Image Forensics and Steganalysis (Hans) Georg Schaathun Department - - PowerPoint PPT Presentation

▶
image forensics and steganalysis
SMART_READER_LITE
LIVE PREVIEW

Image Forensics and Steganalysis (Hans) Georg Schaathun Department - - PowerPoint PPT Presentation

Apr 01, 2024 275 likes •1.15k views

Image Forensics and Steganalysis (Hans) Georg Schaathun Department of Computing University of Surrey 26 June 2009 (Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 1 / 47 Outline Examples 1 Tampering Different

slide-1
SLIDE 1

Image Forensics and Steganalysis

(Hans) Georg Schaathun

Department of Computing University of Surrey

26 June 2009

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 1 / 47

slide-2
SLIDE 2

Outline

1

Examples Tampering Different Security Scenarioes

2

Steganography and Steganalysis Steganography JPEG and F5 The Markov Based Model Double Compression Conditional Probability Features

3

Our group

4

Conclusion

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 2 / 47

slide-3
SLIDE 3

Examples

Outline

1

Examples Tampering Different Security Scenarioes

2

Steganography and Steganalysis

3

Our group

4

Conclusion

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 3 / 47

slide-4
SLIDE 4

Examples Tampering

Outline

1

Examples Tampering Different Security Scenarioes

2

Steganography and Steganalysis

3

Our group

4

Conclusion

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 4 / 47

slide-5
SLIDE 5

Examples Tampering

How worrying is the Iranian weaponry?

Picture from AFP . One of the rockets really fired Some rockets are the product of PhotoShop... The image was retracted after publication

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 5 / 47

slide-6
SLIDE 6

Examples Tampering

How worrying is the Iranian weaponry?

Picture from AFP . One of the rockets really fired Some rockets are the product of PhotoShop... The image was retracted after publication

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 5 / 47

slide-7
SLIDE 7

Examples Tampering

How worrying is the Iranian weaponry?

Picture from AFP . One of the rockets really fired Some rockets are the product of PhotoShop... The image was retracted after publication

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 5 / 47

slide-8
SLIDE 8

Examples Tampering

How worrying is the Iranian weaponry?

Picture from AFP . One of the rockets really fired Some rockets are the product of PhotoShop... The image was retracted after publication

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 5 / 47

slide-9
SLIDE 9

Examples Tampering

Crime Scene Photography

What did the crime scene look like?

Photography is vital evidence

Photography can be altered...

What can we prove?

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 6 / 47

slide-10
SLIDE 10

Examples Tampering

Crime Scene Photography

What did the crime scene look like?

Photography is vital evidence

Photography can be altered...

What can we prove?

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 6 / 47

slide-11
SLIDE 11

Examples Tampering

Who were actually there?

Former Culture Secretary James Purnell Late for the meeting.

Arrived after three other MPs had to leave.

James Purnell was added to the picture (BBC News - 28 September 2007)

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 7 / 47

slide-12
SLIDE 12

Examples Different Security Scenarioes

Outline

1

Examples Tampering Different Security Scenarioes

2

Steganography and Steganalysis

3

Our group

4

Conclusion

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 8 / 47

slide-13
SLIDE 13

Examples Different Security Scenarioes

Is the photo real?

Does it show reality? Or has its author exercises artistic licence?

tampering with evidence adding grandeur to a story computer generated images

For example

Merging images Erasing details or objects

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 9 / 47

slide-14
SLIDE 14

Examples Different Security Scenarioes

Where does the photo come from?

Objective: add credibility to claims All information about the image is potentially useful... Which camera took the image? Time of day, time of year, etc. Subsequent image processing

contrast, compression, brightness, etc.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 10 / 47

slide-15
SLIDE 15

Examples Different Security Scenarioes

Where does the photo come from?

Objective: add credibility to claims All information about the image is potentially useful... Which camera took the image? Time of day, time of year, etc. Subsequent image processing

contrast, compression, brightness, etc.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 10 / 47

slide-16
SLIDE 16

Examples Different Security Scenarioes

Is there more than meets the eye?

