Image Steganalysis with Binary Similarity Measures

Transcription

1 EURASIP Journal on Appled Sgnal Processng 25:7, c 25 Hndaw Publshng Corporaton Image Steganalyss wth Bnary Smlarty Measures İsmal Avcıbaş DepartmentofElectroncsEngneerng, Uludağ Unversty, 659 Bursa, Turkey Emal: avcbas@uludag.edu.tr Mehd Kharraz Department of Electrcal and Computer Engneerng, Polytechnc Unversty, Brooklyn, NY 2, USA Emal: mehd@ss.poly.edu Nasr Memon Department of Computer and Informaton Scence, Polytechnc Unversty, Brooklyn, NY 2, USA Emal: memon@poly.edu.tr Bülent Sankur Departmentof Electrcaland ElectroncsEngneerng, Boğazç Unversty, İstanbul, Turkey Emal: bulent.sankur@boun.edu.tr Receved 4 March 24; Revsed May 25; Recommended for Publcaton by Mauro Barn We present a novel technque for steganalyss of mages that have been subjected toembeddng by steganographc algorthms. The seventh and eghth bt planes n an mage are used for the computaton of several bnary smlarty measures. The basc dea s that the correlaton between the bt planes as well as the bnary texture characterstcs wthn the bt planes wll dffer between a stego mage and a cover mage. These telltale marks are used to construct a classfer that can dstngush between stego and cover mages. We also provde expermental results usng some of the latest steganographc algorthms. The proposed scheme s found to have complementary performance vs-à-vs Fard s scheme n that they outperform each other n alternate embeddng technques. Keywords and phrases: steganography, steganalyss, unversal steganalyss.. INTRODUCTION Steganography refers to the scence of nvsble communcaton, where communcaton between two partes s undetectable by an eavesdropper. Ths s qute dfferent from cryptography, where the goal s to make the content of the communcatons naccessble to an eavesdropper. In contrast, steganographc technques strve to hde the very presence of the message or communcaton tself from an observer. The subject s best explaned n terms of the prsoner s problem [2], where Alce and Bob are two nmates who wsh to communcate n order to hatch an escape plan. However, all communcaton between them s examned by the warden, Wendy, who wll put them n soltary confnement at the slghtest suspcon of covert communcaton. Specfcally, n the general model for steganography we have Alce wshng to send a secret message m to Bob. In order to do so, she embeds m nto a cover object c, to obtan the stego object s. The stego object s then sent through the publc channel. In a pure steganography framework, the technque for embeddng the message s unknown to Wendy and shared as a secret between Alce and Bob. However, t s generally not consdered as good practce to rely on the secrecy of the algorthm tself. In prvate key steganography Alce and Bob share a secret key, whch s used to embed the message. The secret key, for example, can be a password used to seed a pseudorandom number generator to select pxel locatons n an mage cover object for embeddng the secret message (possbly encrypted). Wendy has no knowledge about the secret key that Alce and Bob share, although she s aware of the algorthm that they could be employng for embeddng messages. In publc key steganography, Alce and Bob have prvate-publc key pars and know each other s publc key. As stated above, the goal of steganography s to communcate securely n a completely undetectable manner, such that an adversary should not be able to dfferentate n any sense between cover objects (objectsnot contanng anysecret

2 275 EURASIP Journal on Appled Sgnal Processng message) and stego objects (objects contanng a secret message). In ths context, steganalyss s the set of technques that try to defeat the very purpose of steganography, by detectng the presence of hdden communcaton. Thus steganalyss ams to dstngush between cover objects and stego objects. The art of steganalyss s becomng ncreasngly more mportant n computer forenscs, for screenng and trackng documents that are suspect of crmnal actvtes, and for nformaton securty to prevent leakage of unauthorzed data. Conversely, steganalyss can be used to assess the weaknesses of steganographc algorthms. In the past few years we