Sunday, December 06, 2009

My presentation at PSIVT 2009

An Advanced Least-Significant-Bit Embedding Scheme for Steganographic Encoding

Yeuan-Kuen Lee, Graeme Bell, Shih-Yu Huang,
Ran-Zan Wang and Shyong Jian Shyu

The 3rd Pacific-Rim Symposium on Image and Video Technology ( PSIVT 2009 )
Tokyo, Japan, January 13th - 16th, 2009
Official Website: http://psivt2009.nii.ac.jp/



Presentation PPT

Wednesday, October 07, 2009

Arabic Text Staganography Using Multiple Diacritics

Adnan A. Gutub, Yousef S. Elarian, Sameh M. Awaideh and Aleem K. Alvi, 'Arabic Text Staganography Using Multiple Diacritics,' 2008 5th IEEE International Workshop on Signal Processing and Its Applications (WoSPA 2008), 18-20 March 2008, University of Sharjah, Sharjah, United Arab Emirates. [ PDF ]

Abstract

Steganography techniques are concerned with hiding the existence of data in other cover media. Today, text steganography has become particularly popular. This paper presents a new idea for using Arabic text in steganography. The main idea is to superimpose multiple invisible instances of Arabic diacritic marks over each other. This is possible because of the way in which diacritic marks are displayed on screen and printed to paper. Two approaches and several scenarios are proposed. The main advantage is in terms of the arbitrary capacity. The approach was compared to other similar methods in terms of overhead on capacity. It was shown to exceed any of these easily, provided the correct scenario is chosen.

要弄懂這篇論文所提出來的嵌入技術之前, 確實是需要對阿拉伯文的組成有些基本了解。論文的第二節就提供了關於阿拉伯文的背景知識。

點(dots) 和連接符號(connectivity) 是阿拉伯文字演進所遺留下的兩項特性。

有些阿拉伯字母有 1 個點, 有些有 2 個點, 有些則有 3 個點, 點的旁邊還可以再加上音標(diacritic marks), 我們可以從 Fig. 7 中看到一些例子, 包括點還有出現在文字上下的扭曲音標符號。

From StegoRN

在 21 世紀電腦辭典中, Hamzah 是阿拉伯文字中, 代表閉鎖音之符號;
Merriam-Webster 線上字典的解釋如下:
Hamzah
the sign for a glottal stop in Arabic orthography usually represented in English by an apostrophe

連接符號(connectivity)是書寫阿拉伯文所自然產生的特性, 可將字母完美地連接在一起, 在文件中是完全沒有意義的, 一般稱為 Kashida

這篇論文的主要構想(idea)來自於電腦如何顯示(或)列印這些阿拉伯文音標!

當電腦要顯示一篇阿拉伯文章時, 讀取下一個內碼, 如果是一個音標, 音標顯示完成後, 游標並不會往前移動, 而是留在原處不動, 並繼續讀取下一個內碼。因此, 如果檔案中存在連續好幾個相同的音標, 或是只存在一個音標, 螢幕顯示的結果都是完全一樣的。因此, 如果用人眼看, 是完全看不出異樣的!

作者提出了 2 個方法來實作這個構想: 文字法(textual approach) 影像法(image approach)

文字法最主要是討論如何將機密訊息編碼, 再嵌入到文章之中。以機密訊息為 110001 為例: 由於二進位的 110001 等於十進位的 49, 因此最簡單的做法就是直接將額外的 49 個相同音標放到文件的第一個音標之後。這樣做的好處是可以嵌入任意大小的機密訊息, 完全不受限制。然而, 機密訊息越長, 要嵌入的音標個數會呈指數成長, 實際上並不可行。

一個變通的方法就是將機密訊息切成一個一個區塊 , 再將區塊中的機密訊息轉成十進位數字, 然後再將額外的音標, 增加到文章中不同的音標後面。同樣以機密訊息 110001 為例, 如果區塊大小為 2, 那麼就會切成 (11)=3, (00)=0, (01)=1, 那麼文章中第 1 個音標後面就會再增加 3 個相同音標, 文章的第二個音標就會增加 0 個音標, 文章中第 3 個音標就會增加 1 個額外的相同音標。所增加的音標總數為 3 + 0 + 1 = 4。

作者提出另一種編碼的方式是同值長度編碼(run length encoding, RLE), 同樣以機密訊息 110001 為例, 經過 RLE 編碼後, 得到 2, 3, 1 , 由於每個 run 的長度不可能為 0, 因此, 只要將每個音標的個數變成 2, 3, 1 即可, 換句話說, 文章中第 1 個音標後面就會再增加 1 個相同音標, 文章的第 2 個音標就會增加 2 個音標, 文章中第 3 個音標就會增加 0 個額外的相同音標, 所增加的音標總數為 (2-1) + (3-1) + (1-1) = 3。

影像法是用來處理文件列印的情況, 分成 softcopyhardcopy 兩種, 前者指的是將文件輸出成列印的檔案, 如 PDF 檔案; 後者則是確實輸出到紙張上。

作者指出在同一個位置重覆列印音標確實會使得該音標看起來較暗一些, 由於亮度並不容易區別, 因此建議採用較小的區塊(2 位元)來編碼, 換句話說, 重覆列印的次數不大於 4 次。

論文的 § 5 Comparison to Similar Techniques, 作者從 capacity 的角度和其他方法做比較。但我還是覺得如果沒有解決 security 的問題, 即使 capacity 再大, 也是枉然。基本上, 作者所提出的技術演算法公開了, stego-text 是很容易被自動分辨出來的, 所以並不符合所謂的「柯克霍夫原則 (Kerckhoffs' Principle)」

PS: 柯克霍夫原則 (Kerckhoffs' Principle)
密碼系統的安全性不在於防止敵人洞悉密碼演算法, 鑰匙的保密才是決定密碼安全性的唯一關鍵。The Security of cryptosystem must not depend on keeping secret of crypto-algorithm. The security depends only on keeping secret the key.

Monday, September 28, 2009

Arabic Diacritics Based Steganography

Mohammed A. Aabed, Sameh M. Awaideh, Abdul-Rahman M. Elshafei and Adnan A. Gutub, 'Arabic Diacritics Based Steganography,' 2007 IEEE International Conference on Signal Processing and Communications (ICSPC 2007), 24-27 November 2007, Dubai, United Arab Emirates. [ PDF ]

Abstract

New steganography methods are being proposed to embed secret information into text cover media in order to search for new possibilities employing languages other than English. This paper utilizes the advantages of diacritics in Arabic to implement text steganography. Diacritics - or Harakat - in Arabic are used to represent vowel sounds and can be found in many formal and religious documents. The proposed approach uses eight different diacritical symbols in Arabic to hide binary bits in the original cover media. The embedded data are then extracted by reading the diacritics from the document and translating them back to binary.

