Master Thesis Master's Programme in Network Forensics, 60 credits Blind Image Steganalytic Optimization by using Machine Learning Digital Forensics, 15 credits Halmstad 2018-08-05 Despoina Giarimpampa HALMSTAD UNIVERSITY Contact details: Despoina GIARIMPAMPA Nyhemsgatan 42 302 49 Halmstad [email protected] Ph.D Eric JÄRPE Halmstad University School of Information Technology Department of Intelligent Systems and Digital Design 301 18 Halmstad [email protected] Ph.D Stefan AXELSSON Halmstad University School of Information Technology 301 18 Halmstad [email protected] iii Abstract Since antiquity, steganography has existed in protecting sensitive informa- tion against unauthorized unveiling attempts. Nevertheless, digital media’s evolution, reveals that steganography has been used as a tool for activities such as terrorism or child pornography. Given this background, steganaly- sis arises as an antidote to steganography. Steganalysis can be divided into two main approaches: universal – also called blind – and specific. Specific methods request a previous knowledge of the steganographic technique un- der analysis. On the other hand, universal methods which can be widely practiced in a variety of algorithms, are more adaptable to real-world appli- cations. Thus, it is necessary to establish even more accurate steganalysis techniques capable of detecting the hidden information coming from the use of diverse steganographic methods. Considering this, a universal steganal- ysis method specialized in images is proposed. The method is based on the typical steganalysis process, where feature extractors and classifiers are used. The experiments were implemented on different embedding rates and for various steganographic techniques. It turns out that the proposed method succeeds for the most part, providing dignified results on color images and promising results on gray-scale images. v Acknowledgements I must first express my very profound gratitude to my thesis advisor Eric Järpe. The door to Prof. Järpe’s office was open whenever I had a question about my research or writing. Furthermore, as the second reader of this the- sis, I am gratefully indebted to him for his worthwhile comments on this thesis. I would also like to thank the colleagues who were involved in this re- search project: Mujtaba Aldebes, Mohammad Mirian and Shooresh Sufiye. Without their proper suggestions and useful advices, the study could not have been successfully conducted. Additionally, I would like to acknowledge Mohammed Abdulrazzaq who set up the University Server and provided me with the necessary hardware resources for the experiment. Finally, I would like to thank my family for providing me with support and constant fortitude throughout my years of study and through the process of researching and writing this thesis. This accomplishment would not have been possible without them. Thank you. Despoina Giarimpampa vi When you surround an army, leave an outlet free. Do not press a desperate foe too hard. Sun Tzu, The Art of War vii Contents Abstract iii Acknowledgementsv List of Figuresx List of Tables xi 1 Introduction1 1.1 Purpose of the study........................1 1.2 Motivation..............................2 1.3 Objectives..............................2 1.3.1 Main Objective.......................2 1.3.2 Specific Objectives.....................2 1.4 Methodology............................3 1.5 Significance of the study......................4 1.6 Delimitations, Limitations and Assumptions..........4 1.6.1 Assumptions........................4 1.6.2 Limitations.........................5 1.6.3 Delimitations........................5 1.7 Thesis Organization.........................5 2 Background7 2.1 Steganography...........................7 2.1.1 Characteristics of steganography.............9 2.1.2 Steganography Categorization.............. 10 2.1.3 Steganography in JPEG.................. 13 2.1.4 Applications of Steganography.............. 14 2.2 Steganalysis............................. 15 2.2.1 Steganalysis Categorization................ 15 2.2.2 Steganalytic Process.................... 18 Feature Extraction..................... 18 Classification........................ 20 2.3 Machine Learning.......................... 20 3 Related Work 23 3.1 Steganographic Algorithms.................... 23 3.1.1 The Least Significant Bit Family............. 23 LSB+............................. 24 LSB++............................ 24 viii Contents LSB Matching........................ 24 LSB Matching Revisited.................. 24 Steghide........................... 24 S-UNIWARD........................ 24 Jphide and Jpseek...................... 25 3.1.2 F5............................... 25 3.1.3 Outguess........................... 27 3.1.4 Other Steganographic Methods.............. 