Steganography By: Joe JupinSupervised by: Dr. Longin Jan Latecki

OverviewIntroductionClandestine CommunicationDigital Applications of SteganographyBackgroundUncompressed ImagesCompressed ImagesSteganalysisThe Images UsedFinding and Extracting Messages from BitmapsDetecting Messages in jpegsFuture Work

IntroductionClandestine CommunicationCryptographyScrambles the message into cipherSteganographyHides the message in unexpected placesDigital Applications of SteganographyCan be hidden in digital dataMS Word (doc)Web pages (htm)Executables (exe)Sound files (mp3, wav, cda)Video files (mpeg, avi)Digital images (bmp, gif, jpg)

BackgroundUncompressed ImagesGrayscale Bitmap images (bmp)256 shades of intensity from black to whiteCan be obtained from color imagesArranged into a 2-D matrixMessages are hidden in the least significant bits (lsb)Matrix values change slightlyInterested in patterns that form messagesCharacterIntegerBinarySpace32001000000 948 5700110000 - 00111001A Z 65 9001000001 - 01011010a z97 12201100001 01111010Length = 12Message = Hello Stego!

BackgroundCompressed ImagesGrayscale jpeg images (jpg)Joint Photographic Experts Group (jpeg)Converts image to YCbCr colorspaceDivides into 8x8 blocksUses Discrete Cosine Transform (DCT)Obtain frequency coefficientsScaled by quantization to remove some frequenciesHigh quality setting will not be noticedHuffman CodingAffects the images statistical properties

BackgroundSteganalysisThe Images UsedFrom Star Trek Website1,000 color jpeg images320x240 or 240x320www.startrek.comThere will be Klingons

Finding and Extracting Messages from BitmapsProblemMessages can be hidden in lsbsMay be anywhere in imageCannot see message in imageWould take forever to be processed by a human

Finding and Extracting Messages from BitmapsProcedureInject messages into a imagesTake a Boolean snapshot of even and odd pixelsConstruct a string of all possible charactersAn n-pixel image has n-7 individual character enumerations (320 x 240 - 7 = 76,793)Use character properties to match a message pattern in the enumerated stringDefine a message (pattern of message characters)Define message characters (used in messages)Use stego stems (patterns)A test can be performed faster by using tiled samples Steganography is the art and science of communicating in a way which hides the existence of the communication. In contrast to cryptography, where the "enemy" is allowed to detect, intercept and modify messages without being able to violate certain security premises guaranteed by a cryptosystem, the goal of steganography is to hide messages inside other "harmless" messages in a way that does not allow any "enemy" to even detect that there is a second secret message present [Markus Kuhn 1995-07-03].

Finding and Extracting Messages from BitmapsObservationOnly considered linear unencrypted messagesTrial performed on 100 grayscale bitmaps97 clean3 stegoTook an average of 9 seconds per image to find with 100% accuracy (no training -- cold)Occasionally some garbage text at head or tailTook an average of 3 seconds per image to test with 100% accuracyClean images had pattern scores of less than 10Stego images had pattern scores of 31 or more

Finding and Extracting Messages from BitmapsConclusionMessages are detectible and extractible from non-encrypted uncompressed imagesLinear messages can be found in any direction with more computationThis method can be foiled by hashing the message into the image

Detecting Messages in jpegsProblemCannot use an enumeration scheme to detect or find a messageMay only be able to detect because of encoding schemes and encryptionCannot see message in imageStatistical properties of an image change when a message is injected

