Effect of Different Coding Patterns on Compressed Frequency Domain Based Universal JPEG Steganalysis Bin Li1,2 , Fangjun Huang1 , Shunquan Tan1 , Jiwu Huang1 , and Yun Q. Shi2 1
2
School of Information Science and Technology, Sun Yat-sen University, Guangzhou 510275, China
[email protected] New Jersey Institute of Technology, Newark, NJ 07102, USA
[email protected]
Abstract. Current steganalytic schemes for JPEG steganography are in favor of extracting features in DCT (Discrete Cosine Transform) domain and/or spatial domain. A recently proposed compressed frequency domain based universal steganalytic algorithm [21] showed concern over the statistics of Huffman compressed stream. The authors claimed that it was very effective in detecting stego images embedded by JPEG steganographic tools, including JPHide, F5 and OutGuess. Even though only several bytes were embedded, the scheme was still able to work, thus demonstrating astonishing steganalysis capability. By carefully controlled studies on the factors which may have impact on the new steganalytic method, we find out the truly cause of the powerfulness of this “payload-independent” steganalyzer. Experimental results reveal that different coding patterns used in cover and stego images, rather than the Avalanche Criterion [24] explained by its authors, have led to great detection efficiency. When the same coding pattern is employed in both cover and stego images, the performance of the newly devised steganalyzer has greatly dropped. Implication from this paper is that we should ensure the difference between the cover and stego images is only caused by data embedding itself in steganography and steganalysis.
1
Introduction
Steganography is the practice of secret communication by hiding information in cover medium without drawing suspicion. JPEG image is one of such media popular with steganographists since it is a widely used format for storing image data in our daily life. Several steganographic schemes, such as Jsteg [1], JPHide [2], F5 [3], OutGuess [4], MB1 [5], MB2 [6], PQ [7] and MME [8], hide secret message bits in JPEG image by altering its quantized DCT (Discrete Cosine Transform) coefficients. Discovering the existence of the covert communication is the purpose of steganalysis. If the steganalytic method can determine whether or not a medium contains hidden information with a success rate better than random guessing, the steganographic algorithm is considered to be broken. Similar to cryptography and cryptanalysis, steganography and steganalysis develop with each other. Y.Q. Shi, H.-J. Kim, and S. Katzenbeisser (Eds.): IWDW 2007, LNCS 5041, pp. 143–157, 2008. c Springer-Verlag Berlin Heidelberg 2008
144
B. Li et al.
Jsteg [1] and JPHide [2] are JPEG steganographic tools at the early stage. They replace the least significant bit (LSB) of DCT coefficients with secret message bit and they are detectable by the chi-square attack [9] and the generalized chi-square attack [10,11]. The F5 algorithm [3] can resist the chi-square attack by decreasing the absolute values of the coefficients. Additionally, it employs the matrix encoding technique to improve the embedding efficiency. However, it does not preserve the first order statistic well, especially introducing more zero coefficients so that the histogram of DCT coefficients is shrunk to the center. Another LSB based steganographic tool, OutGuess [4], preserves the global histogram of DCT coefficients to counter the chi-square attack, but it increases block discontinuity in spatial domain. Fridrich et al. [12] presented a calibration method to estimate the statistics of the JPEG cover image by decompressing, cropping and re-compressing. It is effective in detecting F5 as well as OutGuess [13,14]. Later, Sallee [5] designed the model-based steganography, named by MB1. The embedding of MB1 keeps the low precision histogram unchanged by fitting a generalized Cauchy distribution model. The improved version defending against Fridrich’s blockiness attack is known as MB2 [6]. By observing the phenomenon of the distribution of DCT coefficients over-fitting the generalized Cauchy distribution, B¨ ohme et al. [15] successfully launched an attack against MB1. This method is also theoretically effective for attacking MB2. The steganalytic methods mentioned above are of one category which is called specific steganalysis. It is used to break one targeted steganographic algorithm and seldom applicable to others. Another category which draws more and more attention nowadays is the universal steganalysis, or called blind steganalysis. It can detect several steganographic algorithms, but it is less accurate than the specific ones. Based on the techniques used in pattern recognition, the universal steganalysis