Diacritics 就是音標的意思, 換句話說, 就是出現在文字旁邊用來表示不同發音的發音符號。作者在 Table 1 中列出了阿拉伯文的 8 種主要的音標。阿拉伯人用這些音標來改變發音或是用來區別不同字義但拼法卻相似的文字(to alter the pronunciation of a phoneme or to distinguish between words of similar spelling)。由於這些音標在文章中是可有可無的(optional), 因此, 作者提出了本篇利用音標來嵌入機密訊息到阿拉伯文章的論文。

From StegoRN

根據作者的統計分析指出, 上述 8 個音標, 出現頻率最高的是 Fatha, 幾乎等於其他 7 種音標出現的總合。因此, 機密訊息 1 被指定嵌入於 Fatha 所出現的位置中, 機密訊息 0 則被指定嵌入於其他 7 種音標所出現的位置。

本篇論文所提出的 嵌入程序(embedding process) 如下:

選定一篇所有文字都標有音標的掩護文章(a fully diacritized Arabic text), 然後從文章的開頭開始向下搜尋,

如果要嵌入的機密訊息是 1, 掩護文章中所遭遇的文字的音標剛好也是 Fatha, 那就完全不更改掩護文章上的文字, 如果所遭遇的文字的音標不是 Fatha, 而是其他 7 種音標, 則刪去該音標; 然後, 繼續在掩護文章中尋找下一個文字, 如果還是其他 7 種音標, 繼續刪去音標, 直到遭遇帶有 Fatha 的文字;

如果要嵌入的機密訊息是 0, 掩護文章中所遭遇的文字的音標並不是 Fatha, 而是其他 7 種音標, 那就完全不更改掩護文章上的文字, 如果所遭遇的文字的音標是 Fatha, 則刪去 Fatha 音標; 然後, 繼續在掩護文章中尋找下一個文字, 如果還是 Fatha , 則繼續刪去, 直到遭遇其他 7 種音標為止。

萃取程序(extracting process)

要取出機密訊息則是從文章的開頭開始向下搜尋帶有音標的文字, 只要判斷該音標為何? 就可以知道此位置所藏的機密訊息為何?

嵌入容量

這篇論文所提出的嵌入技術, 嵌入容量其實非常容易估計, 只要去算算整篇文章最後留下多少音標, 就是嵌入機密訊息的長度。理論上, 假使音標是隨機出現, 藏入的 0, 1 機密訊息也是隨機的, 那就是有 50% 的音標會被保留下來; 然而, 作者在論文中指出, 平均嵌入容量約為 26.16% (= 50% * 3.27% / 6.25% ), 個人覺得應該是阿拉伯文中存在某種的發音特質, 使得音標出現的次序並不是隨機的, 造成嵌入容量無法達到理論值的緣故。

這篇論文最有趣的一點是作者指出所提出的隱藏技術可能會引起別人的注意:

From StegoRN

換句話說, 當你需要使用隱藏技術來掩護秘密通訊的行為時, 你敢使用這篇論文所提出的技術嗎?

恐怕, 作者自己都不敢!

但, 作者很誠實就是了 :)

Wednesday, September 23, 2009

A Novel Arabic Text Steganography Method Using Letter Points and Extensions

Adnan A. Gutub and Manal M. Fattani, 'A Novel Arabic Text Steganography Method Using Letter Points and Extensions,' WASET International Conference on Computer, Information and Systems Science and Engineering (ICCISSE 2007), 25-27 May 2007, Vienna, Austria. [ PDF ]

Abstract

This paper presents a new steganography approach suitable for Arabic texts. It can be classified under steganography feature coding methods. The approach hides secret information bits within the letters benefiting from their inherited points. To note the specific letters holding secret bits, the scheme considers the two features, the existence of the points in the letters and the redundant Arabic extension character. We use the pointed letters with extension to hold the secret bit ‘one’ and the un-pointed letters with extension to hold ‘zero’. This steganography technique is found attractive to other languages having similar texts to Arabic such as Persian and Urdu. Keywords — Arabic text, Cryptography, Feature coding, Information security, Text steganography, Text watermarking.

論文的 Introduction 中, 作者討論到隱藏學(or 偽裝學, steganography) 這個領域應該要從三個角度來探討: 嵌入容量(capacity), 安全性(security) and 強韌性(Robustness)。作者也討論到 steganography 與 cryptography, 還有與 watermarking 之間的差異。

然而, 比較可惜的一點是作者並沒有指出不同的應用, 對各種需求有極大的差異。例如: steganography 的目的是秘密通訊, 要求整個通訊行為絕對不可以引起監控人員(or一般人)的絲毫懷疑。如果沒有辦法做到這一點, 換句話說, 在沒有保證絕對安全(security)的情況下, 縱使有再大的嵌入容量, 終究也是一套完全沒用的技術。

這篇論文所提出來的技術, 用到了阿拉伯文(Arabic)的兩個特徵:
1. 28 個阿拉伯文字母中, 有 15 個字母有點, 其餘 13 個則沒有點。(Fig.1)
2. 可以在字母前後加入不影響語意的擴充文字(extension)。

From StegoRN

因此, 本篇論文所提出的 嵌入程序(embedding process) 如下:

從文章的開頭開始向下搜尋,

如果想要嵌入的機密訊息為 1, 則尋找下一個有點文字(pointed letter), 如果這個有點文字允許加入擴充文字, 則加入擴充文字, 代表此處嵌有機密訊息, 如果不允許加入擴充文字, 則放棄, 再尋找下一個有點文字;

如果想要嵌入的機密訊息為 0, 則尋找下一個無點文字(un-pointed letter), 如果這個無點文字允許加入擴充文字, 則加入擴充文字, 代表此處嵌有機密訊息。同樣地, 如果這個無點文字並不允許加入擴充文字, 則放棄, 再尋找下一個無點文字。

萃取程序(extracting process)

要取出機密訊息則是從文章的開頭開始向下搜尋擴充文字, 當找到擴充文字時, 只要判斷該文字是否為有點或無點文字(pointed or un-pointed letter), 就可以知道此位置所藏的機密訊息為何?

這篇論文完全沒有討論到一篇加入不少擴充文字(extensions)的文章是否會引起別人的懷疑, 在阿拉伯文中, 擴充文字的使用狀況為何? 總之, 一個隱藏技術所應該面對的安全問題, 卻完全沒有討論, 真的很可惜 !

Monday, September 21, 2009

About Arabic Text Steganography (1)

Prof. Adnan Abdul-Aziz Gutub 是沙烏地阿拉伯(Saudi Arabia) 法德國王石油與礦物大學(King Fahd University of Petroleum and Minerals) 電腦工程學系(Computer Engineering Department) 的主席。

最近連續研讀了四篇 Prof. Adnan Abdul-Aziz Gutub 所發表的研討會論文, 論文主軸都是圍繞在 Arabic Text Steganography, 也就是將機密訊息藏在 Arabic Text 檔案之中, 希望達到秘密通訊的目的。

這四篇論文分別如下:

1. Adnan A. Gutub and Manal M. Fattani,
'A Novel Arabic Text Steganography Method Using Letter Points and Extensions,'
WASET International Conference on Computer, Information and Systems Science and Engineering (ICCISSE 2007),
25-27 May 2007, Vienna, Austria. [ PDF ]

2. Mohammed A. Aabed, Sameh M. Awaideh, Abdul-Rahman M. Elshafei and Adnan A. Gutub,
'Arabic Diacritics Based Steganography,'
2007 IEEE International Conference on Signal Processing and Communications (ICSPC 2007),
24-27 November 2007, Dubai, United Arab Emirates. [ PDF ]

3. Adnan A. Gutub, Yousef S. Elarian, Sameh M. Awaideh and Aleem K. Alvi,
'Arabic Text Staganography Using Multiple Diacritics,'
2008 5th IEEE International Workshop on Signal Processing and Its Applications (WoSPA 2008),
18-20 March 2008, University of Sharjah, Sharjah, United Arab Emirates. [ PDF ]

4. Fahd Al-Haidai, Adnan A. Gutub, Khalid Al-Kahsah and Jameel Hamodi,
'Improving Security and Capacity for Arabic Text Steganography Using Kashida Extensions,'
2009 IEEE/ACS International Conference on Computer Systems and Applications,
10-13 May 2009, Rabat Morocco. [ PDF ]

Saturday, September 12, 2009

News: Gordon Brown: I'm proud to say sorry to a real war hero

Gordon Brown: I'm proud to say sorry to a real war hero
The treatment of code-breaker Alan Turing was utterly unfair, says Gordon Brown

By Gordon Brown
Published: 9:30PM BST 10 Sep 2009
Original Link

This has been a year of deep reflection – a chance for Britain, as a nation, to commemorate the profound debts we owe to those who came before. A unique combination of anniversaries and events have stirred in us that sense of pride and gratitude that characterise the British experience. Earlier this year, I stood with Presidents Sarkozy and Obama to honour the service and the sacrifice of the heroes who stormed the beaches of Normandy 65 years ago. And just last week, we marked the 70 years which have passed since the British government declared its willingness to take up arms against fascism and declared the outbreak of the Second World War.