Additional information hidden in the image?

known as steganography

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 11 / 47

slide-17
SLIDE 17

Examples Different Security Scenarioes

Three important questions

1

Is the photo real?

2

Where does the photo come from?

3

Is there more than meets the eye?

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 12 / 47

slide-18
SLIDE 18

Examples Different Security Scenarioes

User scenarios

News agency, news paper, etc.

can we trust images from the public? they can get thousands of images in a day

Forensics and Court of Law

what can we prove? what is the truth? is the image real or synthetic?

Intelligence services

is there secret communications hidden in the image?

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 13 / 47

slide-19
SLIDE 19

Steganography and Steganalysis

Outline

1

Examples

2

Steganography and Steganalysis Steganography JPEG and F5 The Markov Based Model Double Compression Conditional Probability Features

3

Our group

4

Conclusion

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 14 / 47

slide-20
SLIDE 20

Steganography and Steganalysis Steganography

Outline

1

Examples

2

Steganography and Steganalysis Steganography JPEG and F5 The Markov Based Model Double Compression Conditional Probability Features

3

Our group

4

Conclusion

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 15 / 47

slide-21
SLIDE 21

Steganography and Steganalysis Steganography

The basic problem

Simmons Crypto’83

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 16 / 47

slide-22
SLIDE 22

Steganography and Steganalysis Steganography

The basic problem

Simmons Crypto’83

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob William the Warden

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 16 / 47

slide-23
SLIDE 23

Steganography and Steganalysis Steganography

The basic problem

Simmons Crypto’83

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob William the Warden

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 16 / 47

slide-24
SLIDE 24

Steganography and Steganalysis Steganography

The basic problem

Simmons Crypto’83

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob William the Warden

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 16 / 47

slide-25
SLIDE 25

Steganography and Steganalysis Steganography

The basic problem

Simmons Crypto’83

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob William the Warden

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

I wonder what they are up to, Alice and Bob. . .

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 16 / 47

slide-26
SLIDE 26

Steganography and Steganalysis Steganography

The basic problem

Simmons Crypto’83

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob William the Warden

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

About Uncle Charlie who is ill. Family matters. None

  • f my business.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 16 / 47

slide-27
SLIDE 27

Steganography and Steganalysis Steganography

The basic problem

Simmons Crypto’83

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob William the Warden

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Discussing escape plans. Oh dear. That’s maxi- mum security for Bob.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 16 / 47

slide-28
SLIDE 28

Steganography and Steganalysis Steganography

The basic problem

Simmons Crypto’83

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob William the Warden

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Qvfphffvat rfpncr cynaf. Encrypted?! They sure are up to no good.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 16 / 47

slide-29
SLIDE 29

Steganography and Steganalysis Steganography

The vision

Simmons Crypto’83

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob William the Warden

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Escape at midnight. «Uncle Charlie is much better now.»

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 16 / 47

slide-30
SLIDE 30

Steganography and Steganalysis Steganography

The basic crypto-problem

Encryption

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob the Banker

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 17 / 47

slide-31
SLIDE 31

Steganography and Steganalysis Steganography

The basic crypto-problem

Encryption

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob the Banker Eve

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 17 / 47

slide-32
SLIDE 32

Steganography and Steganalysis Steganography

The basic crypto-problem

Encryption

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob the Banker Eve

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 17 / 47

slide-33
SLIDE 33

Steganography and Steganalysis Steganography

The basic crypto-problem

Encryption

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob the Banker Eve

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 17 / 47

slide-34
SLIDE 34

Steganography and Steganalysis Steganography

The basic crypto-problem

Encryption

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob the Banker Eve

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

What is the password? Transaction data.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 17 / 47

slide-35
SLIDE 35

Steganography and Steganalysis Steganography

The basic crypto-problem

Encryption

Alice

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Bob the Banker Eve

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Genafnpgvba qngn. Sigh! Encrypted.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 17 / 47

slide-36
SLIDE 36

Steganography and Steganalysis Steganography

The data hiding system

The pure stego-system

Embedding Extractor

Message Recovered Cover (Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 18 / 47

slide-37
SLIDE 37

Steganography and Steganalysis Steganography

The data hiding system

The pure stego-system

Embedding Extractor

Message Recovered Cover

Security depends on the confidentiality of the algorithm.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 18 / 47

slide-38
SLIDE 38

Steganography and Steganalysis Steganography

The data hiding system

Secret-key stego-system

Embedding Extractor

Message Recovered Key Cover

The key k is shared confidentially by Alice and Bob.