consists of two major steps. The first step is to extract features which can accurately capture the statistical changes by steganography. The second step is to use a classifier, such as Fisher linear discriminant (FLD), neural network (NN) or support vector machine (SVM), to distinguish the extracted features from cover and stego objects. The “universal” property is mainly contributed by good features, which reflect the statistics deviated by steganographic schemes and are usually changed along with the size of embedding payload. In [16], Farid proposed a steganalyzer with features extracting from a multi-scale decomposition of an image and its prediction error. It provides a satisfactory detection rate. Avcibas et al. [17] obtained features on correlation between the contiguous bit planes of spatial domain representation of image. As [16], Avcibas et al.’s method is effective to JPEG steganography as well as spatial steganography. The calibrated DCT feature based steganalyzer developed by Fridrich [18] is very powerful in attacking serval JPEG steganography. More satisfactory detection results come from the steganalyzer proposed by Shi et al. [19], which utilizes the Markov process to explore the correlation within DCT coefficients. The steganalyzer merging the Markov based and the calibrated DCT based features performs even better [20]. Among the existing universal steganalytic schemes, extracting features directly in DCT domain (e.g. [18,19,20]) appears to be more sensitive to JPEG steganography than in spatial domain (e.g. [16,17]).
Effect of Different Coding Patterns
145
Nonetheless, the state-of-the-art steganalytic techniques cannot work well when embedding rate is extremely low. Recently, Barbier et al. [21] have shown a new point of view on JPEG steganalysis. Their feature extraction was conduct in compressed frequency domain. By examining the Huffman compressed binary stream, a steganalyzer with high and constant detection rate, regardless of the size of embedding payload, was obtained in their setting. It outperforms all existing universal steganalytic algorithms when the embedding rate is low. Besides, the steganalyzer is able to detect a steganographic algorithm not used during the training stage. In this sense, the new steganalytic method seems really “universal”. The compressed frequency domain based features also led to a specific steganalyzer [22]. In this paper, we take a close look on this compressed frequency domain based universal steganalytic scheme. Several factors, which may have impact on the scheme but are not clearly mentioned in [21], are carefully examined here. We find out the detection results have been exaggerated by wrong selection of coding patterns. If the same coding pattern is used in both cover and stego images, the detection performance drops. The rest of this paper is organized as follows. In Sect. 2, we briefly review the basics of JPEG compression and the compressed frequency domain based steganalysis. Investigations through extensive controlled experiments are presented in Sect. 3 to demonstrate that the powerfulness of the newly devised steganalyzer is mainly contributed by different coding patterns. We discuss the obtained results and implications in Sect. 4. Conclusions are drawn in the last section.
2 2.1
Steganalysis in JPEG Compressed Frequency Domain The Basics of JPEG Compression
The JPEG standard defines four types of operation modes: sequential, progressive, hierarchical and lossless [23]. The first three modes are lossy schemes using DCT-based coding and the last one uses a predictive method for lossless compression. In the DCT-based coding scheme, the source image samples are firstly grouped into non-overlapped 8×8 blocks and each block is transformed by the forward Discrete Cosine Transform into a set of 64 values referred to as DCT coefficients. One of these values is referred to as the DC coefficient and the other 63 as the AC coefficients. In the next step, each of the 64 coefficients is quantized using one of 64 corresponding values from a quantization table and then rounded. Then, the previous quantized DC coefficient is used to predict the current quantized DC coefficient, and the difference is encoded. The 63 quantized AC coefficients are converted into a one dimensional zig-zag sequence and undergo run-length encoding. The differential encoding and runlength encoding are done within a single left-to-right and top-to-bottom scan in sequential mode, while in multiple scans in progressive mode. Finally, the entropy coding is used to achieve additional compression losslessly by encoding the quantized DCT coefficients according to their statistical characteristics. One of the two entropy coding, Huffman encoding and arithmetic encoding, can be