So I am both pleased and proud that, thanks to a coalition of computer scientists, historians and LGBT (lesbian, gay, bisexual and transgender) activists, we have this year a chance to mark and celebrate another contribution to Britain's fight against the darkness of dictatorship: that of code-breaker Alan Turing.

From StegoRN
Computer pioneer Alan Turing, who helped crack German Enigma codes during WWII

Turing was a quite brilliant mathematician, most famous for his work on breaking the German Enigma codes. It is no exaggeration to say that, without his outstanding contribution, the history of the Second World War could have been very different. He truly was one of those individuals we can point to whose unique contribution helped to turn the tide of war. The debt of gratitude he is owed makes it all the more horrifying, therefore, that he was treated so inhumanely.

In 1952, he was convicted of "gross indecency" – in effect, tried for being gay. His sentence – and he was faced with the miserable choice of this or prison – was chemical castration by a series of injections of female hormones. He took his own life just two years later.

Thousands of people have come together to demand justice for Alan Turing and recognition of the appalling way he was treated. While Turing was dealt with under the law of the time, and we can't put the clock back, his treatment was of course utterly unfair, and I am pleased to have the chance to say how deeply sorry I and we all are for what happened to him. Alan and the many thousands of other gay men who were convicted, as he was convicted, under homophobic laws, were treated terribly. Over the years, millions more lived in fear in conviction. I am proud that those days are gone and that in the past 12 years this Government has done so much to make life fairer and more equal for our LGBT community. This recognition of Alan's status as one of Britain's most famous victims of homophobia is another step towards equality, and long overdue.

But even more than that, Alan deserves recognition for his contribution to humankind. For those of us born after 1945, into a Europe which is united, democratic and at peace, it is hard to imagine that our continent was once the theatre of mankind's darkest hour. It is difficult to believe that in living memory, people could become so consumed by hate – by anti-Semitism, by homophobia, by xenophobia and other murderous prejudices – that the gas chambers and crematoria became a piece of the European landscape as surely as the galleries and universities and concert halls which had marked out the European civilisation for hundreds of years.

It is thanks to men and women who were totally committed to fighting fascism, people like Alan Turing, that the horrors of the Holocaust and of total war are part of Europe's history and not Europe's present. So on behalf of the British government, and all those who live freely thanks to Alan's work, I am very proud to say: we're sorry. You deserved so much better.

Wednesday, May 06, 2009

Entropy-Coded Segment (ECS) in Rex.jpg



Rex.jpg 影像中的第一個 Entropy-coded segment (ECS) 是出現在 Rex.pdf 文件 page: 24 的 0000373eh ~ 00003826h, 從 F9 85 ... 一直到 49 7F, 一共有 233 個 Bytes.

從 page:23 00003586h 的 DRI Segment, 我們可以得知一個 ECS 中包含了 15 個 MCUs (minimum coded unit), 每一個 MCU 則分別包含一個 8*8 的 Y 亮度區塊, 一個 Cb 色差區塊, 一個 Cr 色差區塊。因此, 這個 233 位元長的 ECS 區段總共包含了 45 個 8*8 的 DCT 係數區塊。

使用 Rex-HuffmanTable.pdf 的 4 個 Huffman Tables, 我們可以將第一個 ECS 還原成 DCT 係數, 詳細的還原過程, 我們記錄在 Rex-Decoding-ECS0.pdf 檔案中, 有興趣的人可以自行下載、查驗。

接在第一個 ECS 後面的是一個 Define Restart Interval (DRI) Marker, 編號從 0 開始, 所以是 'FFD0', 然後才是接著第二個 ECS, 範圍是在文件中 page: 24 的 00003829h ~ 00003951h, 從 F9 8D ... 一直到 A4 BF, 一共有 297 個 Bytes. 後面接著第 2 個 DRI Marker - 'FFD1' , 然後就是開始第三個 ECS。

Rex.jpg 中, 一共有 15 個 ECS, 被 14 個 DRI Marker 分隔著, 編號從 0 開始增加, 最大編號是 7, 然後又從 0 開始編號, 所以最後一個 DRI Marker 編號是 'FFD5' 。最大的編號是 7 的原因很簡單, 因為 'FFD8' 之後的 Marker 都有其各自的意義

14 個 DRI Marker 出現在 Rex.pdf 的位置分別如下:

  FFD0  page: 24 00003827h
  FFD1  page: 25 00003952h
  FFD2  page: 25 00003ab2h
  FFD3  page: 26 00003c31h
  FFD4  page: 27 00003debh
  FFD5  page: 27 00003f9ch
  FFD6  page: 28 000041cah
  FFD7  page: 29 000043cbh
  FFD0  page: 30 00004624h
  FFD1  page: 31 0000484ah
  FFD2  page: 32 00004adch
  FFD3  page: 33 00004d68h
  FFD4  page: 34 00005038h
  FFD5  page: 36 00005326h
 
 

Monday, April 27, 2009

DCT Coefficients in Rex.jpg



我將 Rex.jpg 解壓縮後, 所得到的 DCT 係數, 存放在 Rex-DCT Coefficients.xls 中, 給大家在寫解壓縮程式時, 可以做比對之用。

Thursday, April 09, 2009

Huffman Table in the Rex.jpg



使用 UltraEdit 將 Rex.jpg 檔以 16 進位表示法開啟, 可以得到 Rex.pdf 這份文件。在文件 Page: 23 的 0000358ch 位址上, 可以找到 X'FFDC marker, 整個 DHT (Define Huffman Table(s)) Segment 一直延續到 Page:24 的 0000372f h 結束。

DHT Segment 一共存放了 4 個 Huffman Tables, 使用 Huffman Table Generating Procedure 可以將 DHT Segment 轉換成 4 個 Huffman Tables,我將其存放在 Rex-HuffmanTable.pdf 文件中供人參考。

Sunday, March 08, 2009

News: Funding concentrated on elite might be a mistake

英調查發現 研究經費集中撥給精英大學恐是不智之舉

國科會 國際科技合作 簡訊網
原始文件連結
作者:駐英科技組 現職:駐英科技組
文章來源:Times Higher Education, 15-21 Jan., 2009, No. 1879
發佈時間:98.02.26

英國華威大學經濟學家及教授 Andrew Oswald 在近期調查報告中建議,未來研究經費應廣泛地分撥給各大學,避免集中於少數傳統精英大學之上。這份分析報告與最近英國高等教育評鑑(Research Assessment Exercise, RAE)的調查結果不謀而合,發現出產「世界級」研究並非少數以研究知名的精英大學之專利。

