2628 JOURNAL OF SOFTWARE, VOL. 8, NO. 10, OCTOBER 2013 Detectng P3Stego usng Calbrated Sde Informaton Features Xanmn Yu School of Informaton Scence and Engneerng, Nngbo Unversty Emal: mlhappy1016@163.com Rangdng Wang and Dqun Yan School of Informaton Scence and Engneerng, Nngbo Unversty Emal: {wangrangdng@nbu.edu.cn, yandqun@nbu.edu.cn} Abstract P3Stego s a typcal steganographc tool for P3 audo, whch embeds secret message nto P3 audo accordng to the party of the block length. In ths work, we present a steganalytc method to attack P3Stego. The bg_values nsde nformaton s consdered to extract the steganalytc feature. Re-compresson calbraton has been appled n order to mprove the feature's senstvty. Expermental results show that the extracted feature can reflect the P3Stego trace effectvely. Index Terms steganalyss, P3, bg_values, calbraton I. INTRODUCTION Steganography s the art of hdng the present of communcaton by embeddng secret messages nto nnocent lookng covers, such as dgtal mages, vdeos, and audos [1]. Its am s to avod drawng suspcon to the transmsson of hdden nformaton. Steganalyss s the art of detectng secret messages hdden usng steganography [2]. The goal of steganalyss s to reveal the presence of embedded message and to break the covert communcaton. P3, as a standard for transmsson and storage of compressed audo, s a promsng carrer format for steganography. Frst, P3 s the most popular and wdely used audo fle format. When audos n P3 format are taken as cover sgnals, the stego-audos wll be less lkely to be notced by steganalyzers than other audo formats. Also, t s a challenge for steganalyzers to dstngush whether the dstorton s caused by stego operaton or by P3 encodng snce P3 s a lossy compresson algorthm. For these reasons, P3 audo s easly to be chosen as carrer for steganography and hence the competton between P3 steganography and P3 steganalyss has escalated over the past few years. Several stego tools for P3 audos have been arsen, such as P3Stego [3], UnderP3Cover [4], P3Stegz [5], and Stego-Lame [6]. In the early works of our group members, we also have proposed two novel steganographc methods for P3 audos [7, 8]. As far as P3 steganography tools are concerned, P3Stego s the most typcal one. In P3Stego, wth the beneft of the dstorton adjustment mechansm of the P3 codec, the sum of the dstorton caused by quantzaton and P3Stego s effectvely controlled below the maskng threshold whch s the mnmum sound level that human can perceve. Once the cover audo s unavalable, t s hard to dstngush whether the test audo has been operated by P3Stego or not. In order to defeat P3Stego, some steganalytc methods have been proposed n recent years. Snce P3Stego changes the behavor of quantzaton n P3 encodng, Westfeld [9, 10] proposed an attack method based on the varance of the block length whch s a parameter related to quantzaton. Smlarly, Dttmann [11, 12] consdered that there would be more dfferent block lengths after P3Stego embeddng. Hence, the number of dfferent block lengths s taken as a steganalytc feature n ther method. However, the performance of ths method can be stll mproved especally at low embeddng rates. Qao [13] ntroduced a detecton method based on an nter-frame feature set whch contans the moment statstcal features on the second dervatves, as well as arkov transton features and neghborng jont densty of DCT coeffcents. In hs another work [14], the statstcal moments of GGD (Generalzed Gaussan Dstrbuton) shape parameters for DCT coeffcents are also taken as the steganalytc features. Ozer et al. [15, 16] presented a method for detectng audo steganography based on audo qualty metrcs. Although ths method can expose the presence of P3Stego, relatvely hgh false postve rate s one of the lmtatons. Addtonally, the dmensonalty of the feature space s the man nconvenence of Qao s and Ozer s methods. Generally, the steganalytc detector wll be more straghtforward and effectve f the features can be extracted drectly from the poston where the steganography takes place. Snce P3Stego happens durng quantzaton, more attentons should be pad to the parameters assocated wth the quantzaton. In ths work, the bg_values whch represents the number of quantzed DCT (QDCT) coeffcents n Bg_value regon s ntroduced nto steganalyss to attack P3Stego. In order to weaken the nfluence of the audo content and expose the stego nose, the calbrated feature s extracted by recompresson. The results demonstrate that the proposed do:10.4304/jsw.8.10.2628-2636