146
B. Li et al.
used. The Huffman encoding is more widely applied because of the patent restriction on arithmetic encoding. The output data of the entropy encoder is the JPEG raw binary stream. 2.2
The Compressed Frequency Domain Based Steganalysis
Barbier et al. noticed that the entropy of the JPEG raw binary stream (e.g. Huffman compressed stream) would change after the quantized DCT coefficients were modified by JPEG steganographic tools. They proposed a universal JPEG steganalytic method based on the statistics of the compressed data stream. The idea of the algorithm is as follows [21]. Let I be the binary stream output by Huffman encoding. Assume the length of the stream is m and let bj be the j-th bit. The entropy H(I) of I is given by H(I) = −P (I) log(P (I)) − (1 − P (I)) log(1 − P (I)),
(1)
where P (I) is the probability of “0” in the stream. It can be computed as m
P (I) =
1 (1 − bj ) m j=1
(2)
Hiding message may introduce a variation of entropy, which is related to P (I). In the observation of [21], P (I) follows a Gamma distribution where the peak located at smaller than 0.5 for non-stego images, while P (I) follows a normal distribution centered at 0.5 for stego images regardless of the embedding rate1 . In other words, the hypothesis in this scenario is that the mean of P (I) would move to 0.5 after only several coefficients are modified. The authors of [21] claimed that this phenomenon could be explained by the Avalanche Criterion [24], though no further solid proof was given. However, if this observation were true, it would bring great impact to steganography and steganalysis. Detecting the DCT-based JPEG steganography in extremely low embedding rate would no longer be “mission impossible”. In the practical steganalytic scheme, the stream is divided into blocks of equal size and the Hamming weight is computed for each block to measure P (I) in a finer way. A random variable X is used to describe the outcome values of Hamming weight. The observed probability density function pˆ(x) of X and the i-th order moment Mi (I) (e.g. i ∈ {1, 2, .., 5}) are computed. Then the KullbakLeibler (KL) distance or relative entropy [25] between the pˆ(x) and the average probability function p(x), which is experimentally computed by averaging many cover images, is derived. So is the KL distance between p(x) and pˆ(x). The KL distances and Mi (I) are selected as features. The authors used the gray and color images of different sizes (probably of different quality factors) downloaded from the Internet in their experiments. JPHide, F5 and OutGuess were selected to verify their approach. An FLD based classifier was trained to distinguish between cover and stego images. The authors also claimed that the performance of this steganalyzer would be independent of the embedding rate. Even an incredible low embedding rate, such as 10−6 of the cover image size, would be detectable. 1
See Fig. 2 in [21] for illustration.
Effect of Different Coding Patterns
3
147
Investigation on Different Coding Patterns for JPEG Steganalysis
It is very unusual that the statistics of the compressed stream of stego images do not depend on the embedding rate. In [21], even though the embedding rate is low, the entropy difference between the cover and stego images is obvious. This would be a formidable challenge for current JPEG steganography at first glance. It is important to investigate this compressed frequency domain based steganalyzer. 3.1
Different JPEG Operation Modes and Huffman Tables
Progressive mode is claimed to be used in [21]. However, there is no option for JPHide, F5 and OutGuess to choose the operation mode. They all use sequential mode by default. In other words, the operation mode of the cover image and the stego image might be different. Besides, there are two ways to obtain Huffman tables in a practical JPEG encoder. One way is to use the predefined Huffman tables which are suggested in the annex of the JPEG standard. Although there is no default tables defined in the standard, they are used as a default option to save compression time in many JPEG encoders, such as the implementation by IJG2 . The other way is to use the optimized Huffman tables which are adaptively derived from each image based on its statistics. It makes the entropy compression more efficient in trade of additional computation time in encoding. Progressive mode definitely uses optimal Huffman tables for each scan while the sequential mode may choose predefined Huffman tables or optimal Huffman tables. JPHide and OutGuess are implemented based on IJG codec. JPHide employs the sequential mode with optimized Huffman tables while OutGuess makes use of the sequential mode with predefined Huffman tables. The JPEG encoder of F5 is written in Java but it borrows a great deal of codes and structures from IJG. And the setting for F5 is the sequential mode with predefined Huffman tables. Different JPEG operation modes and different types of Huffman tables may be highly probable of increasing or decreasing the entropy of Huffman compressed data stream. In the following subsections, we will show the role of the operation mode and the Huffman table, as well as the steganographic algorithms and some other factors, in the newly devised steganalytic scheme with comprehensive experiments. 3.2
Experimental Environment
Since we cannot obtain the same cover image set as in [21], we generate JPEG images by ourselves. In return, we can set different parameters such as the quality factor, operation mode and Huffman table in the process of JPEG compression so that the truly cause of the entropy deviation of the Huffman compressed stream 2
