Yuhan Kang, Fenlin Liu, Chunfang Yang, , Xiangyang Luo and Tingting Zhang
Abstract: This study proposes a color image steganalysis algorithm that extracts highdimensional rich model features from the residuals of channel differences. First, the advantages of features extracted from channel differences are analyzed, and it shown that features extracted in this manner should be able to detect color stego images more effectively. A steganalysis feature extraction method based on channel differences is then proposed, and used to improve two types of typical color image steganalysis features.The improved features are combined with existing color image steganalysis features, and the ensemble classifiers are trained to detect color stego images. The experimental results indicate that, for WOW and S-UNIWARD steganography, the improved features clearly decreased the average test errors of the existing features, and the average test errors of the proposed algorithm is smaller than those of the existing color image steganalysis algorithms. Specifically, when the payload is smaller than 0.2 bpc, the average test error decreases achieve 4% and 3%.
Keywords: Color channel, channel difference, color image, steganalysis, steganography.
Steganography is the science and art of concealing secret messages in unsuspected digital media, and the generated digital media are referred to as stego objects. Steganalysis is used to detect the stego objects and extract the secret messages. Among steganographic algorithms [Xiang, Li, Hao et al. (2018); Zhang, Qin, Zhang et al. (2018); Yao, Zhang and Yu (2016); Tang, Chen, Zhang et al. (2015)] with text, image, and video as cover, the image steganographic algorithms attract widespread attention from steganalysts.Steganalysts have designed numerous effective steganalysis algorithms [Yang, Liu, Luo et al. (2013); Pevny, Bas and Fridrich (2010)] for a number of classic image steganographic algorithms such as least significant bit steganography (LSB), F5[Westfeld (2001)], and MB [Sallee (2005)], where many steganalysis algorithms could even locate or extract the secret messages in certain cases [Yang, Luo, Lu et al. (2018)].Currently, steganalysts have also proposed a number of high-dimensional steganalysis features, such as the rich model [Fridrich and Kodovsky (2012)], the projection spatial rich model (PSRM) [Holub and Fridrich (2013b)], maxSRM [Denemark, Sedighi, Holub et al. (2014)], and phase-aware projection features (PHARM) [Holub and Fridrich(2015)], for the new content-adaptive image steganographic algorithms, such as highly undetectable stego (HUGO) [Pevny, Filler and Bas (2010)], wavelet obtained weights(WOW) [Holub and Fridrich (2012)], universal wavelet universal wavelet relative distortion (UNIWARD) steganography [Holub and Fridrich (2013a)], and studied how to select the most effective features from them [Ma, Luo, Li et al. (2018)].
Steganalysts currently focus on steganalysis for steganographic algorithms with grayscale images as covers [Song, Liu, Yang et al. (2015); Zhang, Liu, Yang et al. (2017)].However, color images are more widely used in our life and daily work. And for color image steganography, some steganalysis algorithms have also been proposed. Here, they are classified into various types, including steganalysis algorithms based on changes of color number [Fridrich, Du and Long (2000); Su, Han, Huang et al. (2011)], steganalysis algorithms based on inter-channel texture consistency [Abdulrahman, Chaumont,Montesinos et al. (2016b)], steganalysis algorithms based on co-occurrence matrices across channels [Goljan, Fridrich and Cogranne (2014); Goljan and Fridrich (2015); Liao,Chen and Yin (2016)], steganalysis algorithms based on inter-channel prediction errors[Lyu and Farid (2004); Liu, Sung, Xu et al. (2006); Li, Zhang and Yu (2014)], and steganalysis algorithms based on combinations of different channel features[Abdulrahman, Chaumont, Montesinos et al. (2016a)].
