Paper: Detecting Low Embedding Rates

Author: Andreas Westfeld

Information Hiding Workshop 2002 (IHW 2002)
Noordwijkerhout, The Netherlands, 7–9 October 2002

Springer-Verlag Berlin Heidelberg,
LNCS 2578, pp. 324–339, 2003.


Abstract

This paper shows three approaches for detecting steganograms with low change density. MP3Stego is a steganographic algorithm with a very low embedding rate. The attack presented here is a statistical analysis of block sizes. It is able to detect 0.001 % of steganographic payload in MP3 files. The second approach is the use of hash functions to combine sample categories for the chi-square attack. One of these hash functions enables us to detect about 0.2 bits per pixel in true colour images. Another algorithm (Hide) was presented at the last workshop and constructed to be secure against visual and statistical chi-square attacks. The detection method for Hide combines the three colour components of each pixel to recognise an increased number of "neighbour colours".

From StegoRN

這篇論文提出三個偵測低嵌入量(改變量)的隱藏分析技術:

1. 針對 MP3Stego -
分析 MP3 檔案中, 每一個 block 的大小, 透過統計的方式找到一般 MP3 檔案不會出現的特徵, 藉此判定是否被 MP3Stego 這個隱藏工具嵌入機密訊息。實驗結果顯示, 當嵌入量為 MP3 檔案所能提供嵌入量的 0.001% 時, 此論文所提出的方法就可以辨識出來。

2. 提升卡方攻擊法(Chi-Square Attack)的偵測能力
第二個技術是透過雜湊函數(hash function) 整合樣本分群(sample category), 然後再使用原來的卡方攻擊法分析。本論文提到透過某種雜湊函數確實可以使卡方攻擊法偵測出儘含有 0.2 bpp 的彩色影像(true color image)。

3. 針對 Hide
Hide 是 IHW 2001 所提出來的隱藏軟體, 其使用的 LSB Matching 的技術可以抵抗卡方攻擊法的分析。這篇論文透過觀察每個色彩的臨色總數(the number of neighbor colors), 發現嵌有機密訊息的影像, 臨色總數明顯增加許多。

From StegoRN

From StegoRN

From StegoRN

An Implementation of Key-Based Digital Signal Steganography

Author: Toby Sharp

Information Hiding Workshop 2001
Pittsburgh, PA, USA, April 25–27, 2001

Spring LNCS 2137, pp. 13-26, 2001

Abstract
A real-life requirement motivated this case study of secure covert communication. An independently researched process is described in detail with an emphasis on implementation issues regarding digital images. A scheme using stego keys to create pseudorandom sample sequences is developed. Issues relating to using digital signals for steganography are explored. The terms modified remainder and unmodified remainder are defined. Possible attacks are considered in detail from passive wardens and methods of defeating such attacks are suggested. Software implementing the new ideas is introduced, which has been successfully developed, deployed and used for several years without detection.

在談論這篇論文所使用的嵌入技術之前, 必須要先弄清楚 Pseudo-Random Sequence Generator 的運作方式。作者運用一個 Linear Feedback Shift Register (LFSR) 及使用傳訊者(sender) 和接收者(receiver) 所共同擁有的 stego-key 來建立與初始化這個 LFSR, 產生一連串的擬隨機序列。

使用 LFSR 所產生的擬隨機序列, 就可以決定要將訊息嵌入到 cover signal 的哪些 samples 之中, 作者稱造訪次序(visiting order) 為 sample sequence。假設 cover signal 一共有 P 個 samples, 令 t = log2(P), 因此我們就可以用 LFSR 所產生的 t 個位元來代表一個數字 k , 所以, 下一個要造訪的就是第 k 個 sample。作者在論文中還提到: 如果已經嵌入 x 位元, 剩下 (P-x) samples, 因此只要使用 t' = log2(P-x) 個擬隨機位元就可以決定下一個要造訪的 sample 了。

由上面的討論我們知道 sample sequence 是和 stego-key 值相關的, stego-key 不同, 所造訪的次序就不相同。除了和 stego-key 相關, 為了讓 sample sequence 也與 cover signal 及 embedded data相關, 作者還將所造訪的 sample value 的 Most significant Bit (MSB) 及 Least Significant Bit (LSB) 分別取出, 做為下一個擬隨機次序的前兩個位元。 而 MSB 所代表的就是 sample value, LSB 所代表的就是 embedded data。

這篇論文最重要的核心嵌入技術描述在 p. 15 的最後一段:

When a sample is visited, its data value is modified so that its least significant bit (LSB) is equal to the next bit of the secret data. The LSBs are not simply replaced; instead the whole sample value is incremented or decremented if the LSBs differ. This avoids the "pairs of values" statistical attack introduced in [9]. At each sample, one operation bit is taken from the generator and, if required, is used to determine whether to increment or decrement the sample value.

很可惜地, 論文中提到的隱藏工具 Hide, 網路上已經找不到下載點了。A. Westfeld 在 IHW 2002 年所提出的論文 "Detecting Low Embedding Rates" 中有一張執行的初始畫面(Fig. 6),

　
在本篇論文的 Fig.4 則是展示使用者介面。