have wtnessed a great expanson n felds of steganography and steganalyss. Several new steganography methods are beng proposed each year, most of whch are followed by new and mproved steganalyss technques for ther detecton. The steganalyss technques proposed n the lterature could be categorzed nto two groups. Frst we have technque-specfc steganalyss methods, whch attack a specfc embeddng algorthm, such as the approach proposed n [3]. The secondtype oftechnquess blndto the embeddng method and could be used wth any embeddng algorthm. They are called unversal steganalyss technques. It s the second category that we wll be lookng at n ths paper. For a revew on current steganography and steganalyss technques the reader s referred to [3, 4, 5, 6, 7, 8]. As demonstrated prevously n [9, ], the embeddng process on a document leaves statstcal artfacts, whch could be used to dstngush between stego and cover versons. The argument that watermarkng and steganography leave telltale effects s common to all the steganalytcal methods. For example, Harmsen and Pearlman [5] assume that steganography affects the hstograms of the mages, whch they measure va the center of gravty of the characterstc functon of the RGB probablty densty functons (pdf). Fard assumes that correlaton across wavelets bands s affected [], whle Avcbas et al. demonstrate that mage qualty metrcs are perturbed [9]. Frdrch et al. assume that hstogram of DCT coeffcents are modfed, as n [3, 6], and that the lossless compresson capacty of the LSB plane s dmnshed, as n [8]. In ths paper, n order to capture these statstcal artfacts and hence to determne the presence of hdden messages, we propose a set of bnary smlarty measures between successve bt planes. The basc dea s that, the correlaton between the bt planes as well as the bnary texture characterstcs wthn the bt planes wll dffer between a stego mage and a cover mage. The seventh and eghth bt planes, and possbly others, are used to calculate these bnary smlarty measures. The proposed technque does not need a reference mage and t works wth both spatal and transform-doman embeddng. The method s smlar to that n [, 9], n that t explots ntrnsc statstcal propertes of mages to reveal the presence of steganographc content. The rest of ths paper s organzed as follows. In Secton 2 we revew bnary smlarty measures. In Secton 3 we descrbe our steganalyss technque. In Secton 4 we gve smulaton results and conclude wth a bref dscusson n Secton SIMILARITY MEASURES ON BINARY IMAGES In the proposed steganalyss scheme we nvestgate statstcal features extracted from the lower-order bt planes of mages for the presence of hdden messages. Snce each bt plane s also a bnary mage, we start by consderng smlarty measures between two bnary mages. We assume that any steganographc manpulaton on an mage wll alter the patterns n the neghborhood of a bt n ts bt plane as well as across the bt planes. In other words, the planar-quantal bt patterns wll be affected. An evdence of such telltale effect can be found n the probablty of bt transtons. One mght argue f straghtforward bt plane correlatons cannot be used for the steganalyss purpose. However, the evdence of any change s too weak f we measure only bt correlatons across bt planes. In ths study, we have found that t s more relevant to make comparsons based on bnary texture statstcs.letx ={x,k, k =,..., K} be the sequences of bts representng the K neghborhood pxels (K = 4and ncludes N, W, S, ande neghbors), where the ndex runs over all the mage pxels. We assume mages of sze M N. Let us defne the 5-pont stencl functon χ r,s as follows: fx r = andx s =, 2 fx r = andx s =, χ r,s = 3 fx r = andx s =, 4 fx r = andx s =, based upon whch we now defne the agreement varable for the pxel x as α j = K k= δ(χ,k, j), j =,...,4,K = 4, where δ(m, n) s the Kronecker delta functon, whch s defned as { } m = n δ(m, n) =. Obvously the α j m n functons denote the central pxel-neghbor pxel transton types. The accumulated agreements are defned as a = MN c = MN α, b = MN α 3, d = MN α 2, α 4. These four varables {a, b, c, d} can be nterpreted as the onestep co-occurrence values of a bnary mage. Usng the above