Detecting Messages in jpegsProcedureObtain the 4-level 2-D wavelet decomposition of the imagesObtain the orientation decomposition of frequency space statistics72 features plus the class (0 = clean, 1=stego)Includes: mean, variance, skewness and kurtosis of coefficients and error for prediction in subbandNormalize the data by 0-1 min-maxTrain Fisher Linear Descriptor (FLD)Test the FLD threshold-0.004 17.120 120.485 0.059 0.363 1.041 3.809 -0.291-0.146 838.622 97.874 0.887 0.034 1.391 3.948 -0.703-2.200 15627.538 47.077 -1.128 -0.465 2.060 3.726 -0.7380.011 15.318 90.017 0.594 0.268 0.969 3.877 -0.172-0.523 920.19 62.226 -1.366 -0.146 1.326 3.944 -0.7054.418 15572.229 23.531 -0.123 -0.541 1.980 3.571 -0.705-0.004 0.935 182.339 -1.808 0.601 1.226 4.692 0.205-0.079 193.451 364.874 -9.569 -0.116 1.133 4.244 -0.5771.899 3640.213 24.731 0.766 -0.349 1.681 3.426 -0.62500.590963 0.050189 0.080103 0.345166 0.343829 0.332710 0.001311 0.0213740.482941 0.094929 0.084698 0.411032 0.331954 0.572352 0.260870 0.3372640.135543 0.065238 0.079329 0.542244 0.187500 0.603208 0.306227 0.4248660.370270 0.032725 0.025054 0.381317 0.412698 0.385321 0.001666 0.0430850.402427 0.053992 0.155397 0.553661 0.476190 0.432629 0.237224 0.2716980.422609 0.096439 0.087974 0.463496 0.471598 0.242233 0.153389 0.3604470.395349 0.026724 0.044753 0.738226 0.479060 0.367367 0.073430 0.3613450.427911 0.042625 0.055986 0.558653 0.350634 0.332762 0.165738 0.3010110.611057 0.054988 0.166710 0.497393 0.518569 0.373766 0.153005 0.3206110 meanV12 meanH12 meanD12 varV12 varH12 varD12 skwV12 skwH12skwD12 krtV12 krtH12 krtD12 meanEv12 meanEh12 meanEd12 varEv12varEh12 varEd12 skwEv12 skwEh12 skwEd12 krtEv12 krtEh12 krtEd12meanV23 meanH23 meanD23 varV23 varH23 varD23 skwV23 skwH23skwD23 krtV23 krtH23 krtD23 meanEv23 meanEh23 meanEd23 varEv23varEh23 varEd23 skwEv23 skwEh23 skwEd23 krtEv23 krtEh23 krtEd23meanV34 meanH34 meanD34 varV34 varH34 varD34 skwV34 skwH34skwD34 krtV34 krtH34 krtD34 meanEv34 meanEh34 meanEd34 varEv34varEh34 varEd34 skwEv34 skwEh34 skwEd34 krtEv34 krtEh34 krtEd34class

Detecting Messages in jpegsObservationTrials performed on 2000 images1000 clean and 1000 stegoRandom selection of 1000 instances without replacement (500 each class)Messages in stego had sufficient sizeResults show overwhelming accuracyBior3.1 True Neg 100%, True Pos 98.6%Rbio5.5 True Neg 99.8%, True Pos 98.8%

Detecting Messages in jpegsConclusionMessages of sufficient size can be detected in stego images with great accuracyImproved accuracy may be due to a large training set1000 (800/200)500 (400/100)Restricted domainMany similar images

Detecting Messages in jpegsProblemsAuthors did not handle log of zero problemReplaced with small valueDiffering jpeg sizes need differing message sizesDynamic message injection

Detecting Messages in jpegsOther ClassifiersTests were run on J4.8, SMO, Logistic and Nave Bayes for bior3.1 and rbio5.5 with 80/20 split and default settingsResults

Future WorkWould like to find optimal stemsPattern matchingText miningCryptanalysisWould like to optimize TestMsg codeC/assembly code

ReferencesPetitcolas, F.A.P., Anderson, R., Kuhn, M.G., "Information Hiding - A Survey", July1999, URL: http://www.cl.cam.ac.uk/~fapp2/publications/ieee99-infohiding.pdf (11/26/0117:00)Farid, Hany, Detecting Steganographic Messages in Digital Images Department of Computer Science, Dartmouth College, Hanover NH 03755Moby Words II, Copyright (c) 1988-93, Grady Ward. All Rights Reserved.Lyu, Siwei and Farid, Hany, Steganalysis Using Color Wavelet Statistics and One-Class Support Vector Machines, Department of Computer Science, Dartmouth College, Hanover, NH 03755, USAFarid, Hany, Detecting Hidden Messages Using Higher Order Statistical Models Department of Computer Science, Dartmouth College, Hanover NH 03755

Spy Vs. Spyby Antonio Prohias from MAD Magazine

Have a good Winter Break!