JOURNAL OF SOFTWARE, VOL. 8, NO. 10, OCTOBER 2013 2629 method can acheve a good dscrmnatory ablty for P3Stego. The rest of ths paper s organzed as follows. Secton II brefly covers the basc operatons of the P3Stego algorthm. Secton III presents the proposed method. The effectveness of the proposed method under varous condtons wth expermental results s verfed n Secton IV. Fnally, conclusons are drawn n Secton V. II. BACKGROUND In ths secton, the prncple of P3 compresson s frst revewed n order to better understand P3Stego and then the P3Stego steganography algorthm are analyzed. A. Prncple of P3 Compresson Pulse Code odulaton (PC) s a standard format for storng or transmttng uncompressed dgtal audo. There are two parameters for PC: sample rate Hz and bt-rate Bt. The sample rate descrbes how many samples per second, and the bt-rate descrbes how bg the dgtal word s that wll hold the sample value. PEG-1 Audo Layer 3, or P3, s an audo-specfc format that was desgned by the ovng Pcture Experts Group as part of ts PEG-1 standard [17]. The lossy compresson algorthm of P3 s desgned to greatly reduce the amount of data requred to represent the audo recordng wth a fathful reproducton of the orgnal uncompressed audo for most lsteners. Fg.1 llustrates the entre P3 encodng, whch conssts of the followng steps [18]: Fgure 1. Block dagram of P3 encodng (1) Through a polyphase flter analyss, a sequence of 1152 PC samples are fltered nto 32 equally spaced frequency sub-bands dependng of the Nyqust frequency of the PC sgnal. If the sample frequency of the PC sgnal s 44.1 khz, the Nyqust frequency wll be 22.05 khz. Each sub-band wll be approxmately 22050/32 = 689Hz wde. The lowest sub-band wll have a range from 0 to 689Hz, the next sub-band 689-1378Hz, etc. (2) By applyng a modfed dscrete cosne transform (DCT) to each tme frame of sub-band samples, the 32 sub-bands wll be splt nto 18 fner sub-bands creatng a granule wth a total of 576 frequency lnes. To reduce artfacts caused by the edges of the tme-lmted sgnal segment, each sub-band sgnal has to be wndowed pror to the DCT. If the sub-band sgnal at the present tme frame shows lttle dfference from the prevous tme frame, then the long wndow type s appled, whch enhance the spectral resoluton gven by the DCT. Alternatvely, f the sub-band sgnal shows consderable dfference from the prevous tme frame, then the short wndow s appled, whch enhance the temporal resoluton. (3) Smultaneously, the sgnal s also transformed to the frequency doman by a Fast Fourer Transform as the sgnal s processed by the polyphase flterbank, to obtan hgher frequency resoluton and nformaton on the spectral changes over tme. (4) Psychoacoustc model retreves the frequency nformaton from the FFT output and provdes nformaton about whch parts of the audo sgnals that s audble and whch parts are not. The two presently FFT spectra and the two prevous spectra are compared. If consderable dfferences are found, a request of adoptng short wndows wll be sent to the DCT block. As soon as the dfference fades away, the DCT block wll be changed back to long wndows. At the same tme, the Psychoacoustc model detects the domnant tonal components and for each crtcal band maskng thresholds are calculated. Frequency components below the thresholds are masked out. (5) The scalng and quantzaton are appled to 576 spectral values at a tme, whch s done teratvely n two nested loops, a dstorton control loop(outer loop, whch ams to keep the quantzaton nose below the maskng threshold) and a rate control loop (nner loop, whch determnes the quantzaton step sze and the quantzaton of the frequency doman samples). (6) The Huffman codng, whch retans PEG-1 Layer III a hgh qualty at low bt-rates, s appled to the quantzed values. All parameters generated by the encoder resde n the sde nformaton part of the frame. The frame header, sde nformaton, CRC, Huffman coded frequency lnes etc. are put together to form frames.