這份調查報告以經濟學學科領域為對象,分析 2001 到 2008 年間世界各大學所發表的經濟學研究報告,歸納出 450 篇得列「世界等級」之報告,這幾篇報告不僅曾先後發表於二十二份世界頂尖期刊雜誌,也是被引用率最高的報告。世界級報告中 43 篇來自英國,約佔總數 10%,當中 12篇來自倫敦政經學院(London School of Economics and Political Science),11篇來自牛津大學,6 篇來自華威大學,令人驚訝的是,將近四分之一的比例(另外 18 篇)則是來自「非傳統精英」大學,包括約克大學(University of York)、卡地夫大學(University of Cardiff)、肯特大學(University of Kent)、蘭卡斯特大學(University of Lancaster)和萊斯特大學(University of Leicester)。

Oswald 教授對此調查結果感到意外但也說明,這結果顯現許多大學都有能力創造傑出研究,非凡的研究成果並非少數精英大學之專利,因此僅將研究補助集中撥給少數精英大學恐為不智之舉。再者,英格蘭高等教育獎助委員會(Higher Education Funding Council for England, Hefce)的原創目的本是贊助「任何」卓越研究,而非特定大學之研究。

繼英國高等教育評鑑(RAE)和此報告公佈的調查結果後,未來英格蘭高等教育獎助委員會如何分配研究補助仍待決議,但可預期的是,補助撥款方式將直接受到連帶影響,預計資金會更廣泛地分撥給各大學,以涵蓋成就傑出之「非傳統精英」大學。換言之,羅素集團(英國 20 所研究型大學所組成)過去較多的補助難免因此受到刪減。

Funding concentrated on elite might be a mistake

A report conducted by Andrew Oswald, an economist and professor of the University of Warwick, suggested that future research funding should be spread more thinly and broadly across a wide range of universities, rather than concentrating on a small group of traditional research elite. This report echoed the RAE's (Research Assessment Exercise) findings that world-leading research is not exclusively produced by some small elite of large research universities.

Looking specifically into economics discipline, the report analysed research papers produced in the world between 2001 to 2008 and 450 papers were identified as ‘truly world-leading’, the most highly cited articles published in 22 of the world’s top journals. Among these papers, 43 were from the UK, amounting to about 10 per cent of the total. While many of these UK world-leading papers were produced by top half-dozen universities in the country, with 12 from the London School of Economics and Political Science, 11 from the universities of Oxford and 6 from Warwick, a surprising quarter (the other 18) however were contributed by universities of York, Cardiff, Kent, Lancaster, Leicester and Sheffield, which are not traditionally considered to be among the top rank.

Taken by surprise, Professor Oswald said that the result suggests outstanding work comes from a wide range of sources and therefore, it appears unreasonable if funding is narrowly concentrated on a small number of universities. After all, the original promise of the Higher Education Funding Council for England (Hefce) is to fund excellence wherever it is found, rather than excellence in specific institutions.

How Hefce would allocate funding following the RAE’s result, which is echoed by Professor Oswald’s, is yet to be determined. Nevertheless, some direct influence on the elite universities is expected. It is predicted that funding will be dispersed more thinly and broadly to cover a bigger group of universities, including those not considered to be top but producing extraordinary work. In other words, the elite, such as Russell Group, will lose funding inevitably.
 

Thursday, January 22, 2009

PSIVT 2009

2009/1/15



PSIVT 2009 是在日本東京的國家科學中心(National Center of Sciences) 舉行。


到此一遊 !



Prof. Shih-Yu Huang


Prof. Graeme Bell


我們這篇 paper "An Advanced Least-Significant-Bit Embedding Scheme for Steganographic Encoding" 的三位主要作者都來了, 將由我上台報告論文。


這張照片是銘傳大學與中華大學教授的合照,
最右邊就是中華大學資工系李建興教授, 我和李建興教授是同一個實驗室畢業的, 所以這一次就一起來到東京!


謝朝和教授和其夫人...


Springer 的攤位


這兩位這次都不用上台報告論文, 所以一派輕鬆 ...


Room A 就是我要上台報告的地方, 比一般研討會大很多, ...


Dr. Cees Snoke 是大會 Tutorial 2 的講者之一, 是來自荷蘭的年輕學者, 才 30 歲。這次演講的主題是 Concept-Based Video Retrieval。
晚宴前, 我們一起聊天...
 

Thursday, December 18, 2008

News: Terrorist instructions hidden online

2001/02/05 Jack Kelley 接連在《 USA Today 》發表兩篇報導, 指出美國官方及專家認為賓拉登及其組織可能透過將恐怖攻擊計畫藏在色情網站的圖片之中,或是運動聊天室來傳遞攻擊指令。

原始新聞連結 / Original Link
Terror groups hide behind Web encryption



02/05/2001 - Updated 05:17 PM ET
By Jack Kelley

WASHINGTON — Hidden in the X-rated pictures on several pornographic Web sites and the posted comments on sports chat rooms may lie the encrypted blueprints of the next terrorist attack against the United States or its allies. It sounds farfetched, but U.S. officials and experts say it's the latest method of communication being used by Osama bin Laden and his associates to outfox law enforcement. Bin Laden, indicted in the bombing in 1998 of two U.S. embassies in East Africa, and others are hiding maps and photographs of terrorist targets and posting instructions for terrorist activities on sports chat rooms, pornographic bulletin boards and other Web sites, U.S. and foreign officials say.

"Uncrackable encryption is allowing terrorists — Hamas, Hezbollah, al-Qaida and others — to communicate about their criminal intentions without fear of outside intrusion," FBI Director Louis Freeh said last March during closed-door testimony on terrorism before a Senate panel. "They're thwarting the efforts of law enforcement to detect, prevent and investigate illegal activities."

A terrorist's tool

Once the exclusive domain of the National Security Agency, the super-secret U.S. agency responsible for developing and cracking electronic codes, encryption has become the everyday tool of Muslim extremists in Afghanistan, Albania, Britain, Kashmir, Kosovo, the Philippines, Syria, the USA, the West Bank and Gaza and Yemen, U.S. officials say.

It's become so fundamental to the operations of these groups that bin Laden and other Muslim extremists are teaching it at their camps in Afghanistan and Sudan, they add.

"There is a tendency out there to envision a stereotypical Muslim fighter standing with an AK-47 in barren Afghanistan," says Ben Venzke, director of special intelligence projects for iDEFENSE, a cyberintelligence and risk management company based in Fairfax, Va.

"But Hamas, Hezbollah and bin Laden's groups have very sophisticated, well-educated people. Their technical equipment is good, and they have the bright, young minds to operate them," he said.

U.S. officials say bin Laden's organization, al-Qaida, uses money from Muslim sympathizers to purchase computers from stores or by mail. Bin Laden's followers download easy-to-use encryption programs from the Web, officials say, and have used the programs to help plan or carry out three of their most recent plots:

  * Wadih El Hage, one of the suspects in the 1998 bombing of two U.S. embassies in East Africa, sent encrypted e-mails under various names, including "Norman" and "Abdus Sabbur," to "associates in al Qaida," according to the Oct. 25, 1998, U.S. indictment against him. Hage went on trial Monday in federal court in New York.

  * Khalil Deek, an alleged terrorist arrested in Pakistan in 1999, used encrypted computer files to plot bombings in Jordan at the turn of the millennium, U.S. officials say. Authorities found Deek's computer at his Peshawar, Pakistan, home and flew it to the National Security Agency in Fort Meade, Md. Mathematicians, using supercomputers, decoded the files, enabling the FBI to foil the plot.

