JPEG image steganalysis utilizing both intrablock and interblock correlations
JPEG image steganalysis has attracted increasing attention recently. In this paper, we present an effective Markov process (MP) based JPEG steganalysis scheme, which utilizes both the intrablock and interblock correlations among JPEG coefficients. We compute transition probability matrix for each difference JPEG 2-D array to utilize the intrablock correlation, and "averaged" transition probability matrices for those difference mode 2-D arrays to utilize the interblock correlation. All the elements of these matrices are used as features for steganalysis. Experimental works over an image database of 7,560 JPEG images have demonstrated that this new approach has greatly improved JPEG steganalysis capability and outperforms the prior arts.
- "— The proposed method is compared with state-of-the-art filtering detection algorithms ([Conotter et al. 2013a] and [Zhang et al. 2014]) and is shown to perform better in most cases. Also, it is compared with popular feature extraction algorithms such as [Kirchner and Fridrich 2010], [Chen and Shi 2008], [Pevny and Fridrich 2007], [Kodovsky et al. 2012], [Cozzolino et al. 2014] and [Verdoliva et al. 2014] to show that the proposed technique gives better performance in filtering detection. — Proposed technique's counter anti-forensic effectiveness is shown by testing it against state-of-the-art compression [Fan et al. 2013] and median filter [Fan et al. 2015] antiforensic methods. "
[Show abstract] [Hide abstract] ABSTRACT: This paper presents a statistical steganalysis framework to attack quantization index modulation (QIM) based steganography. The quantization process is generally modeled as an additive noise channel. The proposed method exploits the fact that plain-quantization (quantization without message embedding) decreases local-randomness (or increases local-correlation) in the resulting quantized image. Moreover, QIM-stego image exhibits relatively higher level of local-randomness than the corresponding quantized-cover, though both are obtained using same set of parameters. The local-randomness (or inter-block correlation) of the test-image is used to capture traces left behind by quantization. A parametric model is developed to characterize channel-dependent local-randomness. Maximum likelihood estimation (MLE) framework is used to estimate parameters of the distribution of the local-randomness mask. Distributions of parameters, estimated from the quantized-cover and the QIM-stego images, are used to characterize quantization with and without message embedding. To investigate variations in the estimated parameters as a function of frequency, inter-(variations within each channel(or subband)) and intra-channel (across all channels), joint-channel modeling and single-channel modeling, respectively, is considered. For each approach, a set of parametric detectors based on generalized likelihood ratio test (GLRT) is used to distinguish between the cover-and the stego-images. To improve detection accuracy, decisions from both detectors are fused to generate the final stego-detection decision. Effectiveness of the proposed framework is evaluated using a dataset consisting of over 35000 test-images obtained from 880 uncompressed natural images. Experimental results show that the proposed scheme can successfully detect QIM-stego images with very low false rates. In addition, performance comparison with existing state-of-the-art also shows that the proposed method performs 1 significantly superior than the selected methods.
- "Experimental results show that the proposed methods can successfully distinguish between the quantized-cover and the QIM-stego with very low false rates, i.e., P f p < 0.015 and P f n < 0.03 for sequential embedding, and P f p < 0.013 and P f n < 0.038 for random embedding. Detection performance comparison with existing state of the art [8, 23, 34, 46] also indicates that the proposed scheme performs significantly superior than the selected methods [8, 23, 34, 46]. We are currently evaluating performance of the proposed method for other heavy-tailed distributions such as log-normal, beta, (generalized) extreme value, and so on. "
- "" Although double JPEG compression does not by itself prove malicious or unlawful tampering, it provides an evidence of image manipulation. The detection of double JPEG compression has been well studied [4, 24, 31]. However, if the original image sources are encoded with the same quantization matrix and the doctored images are also encoded with the same quantization matrix, the detection of such forgery becomes much more challenging. "