defntons, several bnary mage smlarty measures can be defned as shown n Table. A good revew of smlarty measures can be found n []. Almost all the measures n Table have an ntutve nterpretaton; for example, the ffth measure dm 5, Sokal and Sneath s smlarty measure 4, yelds the condtonal probablty that LSBs of seventh bt plane s n the same state ( or ) gven the state of the LSBs n the eghth bt plane. The measure s an average over both states actng as predctors and t has a range of to. In ths table, the measures dm to dm are obtaned for seventh and eghth bt planes of the mage, separately. These measures form an adaptaton of the classcal bnary strng smlarty measures, such as n Sokal and Sneath [2]. () (2)

3 Image Steganalyss wth Bnary Smlarty Measures 275 Table : Bnary smlarty measures. Smlarty measure Descrpton Smlarty measure Descrpton Sokal and Sneath smlarty measure Sokal and Sneath smlarty measure 2 Kulczynsk smlarty measure Sokal and Sneath smlarty measure 3 Sokal and Sneath smlarty measure 4 Sokal and Sneath smlarty measure 5 dm = m 7th m 8th,where 2(a + d) m = 2(a + d)+b + c dm 2 = m 7th 2 m 8th 2,where a m 2 = a +2(b + c) dm 3 = m 7th 3 m 8th 3,where m 3 = a b + c dm 4 = m 7th 4 m 8th 4,where m 4 = a + d b + c dm 5 = m 7th 5 m 8th 5,where a/(a + b)+a/(a + c)+d/(b + d)+d/(c + d) m 5 = 4 dm 6 = m 7th 6 m 8th 6,where ad m 6 = (a + b)(a + c)(b + d)(c + d) Varance dssmlarty measure Bnary mnmum hstogram dfference Bnary absolute hstogram dfference dm = m 7th m 8th,where b + c m = 4(a + b + c + d) 4 dm = mn(pn, 7 pn) 8 dm 2 = Bnary mutual entropy dm 3 = Bnary Kullback-Lebler dstance Ojala mnmum hstogram dfference n= 4 pn 7 p8 n n= dm 4 = 4 pn 7 log pn 8 n= 4 n= p 7 n log p7 n p 8 n 5 dm 5 = mn(s 7 n, S 8 n) n= Ocha smlarty measure Bnary Lance and Wllams nonmetrc dssmlarty measure Pattern dfference dm 7 = m 7th 7 m 8th 7,where ( )( ) a a m 7 = a + b a + c dm 8 = m 7th 8 m 8th 8,where m 8 = b + c 2a + b + c dm 9 = m 7th 9 m 8th 9,where bc m 9 = (a + b + c + d) 2 Ojala absolute hstogram dfference 5 dm 6 = S 7 n S8 n n= 5 Ojala mutual entropy dm 7 = S 7 n log S 8 n Ojala Kullback-Lebler dstance n= 5 dm 8 = S 7 n log S7 n S 8 n n= There are three categores of smlarty measures derved from these scores. () The frst group conssts of the computed smlarty, =,...,, across the 7th and 8th bt planes. () The second group conssts of hstogram and entropc features. We frst normalze the hstograms of the agreement scores for the bt planes (ndcated by the superscrpt b): dfferences, dm = m 7th p b j = m 8th α j j α j, b = 7, 8. (3) Based on these normalzed four-bn hstograms, we defne the mnmum hstogram dfference dm and the absolute hstogram dfference measure dm 2, bnary mutual entropy dm 3, and bnary Kullback Lebler dstance dm 4, as also gven n Table. () The thrd set of measures dm 5,..., dm 8 are somewhat dfferent n that we use the neghborhood-weghtng mask proposed by Ojala [3].Foreachbnarymageweobtan a 52-bn hstogram based on the weghted neghborhood, where the score s gven by S = 7 = x 2 by weghtng Fgure : The weghtng pattern of the neghbors n the computaton of Ojala score. For example, the score becomes S = = 4 n the example where E, N, NE bts are and all other bts are. the eght-drectonal neghbors as shown n Fgure. Defnng S 7 n as the count of the nth hstogram bn n the 7th bt plane and S 8 n the correspondng one n the 8th plane, after normalzng these 52-bn hstograms, we can defne Ojala mnmum hstogram dfference dm 5 and Ojala absolute hstogram dfference measure dm 6, Ojala mutual entropy dm 7, and Ojala Kullback-Lebler dstance dm 8 as gven n Table. In Fgure 2 we show how Stools algorthm modfes the LSB and 7-8 bt plane correlatons n terms of the Ojala Kullback-Lebler dstance (measure dm 8 n Table )asa functon of embedded message sze. In the actve warden case where message has to be embedded robustly, deeper bt plane