  * Ramzi Yousef, the convicted mastermind of the World Trade Center bombing in 1993, used encrypted files to hide details of a plot to destroy 11 U.S. airliners. Philippines officials found the computer in Yousef's Manila apartment in 1995. U.S. officials broke the encryption and foiled the plot. Two of the files, FBI officials say, took more than a year to decrypt.

"All the Islamists and terrorist groups are now using the Internet to spread their messages," says Reuven Paz, academic director of the Institute for Counter-Terrorism, an independent Israeli think tank.

Messages in dots

U.S. officials and militant Muslim groups say terrorists began using encryption — which scrambles data and then hides the data in existing images — about five years ago.

But the groups recently increased its use after U.S. law enforcement authorities revealed they were tapping bin Laden's satellite telephone calls from his base in Afghanistan and tracking his activities.

"It's brilliant," says Ahmed Jabril, spokesman for the militant group Hezbollah in London. "Now it's possible to send a verse from the Koran, an appeal for charity and even a call for jihad and know it will not be seen by anyone hostile to our faith, like the Americans."

Extremist groups are not only using encryption to disguise their e-mails but their voices, too, Attorney General Janet Reno told a presidential panel on terrorism last year, headed by former CIA director John Deutsch. Encryption programs also can scramble telephone conversations when the phones are plugged into a computer.

"In the future, we may tap a conversation in which the terrorist discusses the location of a bomb soon to go off, but we will be unable to prevent the terrorist act when we cannot understand the conversation," Reno said.

Here's how it works: Each image, whether a picture or a map, is created by a series of dots. Inside the dots are a string of letters and numbers that computers read to create the image. A coded message or another image can be hidden in those letters and numbers.

They're hidden using free encryption Internet programs set up by privacy advocacy groups. The programs scramble the messages or pictures into existing images. The images can only be unlocked using a "private key," or code, selected by the recipient, experts add. Otherwise, they're impossible to see or read.

"You very well could have a photograph and image with the time and information of an attack sitting on your computer, and you would never know it," Venzke says. "It will look no different than a photograph exchanged between two friends or family members."

U.S. officials concede it's difficult to intercept, let alone find, encrypted messages and images on the Internet's estimated 28 billion images and 2 billion Web sites.

Even if they find it, the encrypted message or image is impossible to read without cracking the encryption's code. A senior Defense Department mathematician says cracking a code often requires lots of time and the use of a government supercomputer.

It's no wonder the FBI wants all encryption programs to file what amounts to a "master key" with a federal authority that would allow them, with a judge's permission, to decrypt a code in a case of national security. But civil liberties groups, which offer encryption programs on the Web to further privacy, have vowed to fight it.

Officials say the Internet has become the modern version of the "dead drop," a slang term describing the location where Cold War-era spies left maps, pictures and other information.

But unlike the "dead drop," the Internet, U.S. officials say, is proving to be a much more secure way to conduct clandestine warfare.

"Who ever thought that sending encrypted streams of data across the Internet could produce a map on the other end saying 'this is where your target is' or 'here's how to kill them'?" says Paul Beaver, spokesman for Jane's Defense Weekly in London, which reports on defense and cyberterrorism issues. "And who ever thought it could be done with near perfect security? The Internet has proven to be a boon for terrorists."


原始新聞連結 / Original Link
Terrorist instructions hidden online



02/05/2001 - Updated 05:22 PM ET
By Jack Kelley

WASHINGTON — Osama bin Laden and other Muslim extremists are posting encrypted, or scrambled, photographs and messages on popular Web sites and using them to plan terrorist activities against the United States and its allies, U.S. officials say. The officials say bin Laden and his associates are using the Internet to conduct what some are calling "e-jihad," or holy war. Bin Laden, a dissident Saudi businessman, has been indicted for the 1998 bombing of two U.S. embassies in East Africa and is believed to be responsible for last fall's bombing of the USS Cole in Yemen. Four alleged bin Laden associates went on trial Monday in federal court in New York for the embassy bombings. "To a greater and greater degree, terrorist groups, including Hezbollah, Hamas, and bin Laden's al Qaida group, are using computerized files, e-mail, and encryption to support their operations," CIA Director George Tenet wrote last March to the Senate Foreign Relations Committee. The testimony, at a closed-door hearing, was later made public.

Through weeks of interviews with U.S. law-enforcement officials and experts, USA TODAY has learned new details of how extremists hide maps and photographs of terrorist targets — and post instructions for terrorist activities — on sports chat rooms, pornographic bulletin boards and other popular Web sites. Citing security concerns, officials declined to name the sites. Experts say it's difficult for law enforcement to intercept the messages.

"It's something the intelligence, law-enforcement and military communities are really struggling to deal with," says Ben Venzke, special projects director for iDEFENSE, a cyberintelligence company.

Officials and experts say the Internet is a new form of the "dead drop," a Cold War-era term for where spies left information. Officials and experts say the messages are scrambled using free encryption programs set up by groups that advocate privacy on the Internet. Those same programs also can hide maps and photographs in an existing image on selected Web sites. The e-mails and images can only be decrypted using a "private key" or code, selected by the recipient .

"The operational details and future targets, in many cases, are hidden in plain view on the Internet," Venzke says. "Only the members of the terrorist organizations, knowing the hidden signals, are able to extract the information."

Officials say bin Laden began using encryption five years ago, but recently increased its use after U.S. officials revealed they were tapping his satellite telephone calls in Afghanistan and tracking his activities.

"We will use whatever tools we can — e-mails, the Internet — to facilitate jihad against the (Israeli) occupiers and their supporters," Sheik Ahmed Yassin, the founder of the militant Muslim group Hamas said in a recent interview in the Gaza Strip. "We have the best minds working with us."

Sunday, December 14, 2008

Defending Against Statistical Steganalysis (part 3)

本篇文章延續 part 2 的討論, 將焦點鎖定在 Section 7 Analysis, 一篇完整的論文, 一定要從各方面去分析所提出的方法, 是否禁得起各方面的考驗。

作者首先交代實驗的影像來源為何?
To evaluate our correction algorithm, we embedded data into 54 pictures taken with a Fuji MX-1700 digital camera around Ann, Arbor, Michigan. The sizes of images is 640*480 pixels.


將照片從數位相機下載到電腦後, 作者設定壓縮品質參數為 75, 將影像重新壓縮, 用來模擬沒有嵌入任何機密訊息的影像。

這組影像中, 可用來嵌入機密訊息的 DCT 係數, 平均為 46,000 個, 最低為 30,000 個, 最高為 97,000。每一個 DCT 係數則提供了一個冗餘位元。 在還沒嵌入機密訊息之前, 作者注意到這些冗餘位元具有較多的 1 (a strong correlation toward one):
On average 63.8% of all the bits are set with a standard derivation of 3.4% between images.
接著, 作者將 Lewis Carroll (愛麗絲夢遊仙境 作者)所著的 "The Hunting of the Snark" 第一章內容 壓縮, 得到 14,700 位元的機密訊息。


Figure 7: Comparison between unmodified images, images with data embedded but without ststistical corrections, and finally images with data embedded plus statistical corrections.

Figure 7 顯示只針對冗餘位元運算的簡單統計結果。針對一個完全隨機, 8 位元大小的資料來源做 Maurer test 的實驗結果是 7.184。在沒有使用校正轉換 (No corrections) 的情況下, 我們注意到 entropy 是從 6.732±0.233 增加到 6.976±0.168, 在 One-Correlation 方面, 也是從 63.41%±3.50% 減少到 59.10%±3.19%; 然而, 當使用校正(Corrections)時, 不管是 One-Correlation 還是 Maurer test, 實驗結果都非常接近沒有嵌入機密訊息的 unmodified images。若僅僅針對那些具備 a priori estimate 的影像實驗, 作者注意到使用校正的實驗結果, 不管是 One-Correction 還是 Maurer test, 實驗結果都更接近未嵌入機密訊息的原始影像。因此, 可以知道使用簡單的統計測試是偵測不到機密訊息的。


Figure 8: The extended Chi-square test detects the embedding for image that has no statistical corrections. Our naive correction is even more detectable. However, an image that receives the proper statistical correction can not be distinguished from an unmodified image.

