Locating Steganalysis of LSB Matching Based on Spatial and Wavelet Filter Fusion

Chunfang Yang,Jie WangChengliang LinHuiqin Chen and Wenjuan Wang

Abstract: For the case of that only a single stego image of LSB (Least Significant Bit)matching steganography is available,the existing steganalysis algorithms cannot effectively locate the modified pixels.Therefore,an algorithm is proposed to locate the modified pixels of LSB matching based on spatial and wavelet filter fusion.Firstly,the validity of using the residuals obtained by spatial and wavelet filtering to locate the modified pixels of LSB matching is analyzed.It is pointed out that both of these two kinds of residuals can be used to identify the modified pixels of LSB matching with success rate higher than that of randomly guessing.Then,a method is proposed to measure the correlation between the results of two locating algorithms.Statistical results show that there are low correlations between the locating results of spatial filter based algorithm and wavelet filter based algorithm.Then these two kinds of residuals are fused by the voting method to improve the locating performance.The experimental results show that the proposed fusion algorithm can effectively improve the locating accuracy for the modified pixels of LSB matching.

Keywords: Steganography,steganalysis,LSB matching,modified pixel,filter.

1 Introduction

Digital steganography is a technique for hiding information in the redundancy of image,video,audio,text and other digital media,to achieve covert communication purposes[Zhang,Qin,Zhang et al.(2018);Xiang,Li,Hao et al.(2018)].In contrast,the purpose of steganalysis is to detect the stego objects and extract the hidden information.However,the existing researches on steganalysis mainly focus on the detection of stego objects [Ma,Luo,Li et al.(2018);Song,Liu,Yang et al.(2015);Xia,Guan,Zhao et al.(2017);Zhang,Liu,Yang et al.(2017)].Actually,the investigators usually are eager to extract the hidden information.Compared with the detection of stego object,extracting the hidden information is more difficult and usually requires more clues,such as the positions of hidden bits or modified samples.

In recent years,researchers have done some researches on estimating the positions of hidden information or modified samples in stego objects.For example,for the case of that the message bits are embedded sequentially,because LSB (Least Significant Bit)replacement steganography would make the frequencies of two pixel values 2aand 2a+1(0≤a≤127) tend to be approximately equal,Westfeld et al.[Westfeld and Pfitzmann (1999)] used the chi-square test to estimate the end position of the initial sequential LSB replacement steganography where the first bit secret information is embedded into the first sample.Ker et al.[Ker and Böhme (2008)] minimized the weighted stego residual subsequence to estimate the starting and end positions of sequential LSB replacement.For the case of owning multiple stego images embedded into the same positions,Ker et al.[Ker and Böhme (2008)] located the stego pixels of LSB replacement by accumulating weighted stego-image (WS) residuals in the same positions of different images.Chiew et al.[Chiew and Pieprzyk (2010)] used the local entropy to improve the algorithm proposed in Ker [Ker (2008)] when the binary image is used as cover.Then,Ker et al.[Ker and Lubenko (2009)] filtered the horizontal,vertical and diagonal wavelet subbands of stego images by Wiener filter,and located the stego pixels of LSB matching by accumulating wavelet absolute residuals in the same positions of different images.Luo et al.[Luo,Li and Yang (2011)] proposed two new residual calculation methods by improving the WS residuals,and used them to locate the stego pixels of LSB matching with higher accuracy than the algorithm in Ker et al.[Ker and Lubenko (2009)].Quach [Quach (2011,2014a)] modeled the images by Markov model and random field,and proposed some cover estimation algorithms based on maximum a posteriori probability,which are applied to the locating steganalysis of LSB replacement and LSB matching.Gui et al.[Gui,Li and Yang (2012)] used Quach’s algorithm in Quach [Quach (2011)] to obtain eight estimated cover images from eight different directions and used the mean of four neighborhoods to obtain the ninth estimated cover image for each stego image,then improved the location accuracy of the algorithm in Quach [Quach (2011)] by nine residual images between each stego image and its nine estimated cover images.Liu et al.[Liu,Tian,Han et al.(2015)] estimated the cover image by recompressing when the cover image has subjected JPEG compression before LSB matching,then located the stego pixels with higher accuracy than existing algorithms.Yang et al.[Yang,Luo,Lu et al.(2018)] proved the optimal stego subset property of multiple least significant bits (MLSB) steganography,and proposed an algorithm based on this property to locate the payload.For the case of owning multiple stego images embedded message with different lengths along the same path,Quach[Quach (2014b)] estimated the embedding path according to the residual values.

