Steganalysis in JPEG

Transcription

1 Steganalysis in JPEG CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey Spring 2007 Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

2 Learning Outcomes learn additional techniques for steganalysis in the JPEG domain. Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

3 Reading Core Reading Jessica Fridrich, Miroslav Goljan, Dorin Hogea: «Steganalysis of JPEG Images: Breaking the F5 Algorithm» 5th Information Hiding Workshop, Noordwijkerhout, The Netherlands, 7 9 October 2002, pp Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

4 Outline JPEG Histogramme Histogramme 1 JPEG Histogramme Histogramme 2 JPEG Calibration The idea 3 Conclusion Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

5 JPEG Histogramme The JPEG Coefficients Histogramme Recall that JPEG uses the blockwise DCT transform 8 8 blocks called DCT coefficients (floating point) The entries are quantised, called JPEG coefficients (integers) Each block has one DC coefficient, (0, 0) 63 AC coefficients, (i, j) (0, 0), 0 i, j 7 Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

6 JPEG Histogramme Histogramme Histogramme We calculate the histogramme of the AC JPEG coefficients h(x) is the number of coefficients equal to x Frequency-wise histogramme h ij (x) is the number of blocks where coefficient (i, j) is equal to x DC histogramme h 00 (x) The histogramme can be plotted curve bar chart Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

7 JPEG Histogramme Histogramme Histogramme We calculate the histogramme of the AC JPEG coefficients h(x) is the number of coefficients equal to x Frequency-wise histogramme h ij (x) is the number of blocks where coefficient (i, j) is equal to x DC histogramme h 00 (x) The histogramme can be plotted curve bar chart Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

8 JPEG Histogramme Histogramme Histogramme We calculate the histogramme of the AC JPEG coefficients h(x) is the number of coefficients equal to x Frequency-wise histogramme h ij (x) is the number of blocks where coefficient (i, j) is equal to x DC histogramme h 00 (x) The histogramme can be plotted curve bar chart Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

9 Outline JPEG Histogramme 1 JPEG Histogramme Histogramme 2 JPEG Calibration The idea 3 Conclusion Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

10 JPEG Toolbox Reading a JPEG image JPEG Histogramme» im = jpeg_read ( Kerckhoffs.jpg ) im = image_width: 180 image_height: 247 image_components: 3 image_color_space: 2 jpeg_components: 3 jpeg_color_space: 3 comments: {} coef_arrays: {[248x184 double] [128x96 double] [128x96 quant_tables: {[8x8 double] [8x8 double]} ac_huff_tables: [1x2 struct] dc_huff_tables: [1x2 struct] optimize_coding: 0 comp_info: [1x3 struct] progressive_mode: 0» Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

11 JPEG Toolbox JPEG data JPEG Histogramme» Xy = im.coef_arraysim.comp_info(1).component_id ;» whos Xy Name Size Bytes Class Attributes Xy 248x double» Q = im.quant_tablesim.comp_info(1).quant_tbl_no Q =» Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

12 JPEG Histogramme w/o the toolbox Load/Save workspace jpeg_read and jpeg_write are compiled functions, Non-trivial to install In the exercises, can load presaved workspaces» load image.mat» whos Name Size Bytes Class Attributes im 1x struct There is one mat-file for each image on the web page Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

13 JPEG Histogramme Other toolbox functions I recommend that you use the other toolbox functions bdct, ibdct, quantize, dequantize These are m-files, which can be copied into current directory. Alternatively, use matlab on tweek which has the toolbox. Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

14 JPEG Histogramme Extracting AC coefficients Consider N M matrix, A If B is a boolean (logical) N M matrix, then A(B) is a vector consisting of all elements from A corresponding to a 1 (true) in B Suppose we run (where A is N M DCT image) 1 B = logical(ones(8,8)) % Make 8x8 matrix of ones 2 B(1,1) = 0 % DC coefficient : zero 3 BB = repmat ( B, N/8, M/8 ) % Concatenate block for full image 4 X = A(B) % Vector of AC coefficients Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

