![Page 1: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/1.jpg)
Higher-Order Statistics and Pairs AnalysisCSM25 Secure Information Hiding
Dr Hans Georg Schaathun
University of Surrey
Spring 2008
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 1 / 41
![Page 2: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/2.jpg)
Outcomes
Understand the principle of higher-order statisticsBe able to implement at least one steganalysis technique usinghigher-order statistics.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 2 / 41
![Page 3: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/3.jpg)
Reading
Core Reading
«Quantitative steganalysis of digital images:estimating the secret message length»by Jessica Fridrich, Miroslav Goljan, Dorin Hogea, David Soukal,in Multimedia Systems 2003
Suggested Reading
«Higher-order statistical steganalysis of palette images»by Jessica Fridrich, Miroslav Goljan, David Soukal
Suggested Reading
Jessica Fridrich, Miroslav Goljan, and Rui Du (State University of NewYork, Binghamton) ‘Detecting LSB Steganography in Color andGray-Scale Images’ in Multimedia and Security 2001
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 3 / 41
![Page 4: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/4.jpg)
Background
Outline
1 Background
2 Pairs analysisThe characteristic sequenceHomogenous pairs
3 Where Pairs Analysis failsDithered backgrounds
4 RS steganalysisThe ideaThe resultCounter-measures
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 4 / 41
![Page 5: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/5.jpg)
Background
Where χ2 falls short
The χ2 test we have seenAnalyses histogram only.Detects embedding in consecutive pixels
What if the message is randomly spread across the image?Generalised χ2 analysis.
Yes/No answer; cannot estimate message lengthCan be fooled if the message is biased (more 0-s than 1-s or v.v.)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 5 / 41
![Page 6: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/6.jpg)
Background
Higher-order statisticsPixels in neighbourhoods
Pairs of Values counts single pixels→ first-order statistic
Higher-order statisticsCount pairs of (neighbour) pixels (2nd order)Pixel triplets (3rd order)
Study relations between pixels in a neighbourhood
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 6 / 41
![Page 7: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/7.jpg)
Pairs analysis
Pairs Analysis
Pairs Analysis is quantitativei.e. estimates the message length
Originally designed for GIF.We present it for spatial, grayscale images.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 7 / 41
![Page 8: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/8.jpg)
Pairs analysis The characteristic sequence
Outline
1 Background
2 Pairs analysisThe characteristic sequenceHomogenous pairs
3 Where Pairs Analysis failsDithered backgrounds
4 RS steganalysisThe ideaThe resultCounter-measures
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 8 / 41
![Page 9: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/9.jpg)
Pairs analysis The characteristic sequence
The characteristic sequence
Let c, c′ be two colours (grayscales).Read image row by row (left to right and top down).Assign 0 to c and 1 to c′.Ignore all other colours.Resulting sequence is denoted Z (c, c′).
Definition
Z = Z (0, 1)|Z (2, 3)|Z (4, 5)| . . . |Z (254, 255), (1)Z ′ = Z (1, 2)|Z (3, 4)|Z (5, 6)| . . . |Z (255, 0). (2)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 9 / 41
![Page 10: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/10.jpg)
Pairs analysis The characteristic sequence
The colour cut
Z ( , ) extracted from an imageExtracted column-wise (Matlab-style)Row-wise extraction is equally valid.
����
��
��
���� ��
���� ��
001111000000111111001101110010111001111110
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 10 / 41
![Page 11: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/11.jpg)
Pairs analysis Homogenous pairs
Outline
1 Background
2 Pairs analysisThe characteristic sequenceHomogenous pairs
3 Where Pairs Analysis failsDithered backgrounds
4 RS steganalysisThe ideaThe resultCounter-measures
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 11 / 41
![Page 12: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/12.jpg)
Pairs analysis Homogenous pairs
Second-order structure
Second-order structure (of Z and of Z ′)count pairs of consecutive bitsfour possible pairs 00,01,10,11
Homogenous pairs: 00, 11Let F be frequency of Homogenous pairs in Z .Let R = F/n be the relative frequency.
where n = N ·M − 1 is the number of pairs.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 12 / 41
![Page 13: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/13.jpg)
Pairs analysis Homogenous pairs
Example
0 0 0 1 1 0 1 1 1 1 0 1 1Homog. 1 1 0 1 0 0 1 1 1 0 0 1
F = 7N = 11R = 7/11 = 0.6364
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 13 / 41
![Page 14: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/14.jpg)
Pairs analysis Homogenous pairs
Expected structure of Z
Let R(p) = E(R) beexpected, relative frequency of homogenous pairs in Zwhen a fraction p of pixel LSB-s have been flipped.(e.g. if a random unbiased bit string of length 2p has beenembedded)
TheoremR(p) is a parabola with minimum at R(1/2) = 1/2.