Above algorithms can accurately estimate the embedding positions of random LSB replacement and LSB matching steganography under the condition of owning enough stego images embedded along the same path.However,in many cases it is very difficult for the investigators to obtain multiple stego images with the same embedding path.And when only a stego image is available,above algorithms would locate stego positions or modified positions with a success rate close to that of randomly guessing.Therefore,it is still urgent to improve the locating accuracy in the case of owning a single stego image.In 2012,Quach [Quach (2012)] proved that the modified pixels in a stego image can be located with a lower error rate under the condition of owning enough independent non-random discriminant functions.Activated by this idea,a modified pixel locating algorithm for the typical LSB matching steganography is proposed based on fusing spatial and wavelet filtering.This algorithm constructs discriminant functions based on the residuals obtained by spatial and wavelet filtering respectively under the condition of having only a single stego image,then fuses the results of two discriminant functions to locate the modified pixels of LSB matching.The experimental results show that the proposed algorithm can effectively improve the locating accuracy for the modified pixels of LSB matching steganography,the advantage of true positive rate over false positive rate is more obvious.

2 Validity analysis of spatial and wavelet filtering residuals for locating modified pixels of LSB matching

Quach [Quach (2012)] pointed out that the prerequisites of fusing different discriminant functions are 1) the true positive rates of these discriminant functions for the modified pixels are higher than the false positive rate for the unmodified pixels,2) these discriminant functions are independent of each other.This section will analyze the validities of spatial and wavelet filtering residuals for locating the modified pixels of LSB matching,namely,whether the true positive rate for modified pixels is higher than the false positive rate for unmodified pixels.

2.1 Locating modified pixels of LSB matching based on spatial residual

For the case of owning multiple stego images embedded into the same positions,the existing locating steganalysis algorithms usually firstly estimate the cover images,then compute the residuals between the estimated cover images and the stego images,finally determine whether pixels in a position contain message based on the accumulated residuals in this position of different stego images.In steganalysis,4-neighborhood mean filter is one of the most commonly used cover estimation algorithms.

Letni,jdenote the stego noise added into the pixelxi,jby LSB matching,viz.si,j=xi,j+ni,j.Then the spatial residual can be obtained as follows:

Letzi,jdenote the residual of stego noise in spatial domain,viz.

When the modification ratio of LSB matching steganography isα,the stego noiseni,jwill be equal to 0,-1 and 1 with the probabilityP(ni,j)as follows:

Table1:The distribution of spatial stego noise residual in the unmodified position(ni , j =0)

From Eq.(4),it can be deduced that when the pixelsi,jdid not subject modifying during LSB matching steganography,viz.ni,j=0,the distribution of spatial stego noise residualzi,jis shown in Tab.1,where the mean is 0 and the variance isα4.When the pixelsi,jsubjected modifying during LSB matching steganography,viz.ni,j=1or -1,the distribution of spatial stego noise residualzi,jis shown in Tab.2,where the mean is 0 and the variance is1+α4.The existing researches show that the difference between the cover pixel and the mean of its 4 neighborhoods,viz.the mean of the spatial residuals of the cover images is usually equal to 0.Therefore,it is impossible to judge whether a pixels in the stego image has been modified according to the mean value of the spatial residuals,but it is possible to locate the pixels modified by LSB matching steganography according to the square of spatial residuals.

Table2:The distribution of spatial stego noise residual in the modified position (ni , j ≠0)

Then,10,000 grayscale cover images of size 512×512 were obtained by randomly cutting from 10,000 high-resolution images of “tiff” format downloaded from http://agents.fel.cvut.cz/stegodata/RAWs/.And 1000 different pseudo-random bit streams with length of floor (512×512×0.1) were respectively embedded into 1000 cover images selected from the obtained 10,000 grayscale cover images by LSB matching.Fig.1 shows the true positive rate for modified pixels and false positive rate for unmodified pixels of locating algorithm based on spatial residual square.In Fig.1,the 1000 images were numbered in ascending order of the true positive rate to make the result more intuitive.It can be seen that,for most images,one can use the spatial residual squares to locate the modified pixels of LSB matching with true positive rate higher than the false positive rate for the unmodified pixels.This satisfies one of the first prerequisite for fusing different discriminant functions pointed out by Quach [Quach (2012)].