15 Histogramme JPEG Histogramme We have discussed histogrammes before Essentially you need two functions hist to extract frequencies bar to make the plot Refer to help files and to exercise sheet Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

16 JPEG Histogramme Exercise JPEG Histogramme 1 Refer to details on the exercise sheet. 2 Download Image A from the web site; and load it in. 3 Make a vector X of AC coefficients (luminence) from A 4 Plot a histogramme of the JPEG AC coefficients of A. Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

17 Outline JPEG Calibration The idea 1 JPEG Histogramme Histogramme 2 JPEG Calibration The idea 3 Conclusion Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

18 JPEG Calibration The idea The calibrated image JPEG has a block-structure Steganography in JPEG follows the block-structure What happens if we de- and re-compress the image with different block structure? Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

19 JPEG Calibration The idea The calibrated image JPEG has a block-structure Steganography in JPEG follows the block-structure What happens if we de- and re-compress the image with different block structure? Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

20 JPEG Calibration The idea The calibrated image JPEG has a block-structure Steganography in JPEG follows the block-structure What happens if we de- and re-compress the image with different block structure? Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

21 The calibrated image JPEG Calibration The idea JPEG has a block-structure Steganography in JPEG follows the block-structure What happens if we de- and re-compress the image with different block structure? Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

22 JPEG Calibration The idea The calibrated image JPEG has a block-structure Steganography in JPEG follows the block-structure What happens if we de- and re-compress the image with different block structure? Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

23 JPEG Calibration Histogramme comparison The idea 1 Decompress the image 2 Crop 4 pixels; either 4 rows at top and bottom 4 columns left and right 4 pixels on each edge 3 Recompress using same quality factor and quantisation matrix called calibrated image 4 Compare histogramme of original and calibrated images 5 What do you see? Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

24 Outline JPEG Calibration 1 JPEG Histogramme Histogramme 2 JPEG Calibration The idea 3 Conclusion Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

25 JPEG Calibration JPEG Toolbox Decompression Dequantisation» Xy2 = dequantize ( Xy, Q ) ; Inverse transform» Xy3 = ibdct ( Xy2 ) ; Normalisation» Xy4 = uint8( Xy ) ; Did it work?» imshow ( Xy4 ) Note, we have only used grayscale information. Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

26 JPEG Toolbox Recompression JPEG Calibration New range» Xy3 = double( Xy4-128 ) ; Inverse transform» Xy2 = bdct ( Xy3 ) ; Quantisation» Xy = quantize ( Xy2, Q ) ; Reinsertion» im.coef_arrays{im.comp_info(1).component_id} = Xy ; Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

27 JPEG Calibration Exercise JPEG Image Calibration 1 Refer to details on the exercise sheet. 2 You still have the image A from the previous exercise. 3 Make an m-file which takes an image as input and outputs the calibrated image. Make a calibrated image A from A. 4 Plot a histogramme of the JPEG AC coefficients of A. 5 Compare the two histogrammes and comment. Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

28 Exercise (Part 2) JPEG Image Calibration JPEG Calibration 1 Refer to details on the exercise sheet. 2 Download Image B from the web site; and load it in. 3 Make a calibrated image B from B, as in Part 1. 4 Plot histogrammes (JPEG coefficients) of B and B (as in the previous part) 5 Compare the histogrammes of A, B, A, and B. What do you see? Do you think A and/or B is a stegogramme? Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

29 Conclusion Conclusion Compare an image and its calibrated image Normally very similar statistics,... because neighbour blocks are similar (visually) Data embedding change blocks independently Changes block structure and block statistics,... but the calibrated image is not changed in the same way We can use the calibrated image to estimate statistics in the original coverimage. Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24

30 In general Conclusion Main challenge in stegananalysis what is the expected statistics for a normal image? a.k.a. baseline value (Extra) Structural Steganalysis Look out for features in the JPEG format What is in the comments field? gives you access to this field... See Image D Dr Hans Georg Schaathun Steganalysis in JPEG Spring / 24