The steganalysis algorithms based on changes of color number primarily used the characteristic that steganography will increase the number of colors or similar color pairs to detect color stego images. For example, Fridrich et al. [Fridrich, Du and Long (2000)]extracted the ratio of similar color pairs in the color pairs appearing as features, and Su et al. [Su, Han, Huang et al. (2011)] embedded fixed ratios of random information in the given image, and then extracted the increased numbers of different colors and similar color pairs as features to detect the color stego image of LSB steganography. The steganalysis algorithms based on inter-channel texture consistency primarily extracted the statistical features that could reflect the strong consistency between the texture of different channels to detect color stego image. For example, Abdulrahman et al.[Abdulrahman, Chaumont, Montesinos et al. (2016b)] used the cosine and sine of the angle between the gradients of different channels to depict the texture direction consistency of different channels, extract their co-occurrence matrices, and combined them with SCRMQ1 (spatio-color rich model with quantization step q=1) [Goljan,Fridrich and Cogranne (2014)] to improve the detection accuracy of color stego images.The steganalysis algorithms based on the co-occurrence matrices across channels primarily captured the correlation between different channels by extracting the cooccurrence matrices across the residuals of three channels to detect the color stego image.For example, Goljan et al. [Goljan, Fridrich and Cogranne (2014)] extracted the cooccurrence matrices between the residuals of three channels and the rich model features of each channel, and then merged them into the color image steganography detection features, SCRMQ1. Goljan et al. [Goljan and Fridrich (2015)] divided the image pixels into blocks according to the color filter array characteristics from the imaging principle of a camera, and then computed the co-occurrence matrices across residuals in different channels from each block and merged them as the final feature set for steganalysis. Liao et al. [Liao, Chen and Yin (2016)] obtained the regions with complex texture in each channel and the regions with complex texture in any channel, and then calculated the cooccurrence matrices from residuals of these two types of regions in each channel and combined them as steganalysis features, that improved the detection accuracy of new adaptive steganography, such as WOW and S-UNIWARD. The steganalysis algorithms based on inter-channel prediction errors considered the correlation between channels when calculating the prediction errors of the image elements (such as pixel or wavelet coefficients) or their features, and then combined the features of prediction errors with other features to detect the color stego image. For example, Lyu et al. [Lyu and Farid(2004)] utilized the correlation between horizontal, vertical, and diagonal wavelet subband coefficients of different scales and different color channels to calculate logarithmic prediction errors, extracted their statistic features such as mean, variance, skewness, and kurtosis, and then used one-class support vector machines to realize pure blind detection of color image steganography. Liu et al. [Liu, Sung, Xu et al. (2006)] measured the correlation coefficients between the LSB planes of different color channels and the correlation coefficients between the prediction errors of each channel, and then combined them with the features reflecting the correlation in each channel to improve the color stego image detection performance of LSB matching. Li et al. [Li, Zhang and Yu (2014)]calculated the prediction errors of other channels from Y-channel by differences, and extracted the Markov features, Pevny features (PEV), co-occurrence matrix features, and their calibration features of the prediction error, and then combined them with the statistical features in the Y-channel to improve the detection performance of the color JPEG image steganography. The steganalysis algorithms based on the combination of different channel features extracted the features from three channels of the color image and then combined them to obtain the steganalysis feature. For example, Abdulrahman et al. [Abdulrahman, Chaumont, Montesinos et al. (2016a)] used steerable Gaussian filters to construct gradient magnitudes and derivatives of each channel, and then calculated the co-occurrence matrices from them as features SGF (steerable Gaussian filters) which is combined with the spatio rich model with quantization step q=1(SRMQ1) features and color rich model with quantization stepq=1(CRMQ1) to train the steganalyzer.
Compared with simply applying the steganography detection algorithm of grayscale images in three channels and fusing the results, the above algorithms improve the detection accuracy of color image steganography. Specifically, Abdulrahman et al.[Abdulrahman, Chaumont, Montesinos et al. (2016a)] combines three color steganalysis features with great performance, and obtains a better result. However, two of them,SRMQ1 and SGF, fail to consider a number of types of relationships between different color channels. As the pixels in different color channels exhibit strong correlative dependence and interplay, it is very likely that extracting these two features from the differences of different channels will further improve the accuracy of color image steganalysis.
In view of this, this study proposes a steganalysis algorithm for color images based on residuals of channel differences. The advantages of the channel difference feature are first analyzed from the view of the variance change rate. A steganalysis feature extraction method, based on residuals of channel differences, is then proposed. Then the proposed feature extraction method is used to improve two high-dimensional rich model features--the spatio rich model with quantization step q=1(SRMQ1) and steerable Gaussian filters (SGF). Combining the improved features with the 22563-dimension steganalysis feature reported in Abdulrahman et al. [Abdulrahman, Chaumont, Montesinos et al.(2016a)], a color image steganalysis algorithm based on residuals of channel differences is proposed. Finally, the experimental results indicate that, when secret messages are embedded into the R, G, or B color channels by new adaptive steganography such as WOW and S-UNIWARD, the improved features significantly enhance the steganalysis performance compared to the original features, and the proposed color image steganalysis algorithm has significantly smaller detection error rates than existing algorithms.Specifically, at smaller embedding rates, the maximum decreasing amplitude of detection errors can attain 3%.
