LSB detection by Pairs Analysis CSM25 Secure Information Hiding Dr - PowerPoint PPT Presentation

LSB detection by Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey Spring 2007 Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 1 / 41

Outcomes Learn how to implement pairs analysis Understand strengths and limitations of pairs analysis Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 2 / 41

Background Where χ 2 falls short The χ 2 test we have seen Analyses histogram only. Detects embedding in consecutive pixels What if the message is randomly spread across the image? Generalised χ 2 analysis. Yes/No answer; cannot estimate message length Can be fooled if the message is biased (more 0-s than 1-s or v.v.) Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 3 / 41

Background Higher-order statistics Pixels in neighbourhoods Pairs of Values counts single pixels → first-order statistic Higher-order statistics Count pairs of (neighbour) pixels (2nd order) Pixel triplets (3rd order) Study relations between pixels in a neighbourhood Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 4 / 41

Pairs analysis Reading Core Reading «Quantitative steganalysis of digital images: estimating the secret message length» by Jessica Fridrich, Miroslav Goljan, Dorin Hogea, David Soukal, in Multimedia Systems 2003 Suggested Reading «Higher-order statistical steganalysis of palette images» by Jessica Fridrich, Miroslav Goljan, David Soukal Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 5 / 41

Pairs analysis Pairs Analysis Pairs Analysis is quantitative i.e. estimates the message length Originally designed for GIF. We present it for spatial, grayscale images. Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 6 / 41

Pairs analysis The characteristic sequence Outline Background 1 Pairs analysis 2 The characteristic sequence Homogenous pairs Where Pairs Analysis fails 3 Dithered backgrounds RS steganalysis 4 The idea The result Counter-measures Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 7 / 41

Pairs analysis The characteristic sequence The characteristic sequence Let c , c ′ be two colours (grayscales). Read image row by row (left to right and top down). Assign 0 to c and 1 to c ′ . Ignore all other colours. Resulting sequence is denoted Z ( c , c ′ ) . Definition Z = Z ( 0 , 1 ) | Z ( 2 , 3 ) | Z ( 4 , 5 ) | . . . | Z ( 254 , 255 ) , (1) Z ′ = Z ( 1 , 2 ) | Z ( 3 , 4 ) | Z ( 5 , 6 ) | . . . | Z ( 255 , 0 ) . (2) Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 8 / 41

� � � � � � � � Pairs analysis The characteristic sequence The colour cut Z ( , ) extracted from an image Extracted column-wise (Matlab-style) Row-wise extraction is equally valid. � � 001111000000111111001101110010111001111110 Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 9 / 41

Pairs analysis Homogenous pairs Outline Background 1 Pairs analysis 2 The characteristic sequence Homogenous pairs Where Pairs Analysis fails 3 Dithered backgrounds RS steganalysis 4 The idea The result Counter-measures Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 10 / 41

Pairs analysis Homogenous pairs Second-order structure Second-order structure (of Z and of Z ′ ) count pairs of consecutive bits four possible pairs 00,01,10,11 Homogenous pairs: 00, 11 Let F be frequency of Homogenous pairs in Z . Let R = F / n be the relative frequency. where n = N · M is the number of pixels. Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 11 / 41

Pairs analysis Homogenous pairs Exercise Make a function producing Z from an image X . Make a function producing Z ′ from an image X . Make a function counting homogenous pairs in a sequence Z . Test the functions on stego-image and cover-images you have used before. How many homogenous pairs are there in Z ? How many in Z ′ ? Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 12 / 41

Pairs analysis Homogenous pairs Expected structure of Z Let R ( p ) = E ( R ) be expected , relative frequency of homogenous pairs in Z when a fraction p of pixel LSB-s have been flipped. (e.g. if a random unbiased bit string of length 2 p has been embedded) Theorem R ( p ) is a parabola with minimum at R ( 1 / 2 ) = 1 / 2 . R ( p ) = ap 2 + bp + c for some constants a, b, and c. Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 13 / 41

Pairs analysis Homogenous pairs Why parabola? k 1 k 2 k 3 k 4 · · · k r � �� � ���� � �� � � �� � � �� � Z = 0000 111 00 . . . 0 11 . . . 1 · · · 11 . . . 1 nR ( 0 ) = � r i = 0 ( k i − 1 ) Homogenous pair remains homogenous: Pr = q 2 + ( 1 − q ) 2 Both change + Neither changes Heterougenous pair remains homogenous: Pr = 2 q ( 1 − q ) r � [ q 2 + ( 1 − q ) 2 ]( k i − 1 ) + 2 q ( 1 − q )( r − 1 ) nR ( q ) = i = 1 Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 14 / 41