27 3.2 Steganalytic Algorithms...................... 30 3.2.1 Subtractive Pixel Adjacency Model............ 30 3.2.2 CC-PEV........................... 30 3.2.3 Cross Domain Features.................. 30 3.2.4 Local Binary Pattern.................... 30 3.2.5 Content-Selective Residuals................ 31 3.2.6 Other Feature Extractors.................. 31 3.3 Machine Learning in Steganalysis................. 32 3.4 Chapter Summary.......................... 34 4 Proposed Method 35 4.1 Proposed Method.......................... 35 4.2 Experimental Setup......................... 37 4.2.1 Datasets........................... 37 4.2.2 Embedding Software.................... 39 4.3 Feature Extraction.......................... 40 4.4 Classification............................. 42 4.4.1 Classifiers.......................... 42 4.4.2 Evaluation Metrics..................... 44 4.5 Chapter Summary.......................... 45 5 Results and Discussion 47 5.1 Results and Analysis........................ 47 5.2 Ethical and Social Analysis..................... 54 5.3 Chapter Summary.......................... 56 6 Conclusion 57 6.1 Contributions............................ 57 Intergation of datasets................... 57 Development of a reliable method............ 57 Reliable classification.................... 57 Avoidance of any dependence.............. 57 Evaluation.......................... 57 6.2 Discussions............................. 57 6.3 Future/Further Work........................ 58 A Matlab Code 59 B Batch File 61 ix List of Figures 1.1 Methodology............................3 2.1 Evolution in hiding methods...................9 2.2 The steganography scheme.................... 10 2.3 The principles of steganography................. 11 2.4 Classification of steganographic methods............ 12 2.5 Classification of stegosystems................... 12 2.6 JPEG Mechanism.......................... 14 2.7 The Passive Warden Scheme.................... 16 2.8 The Active Warden Scheme.................... 16 2.9 Visual based steganalysis...................... 17 2.10 Steganalysis categorization.................... 18 2.11 Steganalitic process......................... 19 2.12 Simple Model of steganography.................. 19 3.1 F5 Implementation Steps...................... 26 3.2 Interblock and Intrablock correlation............... 31 4.1 General Steps............................ 35 4.2 Method Stages............................ 36 4.3 Dresden Database.......................... 38 4.4 Bmp Database............................ 38 4.5 BOSS Database........................... 39 4.6 Steganographic Methods Used.................. 40 4.7 First-level Classification...................... 43 4.8 Second-level Classification..................... 43 5.1 Plot of Class-Spam Features.................... 47 5.2 Plot of Class-LBP Features..................... 48 5.3 Plot of Class-CSR Features..................... 48 5.4 Plot of Class-Bytes......................... 49 5.5 Plot of Class-Dimensions...................... 50 5.6 Plot of Bytes-Dimensions...................... 50 5.7 Highest Detection Rate....................... 51 5.8 Comparison between embedding rates detection of the LSB Family methods........................... 52 5.9 ROC curve for BMP images.................... 52 5.10 ROC curve for PGM images.................... 53 5.11 ROC curve for JPEG images.................... 53 5.12 PRC curve for JPEG images.................... 54 x List of Figures 5.13 PRC curve for BMP images.................... 54 xi List of Tables 4.1 Selected Steganographic Methods................. 41 5.1 Method Results............................ 51 xiii List of Abbreviations bpp bits per pixel DCT Discrete Cosine Transform HVS Human Visual System LSB Least Significant Bit SVM Support Vector Machine TP True Positive TN True Negative FN False Negative FP False Positive 1 Chapter 1 Introduction Information is power. There is an ongoing digital war leading into an esca- lated secrecy in data with regards to possession as well as to transmission. The current thesis will try to dissect the phenomenon and investigate a forensic approach on steganography, an information hiding method that steadily gains ground. Index Terms Cover media: an object that is original, without a secret message stored in it, the carrier of the hidden message Stego media: a medium in which the information is hidden, the cover image with a secret message concealed within it Embedded payload: the information which is to be hidden or concealed Training objects: data used for producing a model Image Feature: statistical representation of an image These terms will hence forth be used without further ado. 1.1 Purpose of the study Steganography is the technique of concealing particulars in data of any