Steganography

By: Joe Jupin Supervised by: Dr. Longin Jan Latecki

Overview


Introduction
 

Clandestine Communication Digital Applications of Steganography Uncompressed Images Compressed Images Steganalysis The Images Used

Background
   

  

Finding and Extracting Messages from Bitmaps Detecting Messages in jpegs Future Work

Introduction


Clandestine Communication
 

Cryptography


Scrambles the message into cipher Hides the message in unexpected places

Steganography


Digital Applications of Steganography



Can be hidden in digital data

     

MS Word (doc) Web pages (htm) Executables (exe) Sound files (mp3, wav, cda) Video files (mpeg, avi) Digital images (bmp, gif, jpg)

Length = 12

Background



Message = Hello Stego!

Uncompressed Images Character Integer Binary

Space 0 9 A Z a z

Grayscale Bitmap images (bmp)

32 00100000  256 shades of intensity from black to white 48 57 00110000 - 00111001  Can be obtained from color images 01000001 - 01011010  Arranged 65 a90-D matrix into 2 2 Messages are hidden in the least significant bits 97 122 01100001 01111010 (lsb)  Matrix values change slightly  Interested in patterns that form messages

Background


Compressed Images


Grayscale jpeg images (jpg)

   

Joint Photographic Experts Group (jpeg) Converts image to YCbCr colorspace Divides into 8x8 blocks Uses Discrete Cosine Transform (DCT)
Obtain frequency coefficients Scaled by quantization to remove some frequencies High quality setting will not be noticed

 

Huffman Coding Affects the images statistical properties

Background
Steganalysis  The Images Used



From Star Trek Website

1,000 color jpeg images  320x240 or 240x320  www.startrek.com  There will be Klingons


Finding and Extracting Messages from Bitmaps



Problem
Messages can be hidden in lsb s  May be anywhere in image  Cannot see message in image  Would take forever to be processed by a human


Finding and Extracting Messages from Bitmaps

Steganography is the art and science of communicating in a way which  Procedurehides the existence of the communication. In contrast to cryptography, where the "enemy" is allowed to  Inject messages into a images detect, intercept and modify messages without odd pixels to being able  Take a Boolean snapshot of even and violate certain security premises guaranteed by a  Construct a string of all possible characters cryptosystem, theimageof steganographycharacter messages goal has n-7 individual is to hide  An n-pixel nninsideenumerations (320 xmessages in a way that does not other "harmless" 240 - 7 = 76,793) allow character properties to match a message  Use any "enemy" to even detect that there is a second secret message present [Markus Kuhn 1995-07-03]. pattern in the enumerated string
  

Define a message (pattern of message characters) Define message characters (used in messages) Use stego stems (patterns)

A test can be performed faster by using tiled samples

Finding and Extracting Messages from Bitmaps



Observation
 

Only considered linear unencrypted messages Trial performed on 100 grayscale bitmaps
 

97 clean 3 stego

Took an average of 9 seconds per image to find with 100% accuracy (no training -- cold)


Occasionally some garbage text at head or tail

Took an average of 3 seconds per image to test with 100% accuracy

 

Clean images had pattern scores of less than 10 Stego images had pattern scores of 31 or more

Finding and Extracting Messages from Bitmaps



Conclusion
Messages are detectible and extractible from non-encrypted uncompressed images non Linear messages can be found in any direction with more computation  This method can be foiled by hashing the message into the image


Detecting Messages in jpegs



Problem
Cannot use an enumeration scheme to detect or find a message  May only be able to detect because of encoding schemes and encryption  Cannot see message in image  Statistical properties of an image change when a message is injected