4 2752 EURASIP Journal on Appled Sgnal Processng dm kb kb 2kB 3kB 6kB kb Message sze BP 78 BP 67 BP 56 Fgure 2: Varaton of the Ojala Kullback-Lebler dstance as a functon of embedded message sze n the Stools steganographc method. (Legend: BP 78 means bt planes 7 and 8, etc.) dm ORG B.2kB 2kB 5kB Message length BP 78 BP 67 BP 56 Fgure 4: Varaton of the bt plane correlatons, measured wth the measure dm 7, the Ojala entropy, as a functon of embedded message length for F5 algorthm. dm ORG Watermark strength BP 78 BP 67 BP 56 Fgure 3: Varaton of the bt plane correlatons, measured wth the Ojala entropy measure dm 8, as a functon of embeddng strength n Dgmarc [6] algorthm ORG kb.2kb 2kB 5kB Message length dm 7 dm 8 dm 9 Fgure 5: Varaton of dm 7, dm 8, dm 9 measures across 7-8 bt planes as a functon of embedded message length for F5 algorthm. correlatons (5-6 bt planes) should be taken nto account. In Dgmarc [4] example, as shown n Fgure 3, we see the same monotonc trend n the Ojala entropy measure (dm 8 n Table ) as a functon of watermark strength. In Fgure 4, the effects of the F5 [5] embeddng algorthm on the 5-6 bt planes (dm 7, the Ojala entropy n Table ) are llustrated. Fnally, varatons of dm 7, dm 8, dm 9 measures n Table across 7-8 bt planes as a functon of embedded message length for F5 [5] algorthm are shown n Fgure STEGANALYSIS TECHNIQUE BASED ON BINARY MEASURES We hypothesze that bnary smlarty measures between bt planes wll dffer n ther patterns between clean and stego mages, that s, the statstcs wll be modfed as a consequence of message embeddng. Ths s the bass of our steganalyzer that ams to classfy mages as stego and cover mages. In fact, embeddng nformaton n any bt plane

5 Image Steganalyss wth Bnary Smlarty Measures 2753 modfes the correlaton between that plane and ts contguous neghbors. For example, for LSB steganography, one expects a decreased smlarty between the seventh and the eghth bt planes of the mage as compared to ts unmarked verson, due to randomzaton of the eghth plane. Hence, smlarty measures between these two LSBs should yeld hgher scores n a clean mage as compared to a stego mage, as the embeddng process destroys the preponderance of bt-par matches. Note that the same procedure generalzes qute easly to detect messages n any other bt plane. Furthermore, our results ndcate that we can even buld steganalyzer for non-lsb embeddng technques lke the recent F5 algorthm [5]. Ths s because a technque lke F5 (and many other robust watermarkng technques, whch can be used for steganography n an actve warden framework [2]) results n the modfcaton of the correlaton between bt planes. Classfer desgn We have used support vector machnes (SVM) classfer [6]. In support vector machne (SVM) [7], the underlyng dea rests on the mnmzaton of the tranng set error, or the maxmzaton of the summed dstances between the separatng hyperplane and the subset of closest data ponts (the support vectors). For the tranng feature sets (m, y ), =,..., N, y [, ], the feature vector m les on a hyperplane gven by w T m + b =, where w s the normal to the hyperplane. A set of feature vectors s sad to be optmally separated f no errors occur and the dstance between the closest vectors to the hyperplane s maxmal. The dstance d(w, b; m) ofafeaturevectorm from the hyperplane (w, b) s d(w, b; m) = w T m + b / w. The optmal hyperplane s obtaned by maxmzng ths margn. There are a number of avalable mplementatons of SVM. We have used the freely avalable Lbsvm [8]package. The classfer tranng and testng procedures are as follows. () An equal number of marked (wth varyng message lengths) and unmarked mages are randomly chosen for the desgn step. Snce the number of embeddable mages vares as a functon of both the message sze and the steganographc algorthm, the number of stego mages wth a gven message length used n the marked category of the tranng set s determned wth ther emprcal statstcs n mnd. For example, gven a specfc method, f there are twce as many mages wth % message lengths as compared to 5% messages, then the tranng set wll contan twce as many mages wth % message as mages wth 5% messages. (2) The traned classfer s then tested aganst the remanng set of unseen unmarked and marked mages whch conssts of mages wth % embeddng, 5% embeddng,..., denoted respectvely as,,... (3) The above procedure s repeated 5 tmes, resultng n 5dfferent classfers and the average of the classfer performances s computed. Table 2: The number of mages n