2630 JOURNAL OF SOFTWARE, VOL. 8, NO. 10, OCTOBER 2013 In flter bank analyss, a polyphase flter [n] s gven by: H π (2 + 1) ( n 16) H [ n] = h[ n] cos[ ], = 0 31, n = 0 511 64 (1) Where h[n] s a low-pass flter. The orgnal PC sgnal and fltered sgnals and fltered sgnals are denoted by x[n] P[n] and respectvely. P [ n] = 511 m= 0 x[ n m] H [ m], = 0 31 (2) We obtan sub-band sgnals P[n] s down-sampled by 32. S [ n] = P[32n] = n = 1 S [n], whch x[32n m] H [ m], = 0 31 (3) As a lapped transform, the DCT s a bt unusual compared to other Fourer-related transforms n that t has half as many outputs as nputs (nstead of the same number). To obtan DCT coeffcents, P3 defnes long wndow and short wndow to enhance frequency resoluton and temporal resoluton, respectvely. The product of selected wndow coeffcents and sub-band sgnal s denoted by Z k. The DCT coeffcents are gven by : n 1 = π n n X Z k cos[ ( zk + 1+ ) (2 + 1)], = 0,1,, 1 k= 0 2n 2 2 (4) For the long wndow, n equals 36, otherwse n equals 12 for the short wndow. In Psychoacoustc odel II, NR(m) ndcates the mask-to-nose rato at m bts quantzaton, whch measures the threshold of perceptble dstorton. Wth the sgnal-to-nose rato (SNR) of the sgnal, SR(m) s calculated as: SR( m) = SNR( m) NR( m) (5) The P3 compresson algorthm reles on explotng weakness of human audtory percepton and hdes the fact that a sgnfcant amount of nformaton s dscarded wthout any notceable degradaton of qualty. In P3 compresson, several bt-rates are specfed n the PEG-1 Layer 3 standard: 32, 40, 48, 56, 64, 80, 96, 112, 128, 160, 192, 224, 256, and 320kbt/s, and the avalable samplng frequences are 32, 44.1, and 48 khz. The P3 decodng, demonstrated n Fg.2, s the nverse process of encodng contans the steps n the order of Huffman decodng, nverse quantzaton, nverse DCT and alasng cancellaton, and flter-bank synthess. Frst Huffman decodng s performed on the P3 btstream, then the decoder restore the quantzed DCT coeffcent values and the sde nformaton related to them, such as the wndow type that s assgned to each frame. After nverse quantzaton, the coeffcents are transformed back to the sub-band doman by applyng an nverse DCT on the coeffcents. Fnally, the waveform n the PC format s reconstructed by the synthess flterbank. Fgure 2. Block dagram of P3 decodng B. Revew of P3Stego Steganography Algorthm The embeddng of P3Stego s ntegrated wth the nner loop functon that controls the bt rate of P3 encoder. The pseudo-code for the nner loop functon wth P3Stego s gven n Fg. 3.
