Paper: Detecting Low Embedding Rates

Author: Andreas Westfeld

Information Hiding Workshop 2002 (IHW 2002)
Noordwijkerhout, The Netherlands, 7–9 October 2002

Springer-Verlag Berlin Heidelberg,
LNCS 2578, pp. 324–339, 2003.


Abstract

This paper shows three approaches for detecting steganograms with low change density. MP3Stego is a steganographic algorithm with a very low embedding rate. The attack presented here is a statistical analysis of block sizes. It is able to detect 0.001 % of steganographic payload in MP3 files. The second approach is the use of hash functions to combine sample categories for the chi-square attack. One of these hash functions enables us to detect about 0.2 bits per pixel in true colour images. Another algorithm (Hide) was presented at the last workshop and constructed to be secure against visual and statistical chi-square attacks. The detection method for Hide combines the three colour components of each pixel to recognise an increased number of "neighbour colours".

From StegoRN

這篇論文提出三個偵測低嵌入量(改變量)的隱藏分析技術:

1. 針對 MP3Stego -
分析 MP3 檔案中, 每一個 block 的大小, 透過統計的方式找到一般 MP3 檔案不會出現的特徵, 藉此判定是否被 MP3Stego 這個隱藏工具嵌入機密訊息。實驗結果顯示, 當嵌入量為 MP3 檔案所能提供嵌入量的 0.001% 時, 此論文所提出的方法就可以辨識出來。

2. 提升卡方攻擊法(Chi-Square Attack)的偵測能力
第二個技術是透過雜湊函數(hash function) 整合樣本分群(sample category), 然後再使用原來的卡方攻擊法分析。本論文提到透過某種雜湊函數確實可以使卡方攻擊法偵測出儘含有 0.2 bpp 的彩色影像(true color image)。

3. 針對 Hide
Hide 是 IHW 2001 所提出來的隱藏軟體, 其使用的 LSB Matching 的技術可以抵抗卡方攻擊法的分析。這篇論文透過觀察每個色彩的臨色總數(the number of neighbor colors), 發現嵌有機密訊息的影像, 臨色總數明顯增加許多。

From StegoRN

From StegoRN

From StegoRN

關於 Jsteg 的點點滴滴 (六) : A. Westfeld

Andreas Westfeld & Andreas Phitzmann 在 IHW99 的論文 "Attacks on Steganographic System" 中, 曾經三次提到 Jsteg:

1. 在 P.3 提到 Tinsley 的年度報告中有介紹一種關於 Jsteg 的攻擊方法。其實, Tinsley 另外還提出 j1, j2 兩個新嵌入法。

Related to this work is Final Year Project of Tinsley on Steganography and JPEG Compression. He describes statistical attacks applied to Jsteg using a different statistical model.

2. P.8 說明為什麼提出來的 Visual Attack 無法運用在破解 Jsteg。

Jsteg - embedding in a transformed domain. Jsteg embeds in JPEG images. In JPEG images, the image content is transformed into frequency coefficients to achieve storage as compact as possible. There is no visual attack in the sense presented here, because one steganographic bit influences up to 256 pixels.

3. P.12 最後, 運用作者所提出來的 Chi-Square Attack, 就可以成功破解 Jsteg。

Jsteg - embedding in a transformed domain. As already noted in Sect. 3, visual attacks do not work concerning Jsteg. Since Jsteg (as EzStego) embeds bits continuously, we use the former presentation of Fig. 16 in Fig 17, Fig. 18 and Fig. 19. The show that our statistical test is quite effective concerning Jsteg as well.

Andreas Westfeld 在 IHW01 的論文 "F5 - A Steganographic Algorithm High Capacity Despite Better Steganalysis" , 也有一整個章節在介紹 Jsteg, Figure 4 甚至將 C 的程式碼給貼出來, 最後, Westfeld 還自己在 IHW99 提出來 Chi-Square Attack 來說明 Jsteg 是不夠安全的。對了, 值得一提的是在判斷 DCT 係數不等於 0 或 1 的方法, Westfeld 的 C 程式是這樣寫的 if ((inval & 1) != inval), inval 就是 DCT 係數, ( inval & 1 ) 是用 bitwise operator & 將 LSB 前面的 bits 通通設為 0 了, 如果這樣做之後, inval 的值仍然沒有改變, 表示一定等於 0 或 1。一般簡單又明瞭的寫法是 if (( inval !=0)||(inval!=1)), 大家可以比較參考一下。

This algorithm made by Derek Upham serves as a starting point for the contemplation here, because it is resistant against the visual attacks presented in [5], and nevertheless offers an admirable capacity for steganographic messages (e. g., 12.8 % of the steganogram’s size). After quantisation, Jsteg replaces the least significant bits (LSB) of the frequency coefficients by the secret message. The embedding mechanism skips all coefficients with the values 0 or 1. Fig. 4 shows Derek Upham’s embedding function of Jsteg in C source code.

However, the statistical attack [5] on Jsteg reliably discovers the existence of embedded messages, because Jsteg replaces bits and, thus, it introduces a dependency between the value’s frequency of occurrence, that only differ in this bit position (here: LSB). Jsteg influences pairs of the coefficient’s frequency of occurrence, as Fig. 5 shows.