the database gven the message length and the embeddng type. The embedded message sze s equal to 384, 92, 384, and 576 bytes, respectvely, for bt/pxel ratos from % to 5%. P (bts/pxel) LSB LSB +/ F5 Outguess Outguess+ (384B) (92B) (384B) (576B) SIMULATION RESULTS 4.. Expermental setup An ntal database consstng of 8 natural mages was used [9].Themageswereconvertedtograyscaleandthe borders around them were cropped, resultng n mages of sze pxels, after whch they were recompressed wth a qualty factor of 75. Ths database was augmented wth the stego versons of these mages usng 5 dfferent embeddng technques, and dfferent message lengths were employed. Snce the actual steganographc capacty of a gven mage s dependent on the content of the mage as well as the embeddng technque used, we used a varety of message lengths to create our dataset Embeddng methods and message lengths The embeddng methods were chosen on the bass of most current steganographc algorthms avalable. The embeddng algorthms used n our experments were LSB, LSB +/, OutGuess, OutGuess+, and F5. The LSB and LSB +/ technques operate n the spatal doman, but wth LSB the leastsgnfcant bt of each pxel value s flpped, whereas wth LSB +/ the pxel values are ncremented or decremented by. The second set of technques whch nclude OutGuess [2], wth + and flags, and F5 [5] operates n the JPEG doman by modfyng the least sgnfcant bt of DCT coeffcents. There are dfferent approaches n the lterature n choosng the length of the stego message beng embedded. Fard [] choosesn n pxels from the central regon of a randomly chosen mage. Another approach s to take constant length messages, say at, 5, or bts. But n both approaches the actual message sze has no proportonalty wth the actual mage sze. In order to avod these problems, we have used the followng approach n defnng the message length: we assumed that p btscouldbeembeddedneach pxel value, regardless of the depth of the pxels, that s, 8 or 24 bt/pxel, where p s a fracton <p<. Thus the message length conssts of a percentage pont of the total number of pxels, and the length s ndependent of the type of mage format, bmp or jpeg, but proportonal to the sze of the mage. Furthermore, snce the szes of all mages n our experments were equal, the actual message lengths were also constant. Thus we consdered four message lengths, %, 5%, %, and 5%, respectvely denoted by the symbols,,, and. Table 2 below shows the arrangement n the

6 2754 EURASIP Journal on Appled Sgnal Processng True postve Fard False postve (a) True postve Fard False postve (b) Fgure 6: Comparson results, n the ROC plots; the sold lnes are from whereas the dashed lnes represent Fard s technque. (a) LSB and (b) LSB +/. database. One can notce that as the message length grows, the number of mages that can be accommodated decreases; n fact, wth methods such as Outguess ths decrease s qute sharp Classfcaton results Statstcs from the orgnal unmarked mages as well as the stego mages were obtaned by computng the bnary smlarty measures, ntroduced n Secton 2. Thus a vector of length 8 was obtaned for each mage. These vectors were then used to tran and test the classfer, where we used 72 marked and 72 unmarked mages n the tranng process. The classfer was traned wth all embeddng percentages from % to 5%. For example n the Outguess, the classfer was presented wth 72 unmarked and 72 marked mages, where the marked mages conssted of 38 mages wth message, 298 wth, and 4 wth. Images wth messages were not used n ths case snce very few of them are avalable. Table 3: Classfcaton results usng SVM. Outguess Outguess+ F5 LSB LSB +/ Accuracy: Accuracy: Accuracy: Accuracy: In Table 3, we gve the test stage classfcaton accuracy. Here accuracy s defned as the area under the ROC curve obtaned from the classfer, where the ROC curves are obtaned by frst desgnng a classfer and then testng the data unseen to the classfer aganst the traned classfer at the same tme movng the separatng hyperplane. As the separatng hyperplane s moved, the false alarm rate changes, and we get the correspondng detecton rate. Also the obtaned ROC curves for each embeddng technque could be seen n Fgures 6 and 7.

