Universal Steganalysis Based On Features In Transform Domain

Steganalysis is a new branch of information security,which mainly researches on the effective deteetion of the cover image and boosts the development of information security. Especially after the 9.11 event, steganalysis became more important,which plays an important role in national defence and military security. Therefore,research on steganalysis is very valuable both in academic development and potential applications. This dissertation is mainly focused on analysis and detection techniques of steganograpgy in images. The concepts in this dissertation keep abreast of the international steganography reserch progress. Basis on referencing the latest advanced steganalysis methos in the world, this dissertation proposed several practical and reliable algorithms. The main contribution of this dissertation is summarized as follows:(1) Markov Chain was employed to model the dependencies among adjacent DCT (Discrete Cosine Transform) coefficients to design classification features, in order to attack the advanced JPEG (Joint Photographic Expert Group)steganographic methods. Since the hidden messages are sometimes independent to the cover data, the embedding process often decreases the dependencies exiting in original cover data to some extent. Markov transition matrix was firstly applied to derive correlations between the coefficients in DCT domain, which was extracted respectively from horizontal, vertical, and zigzag direction to construct local Markov feature. The feature weight was allocated to each local feature according to the contribution degree on classification. The detection rates of the weighted features (4:3:3) are always higher than 91% while attacking the four steganographic schemes(Outguess,F5,Mb1 and Mb2) at imbedding rate 0.05, and the feature fusion operation does not increase the feature dimension. In the other hand, Markov Chain was used to model the dependencies among DCT coefficients in adjacent 8×8 blocks, by combining intra-block Markov feature, the intra-block and inter-block feature was proposed. Since the horizontal and vertical scan failed to detect F5 steganography with low imbedding-rate, zigzag pattern was developed to scan DCT blocks and each block coefficients. Difference array was introduced to enhance the variations caused by steganographic scheme. The experiment results have demonstrated the effectiveness of the proposed scheme, the detection rate for F5 steganography at embedding-rate 0.05 reaches 95%.(2) Since the generalization ability of two-class classification is limited to stego images, a universal steganalysis method was designed by training on clean images only. In order to enhance the variations caused by some steganography, the statistics for describing clean image were extracted from the first, second total differential and gradient images. By three scales of wavelet packet decomposition, differential and gradient images were decomposed into some coefficient subbands, and the multi-order absolute characteristic function moments of histogram were extracted as features. While the clustering relationship among the statistical features of the clean images is not strong enough, the feature set of clean samples were clustered by FCM (Fuzzy C-Means)algorithm before training, Xie-Beni measure was utilized to determine the suitable clustering numbers, finally a one-class classifier with multiple hyperspheres was generated. The experiments works on mixed image library, constituting by JSteg, JPhide, F5 , Outguess stego-images and the testing clean images, have demonstrated the validity of the proposed method. Compared with two-class classifier, the proposed method has the better generality ability.(3) A novel program based on ICA (independent component analysis) was designed to estimate the embedded messages. This dissertation views active steganalysis as ICA problem under the assumption that embedded secret message is an independent, identically distributed (i.i.d), the BSS(blind source seperation) method was utilized to estimate the hidden messages. Since the DCT coefficients non-Gaussian distributed, the DCT coefficients and the spread-spectrum messages are Gaussian distributed, the process for embedding spread-spectrum messages in DCT domain was more suitable for BSS model, the proposed method was applied on estimating the messages embedded in DCT domain. The HMT (hidden Markov tree) for DCT domain was employed to predict a estimate version of a cover image, then Fast ICA was utilized to estimate the hidden messages Simulation experiment validates the advantage of the proposed method, which gives the results of blind separation.