Detecting Messages in jpegs



meanV12 0.590963 meanH12 meanD12 varV12 -0.004 17.120 0.050189 120.485 0.059 varH12 0.080103 0.3451660.363 varD12 0.343829 0.332710 0.001311 12 1.041 skwV12 3.809 skwH 0.021374 -0.291 skwD12 0.482941 krtV12 -0.146 838.622 krtH12 0.094929 97.874 krtD12 0.084698 0.887 meanEv12 meanEh12 meanEd12 varEv12 0.4110320.034 0.331954 0.572352 0.260870 0.337264 1.391 3.948 -0.703 0.135543 varEd12 -2.200 15627.538skwEv12 skwEh12 skwEd12 krtEv12 krtEh12 krtEd12 0.065238 47.077 0.079329 -1.128 -0.465 2.060 0.542244 0.187500 0.603208 0.306227 0.424866 3.726 -0.738 varEh12 meanV 0.370270 meanH23 meanD23 varV23 0.01123 15.318 0.032725 90.017 0.025054 0.594 varH23 0.3813170.268 varD23 0.412698 0.385321 0.001666 23 0.969 skwV23 3.877 skwH 0.043085 -0.172 skwD23 0.402427 920.19 krtH23 -0.523 krtV23 0.053992 62.226 krtD23 0.155397 -1.366 meanEv23 meanEh23 meanEd23 varEv23 0.553661-0.146 1.326 0.476190 0.432629 0.237224 0.271698 3.944 -0.705

Procedure
34 34

Obtain the 4-level 2-D wavelet decomposition of 42the 0.026724meanD varV images182.339 -1.808 varH meanV 0.395349 meanH -0.004 0.935 0.044753 0.7382260.601 varD 0.479060 0.367367 0.073430 0.361345 1.226 skwV 4.692 skwH 0.205 skwD Obtain 0.427911 krtV the 364.874krtD -0.079 193.451 krtH 0.042625 0.055986 -9.569decomposition 4.244 varEv 0.558653-0.116 1.133 0.350634 0.332762 0.165738 0.301011  orientation meanEv meanEh meanEd -0.577 of frequency varEh varEd 0.6110573640.213 skwEv 1.899 0.054988 24.731 0.166710 0.766 0.497393-0.349 1.681 0.518569 0.373766 0.153005 3.426 -0.625 space statistics skwEh skwEd krtEv krtEh krtEd0.320611
 varEh 0.422609 varEd23 4.41823 15572.229skwEv23 skwEh23 skwEd23 krtEv23 krtEh23 krtEd23 0.096439 23.531 0.087974 -0.123 -0.541 1.980 0.463496 0.471598 0.242233 0.153389 0.360447 3.571 -0.705
34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34 34

 

class 0 72 features plus the class (0 = clean, 1=stego) Includes: mean, variance, skewness and kurtosis of coefficients and error for prediction in subband

  

Normalize the data by 0-1 min-max 0- minTrain Fisher Linear Descriptor (FLD) Test the FLD threshold

Detecting Messages in jpegs



Observation


Trials performed on 2000 images

1000 clean and 1000 stego  Random selection of 1000 instances without replacement (500 each class)  Messages in stego had sufficient size


Results show overwhelming accuracy

Bior3.1 True Neg 100%, True Pos 98.6%  Rbio5.5 True Neg 99.8%, True Pos 98.8%


Detecting Messages in jpegs



Conclusion
Messages of sufficient size can be detected in stego images with great accuracy  Improved accuracy may be due to a large training set


1000 (800/200)  500 (400/100)



Restricted domain


Many similar images

Detecting Messages in jpegs



Problems


Authors did not handle log of zero problem



Replaced with small value

Differing jpeg sizes need differing message sizes



Dynamic message injection

Detecting Messages in jpegs



Other Classifiers
Tests were run on J4.8, SMO, Logistic and Nave Bayes for bior3.1 and rbio5.5 with 80/20 split and default settings  Results


Future Work
Would like to find optimal stems
Pattern matching  Text mining  Cryptanalysis


Would like to optimize TestMsg code



C/assembly code

References


 

Petitcolas, F.A.P., Anderson, R., Kuhn, M.G., "Information Hiding - A Survey", July1999, URL: http://www.cl.cam.ac.uk/~fapp2/publications/ieee99http://www.cl.cam.ac.uk/~fapp2/publications/ieee99-infohiding.pdf (11/26/0117:00) Farid, Hany, Detecting Steganographic Messages in Digital Images Department of Computer Science, Dartmouth College, Hanover NH 03755 Moby Words II, Copyright (c) 1988-93, Grady Ward. All Rights 1988Reserved. Lyu, Siwei and Farid, Hany, Steganalysis Using Color Wavelet Statistics and One-Class Support Vector Machines , Department of Computer OneScience, Dartmouth College, Hanover, NH 03755, USA Farid, Hany, Detecting Hidden Messages Using Higher Order Statistical Models Department of Computer Science, Dartmouth College, Hanover NH 03755

Spy Vs. Spy

by Antonio Prohias from MAD Magazine

Have a good Winter Break!