7 Image Steganalyss wth Bnary Smlarty Measures Fard True postve False postve (a) True postve Fard False postve (b) True postve Fard False postve (c) Fgure 7: Comparson results, n the ROC plots; the sold lnes are from whereas the dashed lnes represent Fard s technque. (a) F5, (b) Outguess,and(c)Outguess+. The most closely related publcaton to our work s by Fard [] n whch hgher-order statstcs of wavelet components are used for detectng hdden messages. But due to the fact that the results are presented dfferently a drect comparson was not possble. So n order to make a far comparson between the two proposed technques, we have used the publcly avalable matlab scrpt from the webste ( fard/) to calculate the proposed

8 2756 EURASIP Journal on Appled Sgnal Processng feature set, and then used our desgn and testng process on the obtaned features. The results n Fgures 6 and 7 show that the two methods are close compettors n that the proposed method proves superor for the LSB and LSB+/ embeddng technques whle Fard s method proves superor n the case of the F5 and Outguess+/ technques. 5. CONCLUSIONS In ths paper, we have addressed the problem of steganalyss of mages. We have developed a technque for dscrmnatng between cover mages and stego mages obtaned from varous steganographc methods. Our approach s based on the hypothess that steganographc schemes leave telltale evdence between bt planes of lower sgnfcance, whch n turn can be exploted for detecton. The steganalyzer has been nstrumented wth bnary mage smlarty measures and a classfer. Smulaton results wth commercally avalable steganographc technques ndcate that the proposed steganalyzer s effectve n classfyng stego and cover mages. Although tests have been run on LSB-based steganography, ntal results have shown that t can easly generalze to the actve warden case by takng deeper bt plane correlatons nto account. For example as n [9]weareabletodetect Dgmarc [4] when the measures are computed for hghersgnfcance bt planes. After ths proof-of-concept desgn, the stegoanalyzer can be mproved by judcous selecton of the feature set n Table, for example, va SFFS (sequental floatng feature search) algorthm. For the non-lsb technques both mage qualty metrcs [9] and bnary smlarty measures can be used jontly. Fnally, gven the fact that our algorthm and that of Fard [] outperform each other for dfferent steganographc methods and that nether one s unformly superor to the other one, ther complementary role should be exploted, for example, n a decson fuson scheme. ACKNOWLEDGMENTS Ths work was supported by AFRL Grant no. F C-9 and TÜBİTAK-NSF Project no. 2E8. We would also lke to thank Mr. Mke Sosonkn for hs help n codng parts of the proposed steganalyss technque. REFERENCES [] H. Fard, Detectng hdden messages usng hgher-order statstcal models, n Proc. IEEE Internatonal Conference on Image Processng (ICIP 2), vol. 2, pp , Rochester, NY, USA, September 22. [2] G. J. Smmons, The prsoners problem and the sublmnal channel, n Proc. Advances n Cryptology (CRYPTO 83), pp. 5 67, Santa Barbara, Calf, USA, August 983. [3] J. Frdrch, M. Goljan, and D. Hogea, Steganalyss of JPEG mages: breakng the F5 algorthm, n Proc. 5th Internatonal Workshop on Informaton Hdng (IH 2), pp , Noordwjkerhout, the Netherlands, October 22. [4] M. Kharraz, H. T. Sencar, and N. Memon, Image Steganography: Concepts and Practce, Lecture Notes Seres, Insttute for Mathematcal Scences, Natonal Unversty of Sngapore, Sngapore, Republc of Sngapore, 24. [5] J. J. Harmsen and W. A. Pearlman, Steganalyss of addtvenose modelable nformaton hdng, n Securty and Watermarkng of Multmeda Contents V, vol. 52 of Proceedngs of SPIE, pp. 3 42, Santa Clara, Calf, USA, January 23. [6] J. Frdrch, M. Goljan, and R. Du, Steganalyss based on JPEG compatblty, n Multmeda Systems and Applcatons IV, vol. 458 of Proceedngs of SPIE, pp , Denver, Colo, USA, August 2, Specal Sesson on Theoretcal and Practcal Issues n Dgtal Watermarkng and Data Hdng. [7] J. Frdrch, M. Goljan, and R. Du, Detectng LSB steganography