接下來, 作者要討論的對象是 DCT 係數直方圖 (DCT frequency histogram)。作者指出在使用校正功能的情況下, 將直方圖直接畫出來是無法注意到和原始影像的差別的。Figure 8 則顯示出針對 extended Chi-square test 的實驗結果, 作者指出使用 Algorithm 1 做校正, extended Chi-square test 在影像的每一部分所計算出的嵌入機率(probability of embedding)都是接近 0 的。

Back to: Defending Against Statistical Steganalysis (part 1)
Back to: Defending Against Statistical Steganalysis (part 2)


Niels Provos, "Defending Against Statistical Steganalysis,"10th USENIX Security Symposium, August 13-17, 2001.

Thursday, December 04, 2008

Defending Against Statistical Steganalysis (part 2)

本篇文章延續 part 1 的討論, 將焦點鎖定在 Section 6 Correcting Statistical Deviations, 探討 OutGuess 0.2 是如何做到將掩護影像(cover-images) 的直方圖特性保留在偽裝影像(stego-images) 之中。

part 1 的討論, 我們知道 OutGuess 0.2 並沒有把所有的冗餘位元(redundant bits) 都拿來作為機密訊息嵌入之用。在 Selection process 中, 最多只允許一半的冗餘位元放置機密訊息。

隱藏學這個研究領域有一項要特別注意的就是: 通常我們並不知道將來對手會用什麼的統計測試(statistical tests) 來偵測機密訊息是否被嵌入到媒體之中。假設我們已經知道一些特定的攻擊手法, 自然就可以事先防範, 同樣用一些冗餘位元來將這些因為嵌入動作而產生的統計偏差(statistical deviation) 給修正回來。

作者首先考量的是 one-correlation 和 Maurer test。作者在本篇論文 Section 1 Introduction 中曾提及:
For example, ones and zeros are equally likely in a message that has been encrypted. However, the redundant data being replaced might have a strong correction towards either zero or one. Embedding the encrypted message weakens that correction.
Maurer test 則是一個用來測試所產生的二元亂數資料是否符合良好亂數的規範的工具 (Ueli M. Maurer, "A Universal Statistical Test for Random Bit Generators," Journal of Cryptography, Vol. 5, pp 89-105, 1992 )。基本上, 當有一個冗餘位元從 0 被改成 1, 作者便嘗試在附近找到另一個冗餘位元將其從 1 改成 0, 這樣做的優點是可以避免增加冗餘位元的亂度(entropy), 確保機密訊息無法從這種統計方式偵測出來。然而, 使用上述的方法, 針對 JPEG 影像, 會使得 DCT 係數直方圖走樣(distortion), 如 Figure 5 中的 DCT 係數 -2 與 -1 比 Figure 3 更接近, DCT 係數 2 與 3 則幾乎相同。


Figure 5: The naive statistical corrections cause the frequency of adjacent DCT coefficients to be equalized. It is immediately evident that the image is modified.

要避免 DCT 係數直方圖走樣的情況發生, 勢必要進行其他的校正(correction)工作來維持住 DCT 係數的分布。舉例來說, 如果要嵌入機密訊息到第 j-th 個 DCT 係數, 令這個係數值為 DCT(j), 假設 DCT(j) = 2i, 那這個 DCT 係數就會被改成 2i+1。要校正這個嵌入動作所產生的走樣, 就要在臨近位置找一個 DCT 係數, 其值剛好為 2i+1, 然後將其值改成 2i。令所找到的這個位置為 k, 那麼 DCT(k) 將由 2i+1 改變成 2i。如果在每一個改變原值的嵌入動作後, 就立刻執行這項校正工作, 那所產生偽裝影像的 DCT 係數直方圖將與原始的掩護影像一模一樣。

再者, 校正轉換(correcting transform) 基本上就是要保持所有的 DCT 係數 (即 frequency counts) 維持不變。因此, 以 frequency counts 為基礎的統計方式是無法偵測出原始媒體與偽裝媒體之間的差異的。

令 f 表示在直方圖中的一個 frequency count, 而 g 為其相鄰的 frequency count, 在不失其一般性的情況下, 令 f > g。令 α 表示冗餘位元用於嵌入機密訊息的比例。在嵌入機密訊息後, frequency count 變成:
f* = f - α ( f - g ) / 2 ,
g* = g + α ( f - g ) / 2 .
我們知道當嵌入量 α 為 0% 時, f 與 g 之間的差距為 ( f - g ), 當 α 越來越大時, f* 與 g* 會越來越接近, 當 α 達到 100% 時, 則
f* = f - ( f - g ) / 2 = ( f + g ) / 2 ,
g* = g + ( f - g ) / 2 = ( g + f ) / 2 .
換句話說, 當全部的冗餘位元都拿來做為嵌入機密訊息之用時, f* = g* = ( g + f ) / 2.

OutGuess 為了維持 DCT 係數直方圖不變, 必須保留足夠的冗餘位元可以在嵌入機密訊息後, 做為校正轉換之用, 因此底下的式子必須成立:
(1- α ) g ≥ α ( f - g) /2
上述式子可以化簡得到 α 的預先估計值(a priori estimate), 做為嵌入機密訊息時的參考:
α ≤ 2 g / (f + g)
給定一個機密訊息, 我們可以使用這個估計值來選擇一個用有足夠冗餘位元來保持原始 frequency counts 的掩護影像。有趣的是, 擁有更多 DCT 係數的影像, 並不代表擁有更多可供嵌入機密訊息的冗餘位元, Figure 6 說明了此一現象。Figure 6 中的每一個圈圈代表一個影像, 橫軸表示其擁有的 DCT 係數的總數, 總軸表示經過上述公式計算後, 所得到可以用來嵌入機密訊息的比例(fraction)。


Figure 6: The fraction of the DCT coefficients that can be used for data hiding does not increase linearly for images with more coefficients.

作者希望提出的校正轉換(correcting transform) 能夠具備下列兩個需求(requirements):
1. For any part of the image, the distribution of the DCT coefficients should be similar to the unmodified image.

2. The number of corrections necessary to preserve statistical properties should be small.
仔細剖析這兩個需求, 要同時達到最佳狀況是不可能的。因為如果要讓第二個需求 - 校正個數達到最小, 就要先分析整體的嵌入狀況, 再著手校正所產生整體誤差, 在這種情況下, 很可能發生某些部分影像 DCT 係數的分布, 無法跟原始分布一樣。換句話說, 要做到任何部分影像的 DCT 係數分布和原始分布一樣, 就必須在這個部分影像中, 立即把嵌入機密訊息的走樣修正回來。如此, 就不可能使校正數目達到最小。作者針對這個問題, 提出一個妥協的方法, 為每個頻率(frequency) 定義了一個臨界值 (threshold), 來表示該 frequency count 可容忍的誤差值。


Algorithm 1: This transform preserves the statistical properties of an JPEG image. It keeps track of differences in the frequency counts between original and stego medium. If the differences exceed a certain threshold, the frequency count is adjusted.