Let X and Ybe random variables representing pixel values at the same position in channel I and channel II, respectively, andNXand NYbe random variables representing steganographic signals at the same positions in channel I and channel II, respectively.The means ofX ,Y ,NXand NYare denoted as μX,μY,μN(yùn)Xand μN(yùn)Y, respectively,and the variances are denoted asand. It assumedthat the correlation coefficient betweenX and Y is r.
Proposition 2.1.When random message bits are embedded into color images by additive noise, if the variances of the steganographic signal in the same positions in channel I and channel II are equal, that is:
and the correlation coefficients between pixel values in the same positions in channel I and channel II and their variances satisfy the following relationships:
then the variance change rate of the difference between the pixels in the same position in channel I and channel II after steganography,ΔD( X-Y), is greater than the variance change rate of the pixel at the corresponding position of either channel I or channel II,ΔD( X)or ΔD( Y).
Proof.When random message bits are embedded into color images by additive noise,because of the randomness of the embedded information, the stego noise is independent of the pixel value. Therefore, the variances of pixelsX and Yin the same positions in channel I and channel II after steganography are as follows:
The variance change rates of pixelsX and Yin the same positions in channel I and channel II are:
In the cover image, if pixels at the same positions in channel I and channel II are differentiated, the variance of the difference is as follows:
In the stego image, if pixels at the same positions in channel I and channel II are differentiated, the variance of the difference is as follows:
Therefore, the variance change rate of the difference between the pixels in the same positions in channel I and channel II after steganography is:
Subtracting the variance change rate of channel I from the variance change rate of the pixel difference between channel I and channel II, the following result is obtained:
The denominator of (10) is always positive because the correlation coefficient between the pixels in the same positions in channel I and channel II is in the range [-1, 1], viz.-1≤r≤1. Therefore, when the correlation coefficient between pixels in the same positions in channel I and channel II in the cover image satisfies the relationship shown in (11), (10) is positive. In other words, the variance change rate of the difference between pixels in the same positions in channel I and channel II is greater than the variance change rate of the pixel in the same position in channel I.
Similarly, by subtracting the variance change rate of channel II from the variance change rate of the difference between pixels in the same positions in channel I and channel II, it also can be derived that the variance change rate of the difference between pixels in the same positions in channel I and channel II is greater than that of channel II when the correlation coefficient between pixels in the same positions in channel I and channel II in the cover image satisfies the relationship shown in (12).
Eqs. (11) and (12) show that ifand the correlation coefficient rsatisfies the relationship (2), the variance change rate of the difference between pixels in the same positions in channel I and channel II after the steganography is greater than the variance change rate of the pixel in the corresponding position of either channel I or channel II.Therefore, the proposition is proved.
One of the necessary conditions of proposition 1 is that the variances of the steganographic signal in the same positions in channel I and channel II satisfy (1). In[Sangwine and Horne (1998)], Sangwine et al. reported that there is always a strong correlation between the three color channels R, G, and B of natural color images and gave the correlation coefficients between color channels asrB-R≈0.78,rR-G≈0.98, and rG-B≈0.94. This strong positive correlation makes the texture complexity of the same region in different channels significantly close.
When the same adaptive steganography algorithm is used to embed information in two channels, the similar texture complexity in the same position of two channels results in the distortion of the two corresponding pixels being significantly close after changing. As the probability of change for each pixel in adaptive steganography is determined by the distortion function and the length of the embedded information, the probability of two pixels in the same position being changed is approximately equal when the random information with equivalent lengths are embedded in the two channels. This also makes the variance of the steganographic signal at the same position approximately equal, that is,
Therefore, one of the necessary conditions of proposition 1, (1), is reasonable.