n color and gray-scale mages, IEEE Multmeda, vol. 8, no. 4, pp , 2, Specal Issue on Securty. [8] K. Sullvan, U. Madhow, S. Chandrasekaran, and B. S. Manjunath, Steganalyss of spread spectrum data hdng explotng cover memory, n Securty, Steganography, and Watermarkng of Multmeda Contents VII, vol. 568 of Proceedngs of SPIE, pp , San Jose, Calf, USA, January 25. [9] İ. Avcıbaş, N. Memon, and B. Sankur, Steganalyss usng mage qualty metrcs, IEEE Trans. Image Processng, vol. 2, no. 2, pp , 23. [] H. Ozer, İ. Avcıbaş, B. Sankur, and N. Memon, Steganalyss of audo based on audo qualty metrcs, n Securty and Watermarkng of Multmeda Contents V, vol. 52 of Proceedngs of SPIE, pp , Santa Clara, Calf, USA, January 23. [] V. Batagelj and M. Bren, Comparng resemblance measures, n Proc. Internatonal Meetng on Dstance Analyss (DISTAN- CIA 92), Rennes, France, June 992. [2] P. H. A. Sneath and R. R. Sokal, Numercal Taxonomy. The Prncples and Practce of Numercal Classfcaton,W.H.Freeman, San Francsco, Calf, USA, 973. [3] T. Ojala, M. Petkänen, and D. Harwood, A comparatve study of texture measures wth classfcaton based on feature dstrbutons, Pattern Recognton, vol. 29, no., pp. 5 59, 996. [4] PctureMarc, Embed Watermark, v..45, Dgmarc Corporaton. [5] A. Westfeld, F5 a steganographc algorthm: hgh capacty despte better steganalyss, n Proc. 4th Internatonal Workshop on Informaton Hdng (IH ), vol. 237 of Lecture Notes n Computer Scence, pp , Sprnger, Pttsburgh, Pa, USA, Aprl 2, Release 2 was used n experments. [6] T. Haste, R. Tbshran, and J. Fredman, The Elements of Statstcal Learnng, Sprnger, New York, NY, USA, 2. [7] V. Vapnk, The Nature of Statstcal Learnng Theory, Sprnger, New York, NY, USA, 995. [8] cjln/lbsvm/. [9] Images were obtaned from: [2] İsmal Avcıbaş receved the B.S. and M.S. degrees n electroncs engneerng from Uludağ Unversty, Bursa, Turkey, n 992 and 994, respectvely, and the Ph.D. degree n electrcal and electroncs engneerng from Boğazç Unversty, İstanbul, Turkey, n 2. He receved a scholarshp from The Scentfc Councl of Turkey, TUBITAK, BDP Program, and dd research on mage compresson and steganalyss n the Department of Computer and Informaton Scence, Polytechnc Unversty, Brooklyn, NY, n He s currently an Assstant Professor at the Department of Electroncs Engneerng, Uludağ Unversty, Bursa, Turkey. Hs current research nterests are n sgnal processng, data compresson, steganalyss of audo-vsual data, and pattern recognton.

9 Image Steganalyss wth Bnary Smlarty Measures 2757 Mehd Kharraz receved hs B.E. degree n electrcal engneerng from Cty College of New York. He receved hs M.S. degree n electrcal engneerng from the Department of Electrcal and Computer Engneerng at Polytechnc Unversty, Brooklyn, NY, n May 22, and s currently pursung hs Ph.D. Hs current research nterests nclude multmeda and computer securty. Nasr Memon s a Professor n the Computer Scence Department at Polytechnc Unversty, New York. Professor Memon s research nterests nclude data compresson, computerandnetworksecurty,andmultmeda communcaton, computng, and securty. He was an Assocate Edtor for the IEEE Transactons on Image Processng from He s currently an Assocate Edtor for the ACM Multmeda Systems Journal, the IEEE Transactons on Informaton Forenscs and Securty, and the Journal of Electronc Imagng. Bülent Sankur receved hs B.S. degree n electrcal engneerng from Robert College, Istanbul, and completed hs M.S. and Ph.D. degrees at Rensselaer Polytechnc Insttute, NY, USA. He has been teachng at Boğazç (Bosphorus) Unversty n the Department of Electrcal and Electroncs Engneerng. Hs research nterests are n the areas of dgtal sgnal processng, mage and vdeo compresson, bometry, cognton, and multmeda systems. Dr. Sankur has held vstng postons at the Unversty of Ottawa, Techncal Unversty of Delft, and École Natonale Supéreure des Télécommuncatons, Pars. He was the Charman of ICT 96: Internatonal Conference on Telecommuncatons and EUSIPCO 5: The European Conference on Sgnal Processng as well as Techncal Charman of ICASSP.