作者宣稱 Algorithm 1 可以滿足上述兩項需求。Algorithm 1 是在整個機密訊息嵌入完成之後, 才開始執行校正的。在論文中, Algorithm 1 註記了 5 個標記, 我們在此分別說明這些關鍵步驟:
標記 1 : 從原始掩護影像中, 計算 DCT 頻率的直方圖, 並將之存放於陣列 N 之中。

標記 2 : 決定每一個頻率可容忍的誤差值, 並將之存放於陣列 N* 之中。
    計算方式如下:
    k ← number of coefficients in image;
    α← 0.03 * 5000 / k ;
    N*(i) = α * N(i);
    用陣列 N error 記錄每個 DCT 係數目前的累積誤差。
    Nerror (i) ← 0;

標記 3 : AdjDCT ← DCT(i) ⊕ 1;
Algorithm 1 針對每一個可供嵌入的位置, 從影像的開端開始處理, 如果找到一個 DCT 係數遭到修改, 他並不會直接就去想辦法校正回來, 而是看看這個修改是否已經超出可容忍的程度, 如果只是就先去看看與其配對的 DCT 係數 AdjDCT (標記 3) 是否也存在誤差值, 如果也存在誤差值 (標記 4), 那就正好可以抵銷, 不需另外做修正, 以滿足第二個需求 - 校正越少越好。如果 AdjDCT 並不存在誤差值, 再加上本身的誤差尚未超出容忍值 (標記 5), 則暫時先不做校正動作, 僅是累計其誤差值 increment Nerror [DCT(i)]。如果誤差已經超出容忍值 N*[DCT(i)] 了, 為了滿足第一項需求, 必須要立即執行校正程序: 在附近找到配對的係數修正回來, 也就是執行 Algorithm 2: exchDCT(i, DCT(i)); 如果找不到配對的係數, 則記錄其誤差, 留待最後階段再一起做大範圍 (從影像末端 k, 開始往前找) 的校正工作。

如果想要更進一步了解 Algorithm 1 中 threshold frequencies 作用的讀者, 可以嘗試將 α 值先設定為 0, 觀察執行情形, 然後將 α 值先設定為 1, 再觀察其變化, 應該就能比較了解 α 所扮演的角色。


Algorithm 2: Find a specific DCT coefficient and change it to its adjacent DCT coefficient.

Algorithm 1 在兩種情況下會呼叫 Function exchDCT() 進行實際校正的動作:

1. 當累積的誤差 Nerror 已經超過可容任的範圍, 則會立即進行校正動作, 以免累機誤差太大, 不符合需求 1。
If the number of errors for the coefficient, Nerror[DCT(i)], can be incremented without exceeding its threshold value. If another increment is possible, we continue with the next modification. Otherwise, we have to correct the current modification in the image. The exchDCT algorithm is responsible for that.
2. 最後階段, 進行大範圍的搜尋, 將所有的誤差都校正回來。雖然, 並不是所有的誤差都可以校正回來, 但只要能夠將大部分的誤差都校正回來, 就不會被偵測出來。
After all modifications have been examined, we need to correct all remaining errors. Not all the corrections might be possible. However, if we are able to correct most of the errors, changes in the histogram are not detectable.
 
Back to: Defending Against Statistical Steganalysis (part 1)
Go to: Defending Against Statistical Steganalysis (part 3)


Niels Provos, "Defending Against Statistical Steganalysis,"10th USENIX Security Symposium, August 13-17, 2001.
 

Saturday, November 01, 2008

Paper: Detecting Low Embedding Rates


Author: Andreas Westfeld

Information Hiding Workshop 2002 (IHW 2002)
Noordwijkerhout, The Netherlands, 7–9 October 2002

Springer-Verlag Berlin Heidelberg,
LNCS 2578, pp. 324–339, 2003.



Abstract

This paper shows three approaches for detecting steganograms with low change density. MP3Stego is a steganographic algorithm with a very low embedding rate. The attack presented here is a statistical analysis of block sizes. It is able to detect 0.001 % of steganographic payload in MP3 files. The second approach is the use of hash functions to combine sample categories for the chi-square attack. One of these hash functions enables us to detect about 0.2 bits per pixel in true colour images. Another algorithm (Hide) was presented at the last workshop and constructed to be secure against visual and statistical chi-square attacks. The detection method for Hide combines the three colour components of each pixel to recognise an increased number of "neighbour colours".

From StegoRN



這篇論文提出三個偵測低嵌入量(改變量)的隱藏分析技術:

1. 針對 MP3Stego -
分析 MP3 檔案中, 每一個 block 的大小, 透過統計的方式找到一般 MP3 檔案不會出現的特徵, 藉此判定是否被 MP3Stego 這個隱藏工具嵌入機密訊息。實驗結果顯示, 當嵌入量為 MP3 檔案所能提供嵌入量的 0.001% 時, 此論文所提出的方法就可以辨識出來。

2. 提升卡方攻擊法(Chi-Square Attack)的偵測能力
第二個技術是透過雜湊函數(hash function) 整合樣本分群(sample category), 然後再使用原來的卡方攻擊法分析。本論文提到透過某種雜湊函數確實可以使卡方攻擊法偵測出儘含有 0.2 bpp 的彩色影像(true color image)。

3. 針對 Hide
Hide 是 IHW 2001 所提出來的隱藏軟體, 其使用的 LSB Matching 的技術可以抵抗卡方攻擊法的分析。這篇論文透過觀察每個色彩的臨色總數(the number of neighbor colors), 發現嵌有機密訊息的影像, 臨色總數明顯增加許多。

From StegoRN

From StegoRN

From StegoRN

Monday, October 27, 2008

An Advanced Least-Significant-Bit Embedding Scheme for Steganographic Encoding

Authors: Yeuan-Kuen Lee, Graeme Bell, Shih-Yu Huang, Ran-Zan Wang and Shyong Jian Shyu

The 3rd Pacific-Rim Symposium on Image and Video Technology ( PSIVT 2009 )
Tokyo, Japan, January 13th - 16th, 2009
Official Website: http://psivt2009.nii.ac.jp/

Abstract

The advantages of Least-Significant-Bit (LSB) steganographic data embedding are that it is simple to understand, easy to implement, and it results in stego-images that contain hidden data yet appear to be of high visual fidelity. However, it can be shown that under certain conditions, LSB embedding is not secure at all. The fatal drawback of LSB embedding is the existence of detectable artifacts in the form of pairs of values (PoVs). The goals of this paper are to present a theoretic analysis of PoVs and to propose an advanced LSB embedding scheme that possesses the advantages of LSB embedding suggested above, but which also provides an additional level of communication security. The proposed scheme breaks the regular pattern of PoVs in the histogram domain, increasing the difficulty of steganalysis and thereby raising the level of security. The experimental results show that both the Chi-square index and RS index are less than 0.1, i.e., the hidden message is undetectable by the well-known Chi-square and RS steganalysis attacks.