JOURNAL OF SOFTWARE, VOL. 8, NO. 10, OCTOBER 2013 2631 Algorthm: P3Stego Embeddng (nner loop functon) Input: DCT Coeffcents ( I ), Secret bt ( b ) Input Parameters: Number of avalable bts ( B ), Output: Part2_3_length ( P 32 ) Begn 1. q = q + 1 s s 2. Iˆ = Quantzer( q, I) then goto Step 1 Else goto Step 4. Quantzaton Step ( q ) s s 3. If I ˆ > 8205 max 4. P = HuffmanCodng( Iˆ ) 32 5. 32 embedrule = ( P %2) ( b) 6. If P > B or embedrule = 1 32 max then goto Step 1 Else goto Step 7. 7. return P 32 max coeffcents can be coded wth the avalable number of bts. The varable P 32 contans the number of the bts used for scalefactors and Huffman code data for current granule, whch s also called block length. Wthout embeddng, the nner loop wll be fnshed when the P 32 s wthn the range of the number of bts avalable. In P3Stego, the nner loop wll contnue to terate untl the party of the P 32 s equal to the hdden bt b and the bt demand for Huffman codng s met. Once the nner loop s done, another loop, namely outer loop, wll check the dstortons ntroduced by the quantzaton operaton. If the allowed dstorton s exceeded, the nner loop wll be called agan. The above process wll be terated untl the bt rate and dstorton requrements are both met. III. PROPOSED STEGANALYTIC ETHOD Obtanng the features that can reflect the dfferences between stego audos and cover audos s a crucal step for steganalyss. Snce P3Stego'nformaton hdng takes place durng the quantzaton process, t s natural and reasonable to generate feature from the parameters related to quantzaton. The parameter concerned n the proposed method s bg_values n sde nformaton. In ths secton, the steganographc mpact on bg_values s analyzed frst. The calbrated feature s obtaned by re-compresson n order to reduce the nfluence of the audo content. At last, we present the attackng algorthm for P3Stego. A. Steganographc Effect on Bg_values In order to mprove the compresson effcency, lossless huffman codng s adopted n P3 encodng. Quantzed DCT(QDCT) coeffcents s dvded nto three zones from hgh to low frequency: the all-zero regon(rzero), the small value regon(count1) and the large value regon(bg_value),shown n Fg.4. End Fgure 3. Pseudo-code for nner loop functon wth P3Stego The nner loop quantzes the DCT coeffcents and ncreases the quantzaton step untl the quantzed Fgure 4. The partton of QDCT coeffcents The Rzero regon s not requred to be encoded. In Count1 regon, each of the four QDCT coeffcents s encoded. Each of the two QDCT coeffcents s encoded n Bg_value regon, whch can be subdvded nto Regon0, Regon1 and Regon1 regon. The number of QDCT coeffcents n Bg_value, Count1 and Rzero
2632 JOURNAL OF SOFTWARE, VOL. 8, NO. 10, OCTOBER 2013 regon s represented by bg_values,count1 and rzero respectvely. The value of bg_values, count1 and rzero has followng rules: f the value of two consecutve QDCT coeffcents s zero, then the value of rzero plus one; f the absolute value of four consecutve QDCT coeffcents s less than one, then the value of count1 plus one. As the value of bg_values, count1 and rzero has the followng condton: 2 * rzero+ 4* count1 + 2* bg_ values= 576 (6) so the value of bg_values can be obtaned wth rzero and count1.because the relatonshp of rzero,count1 and bg_values, the parameter of bg_values s concerned n ths artcle. As descrbed n Secton2, t s obvous that more teratons are requred to ext the nner loop due to the embeddng. Consequently, we wll have a larger quantzaton step at the end of the loop n stego case. The larger the quantzaton step s, the smaller the value of the QDCT coeffcents. So the value of bg_values becomes small and the next frame's bg_values becomes larger n stego case. Fnally, the varance of bg_values s larger than n non-stego case. Ths phenomenon s clearly seen n Fg.2 whch s the dstrbuton of bg_values of the same P3 audo n non-stego case and stego case. The horzontal axs represents the ndex of frame and the vertcal axs represents the value of bg_values. In stego case, the audo s embedded wth 50% messages(100% corresponds to the maxmum sze of a message that can be embedded by P3Stego). (a)non-stego From Fg. 2, t s obvous to take the varance of bg_values as feature to detect P3Stego. That s Where N 2 g g = 1 f = N 1 (7) g { 1,2, N } ( ) s the value of bg_values n th granule and g s the mean value of bg_values n all granules. B. Calbraton Feature by Re-compresson In steganalyss, t s almost mpossble to have access to the cover durng the process of steganalyss. If we can obtan the