Gives Bob an edge over Eve.

Without the key, the stego-text is indistinguishable from any other cover text

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 18 / 47

slide-39
SLIDE 39

Steganography and Steganalysis Steganography

The data hiding system

Secret-key stego-system

Embedding Extractor

Message Recovered Key Cover

The key k is shared confidentially by Alice and Bob.

Gives Bob an edge over Eve.

Without the key, the stego-text is indistinguishable from any other cover text

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 18 / 47

slide-40
SLIDE 40

Steganography and Steganalysis Steganography

The data hiding system

Secret-key stego-system

Embedding Extractor

Message Recovered Key Cover

The key k is shared confidentially by Alice and Bob.

Gives Bob an edge over Eve.

Without the key, the stego-text is indistinguishable from any other cover text

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 18 / 47

slide-41
SLIDE 41

Steganography and Steganalysis Steganography

The data hiding system

Secret-key stego-system

Embedding Extractor

Message Recovered Key Cover

The cover text is a red herring It has no value at the receiver

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 18 / 47

slide-42
SLIDE 42

Steganography and Steganalysis Steganography

The data hiding system

Significance of the Cover Image

Embedding Extractor

Message Recovered Key

The cover text is a red herring It has no value at the receiver

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 18 / 47

slide-43
SLIDE 43

Steganography and Steganalysis Steganography

The data hiding system

Watermarking System

Embedding Extractor

Message Recovered Key Cover File

Related to watermarking – where the cover image is essential. Watermarking ties the message to the cover.

The attacker tries to separate the two.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 18 / 47

slide-44
SLIDE 44

Steganography and Steganalysis Steganography

The data hiding system

Watermarking System

Embedding Extractor

Message Recovered Key Cover File (Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 18 / 47

slide-45
SLIDE 45

Steganography and Steganalysis Steganography

The data hiding system

Watermarking System

Embedding Extractor

Message Recovered Key Cover File (Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 18 / 47

slide-46
SLIDE 46

Steganography and Steganalysis Steganography

Definitions

The tools

Definition (Stego-system) A system which allows Alice and Bob to communicate secretly without Eve knowing that any secret communication is taking place. Definition (Steganography) The study of (and art of developing) stego-systems. Definition (Steganalysis) The art of detecting whether secret communications is taking place or not.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 19 / 47

slide-47
SLIDE 47

Steganography and Steganalysis Steganography

Definitions

The tools

Definition (Stego-system) A system which allows Alice and Bob to communicate secretly without Eve knowing that any secret communication is taking place. Definition (Steganography) The study of (and art of developing) stego-systems. Definition (Steganalysis) The art of detecting whether secret communications is taking place or not.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 19 / 47

slide-48
SLIDE 48

Steganography and Steganalysis Steganography

Definitions

The tools

Definition (Stego-system) A system which allows Alice and Bob to communicate secretly without Eve knowing that any secret communication is taking place. Definition (Steganography) The study of (and art of developing) stego-systems. Definition (Steganalysis) The art of detecting whether secret communications is taking place or not.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 19 / 47

slide-49
SLIDE 49

Steganography and Steganalysis Steganography

Steganalysis

Using Machine Learning

Most recent steganalysis systems use Machine Learning

  • r related statistical techniques

Most often a two-class SVM is used (natural vs. steganogram)

1

Extract features (statistics) from the image

Multi-dimensional floating point vector

2

Train the system

Input two ensembles of feature vectors The system will estimate a model

3

Testing

Input the estimated model + Images from each class Output classification decisions – Estimate accuracy