Another necessary condition of proposition 1 is that the correlation coefficients between the pixels in the same positions in channel I and channel II and their variances satisfy (2). As reported in Sangwine et al. [Sangwine and Horne (1998)], the strong positive correlation between the two channels results in the left-hand side of (2), the correlation coefficient between two channels, being greater than zero and close to one. In addition, the similar texture complexity of the same position in the two channels makes the variances of the pixel values in the same position approximately equal, resulting in the right-hand side of (2)being approximately zero. Therefore, the correlation coefficients between pixels in the same positions in different color channels and their variances should be able to satisfy (2) in the bulk of color images. The proportion of images whose two channels satisfy (2) will be calculated from the 10,000 color images from BOSSbase database3http://agents.fel.cvut.cz/stegodata/RAWs/.
Let channel I and channel II represent channel R and channel G, respectively, and the value of the right-hand side of (2) is subtracted from the value of the left-hand side for each image, that is:
In a color image, if the correlation coefficient between channel R and channel G and their variance results in (14) being greater than zero, it can be concluded that channel R and channel G of this image satisfy (2). From the statistical results shown in Fig. 2(a), there are 9992 images whose channel R and channel G satisfy (2) in the 10,000 color BOSSbase images. Similarly, there are 9887 images whose channel R and channel B satisfy (2), and 9927 images whose channel G and channel B satisfy (2), as shown in Figs.2(b) and 2(c). It can be seen that the ratio of images whose two color channels satisfy (2)is greater than 98%, which indicates that the second necessary condition of proposition 1 is reasonable.
Figure 1: Value of function “res” (14) with correlation coefficient between different color channels and their variances as parameters (x-label: Number of pictures and y-label:Value of “res”): (a) Channel R and channel G, (b) Channel R and channel B, and (c)Channel G and channel B
Figure 2: Procedure of steganalysis feature extraction based on residuals of channel difference
The above analysis of the conditions of proposition 1 indicates that, for most of the color images, the variance change rate of the difference between pixels in the same positions in different channels after steganography should be greater than that of the corresponding pixel in any of the channels. When the means of the steganographic signal,NXand NY,are zero, the mean change rate of the pixel value after steganography is zero and the mean change rate of the difference between pixels in the same positions in different channels is also zero. Therefore, proposition 1 indicates that steganography has a greater effect on the distribution of pixel differences between two channels than on any single channel. In addition, the features extracted from the pixel difference between two channels should be able to detect the color stego image more effectively.
In existing color image steganalysis algorithms, some features are independently extracted from the residuals of each color channel, and then combined. According to the analysis in Section 2, if the residuals are computed from the differences between different color channels, the steganalysis features extracted from them should have better detection performance. Therefore, this section proposes the following steganalysis feature extraction method based on the residuals of channel differences. As shown in Fig. 3, the primary steps of the method are as follows:
1) Calculate the channel differences between any two of the three colors channels R, G,or B, in a color spatial image, as follows:
where DRG,DRB, and DGBare the differences between channels red and green, red and blue, and green and blue, respectively;
2) The n high-pass filters are used to filter the three channel differences DRG,DRB, and DGB, and then the residual image sets dRG,dRB, and dGBof three channel differences are generated as follows:
3) Each residual image in the residual image sets dRG,dRB, and dGBis seen as a feature extraction source, from which statistical features such as the co-occurrence matrices or Markov transition probability matrices are extracted as the feature subsetsfRG,fRB,and fGB:
4) Merge the features in feature subsets fRG,fRB, and fGBto obtain the steganalysis feature based on the residual of channel differences.
In existing color steganalysis features, SRMQ1 feature has become one of the mainstream steganalysis features because it considers a number of types of relationships between neighboring samples of noise residuals obtained by linear and non-linear filters and achieves excellent performance. In recent years, SGF feature is proposed as a new feature to significantly improve the steganalysis performance. This feature takes into account the correlation between adjacent pixels inside each channel. The image content components are eliminated by a number of filters of different orientations, which helps to capture the steganographic signals with higher signal-to-noise ratio, and results in a more reliable detection of stego images. However, these two features fail to consider the correlation between channels. This section tries to apply the feature extraction method proposed in Section 3 to SRMQ1 and SGF features, which are called DSRMQ1 and DSGF. And a color image steganalysis algorithm is proposed by combining the DSRMQ1 and DSGF features with the CRMQ1, SRMQ1, and SGF features. As supervised learning techniques typically outperform unsupervised learning techniques in both the accuracy and efficiency [Xiang, Zhao, Li et al. (2018)], supervised learning techniques are more widely used in steganalysis. And the ensemble classifier [Kodovsky,Fridrich and Holub (2012)] has become a popular learning tool used in steganalysis.Therefore, it will also be used in the proposed color image steganalysis algorithm. The algorithm comprises steganalyzer training and stego image detection. The detailed procedures are as follows:
Algorithm 1:Training color steganalyzer.