Figure1:When the embedding ratio is 0.10,the performance of locating steganalysis for LSB matching based on spatial residual square

2.2 Locating modified pixels of LSB matching based on wavelet residual

The wavelet residual was firstly introduced to steganalysis by Goljan et al.[Goljan,Fridrich and Holotyak (2006)],and has a very good performance for detecting stego images of LSB matching.Then,Ker et al.[Ker and Lubenko (2009)] applied it to locating the stego positions of LSB matching for the case of owning multiple stego images embedded into the same position.Firstly,the stego images are decomposed by wavelet decomposition to be a low frequency subbandL,a horizontal subbandH,a vertical subbandsVand a diagonal subbandD.Then the horizontal,vertical and diagonal subband coefficients are filtered by a quasi-Wiener filter as follows,

whereWdenotes a two-dimensional signal,denotes the stego noise variance (when the modification ratio of LSB matching steganography isα,=α),represents the local variance in thei-th row andj-th column of the cover image.In Ker et al.[Ker and Lubenko (2009)],the local variance is estimated by MAP estimation method as follows,

whererepresents the mean square ofT×Tadjacent samples in a square region of sizeT×Tcentering on thei-th row andj-th column samples.

Figure2:Wavelet residual image

After the horizontal,vertical and diagonal wavelet subband residuals ℜ[H],ℜ[V]andℜ[D]are computed by (5),the wavelet residual image is constructed by combining them with the zeroed low-frequency subband as shown in Fig.2.Then the inverse wavelet transform of wavelet residual image is done to generate the WAM (Wavelet Absolute Moments) residual imageR.

For the case of owning multiple stego images embedded into the same positions by LSB matching,the algorithm in Ker et al.[Ker and Lubenko (2009)] estimates the stego positions by the absolute means of residualsRi,jover the same positions of these images.When the stego images are enough,this algorithm can estimate stego positions of LSB matching with a very low error rate.Therefore,when only a stego image of LSB matching is available,it should be possible to determine whether a pixel has been modified based on the absolute value of the WAM residualRi,jwith a success rate higher than that of guessing randomly.Taking the stego images with the embedded ratio of 0.10 in previous section as an example,Fig.3 shows the true positive rate for modified pixels and false positive rate for unmodified pixels of LSB matching based on the absolute values of WAM residuals computed by wavelet filtering.It can be seen that for most images,one can use the absolute values of WAM residuals to locate the modified pixels of LSB matching with true positive rate greater than the false positive rate.This satisfies the first prerequisite for fusing different discriminant functions pointed out by Quach[Quach (2012)].

Figure3:When the embedding ratio is 0.10,the performance of locating steganalysis for LSB matching based on wavelet residual

3 Locating modified pixels of LSB matching by fusing spatial and wavelet residuals

The second condition pointed out in Quach [Quach (2012)] for fusing different discriminant functions is that different discriminant functions are independently of each other.When the amount of modified pixels is equal to that of unmodified pixels and two discriminant functions are independent of each other,they will have the same decision result for about 50% of the pixels.When the discriminant functions of two discriminant functions are exactly the same,they have the strongest correlation.Therefore,this section adopts the following indexes to measure the correlation between the results of two locating algorithms,

wheref1(i,j)andf2(i,j)respectively denote the discriminant results of the functionsf1andf2in thei-th row andj-th column,0 indicates that the pixel is regarded as the unmodified pixel,1 indicates that the pixel is regarded as the modified pixel,and

The stronger the independence between the results of discriminant functionsf1andf2is,the value of correlation index computed by (7) will be closer to 0,and the better performance will be reached by fusion.The weaker the independence between the results of discriminant functionsf1andf2is,the value of correlation index computed by (7)will be closer to 1,and it is more difficult to improve the performance by fusion.

Figure4:Correlation between results of two locating algorithms for 1000 fully embedded stego images

The 1000 cover images randomly selected in Section 2.1 were embedded fully by LSB matching,so that the ratio of modified pixels in each stego image is about 50%.The modified pixels and unmodified pixels were discriminated based on the spatial residual and wavelet residual respectively.Then,the correlation between the results of two locating algorithms was computed by (7) for each stego image.

Fig.4 shows the correlation indexes between the locating results based on spatial residual and the locating results based on wavelet residual for each stego image.It can be seen that there are some correlation between the results of these two algorithms,but which are almost lower than 0.6 and closer to 0.Therefore,fusing these two algorithm would improve the locating accuracy for modified pixels of LSB matching.