estmaton of the cover from the suspect one as effectvely as possble, the steganalystc performance wll be mproved. Several methods for cover estmaton have been arsen n recent years, such as flterng [19], down-samplng [20], re-embeddng [21], and re-compresson [22]. One of the most famous approaches for creatng an estmate of the cover mage s the model proposed by Jessca Frdrch n [22] known as JPEG re-compresson calbraton. Smlarly, we conjectured that the steganographc effect on bg_values would be removed through re-compresson calbraton. Denote d as an P3 audo under scrutny and e s the P3 audo that d s decompressed to the tme doman and the compressed back to P3 wth the same compresson rato. That s, = C ( D( ) CR) e d, (8) Where C and D denote the P3 compresson and decompresson algorthm respectvely, and CR s the compresson rato. Then we can obtan the fnal calbrated feature f, that s f = f d f e Where and e f d and f e (9) s the feature extracted from d respectvely by equaton (7). Fgure 5. (b)stego Dstrbuton of bg_values n non-stego case and stego case C. Detectng P3Stego d Denote as an P3 audo under scrutny and t contans totally N granules. The process of detectng P3Stego s descrbed as follows. Step1: Obtan the cover estmaton d and compressng agan. e by decodng
JOURNAL OF SOFTWARE, VOL. 8, NO. 10, OCTOBER 2013 2633 Step2: For the th granule n d and e, obtan the value of bg_values by the sde nformaton respectvely. Step3: Repeat Step 2 untl reach the end. Fnally, we can get the sequence of the value of bg_values. f Step 4: Calculate d f and e by equaton (7) and f = f then extract the feature d f e. Step5: Take the f as nput for SV classfer. Apply SV classfer and determne whether the testng P3 audo has been deal wth P3Stego or not. IV. EXPERIENTAL RESULTS A. Expermental Setup A total number of 500 mono audos wth dfferent styles are used and each audo s sampled at 44.1 khz, 16 bts/sample and has the duraton of 10s. They have never been P3 compressed. Random sequence wth 0 and 1 s taken as the secret message and no preprocessng such as compresson or encrypton s done to the message before embeddng. All audos are embedded wth 10%, 20%, 50%, 80%, 100% messages (100% corresponds to the maxmum sze of a message that can be embedded by P3Stego). In the experments, half of the nature and stego audos are randomly selected to tran the SV classfer and the rest are used for testng. TABLE I. AVERAGE RESULTS UNDER DIFFERENT BIT-RATES B. Expermental Results and Dscussons In our experments, true postve ( TP ) means that stego P3 audo s predcted as stego P3 audo, and true negatve ( TN ) means that the nature P3 audo s predcted as nature P3 audo. Consequently, false negatve ( FN ) means that the stego P3 audo s predcted as nature P3 audo, false postve ( FP ) means that the nature P3 audo s predcted as stego P3 audo. Snce the stego P3 audo and the nature P3 audo to be detected have the same quanttes n our experments, the fnal detecton accuracy rate ( AR ) s AR = ( TPR + TNR) / 2 computed as, where TPR = TP /( TP + FN),and TNR = TN /( TN + FP). For each case, we average the ten tmes test results. Table 1 lsts the average results under dfferent bt-rates. It s observed from Table I that the accuracy rate ncreases wth the ncrease of embeddng rate. It s n lne wth our expecton because the more the nformaton s hdden, the easer the audo after the operaton of steganography wll be detected.the detecton results s good when the embeddng rate s over 50%: all the results are over 90%. Especally when the embeddng rate s less than 50%, the detecton results are not good. Ths shows that the steganalyss of P3Stego s stll very challengng n cases wth low embeddng rates. CR (kbps) ER (%) TPR(%) TNR(%) AR (%) 96 112 128 10 63.00 68.17 65.59 20 73.92 83.92 78.92 50 91.75 96.00 93.88 80 94.92 99.42 97.17 100 97.08 99.75 98.42 10 60.67 70.17 65.42 20 73.42 80.17 76.80 50 89.08 93.92 91.50 80 93.92 97.42 95.67 100 97.17 98.67 97.92 10 60.50 65.42 62.96 20 67.58 76.17 71.88 50 86.75 93.75 90.25 80 93.67 95.33 94.50 100 94.83 97.58 96.21 In order to show the detecton relablty performance, recever operatng characterstc (ROC) curve has been used to verfy the effectveness of the proposed method. Fg. 6 gves the ROC curves under dfferent compresson ratos. The curves ndcate that the proposed scheme s able to relably detect the trace of P3Stego. For nstance, n Fg. 6(a), a probablty of detecton of approxmately 95% s acheved at a false postve rate of 10%, when the embeddng rate s 50%.