Input:Color image training set, including cover training images and corresponding stego training images.
Output:Trained steganalyzer.
1) Steganalysis features extraction. A 39722-dimensional steganalysis feature is extracted from each training image as follows.
I.CRMQ1, SRMQ1, and SGF features extraction. The CRMQ1, SRMQ1, and SGF features with dimensions 22563 are extracted by the method in Abdulrahman et al.[Abdulrahman, Chaumont, Montesinos et al. (2016a)];
II.Channel differences computation. Compute the differences between two pixel values in the same position in any two color channels to get the channel differences;
III. DSRMQ1 feature extraction. The method presented in Section 3 is used to extract the 12753-dimensional DSRMQ1 feature from the channel differencesDRG,DRB, and DGB;
IV.DSGF feature extraction. The method presented in Section 3 is used to extract the 4406-dimensional DSGF features from the channel differencesDRG,DRB, and DGB;
V.Features merging. Merge the features extracted in asteps I, III, and IV to generate the 39722-dimensional color image steganalysis feature.
2) Ensemble classifier training. The group of label and corresponding steganalysis feature of each training image are taken as a training sample to train the ensemble classifier, that will be used as the steganalyzer.
Algorithm 2:Detecting color stego image.
Input:The given color image and the steganalyzer obtained by Algorithm 1.
Output:The label of the given image. If the given image is a stego image, the label is set as +1, otherwise, the label is set as -1.
1) Steganalysis feature extraction. For each color image to be detected, the same procedure and parameters of step 1) in algorithm 1 are used to extract the 39722-dimensional steganalysis feature of the given image.
2) Classifying the given image. Take the 39722-dimensional steganalysis feature of the given image as input, and use the steganalyzer trained by Algorithm 1 to distinguish whether the given image is a stego image.
10,000 raw images downloaded from BOSSbase4http://agents.fel.cvut.cz/stegodata/RAWs/were scaled to generate 10000 color cover images in “tiff” format with sizes of 512× 512pixels. The two typical adaptive steganography algorithms, WOW [Holub and Fridrich (2012)] and S-UNIWARD [Holub and Fridrich (2013a)], were used to embed pseudo-random information in the R, G, and B color channels of cover images with payloads of 0.05, 0.1, 0.2, 0.3, and 0.4 bits per channel pixel (bpc), and then generated2× 5=10groups of color stego images. Then, the performance of the proposed DSRMQ1 and DSGF features and color image steganalysis algorithm were tested with these images.
In each experimental unit, 5000 images were randomly selected as training cover images,and the corresponding 5000 stego images were used as training stego images. The remaining 5000 cover images and 5000 stego images were used as test cover and stego images, respectively. And the average testing errors under equal priors [Fridrich and Kodovsky (2012)] were calculated to evaluate the performance. For each payload of a steganographic algorithm, 10 experimental units were performed. The median of the average testing errors under equal priors of 10 experimental units was taken to measure detection performance. The smaller the value, the better the steganalysis performance.