Pairs analysis Homogenous pairs Why parabola? k 1 k 2 k 3 k 4 · · · k r � �� � ���� � �� � � �� � � �� � Z = 0000 111 00 . . . 0 11 . . . 1 · · · 11 . . . 1 nR ( 0 ) = � r i = 0 ( k i − 1 ) Homogenous pair remains homogenous: Pr = q 2 + ( 1 − q ) 2 Both change + Neither changes Heterougenous pair remains homogenous: Pr = 2 q ( 1 − q ) r � [ q 2 + ( 1 − q ) 2 ]( k i − 1 ) + 2 q ( 1 − q )( r − 1 ) nR ( q ) = i = 1 Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 14 / 41

Pairs analysis Homogenous pairs Why parabola? k 1 k 2 k 3 k 4 · · · k r � �� � ���� � �� � � �� � � �� � Z = 0000 111 00 . . . 0 11 . . . 1 · · · 11 . . . 1 nR ( 0 ) = � r i = 0 ( k i − 1 ) Homogenous pair remains homogenous: Pr = q 2 + ( 1 − q ) 2 Both change + Neither changes Heterougenous pair remains homogenous: Pr = 2 q ( 1 − q ) r � [ q 2 + ( 1 − q ) 2 ]( k i − 1 ) + 2 q ( 1 − q )( r − 1 ) nR ( q ) = i = 1 Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 14 / 41

Pairs analysis Homogenous pairs The R -function Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 15 / 41

Pairs analysis Homogenous pairs Structure of the shifted pairs Compare the pairs Z with shifted pairs Z ′ Two parabolas Assumption R ′ ( p ) are parabolic and symmetric around p = 1 / 2 , i.e. R ′ ( p ) = a ′ p 2 + b ′ p + c ′ . We will study D ( p ) = R ( p ) − R ′ ( p ) . Difference between two parabolæ is a parabola D ( p ) = ap 2 + bp + c for unknown a , b , p . Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 16 / 41

Pairs analysis Homogenous pairs Structure of the shifted pairs Compare the pairs Z with shifted pairs Z ′ Two parabolas Assumption R ′ ( p ) are parabolic and symmetric around p = 1 / 2 , i.e. R ′ ( p ) = a ′ p 2 + b ′ p + c ′ . We will study D ( p ) = R ( p ) − R ′ ( p ) . Difference between two parabolæ is a parabola D ( p ) = ap 2 + bp + c for unknown a , b , p . Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 16 / 41

Pairs analysis Homogenous pairs Structure of the shifted pairs Compare the pairs Z with shifted pairs Z ′ Two parabolas Assumption R ′ ( p ) are parabolic and symmetric around p = 1 / 2 , i.e. R ′ ( p ) = a ′ p 2 + b ′ p + c ′ . We will study D ( p ) = R ( p ) − R ′ ( p ) . Difference between two parabolæ is a parabola D ( p ) = ap 2 + bp + c for unknown a , b , p . Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 16 / 41

Pairs analysis Homogenous pairs Structure of the shifted pairs Compare the pairs Z with shifted pairs Z ′ Two parabolas Assumption R ′ ( p ) are parabolic and symmetric around p = 1 / 2 , i.e. R ′ ( p ) = a ′ p 2 + b ′ p + c ′ . We will study D ( p ) = R ( p ) − R ′ ( p ) . Difference between two parabolæ is a parabola D ( p ) = ap 2 + bp + c for unknown a , b , p . Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 16 / 41

Pairs analysis Homogenous pairs Structure of the shifted pairs Compare the pairs Z with shifted pairs Z ′ Two parabolas Assumption R ′ ( p ) are parabolic and symmetric around p = 1 / 2 , i.e. R ′ ( p ) = a ′ p 2 + b ′ p + c ′ . We will study D ( p ) = R ( p ) − R ′ ( p ) . Difference between two parabolæ is a parabola D ( p ) = ap 2 + bp + c for unknown a , b , p . Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 16 / 41

Pairs analysis Homogenous pairs Structure of the shifted pairs Compare the pairs Z with shifted pairs Z ′ Two parabolas Assumption R ′ ( p ) are parabolic and symmetric around p = 1 / 2 , i.e. R ′ ( p ) = a ′ p 2 + b ′ p + c ′ . We will study D ( p ) = R ( p ) − R ′ ( p ) . Difference between two parabolæ is a parabola D ( p ) = ap 2 + bp + c for unknown a , b , p . Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 16 / 41

Pairs analysis Homogenous pairs The R ′ -function Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 17 / 41

Pairs analysis Homogenous pairs The R ′ -function Dr Hans Georg Schaathun LSB detection by Pairs Analysis Spring 2007 17 / 41