This section will use the voting method as a fusion strategy to fuse the locating results of above two locating algorithms,and propose the following improved locating algorithm for LSB matching.

Algorithm 1:Locating modified pixels of LSB matching based on spatial and wavelet filter fusion.

Input:A stego image of LSB matching,modification ratioα,discrimination threshold.

Output:An estimated modification matrix.When a pixel is discriminated as modified pixel,the element in corresponding position of this pixel is set as 1;otherwise,the corresponding element is set as 0.

Steps:

1) Compute the number of modified pixels,MNα,whereMandNdenote the width and height of the given stego image,andαdenotes the ratio of modified pixels.

2) Create a modified pixel voting matrix with size ofM×Nand set all elements as 0,and create an estimated modification matrix with size ofM×Nand set all elements as 0.

3) According to (2),the given stego image is high-pass filtered by 4-neighborhood mean to obtain the spatial residual image.

4) Compute the spatial residual squares,selectMNαpositions with the largestMNαspatial residual squares,and set the elements in these positions of the modified pixel voting matrix as 1.

5) Calculate a one-level wavelet decomposition of the given stego image using the 8-tap Daubechies filter,zero out the coefficients in the low-frequency subband,and filter the horizontal,vertical and diagonal subbands by a quasi-Wiener filtered as shown in (5).

6) Combine the zeroed low frequency subband and filtered horizontal,vertical and diagonal subbands as the wavelet residual image.

7) Transform the wavelet residual image to the final residual imageRi,jby the inverse wavelet transform.

8) SelectMNαpositions with the largestMNαabsolute values of final residualsRi,j,and add 1 to the elements in these positions of the modified pixel voting matrix.

9) Compare each element in the modified pixel voting matrix with the discriminant threshold,when the value of an element is not less than the threshold,the corresponding pixel is regarded as the modified pixel,and the corresponding element in the estimated modification matrix is set as 1;otherwise,the corresponding pixel is regarded as the unmodified pixel,and the corresponding element in the estimated modification matrix is set as 0.

4 Experimental results and analysis

In this section,the proposed locating algorithm based on spatial and wavelet filter fusion was used to locate the modified pixels in the 1000 stego images with embedding ratio 0.1 generated in Section 2.1.

Figure5:Locating performance of the proposed fusion algorithm for 1000 stego images of LSB matching with embedding ratio 0.1,when the threshold is 1

Figure6:Performance of the proposed fusion algorithm and the two original algorithms before fusing for 1000 stego images of LSB matching with embedding ratio 0.1,when the threshold is 1

Fig.5 shows the true positive rate for the modified pixels and the false positive rate for the unmodified pixels in each stego image when the threshold is 1.It can be seen that the proposed algorithm has a higher true positive rate for the modified pixels than the false positive rate for the unmodified pixels.This demonstrates that the proposed algorithm can effectively locate the modified pixels,that is,can locate the modified pixels with a success rate higher than that of guessing randomly.The difference between true positive rate and false positive rate directly reflects the performance of the locating algorithm.The greater difference demonstrates the better performance.Fig.6 shows the difference between the true positive rate for the modified pixels and the false positive rate for the unmodified pixels in each stego image,which is referred as DPR (Difference between true Positive Rate and flase Positive Rate).It can be seen from Fig.6 that for most stego images,the performance of the proposed fusion algorithm is better than that of the two original algorithms before fusing.

5 Conclusion

For the case of owning a single stego image of LSB matching,the existing algorithms cannot effectively discriminate the modified pixels and the unmodified pixels.Activated by Quach’s idea of locating modified pixels,an improved locating algorithm for LSB matching steganography is proposed by fusing spatial and wavelet residuals.Experimental results show that the proposed fusion algorithm can effectively improve the locating accuracy for the modified pixels of LSB matching.

However,because only two algorithms are fused by the simple voting method,the accuracy is still not very satisfactory.Therefore,we would try to fuse more effective locating algorithms by the stronger learning method [Xiang,Zhao,Li et al.(2018)].Additionally,we may search the images with the similar contents on the Internet [Xiang,Shen,Qin et al.(2018)],and use them as references to estimate the cover images.

Acknowledgement:This work was supported by National Natural Science Foundation of China (Grant Nos.61872448,61302159,61772549,U1804263,U1736214,61602508)and Science and Technology Research Project of Henan Province,China (Grant No.152102210005).