4

Real use

Input: model; feature vector from a suspicious image

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 20 / 47

slide-50
SLIDE 50

Steganography and Steganalysis JPEG and F5

Outline

1

Examples

2

Steganography and Steganalysis Steganography JPEG and F5 The Markov Based Model Double Compression Conditional Probability Features

3

Our group

4

Conclusion

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 21 / 47

slide-51
SLIDE 51

Steganography and Steganalysis JPEG and F5

JPEG images

pixmap JPEG array subblocked Blockwise DCT Quantisation

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 22 / 47

slide-52
SLIDE 52

Steganography and Steganalysis JPEG and F5

JPEG images

pixmap JPEG array subblocked Blockwise DCT Quantisation JPEG Compression

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 22 / 47

slide-53
SLIDE 53

Steganography and Steganalysis JPEG and F5

JPEG images

pixmap JPEG array JPEG Compression Source Coding Serialisation JPEG file

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 22 / 47

slide-54
SLIDE 54

Steganography and Steganalysis JPEG and F5

JPEG Steganography

Many stego-algorithms work on the JPEG Array

Integer matrix

E.g. Jsteg

Ignore +1 and 0 coefficients Embed in the least significant bit of each coefficient Extract by taking c mod 2

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 23 / 47

slide-55
SLIDE 55

Steganography and Steganalysis JPEG and F5

The F5 Algorithm

by Andrea Westfeld

Better preservation of image statistics JPEG coefficient magnitudes are always decreased Matrix coding (source coding) is used

coding to match the cover minimise the number of modifications

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 24 / 47

slide-56
SLIDE 56

Steganography and Steganalysis JPEG and F5

Typical JPEG Steganography

Modulate information on the cover

±1 changes to coefficients

Independent modifications

Independence of the cover Independence of individual coefficients

This is the problem of steganography

Image coefficients are not independent The modifications become detectible noise

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 25 / 47

slide-57
SLIDE 57

Steganography and Steganalysis The Markov Based Model

Outline

1

Examples

2

Steganography and Steganalysis Steganography JPEG and F5 The Markov Based Model Double Compression Conditional Probability Features

3

Our group

4

Conclusion

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 26 / 47

slide-58
SLIDE 58

Steganography and Steganalysis The Markov Based Model

The Markov Based Model – Overview

Yun Q Shi et al

Consider the absolute value of the JPEG array Difference matrix – differences between adjacent coefficients Model the difference matrix

First-order Markov model

Estimate a Transition Probability Matrix

which forms our features

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 27 / 47

slide-59
SLIDE 59

Steganography and Steganalysis The Markov Based Model

The difference array

→ − = Fv(i, j) = |Ji,j| − |Fi+1,j| To reduce complexity, the difference array is capped at ±T

Large (small) values are reduced (increased) to the capping value.

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 28 / 47

slide-60
SLIDE 60

Steganography and Steganalysis The Markov Based Model

The other three difference arrays

Horizontal, and major and minor diagonal

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 29 / 47

slide-61
SLIDE 61

Steganography and Steganalysis The Markov Based Model

Transition Probability Matrix

For s, t ∈ {−T, −T + 1, . . . , T − 1, T}, we estimate

Mv

s,t = P(Fv(i + 1, j) = s|Fv(i, j))

Mh

s,t = P(Fh(i, j + 1) = s|Fh(i, j))

Md

s,t = P(Fd(i + 1, j + 1) = s|Fd(i, j))

Mm

s,t = P(Fm(i, j + 1) = s|Fm(i + 1, j))

This gives four matrices

Mx = [Mx

s,t]

4(2T + 1)2 features

Shi et al suggested T = 4 for 323 features

Performance around 90%–98% accuracy

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 30 / 47

slide-62
SLIDE 62

Steganography and Steganalysis Double Compression

Outline

1

Examples

2

Steganography and Steganalysis Steganography JPEG and F5 The Markov Based Model Double Compression Conditional Probability Features

3

Our group

4

Conclusion

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 31 / 47

slide-63
SLIDE 63

Steganography and Steganalysis Double Compression

The F5 implementation

JPEG based stego-algorithms should work on the JPEG array This is what F5 (and Jsteg) Software actually do:

1

Load and Decompress the Image

Internal Spatial Representation Compression Parameters are discarded

2

Compression and Embedding as an integrated process

Compression implemented by tweeking existing compression routines Usually using default parameters

3

Save the comressed image

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 32 / 47

slide-64
SLIDE 64

Steganography and Steganalysis Double Compression

The F5 implementation

JPEG based stego-algorithms should work on the JPEG array This is what F5 (and Jsteg) Software actually do:

1

Load and Decompress the Image

Internal Spatial Representation Compression Parameters are discarded

2

Compression and Embedding as an integrated process

Compression implemented by tweeking existing compression routines Usually using default parameters

3

Save the comressed image

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 32 / 47

slide-65
SLIDE 65

Steganography and Steganalysis Double Compression

The F5 implementation

JPEG based stego-algorithms should work on the JPEG array This is what F5 (and Jsteg) Software actually do:

1

Load and Decompress the Image

Internal Spatial Representation Compression Parameters are discarded

2

Compression and Embedding as an integrated process

Compression implemented by tweeking existing compression routines Usually using default parameters

3

Save the comressed image

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 32 / 47

slide-66
SLIDE 66

Steganography and Steganalysis Double Compression

The F5 implementation

JPEG based stego-algorithms should work on the JPEG array This is what F5 (and Jsteg) Software actually do:

1

Load and Decompress the Image

Internal Spatial Representation Compression Parameters are discarded

2

Compression and Embedding as an integrated process

Compression implemented by tweeking existing compression routines Usually using default parameters

3

Save the comressed image

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 32 / 47

slide-67
SLIDE 67

Steganography and Steganalysis Double Compression

The F5 implementation

JPEG based stego-algorithms should work on the JPEG array This is what F5 (and Jsteg) Software actually do:

1

Load and Decompress the Image

Internal Spatial Representation Compression Parameters are discarded

2

Compression and Embedding as an integrated process

Compression implemented by tweeking existing compression routines Usually using default parameters

3

Save the comressed image

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 32 / 47

slide-68
SLIDE 68

Steganography and Steganalysis Double Compression

Double Compression

The F5 software recompresses the image

Usually using a different compression factor Known as Double Compression

This normally causes artifacts Typical Steganalysis classifiers

Compare Clean images against F5 processed images What is detected? Double Compression or Steganography?

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 33 / 47

slide-69
SLIDE 69

Steganography and Steganalysis Double Compression

Double Compression

The F5 software recompresses the image

Usually using a different compression factor Known as Double Compression

This normally causes artifacts Typical Steganalysis classifiers

Compare Clean images against F5 processed images What is detected? Double Compression or Steganography?

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 33 / 47

slide-70
SLIDE 70

Steganography and Steganalysis Double Compression

Double Compression

The F5 software recompresses the image

Usually using a different compression factor Known as Double Compression

This normally causes artifacts Typical Steganalysis classifiers

Compare Clean images against F5 processed images What is detected? Double Compression or Steganography?

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 33 / 47

slide-71
SLIDE 71

Steganography and Steganalysis Double Compression

Alternative Experiment

New training set

1

Steganograms from F5 (with a hidden message)

2

Cover images processed by F5 without a message

Thus both of classes are doubly compressed Our classifier will have to work on the embedding only

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 34 / 47

slide-72
SLIDE 72

Steganography and Steganalysis Double Compression

1st vs. 2nd Order Markov Models

Performance

Ignoring Double Compression Message length (bytes) 618 1848 4096 1st Order 89.5% 93.5% 98.0% 2nd Order 99.1% 99.1% 98.6% F5 vs. doubly compressed (clean) images Message length (bytes) 618 1848 4096 1st Order 50.2% 84.3% 97.9% 2nd Order 50.0% 55.6% 70.6%

