene/ [2] http://www.juste.gov/opa/douments/062810omplant1.pdf [3] http://www.juste.gov/opa/douments/062810omplant2.pdf [4] http://www.agents.z/boss/bossfnal/ndex.php?mode=vie W&tmpl=materals [5] http://dde.bnghamton.edu/download/stego_desgn/ [6] Chen C and Sh Y (2008). JPEG mage steganalyss utlzng both ntrablok and nterblok orrelatons. Pro. 2008 IEEE Internatonal Symposum on Cruts and Systems, pp. 3029 3032. [7] Fller T and Frdrh J (2010). Gbbs onstruton n steganography. IEEE Trans. on Info. Forenss and Seurty, 5(4): 705-720. [8] Fller T and Frdrh J (2011). Desgn of adaptve steganograph shemes for dgtal mages. Pro. SPIE, Eletron Imagng, Meda Watermarkng, Seurty, and Forenss XIII, San Franso, CA, January 23-26, 2011. [9] Fller T, Judas J and Frdrh J (2011). Mnmzng addtve dstorton n steganography usng syndrome-trells odes. IEEE Trans. on Info. Forenss and Seurty, to appear. [10] Frdrh J, Goljan M and Hogeam D (2002). Steganalyss of JPEG mages: breakng the F5 algorthm. Pro. of 5 th Informaton Hdng Workshop, pp. 310-323. [11] Frdrh J (2004). Feature-based steganalyss for JPEG mages and ts mplatons for future desgn of steganograph shemes. LNCS, 3200, pp.67-81. 84

[12] Frdrh J, Kodovsky J, Holub V and Goljan M (2011). Breakng HUGO the proess dsovery. In Pro. 13th Informaton Hdng Workshop, Prague, Czeh Republ, May 18 20, 2011. [13] Frdrh J, Kodovsky J, Holub V and Goljan M (2011). Steganalyss of ontent-adaptve steganography n spatal doman. In Pro. 13th Informaton Hdng Workshop, Prague, Czeh Republ, May 18 20, 2011. [14] Gul G and Kurugollu F (2011). A new methodology n steganalyss: breakng hghly undetetable steganography (HUGO). In Pro. 13th Informaton Hdng Workshop, Prague, Czeh Republ, May 18 20, 2011. [15] Hetzl S and Mutzel P (2005). A graph-theoret approah to steganography. LNCS, 3677, pp. 119 128. [16] Hlbe, JM (2009). Logst Regresson Models. Chapman & Hall/CRC Press. ISBN 978-1-4200-7575-5. [17] Joahms T (2000). Estmatng the generalzaton performane of a SVM effently. Pro. of the Internatonal Conferene on Mahne Learnng, Morgan Kaufman, 2000. SVM_lght s avalable at http://svmlght.joahms.org/ [18] Kasabov NK and Song Q (2002). DENFIS: dynam evolvng neural-fuzzy nferene system and ts applaton for tme-seres predton. IEEE Transatons on Fuzzy Systems, 10(2): 144-154. [19] Ker A (2005). Improved deteton of LSB steganography n graysale mages. LNCS, 3200, pp. 97 115. [20] Kodovsky J and Frdrh J (2009). Calbraton revsted. Proeedngs of the 11th ACM Multmeda and Seurty Workshop, Prneton, NJ, September 7-8, 2009. [21] Kodovsky J, Pevny T and Frdrh J (2010). Modern steganalyss an detet YASS, Pro. SPIE, Eletron Imagng, Meda Forenss and Seurty XII, San Jose, CA, January 17 21, pp. 02-01 - 02-11, 2010. [22] Kodovsky J and Frdrh J (2011). Steganalyss n hgh dmensons: fusng lassfers bult on random subspaes. Pro. SPIE 7880, 78800L (2011); do:10.1117/12.872279 [23] L B, Sh Y and Huang J (2009). Steganalyss of YASS. IEEE Trans. Informaton Forenss and Seurty, 4(3):369-382. [24] Lu Q, Sung AH, Chen H and Xu J (2008). Feature mnng and pattern lassfaton for steganalyss of LSB mathng