Independent JPEG Group. http://www.ijg.org
148
B. Li et al.
can be revealed. There are 1338 uncompressed TIFF format color images of size 384×512 (or 512×384) in UCID [26] image database. All these images are used in our experiments. We apply the publicly available JPEG implementation library IJG version 6b to generate cover image sets. Three kinds of coding pattern are used. They are: 1. Sequential mode with predefined Huffman tables, denoted as “FIX” in the context. 2. Sequential mode with optimized Huffman tables, denoted as “OPT”. 3. Progressive mode, denoted as “PRO”. We can easily convert images within these coding patterns by Matlab JPEG Toolbox [27] which is also based on IJG version 6b. Under this circumstance, for example, an image compressed with the coding pattern PRO by IJG is exactly the same as the image compressed with the coding pattern FIX or OPT by IJG and then converted by JPEG Toolbox to PRO. The stego images with different coding patterns we generated are similarly derived in this way. 3.3
Results of Investigation
The role of coding pattern. The primary task is to find out if there is any difference in entropy within three coding patterns. We compress the TIFF format images into JPEG using the quality factor (QF) varying from 40 to 100. With coding pattern FIX, OPT and PRO respectively, three kinds of cover image sets are generated for each QF. No message is embedded. The probability of “0” in Huffman compressed stream, denoted as P (I), is computed for each image. Distribution of P (I) within 1338 images compressed by each coding pattern are compared in the Fig. 1. We can observe that the distribution of P (I) is different in three coding patterns, though three image sets contain all the cover images without embedding any bit. So we can conclude that the entropy of the Huffman compressed stream can be changed by coding pattern conversion. Furthermore, the difference within the coding patterns become obvious with larger QFs. The role of quality factor. We plot the results of image sets with the same coding pattern but using different quality factors in Fig. 2. As we can see, the distribution curves shift from right to left as QF increases in coding pattern FIX (QF=100 is an exception). For most of the higher QFs, the peaks of the curves concentrate on 0.5 in coding pattern OPT. Although the distribution curves in coding pattern PRO shift from right to left, the peaks are never located at less than 0.5. These results prove that not only the coding pattern but also the quality factor has effect on P (I). Lowering the QF tends to make more zero coefficients, thus the distribution curve shifts. In addition, we do not get a Gamma distribution, which can model the sum of normal distributions, for the cover image set as in [21]. It is possible that the cover image set in [21] might be composed of images with different coding patterns and different quality factors. This is consist with the fact that the images downloaded from the Internet are of great diversity.