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 35 / 47

slide-73
SLIDE 73

Steganography and Steganalysis Double Compression

1st vs. 2nd Order Markov Models

Performance

Ignoring Double Compression Message length (bytes) 618 1848 4096 1st Order 89.5% 93.5% 98.0% 2nd Order 99.1% 99.1% 98.6% F5 vs. doubly compressed (clean) images Message length (bytes) 618 1848 4096 1st Order 50.2% 84.3% 97.9% 2nd Order 50.0% 55.6% 70.6%

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 35 / 47

slide-74
SLIDE 74

Steganography and Steganalysis Conditional Probability Features

Outline

1

Examples

2

Steganography and Steganalysis Steganography JPEG and F5 The Markov Based Model Double Compression Conditional Probability Features

3

Our group

4

Conclusion

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 36 / 47

slide-75
SLIDE 75

Steganography and Steganalysis Conditional Probability Features

Complexity

Shi et al’s technique uses 323 features Computationally costly, to extract and to train We have proposed a simpler set

achieving similar performance

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 37 / 47

slide-76
SLIDE 76

Steganography and Steganalysis Conditional Probability Features

Basic ideas

1

The Markov Model is flawed

probability distribution of each coefficient is

determined by preceeding coefficients independent of position

it should depend on the frequency (position in a subblock)

2

The transition probability matrix is too fine-grained

too many features to compute

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 38 / 47

slide-77
SLIDE 77

Steganography and Steganalysis Conditional Probability Features

The coefficients considered

xh yh zh xv xd yv yd zv zd

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 39 / 47

slide-78
SLIDE 78

Steganography and Steganalysis Conditional Probability Features

The CP Features

Definitions

Triplet (x, y, z) as in figure Three posterior events

A1 : y > z; A2 : y = z; A3 : y < z

Three prior events

B1 : x > y; B2 : x = y; B3 : x < y

Nine features per triplet (x, y, z)

P(Ai|Bj) fro i, j = 1, 2, 3

27 features in total

A 54-feature variant (six triplets) was less effective

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 40 / 47

slide-79
SLIDE 79

Steganography and Steganalysis Conditional Probability Features

Performance

CP Features

Computation – Markov Model based technique in parenthesis

Training 770ms (150ms) on 2480 images Classification 0.2ms (same) per image Feature Extraction 114ms (13s) per image

Accuracy (large message, 4kB)

97.2% for both CP and Markov Model 95% confidence interval is (95.3%, 99.2%)

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 41 / 47

slide-80
SLIDE 80

Steganography and Steganalysis Conditional Probability Features

Performance

CP Features

Computation – Markov Model based technique in parenthesis

Training 770ms (150ms) on 2480 images Classification 0.2ms (same) per image Feature Extraction 114ms (13s) per image

Accuracy (large message, 4kB)

97.2% for both CP and Markov Model 95% confidence interval is (95.3%, 99.2%)

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 41 / 47

slide-81
SLIDE 81

Our group

Outline

1

Examples

2

Steganography and Steganalysis

3

Our group

4

Conclusion

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 42 / 47

slide-82
SLIDE 82

Our group

Steganalysis and Image Forensics

and Machine Learning

Steganalysis

Development of Scientific Methodology New feature sets

sister team on Image Forensics sister group in Biologically Inspired Methods

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 43 / 47

slide-83
SLIDE 83

Our group

Coding Theory

Applications in Data Hiding

Deletion/Insertion Correction

for use in Watermarking Geometric Distortions

Wet Paper and Dirty Paper Coding

Distortion Minimisation in Watermarking and Steganography

Construction/Non-Existence of Codes

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 44 / 47

slide-84
SLIDE 84

Our group

Information Security

Security in Contact-Less Payment Systems

are they sufficiently secure

sister group in E-voting

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 45 / 47

slide-85
SLIDE 85

Conclusion

Outline

1

Examples

2

Steganography and Steganalysis

3

Our group

4

Conclusion

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 46 / 47

slide-86
SLIDE 86

Conclusion

Next project

Information Forensics is a booming area

Image Forensics in particular The methods and methodology are largely shared with Steganalysis

Is there room for collaboration?

Machine Learning Sound methodology

(Hans) Georg Schaathun Image Forensics and Steganalysis 26 June 2009 47 / 47