Challenges and Detection Techniques in F5 Image Steganography
Francisco Ruiz explores the limitations of F5 image steganography, highlighting issues such as capacity reduction, detection vulnerabilities, and quality degradation. Various techniques for detecting F5-embedded images, including histogram analysis and comparison with cropped versions, are discussed. The potential impact of these challenges on the effectiveness of F5 as a steganographic method is emphasized.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Can We Do Better than F5 Image Steganography? Francisco Ruiz, IIT Forensecure 2017
JPEG embedding 0.05 DCT AC coefficients: blocks x (luma + 2 chroma) x 64 Most of them are zeros: good compression Next in number are +1, -1, +2, -2, etc. 0.045 0.04 0.035 0.03 0.025 0.02 0.015 0.01 0.005 0 -10 -9 -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10
F5 encoding (A. Westfeld 1999) 1. Permute the data. 2. Encode binary message as odd-even, by decreasing absolute value of non-zeros. 3. Un-permute the data so that the image is recovered and changes are scattered. 4. Matrix encoding minimizes changes.
Anything wrong with F5? Still the champion, but it has some problems: 1. If starting from +1 or -1, we might get a 0 result. 2. Zeros are skipped when decoding, so these data must be encoded again until the result is not zero, reducing capacity (shrinkage). 3. The process creates extra zeros. This happens often because those are the next most frequent values.
How bad is it? 0.05 Pretty bad, but the effect is similar to that of reducing the quality of the image. Unfortunately for the embedder, it can be detected (Fridrich et al., Siergiej et al.) 0.045 0.04 0.035 0.03 cover 0.025 F5 Q = 5 0.02 0.015 0.01 0.005 0 -10 -9 -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10
Detection: compare to cropped image 0.05 When the original is unavailable, crop the image 1 pixel all around to make it re-block, then save with same quality (from file header) Frequencies will change, so normalize with frequency of zero Normalized histogram won t change a lot 0.045 0.04 0.035 0.03 cover 0.025 cover-cropped 0.02 0.015 0.01 0.005 0 -10 -9 -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10
The histogram of a F5-embedded image goes a lot flatter after cropping 0.05 This is because the original quality is still in the header. Saving the cropped image re- computes the coefficients, with a smaller fraction of zeros. Possibly can be fixed by re- writing the header so the histogram for that Q value matches the F5 histogram. 0.045 0.04 0.035 0.03 0.025 F5 F5-cropped 0.02 0.015 0.01 0.005 0 -10 -9 -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10
PassLok eliminates the problem: 1. Don t make any extra zeros: change +1 to -1, -1 to +1. Parity is reversed for negative numbers so this works. Added bonus: no shrinkage, larger capacity 2. Occasionally increment absolute value rather than decrement. Pick those randomly, fraction to increment Y: Y= #2 s/(#1 s + #2 s) (around 20% for the sample cover)
How we find that fraction Probability of change: p Fraction being incremented: y B column won t change if: p(1-y)B + pyB = pB = pyA + p(1-y)C A B C p(1-y)B p y B Assuming A/B = B/C, result: y = B/(A+B) p y A p(1-y)C
PassLok nails the frequencies 20000 15000 cover F5 PassLok 10000 5000 0 -10 -9 -8 -7 -6 -5 -4 -3 -2 -1 0 1 2 3 4 5 6 7 8 9 10
The image ends up looking sharper F5 (47 kB) PassLok (55 kB) both with 83% embedding into luma and chroma channels (6.7 kB)
What happens when cropped? But so does a sharpened cover PassLok goes a little flatter 0.05 0.05 0.045 0.045 0.04 0.04 0.035 0.035 0.03 0.03 sharp sharp-cropped PassLok PL-cropped 0.025 0.025 0.02 0.02 0.015 0.015 0.01 0.01 0.005 0.005 0 0 -10 -8 -6 -4 -2 0 2 4 6 8 10 -10 -8 -6 -4 -2 0 2 4 6 8 10
Conclusion PassLok achieves near-perfect preservation of the DCT AC coefficient histogram, with no shrinkage. The image looks sharper possibly as a consequence of incremented coefficients. When cropped, the histogram changes like that of a sharpened image. Will perceived sharpening be detectable in the absence of the cover image?
Thanks! Comments: ruiz@iit.edu See PassLok in action at https://passlok.com It does PNG stego and encryption too! Kind regards to Jean-Claude Rock for his contribution