R(p) = ap2 + bp + c
for some constants a, b, and c.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 14 / 41
![Page 15: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/15.jpg)
Pairs analysis Homogenous pairs
Why parabola?
k1 k2 k3 k4 · · · kr
Z =︷ ︸︸ ︷0000
︷︸︸︷111
︷ ︸︸ ︷00 . . . 0
︷ ︸︸ ︷11 . . . 1 · · ·
︷ ︸︸ ︷11 . . . 1
nR(0) =∑r
i=0(ki − 1)
Homogenous pair remains homogenous: Pr = q2 + (1− q)2
Both change + Neither changes
Heterougenous pair becomes homogenous: Pr = 2q(1− q)
nR(q) =r∑
i=1
[q2 + (1− q)2](ki − 1) + 2q(1− q)(r − 1)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 15 / 41
![Page 16: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/16.jpg)
Pairs analysis Homogenous pairs
Why parabola?
k1 k2 k3 k4 · · · kr
Z =︷ ︸︸ ︷0000
︷︸︸︷111
︷ ︸︸ ︷00 . . . 0
︷ ︸︸ ︷11 . . . 1 · · ·
︷ ︸︸ ︷11 . . . 1
nR(0) =∑r
i=0(ki − 1)
Homogenous pair remains homogenous: Pr = q2 + (1− q)2
Both change + Neither changes
Heterougenous pair becomes homogenous: Pr = 2q(1− q)
nR(q) =r∑
i=1
[q2 + (1− q)2](ki − 1) + 2q(1− q)(r − 1)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 15 / 41
![Page 17: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/17.jpg)
Pairs analysis Homogenous pairs
Why parabola?
k1 k2 k3 k4 · · · kr
Z =︷ ︸︸ ︷0000
︷︸︸︷111
︷ ︸︸ ︷00 . . . 0
︷ ︸︸ ︷11 . . . 1 · · ·
︷ ︸︸ ︷11 . . . 1
nR(0) =∑r
i=0(ki − 1)
Homogenous pair remains homogenous: Pr = q2 + (1− q)2
Both change + Neither changes
Heterougenous pair becomes homogenous: Pr = 2q(1− q)
nR(q) =r∑
i=1
[q2 + (1− q)2](ki − 1) + 2q(1− q)(r − 1)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 15 / 41
![Page 18: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/18.jpg)
Pairs analysis Homogenous pairs
The R-function
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 16 / 41
![Page 19: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/19.jpg)
Pairs analysis Homogenous pairs
Structure of the shifted pairs
Compare the pairs Z with shifted pairs Z ′
Two parabolas
Assumption
R′(p) are parabolic and symmetric around p = 1/2, i.e.
R′(p) = a′p2 + b′p + c′.
We will study D(p) = R(p)− R′(p).Difference between two parabolæ is a parabola
D(p) = ap2 + bp + c for unknown a, b, p.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 17 / 41
![Page 20: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/20.jpg)
Pairs analysis Homogenous pairs
Structure of the shifted pairs
Compare the pairs Z with shifted pairs Z ′
Two parabolas
Assumption
R′(p) are parabolic and symmetric around p = 1/2, i.e.
R′(p) = a′p2 + b′p + c′.
We will study D(p) = R(p)− R′(p).Difference between two parabolæ is a parabola
D(p) = ap2 + bp + c for unknown a, b, p.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 17 / 41
![Page 21: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/21.jpg)
Pairs analysis Homogenous pairs
Structure of the shifted pairs
Compare the pairs Z with shifted pairs Z ′
Two parabolas
Assumption
R′(p) are parabolic and symmetric around p = 1/2, i.e.
R′(p) = a′p2 + b′p + c′.
We will study D(p) = R(p)− R′(p).Difference between two parabolæ is a parabola
D(p) = ap2 + bp + c for unknown a, b, p.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 17 / 41
![Page 22: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/22.jpg)
Pairs analysis Homogenous pairs
Structure of the shifted pairs
Compare the pairs Z with shifted pairs Z ′
Two parabolas
Assumption
R′(p) are parabolic and symmetric around p = 1/2, i.e.
R′(p) = a′p2 + b′p + c′.
We will study D(p) = R(p)− R′(p).Difference between two parabolæ is a parabola
D(p) = ap2 + bp + c for unknown a, b, p.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 17 / 41
![Page 23: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/23.jpg)
Pairs analysis Homogenous pairs
Structure of the shifted pairs
Compare the pairs Z with shifted pairs Z ′
Two parabolas
Assumption
R′(p) are parabolic and symmetric around p = 1/2, i.e.
R′(p) = a′p2 + b′p + c′.
We will study D(p) = R(p)− R′(p).Difference between two parabolæ is a parabola
D(p) = ap2 + bp + c for unknown a, b, p.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 17 / 41
![Page 24: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/24.jpg)
Pairs analysis Homogenous pairs
Structure of the shifted pairs
Compare the pairs Z with shifted pairs Z ′
Two parabolas
Assumption
R′(p) are parabolic and symmetric around p = 1/2, i.e.
R′(p) = a′p2 + b′p + c′.