2634 JOURNAL OF SOFTWARE, VOL. 8, NO. 10, OCTOBER 2013 Whle the ROC curve contans most of the nformaton about the accuracy of the classfer, t s sometmes desrable to produce quanttatve summary measures of the ROC curve. The most commonly used such measure s the area under the ROC curves (AUC). In ths paper, the detecton relablty [22] s adopted to evaluate the detecton performance, whch s defned as, ρ = 2A 1 (10) where A s the AUC. A ρ = 1 s scaled to obtan ρ = 0 for a perfect detecton and for a random guessng. The results for detecton relabltes under dfferent embeddng rates and dfferent compresson ratos are shown n Table II. The results n Table II show that the detecton performance depends on the embeddng rate. The less the embeddng rate, the more dffcult t s to detect. Fgure 6. ROC curves under dfferent embeddng rates (a) 96kbps (b) 112kbps (c) 128kbps. TABLE II. AUC RESULTS UNDER DIFFERENT EBEDDING RATES CR (kbps) ER (%) AUC ρ 10 0.7197 0.4394 20 0.8661 0.7322 96 50 0.9580 0.9160 80 0.9908 0.9816 100 0.9919 0.9838 10 0.7137 0.4274 20 0.8505 0.7010 112 50 0.9562 0.9124 80 0.9768 0.9536 100 0.9778 0.9556 10 0.6764 0.3528 20 0.8194 0.6388 128 50 0.9270 0.8540 V. CONCLUSIONS 80 0.9762 0.9524 100 0.9842 0.9684 In ths paper, the effect on the bg_values caused by P3Stego embeddng, s analyzed. The steganalytc features s obtaned from the detectng and estmated audos obtaned by re-compresson calbraton. The extracton of the feature s smple and rapd because they
JOURNAL OF SOFTWARE, VOL. 8, NO. 10, OCTOBER 2013 2635 can be obtaned drectly from the P3 btstream wthout fully decodng. The expermental results show that the proposed method s effectve to detect P3Stego. ACKNOWLEDGEENT Ths work s supported by the Natonal Natural Scence Foundaton of Chna (NSFC: 60873220, 61170137), Doctoral Fund of nstry of Educaton of Chna(20103305110002), Scentfc Research Fund of Zhejang Provncal Educaton Department (Grant No. Y201119434), Key Innovaton Team of Zhejang Provnce (Grant No. C01416124200), The Outstandng (Postgraduate) Dssertaton Growth Foundaton of Nngbo Unversty (Grant No. 10Y20100002),Zhejang natural scence foundaton of Chna (ZJNSF:Z1090622,Y1090285), Zhejang scence & technology preferred projects of Chna(2010C11025), Zhejang provnce educaton department key project of Chna (ZD2009012), Nngbo scence & technology preferred projects of Chna(2009B10003), Nngbo key servce professonal educaton project of Chna(2010A610115). REFERENCES [1] S. Dumtrescu, X. Wu, Z. Wang, Detecton of LSB steganography va sample par analyss, IEEE Transactons on Sgnal Processng, 2003, vol. 51, pp. 1995-2007. [2] N. Provos, P. Honeyman, Hde and seek: an ntroducton to steganography, IEEE Securty & Prvacy, 2003, vol.1, pp. 32-44. [3] F. Pettcolas, P3Stego. http://www.pettcolas.net/faben/steganography/mp3stego, 2002. [4] C. Platt, UnderP3Cover. http://sourceforge.net/projects/ump3c, 2004. [5] Z. Achmad, P3Stegz. http://sourceforge.net/projects/mp3stegz, 2002. [6] Noch, Stego-Lame. http://sourceforge.net/projects/stego-lame, 2002. [7] D. Yan, R. Wang, L. Zhang, Quantzaton step party-based steganography for P3 audo, Fundamenta Informatcae, 2009, vol.97, pp. 1-14. [8] D. Yan, R. Wang, Huffman table swappng-based steganography for P3 audo, ultmeda Tools and Applcatons, 