steganography n graysale mages. Pattern Reognton, 41(1): 56-66. [25] Lu Q, Sung AH, Rbero BM, We M, Chen Z and Xu J (2008). Image omplexty and feature mnng for steganalyss of least sgnfant bt mathng steganography. Informaton Senes, 178(1): 21-36. [26] Lu Q, Sung AH and Qao M (2009). Improved deteton and evaluaton for JPEG steganalyss. Pro. 17 th ACM Multmeda, pp. 873-876. [27] Lu Q and Sung AH (2009). A new approah for JPEG resze and mage splng deteton. Pro. ACM Multmeda Workshop on Multmeda n Forenss 2009, pp. 43-47. [28] Lu Q, Sung AH and Qao M (2011). Neghborng jont densty-based JPEG steganalyss. ACM Trans. on Intellgent Systems and Tehnology, 2(2): artle 16. [29] Lu Q, Sung AH and Qao M (2011). A method to detet JPEG-based double ompresson. In Pro. of 8 th Internatonal Symposum on Neural Networks (2), pages 466-476. [30] Lu Q, Sung AH, Chen Z and Huang X (2011). A JPEGbased statstally nvsble steganography. In Pro of 3 rd ACM Internatonal Conferene on Internet Multmeda Computng and Serve, August 5-7, 2011, Chengdu, Chna. [31] Lu Q. Deteton of msalgned roppng and reompresson wth the same quantzaton matrx and relevant forgery, ACM Workshop on Multmeda n Forenss and Intellgene 2011. Under revew. [32] Lubenko I and Ker AD (2011). Steganalyss usng logst regresson. In Pro. SPIE 7880, 78800K (2011); do:10.1117/12.872245 [33] Lyu S and Fard H (2005). How realst s photorealst. IEEE Trans. on Sgnal Proessng, 53(2): 845-850. [34] Marvel L, Bonelet C and Retter C (1999). Spread spetrum mage steganography. IEEE Trans. Image Proessng, 8(8): 1075-1083. [35] Melkanen J (2006). LSB mathng revsted. IEEE Sgnal Proessng Letters 13(5):285-287. [36] Pevny T and Frdrh J (2007). Mergng Markov and DCT features for mult-lass JPEG steganalyss. Pro. SPIE, Vol. 6505, 650503, 2007; DOI:10.1117/12.696774. [37] Pevny T, Fller T and Bas P (2010). Usng hgh-dmensonal mage models to perform hghly undetetable steganography, Pro. 12 th Informaton Hdng, Calgary, Alberta, Canada, June 28-30, 2010. [38] Provos N (2001). Defendng aganst statstal steganalyss. Pro. 10 th USENIX Seurty Symposum, vol.10, pp. 323-335. [39] Sahnev V, Km HJ and Zhang R (2009). Less detetable JPEG steganography method based on heurst optmzaton and BCH syndrome ode. In: Proeedngs of the 11 th ACM Multmeda & Seurty Workshop. Pp. 131-140. [40] Sallee P (2004). Model based steganography. LNCS, 2939, pp. 154 167. [41] Sharp T (2001). An mplementaton of key-based dgtal sgnal steganography. LNCS, 2137, pp.13 26, 2001. [42] Sh Y, Chen C and Chen W (2007). A Markov proess based approah to effetve attakng JPEG steganography. LNCS, 4437, pp. 249-264. [43] Solank K, Sarkar A and Manjunath B (2007). YASS: Yet another steganograph sheme that ressts blnd steganalyss. LNCS, 4567, pp. 16-31. [44] Vapnk V (1998), Statstal Learnng Theory, John Wley. [45] Westfeld A (2001). Hgh apaty despte better steganalyss (F5 a steganograph algorthm). LNCS 2137, pp. 289 302. [46] http://www.se.ntu.edu.tw/~jln/lbsvm/ [47] http://dde.bnghamton.edu/download/merged/ [48] http://www.nformeda.s.mu.edu/yanrong/matlabarsen al/matlabarsenal.htm [49] http://www.prtools.org 85