The steganalysis performance of SRMQ1 and SGF features in Abdulrahman et al.[Abdulrahman, Chaumont, Montesinos et al. (2016a)], the DSRMQ1 and DSGF features proposed in Section 4, and the combined features DSRMQ1+DSGF and DSRMQ1+DSGF+SRMQ1+SGF were tested with above experimental settings in this subsection. Tab. 1 presents the average testing errors under equal priors of the above feature types for WOW and S-UNIWARD. It can be seen that, for both the steganographic algorithms, the performance of DSRMQ1 and DSGF features are significantly better than those of SRMQ1 and SGF features. The average test errors of DSRMQ1 features for WOW and S-UNIWARD are smaller than those of the original SRMQ1 feature by the decreasing amplitudes reaching 12.19% and 13.43% respectively. The average test errors of DSGF feature for WOW and S-UNIWARD steganography are smaller than those of original SGF features, with decreasing amplitudes reaching 16.30% and 17.17%, respectively. If the DSRMQ1 and DSGF features are combined, the combined features exhibit better performance. Compared with the average test errors of original SRMQ1+SGF features,those of the DSRMQ1+DSGF features for WOW and S-UNIWARD are smaller, with decreasing amplitudes reaching 12.82% and 14.51%, respectively. And the average test errors of the combined DSRMQ1+DSGF+SRMQ1+SGF features for WOW and SUNIWARD are much smaller than that, with decreasing amplitudes reaching 14.45% and 15.60%, respectively.
Above experimental results indicate that, compared to the features extracted from residuals of three channels, the features extracted from the residuals of channel differences exhibit better steganalysis performance.
Table 1: Average test errors of features before and after improving
The performance of the steganalysis algorithms in Abdulrahman et al. [Abdulrahman,Chaumont, Montesinos et al. (2016a)] and [Goljan, Fridrich and Cogranne (2014)], and the proposed steganalysis algorithm are tested with above experimental settings in this subsection. The average test errors of the three steganalysis algorithms for WOW and SUNIWARD with different payloads are presented in Tab. 2. Fig. 3 shows the receiver operating characteristic (ROC) curves of three steganalysis algorithms for WOW with payloads of 0.05, 0.1, and 0.3 bpc, and it is similar to that for S-UNIWARD. It can be seen that the proposed steganalysis algorithm outperforms the steganalysis algorithms in Abdulrahman et al. [Abdulrahman, Chaumont, Montesinos et al. (2016a)] and [Goljan,Fridrich and Cogranne (2014)] under different payloads for WOW. Specifically, when the payload is small, the advantage of the proposed steganalysis algorithm is more significant. The true positive rate of the proposed algorithm is clearly greater than those of the algorithms in Abdulrahman et al. [Abdulrahman, Chaumont, Montesinos et al.(2016a)] and [Goljan, Fridrich and Cogranne (2014)] at different false positive rates, and the maximum decreasing amplitudes of the average test errors for WOW and SUNIWARD are between 4% and 5%. Even when the payload is greater than or equal to 0.2 bpc, the true positive rate of the steganalysis algorithm proposed in this study is still greater than those of the algorithms in Abdulrahman et al. [Abdulrahman, Chaumont,Montesinos et al. (2016a)] and [Goljan, Fridrich and Cogranne (2014)], and the average test error is decreased by approximately 2%. The outstanding performance of the proposed steganalysis algorithm can be attributed to the addition of the features extracted from the residuals of channel differences. In addition, with increased payload, the steganalysis algorithms in Abdulrahman et al. [Abdulrahman, Chaumont, Montesinos et al. (2016a)] and [Goljan, Fridrich and Cogranne (2014)] achieve significant success rates,resulting in the advantages of the proposed algorithm being less significant than those with low payloads.
Table 2: Average test errors of different steganalysis algorithms.
Figure 3: ROC curves of different steganalysis algorithms for WOW (x-label: False positive rate and y-label: True positive rate): (a) payload 0.05 bpc, (b) payload 0.1 bpc,and (c) payload 0.3 bpc
In existing color image steganalysis algorithms, some features do not consider the correlation between different color channels, and the performance of them can be further improved. This study points out that the influence of steganography to the distribution of channel difference is greater than that of a single channel, and features extracted from channel differences will detect the color stego image with greater success rates. Based on this, two types of typical steganalysis features of color image,SRMQ1 and SGF, are improved. A color image steganalysis algorithm is proposed by combining the improved features with the existing color image steganalysis features.Experimental results indicate that, for both WOW and S-UNIWARD, the improved steganalysis features and algorithm significantly decrease the average test errors of the existing steganalysis features and algorithms.
In future studies, we will attempt to improve other high-dimensional steganalysis features,and design more effective steganalysis algorithms for color JPEG images.
Acknowledgement:This work was supported by the National Natural Science Foundation of China (Nos. 61772549, 61872448, U1736214, 61602508, 61601517,U1804263).
Computers Materials&Continua2019年4期