2011, vol. 52, pp. 291-305. [9] A. Westfeld, Detectng low embeddng rates, Proceedngs of Internatonal Conference on Informaton Hdng, 2003, pp. 324-339. [10] R. Bohme, A. Westfeld, Statstcal charactersaton of P3 encoders for steganalyss, Proceedngs of AC Workshop on ultmeda and Securty, 2004, pp. 25-34. [11] J. Dttmann, D. Hesse, Network based ntruson detecton to detect steganographc communcaton channels: on the example of audo data, Proceedngs of IEEE Internatonal Workshop on ultmeda Sgnal Processng, 2004, pp 343-346. [12] 12 C. Kraetzer, J. Dttman J, Pros and cons of mel-cepstrum based audo steganalyss usng SV classfcaton, Proceedngs of Internatonal Conference on Informaton Hdng, 2007, pp. 359-377. [13]. Qao, A. Sung, Q. Lu, Steganalyss of P3Stego. Proceedngs of Internatonal Jont Conference on Neural Networks, 2009, pp. 2566-2571. [14]. Qao, A. Sung, Q. Lu, Feature mnng and ntellgent computng for P3 steganalyss, Proceedngs of Internatonal Jont Conference on Bonformatcs, Systems Bology and Intellgent Computng, 2009, pp 627-630. [15] H. Ozer, B. Sankur, N. emon, I. Avcbas, Detecton of audo covert channels usng statstcal footprnts of hdden messages, Dgtal Sgnal Processng, 2006, vol.16, pp. 389-401. [16] I. Avcbas, Audo steganalyss wth content-ndependent dstorton measures, IEEE Sgnal Processng Letters, 2006, vol. 13, pp. 92-95. [17] ISO/IEC 11172-3: Informaton technology - codng of movng pctures and assocated audo for dgtal storage meda at up to about 1.5 bt/s - part3: audo, 1993. [18] 18 http://telos-systems.com/techtalk/hosted/brandenburg_mp 3_aac.pdf [19] 19. AD. Ker, R. Bohme, Revstng weghted stego-mage steganalyss, Proceedngs of SPIE on Securty, Forenscs, Steganography, and Watermarkng of ultmeda Contents X, 2008, pp 5-17. [20] 20. AD. Ker, Steganalyss of LSB matchng n grayscale mages, IEEE Sgnal Processng Letters, 2005, vol. 12, pp. 441-444. [21] 21. H. alk, Steganalyss of qm steganography usng rregularty measure, Proceedngs of AC Workshop on ultmeda and Securty, 2008, pp.149-158. [22] 22. J. Frdrch J (2004) Feature-based steganalyss for JPEG mages and ts mplcatons for future desgn of steganographc schemes, Proceedngs of Internatonal Conference on Informaton Hdng, 2004, pp. 67-81. Xanmn Yu s born n 1988. He s currently pursung hs.s. degree n College of Informaton Scence and Engneerng, Nngbo Unversty, Chna. Hs research nterests manly nclude multmeda retreve and securty. Rangdng Wang s born n 1962, receved hs.s. degree n the Department of Computer Scence and Engneerng from the Northwest Polytechnc Unversty, Xan n 1987, and receved hs Ph.D. degree n the School of Electronc and Informaton Engneerng from Tongj Unversty, Shangha, Chna, n 2004. He s now a professor at Faculty of Informaton Scence and Engneerng, Nngbo Unversty, Chna. Hs research nterests manly nclude multmeda securty, dgtal watermarkng for dgtal rghts management, data hdng, and steganography for computer forenscs.
2636 JOURNAL OF SOFTWARE, VOL. 8, NO. 10, OCTOBER 2013 Dqun Yan s born n 1979 and receved hs.s. degree n crcut and system, n 2008, and hs Ph.D. n communcaton and nformaton system, n 2012, both from the College of Informaton Scence and Engneerng at the Nngbo Unversty n Chna. Hs research nterests nclude audo processng and multmeda securty.