0.4 0.35 0.3 0.25 0.2 0.15 0.1 0.05 0 0.44 0.46 0.48 0.5 0.52 0.54 0.56
FIX OPT PRO
Probability
Probability
Effect of Different Coding Patterns
0.58 0.6
0.4 0.35 0.3 0.25 0.2 0.15 0.1 0.05 0 0.44 0.46 0.48 0.5 0.52 0.54 0.56
FIX OPT PRO
0.58 0.6
(c) QF = 70
Probability
0.3 0.2 0.1 0 0.44 0.46 0.48 0.5 0.52 0.54 0.56 0.58 0.6
(e) QF = 90
Probability
FIX OPT PRO
0.4
0.58 0.6
0.4 0.35 0.3 0.25 0.2 0.15 0.1 0.05 0 0.44 0.46 0.48 0.5 0.52 0.54 0.56
FIX OPT PRO
0.58 0.6
(d) QF = 80
0.6 0.5
FIX OPT PRO
(b) QF = 60
Probability
Probability
(a) QF = 40
0.4 0.35 0.3 0.25 0.2 0.15 0.1 0.05 0 0.44 0.46 0.48 0.5 0.52 0.54 0.56
149
0.35 0.3 0.25 0.2 0.15 0.1 0.05 0 0.44 0.46 0.48 0.5 0.52 0.54 0.56
FIX OPT PRO
0.58 0.6
(f) QF = 100
Fig. 1. Distribution of P (I) within 1338 cover images with different coding patterns using a unique quality factor (QF): (a) QF=40, (b) QF=60, (c) QF=70, (d) QF=80, (e) QF=90 and (f) QF=100. Red solid with : FIX, green solid with : OPT, blue solid with ×: PRO. (The horizontal axis and the vertical axis represent the value of P (I) and its probability, respectively. They are the same for Fig. 2 to Fig. 5).
The role of double JPEG compression. F5 and OutGuess decompress the JPEG cover image and then re-compress it with a user specified quality factor before embedding. If the QF of the cover image and the stego image are not equal, it would probably introduce serious double JPEG compression artifacts, which means the histogram of coefficients might not resemble a generalized Cauchy distribution or generalized Gaussian distribution any more. This phenomenon confuses some existing universal steganalyzers by improper training, as it is pointed out in [28,29]. If the image is compressed with the same QF twice, some coefficients are also changed due to the rounding and truncation of inverse DCT in decompression and forward DCT in re-compression. In an attempt to find out the effect of double JPEG compression on the entropy of Huffman compressed stream, we generate three types of double JPEG
B. Li et al.
Probability
150
0.35 QF=20 0.3 QF=40 QF=60 0.25 QF=70 QF=80 0.2 QF=90 0.15 QF=95 QF=100 0.1 0.05 0 0.46 0.48 0.5 0.52 0.54 0.56 0.58 0.6 0.62
0.4 QF=20 0.35 QF=40 0.3 QF=60 QF=70 0.25 QF=80 QF=90 0.2 QF=95 0.15 QF=100 0.1 0.05 0 0.46 0.48 0.5 0.52 0.54 0.56 0.58 0.6 0.62
(b) OPT
Probability
Probability
(a) FIX 0.55 0.5 QF=20 0.45 QF=40 QF=60 0.4 QF=70 0.35 QF=80 0.3 QF=90 0.25 QF=95 0.2 QF=100 0.15 0.1 0.05 0 0.46 0.48 0.5 0.52 0.54 0.56 0.58 0.6 0.62
(c) PRO
Fig. 2. Distribution of P (I) within 1338 images for cover image sets using different quality factors with coding pattern (a) FIX, (b) OPT and (c) PRO. Red solid with : QF=20, green dash: QF=40, blue solid with : QF=60, cyan dash and dot: QF=70, yellow solid with ×: QF=80, magenta dot: QF=90, black solid with : QF=95, brown dash with ♦: QF=100.
compressed image sets. The first type is to compress the images with the first QF (QF1) randomly and uniformly chosen from 81∼100 and re-compress it with a second QF (QF2) randomly and uniformly chosen from 61∼80. This would make QF2 smaller than QF1. The second type is to compress the images twice with QF1 from 61∼80 and QF2 from 81∼100. The third type is to compress the image twice with the same QF selected from 81∼100. All three coding patterns are applied in each type of the double JPEG compressed image and the distribution of P (I) for each set are computed. We compare the single JPEG compressed image sets with the double JPEG compressed image sets for each coding pattern in Fig. 3. Note that in the case of QF1>QF2, difference between single compressed and double compressed images can be found in coding pattern FIX and OPT, while in the case of QF1QF2 QF1QF2 QF1QF2 QF1