這篇就是我們即將在 PSIVT 2009 發表的論文, 其實內容就是 95 學年度 國科會計畫 的結案報告改寫成論文發表。

國科會計畫編號: NSC 95-2221-E-130-014
最低位元嵌入法的修正模型與安全分析
A Modified LSB Embedding Scheme of Steganography and its Security Analysis
執行期間: 2006/08/01 ~ 2007/10/31
計劃書中文摘要下載:

Comments of Reviewer 1

SUMMARY AND CONTRIBUTIONS: This paper proposed an improved LSB steganographic method. The contribution is that both the Chi-square and RS steganalysis attacks can be resisted.
OVERALL EVALUATION: 7 (strong accept)

COMMENTS ON OVERALL EVALUATION: LSB-basd embedding methods seem to be impractical because an image is usually compressed before transmission.
ORIGINALITY: 3 (moderately original)
REFERENCE TO PRIOR WORK: 4 (excellent reference to prior work)
RELEVANCE/IMPORTANCE TO PSIVT: 3 (of sufficient interest)
CLARITY OF PRESENTATION: 3 (is clear enough)
TECHNICAL CORRECTNESS: 3 (probably correct)
EXPERIMENTAL EVALUATION: 4 (sufficient evaluation or theoretical paper)

Comments of Reviewer 2

SUMMARY AND CONTRIBUTIONS: The author(s) of this paper touch(es) on the simplicity of least significant bit (LSB) embedding and highlight(s) its weakness in the form of pairs of values (PoVs) as steganographic encoding artifacts. A new technique using pseudorandom number generator (PRNG) is employed in an algorithm to modify the method of embedding the secret message bits in the LSB of the target image. This method breaks the correlation between the frequency of these pairs of values commonly caused by LSB embedding. The result of the paper is promising and shows resistance to both the Chi-square and RS steganalysis attacks.

OVERALL EVALUATION:
7 (strong accept)

COMMENTS ON OVERALL EVALUATION: This paper establishes a good model for analysing the effect of PoVs and ventures from there to find a method to avoid the pitfalls of LSB embedding by captilising on the property of pseudorandom number generator. The proposed algorithm effectively prevents successful attacks from both Chi-square and RS steganalysis.

ORIGINALITY:
4 (very original)
REFERENCE TO PRIOR WORK: 3 (references adequate)
RELEVANCE/IMPORTANCE TO PSIVT: 3 (of sufficient interest)
CLARITY OF PRESENTATION: 4 (easy to read)
TECHNICAL CORRECTNESS: 3 (probably correct)
EXPERIMENTAL EVALUATION: 4 (sufficient evaluation or theoretical paper)

Comments of Reviewer 3

SUMMARY AND CONTRIBUTIONS: The Least-significant-bit embedding method is well-known technique in data embedding field, however, this paper proposes an advanced LSB embedding method to improve the lack of traditional LSB embedded method. And the experimental results are enough to verify the goals. The paper is esay to read and understand.

OVERALL EVALUATION:
6 (accept)

COMMENTS ON OVERALL EVALUATION: This system is valuable to data embeddubg scheme.

ORIGINALITY: 3 (moderately original)
REFERENCE TO PRIOR WORK: 3 (excellent reference to prior work)
RELEVANCE/IMPORTANCE TO PSIVT: 3 (of sufficient interest)
CLARITY OF PRESENTATION: 4 (references adequate)
TECHNICAL CORRECTNESS: 3 (probably correct)
EXPERIMENTAL EVALUATION: 4 (sufficient evaluation or theoretical paper)

Comments of Reviewer 4

SUMMARY AND CONTRIBUTIONS: The paper describes a known weakness of LSB embedding, and proposes two counter measures.

OVERALL EVALUATION:
4 (borderline)

COMMENTS ON OVERALL EVALUATION:
The main idea is simple and interesting. However, there are many methods proposed in the past few years and I'm not sure whether the method described here have been studied before. Furthermore, there is a problem with the boundary cases, pixels with value 0 and 255. Using the proposed method will create artifacts that look like salt and pepper noise.

ORIGINALITY: 2 (minor originality)
REFERENCE TO PRIOR WORK: 3 (refer)
RELEVANCE/IMPORTANCE TO PSIVT: 3 (of sufficient interest)
CLARITY OF PRESENTATION: 3 (is clear enough)
TECHNICAL CORRECTNESS: 3 (probably correct)
EXPERIMENTAL EVALUATION: 4 (sufficient evaluation or theoretical paper)

PSIVT 2009 received 247 submissions, and accepted 40 papers for oral presentations and 58 for poster presentations. The acceptance rate is slightly less than 40%.
 

Monday, October 06, 2008

Message from PSIVT 2009

10月3日終於接到來自 PSIVT 2009 的消息, 接受了我們投稿的論文。可以開始著手準備前往東京了。

Dear Yeuan-Kuen Lee,

We wish to congratulate you on the acceptance of your submission with paper ID: 154 as an oral presentation in the PSIVT2009 program. Review comments for your paper are now available in the papers management system: https://cmt.research.microsoft.com/PSIVT2009.

The camera-ready paper deadline is on 17 October 2008, and paper preparation instructions can be found at http://psivt2009.nii.ac.jp/node/39. Please note that for your paper to be published in this conference, the camera-ready paper must be received by the deadline, and one of the authors must register for the conference by this deadline as well.

We are looking forward to the presentation of your paper in PSIVT2009.

Best regards,
PSIVT2009 Program Committee

Wednesday, September 24, 2008

Bivariate Distribution & Marginal Distribution

Bivariate Distribution 顧名思義就是具有兩個隨機變數的分配。

From StegoRN

貓頭鷹出版社 所出版的 統計學辭典 中, 舉的例子非常容易理解: 特定構造與型示的二手車。一般來說, 對有興趣的買主來說, 二手汽車有兩個令人感興趣且容易測量的變數: 車齡 里程數

假設有一家二手車行購進了同一樣式的二手車 30 輛, 車行就可以將其依車子的使用年齡和行駛里程數製成一個二變量次數表。換句話說, 就是列出一個二維表格, 一維是車齡, 另一維是里程數, 表中統計符合條件的車輛數。例如: 使用 2-3 年, 行駛 4-5 萬英里的車子有 2 輛。在這個例子中, 兩個變數並不是相互獨立的, 較舊的車通常行駛較長的距離。

From StegoRN

如果表中所使用的是機率, 那就是一個 二變量機率分布 (bivariate probability distribution), 在二變量分配表上, 分別做行相加, 或列相加的動作, 所得出的分配就稱為 邊際分配 (marginal distribution)

在二手車的例子中, 邊際分配為:
里程數  0-10 10-20 20-30 30-40 40-50 50-60 60-70 70-80
車輛數  1   2   2   3   7   6   6   3

車 齡  0 - 1   1 - 2   2 - 3   3 - 4   4 - 5   5 - 6   6 - 7   7 - 8
車輛數  3   2   7   9   3   3   1   2

維基百科中的 聯合分布 ( joint probability distribution ) 條目的說明, 其實和這邊的 Bivariate Distribution 的解釋是差不多的, 指的應該就是同樣的東西。

Tuesday, September 23, 2008

Feature-Based Steganalysis for JPEG Images and Its Implications for Future Design of Steganographic Schemes


Author: Jessica Fridrich

Information Hiding Workshop 2004
Toronto, Ontario, Canada
23 - 25, May, 2004

Lecture Notes in Computer Science, Vol. 3200



Abstract

In this paper, we introduce a new feature-based steganalytic method for JPEG images and use it as a benchmark for comparing JPEG steganographic algorithms and evaluating their embedding mechanisms. The detection method is a linear classifier trained on feature vectors corresponding to cover and stego images. In contrast to previous blind approaches, the features are calculated as an L1 norm of the difference between a specific macroscopic functional calculated from the stego image and the same functional obtained from a decompressed, cropped, and recompressed stego image. The functionals are built from marginal and joint statistics of DCT coefficients. Because the features are calculated directly from DCT coefficients, conclusions can be drawn about the impact of embedding modifications on detectability. Three different steganographic paradigms are tested and compared. Experimental results reveal new facts about current steganographic methods for JPEGs and new design principles for more secure JPEG steganography.