We will study D(p) = R(p)− R′(p).Difference between two parabolæ is a parabola
D(p) = ap2 + bp + c for unknown a, b, p.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 17 / 41
![Page 25: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/25.jpg)
Pairs analysis Homogenous pairs
The R′-function
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 18 / 41
![Page 26: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/26.jpg)
Pairs analysis Homogenous pairs
The R′-function
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 18 / 41
![Page 27: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/27.jpg)
Pairs analysis Homogenous pairs
Structure of the shifted pairs (II)
WriteZ ′ = b1, b2, b3, . . . , bn
Theorem
nR′(1/2) =n−1∑k=1
2−khk ,
where hk is number of homogenous pairs among
(b1, bk+1), (b2, bk+2), . . . , (bn−k , bn).
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 19 / 41
![Page 28: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/28.jpg)
Pairs analysis Homogenous pairs
The estimate of R′(1/2)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 20 / 41
![Page 29: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/29.jpg)
Pairs analysis Homogenous pairs
Zero message assumption
D(p) = ap2 + bp + c
Assumption
Z and Z ′ have the same structure when no message is embedded.
R(0) = R′(0)
D(0) = 0c = 0
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 21 / 41
![Page 30: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/30.jpg)
Pairs analysis Homogenous pairs
Zero message assumption
D(p) = ap2 + bp + c
Assumption
Z and Z ′ have the same structure when no message is embedded.
R(0) = R′(0)
D(0) = 0c = 0
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 21 / 41
![Page 31: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/31.jpg)
Pairs analysis Homogenous pairs
Zero point
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 22 / 41
![Page 32: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/32.jpg)
Pairs analysis Homogenous pairs
Symmetry
Swapping all bits does not change the statisticSwapping 1− q random bits means
Swapping all bits, and then (re)swap q random bits
Embedding q or 1− q bits is the same thing.We conclude, D(q) = D(1− q)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 23 / 41
![Page 33: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/33.jpg)
Pairs analysis Homogenous pairs
Symmetry
Swapping all bits does not change the statisticSwapping 1− q random bits means
Swapping all bits, and then (re)swap q random bits
Embedding q or 1− q bits is the same thing.We conclude, D(q) = D(1− q)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 23 / 41
![Page 34: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/34.jpg)
Pairs analysis Homogenous pairs
Symmetry
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 24 / 41
![Page 35: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/35.jpg)
Pairs analysis Homogenous pairs
Solving a second-order equation
We can estimate R and R′ at q = 12
R( 12 )− R′( 1
2 ) = D( 12 ) = a/4 + b/2 (left side known)
We exploit symmetry0 = D(q)− D(1− q) = (aq2 + bq)− (a(1− q)2 + b(1− q)).
We solve for a and b, to get
4D(12)q − 4D(
12)q2 = D(q)
where D(12) and D(q) are known
Solving the quadratic estimate gives pEstimated message length is 2p
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 25 / 41
![Page 36: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/36.jpg)
Where Pairs Analysis fails Dithered backgrounds
Outline
1 Background
2 Pairs analysisThe characteristic sequenceHomogenous pairs
3 Where Pairs Analysis failsDithered backgrounds
4 RS steganalysisThe ideaThe resultCounter-measures
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 26 / 41
![Page 37: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/37.jpg)
Where Pairs Analysis fails Dithered backgrounds
Dithered backgrounds
Dithering is used to simulate additional coloursTwo colours c1 and c2 alternate over an area.The appearance would be a uniform colour somewhere inbetween.Colour cut (c1, c2) has many heterogenous pairs.The result is that R(0) 6= R′(0) and our assumption fails.This can be fixed by clever choice of colour cut.(I did not find any good examples.)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 27 / 41
![Page 38: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/38.jpg)
Where Pairs Analysis fails Dithered backgrounds
Dithered backgrounds
Dithering is used to simulate additional coloursTwo colours c1 and c2 alternate over an area.The appearance would be a uniform colour somewhere inbetween.Colour cut (c1, c2) has many heterogenous pairs.The result is that R(0) 6= R′(0) and our assumption fails.This can be fixed by clever choice of colour cut.(I did not find any good examples.)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 27 / 41
![Page 39: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/39.jpg)
Where Pairs Analysis fails Dithered backgrounds
Dithered backgrounds
Dithering is used to simulate additional coloursTwo colours c1 and c2 alternate over an area.The appearance would be a uniform colour somewhere inbetween.Colour cut (c1, c2) has many heterogenous pairs.The result is that R(0) 6= R′(0) and our assumption fails.This can be fixed by clever choice of colour cut.(I did not find any good examples.)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 27 / 41
![Page 40: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/40.jpg)
Where Pairs Analysis fails Dithered backgrounds
Dithered backgrounds
Dithering is used to simulate additional coloursTwo colours c1 and c2 alternate over an area.The appearance would be a uniform colour somewhere inbetween.Colour cut (c1, c2) has many heterogenous pairs.The result is that R(0) 6= R′(0) and our assumption fails.This can be fixed by clever choice of colour cut.(I did not find any good examples.)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 27 / 41
![Page 41: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/41.jpg)
Where Pairs Analysis fails Dithered backgrounds
Dithered backgrounds
Dithering is used to simulate additional coloursTwo colours c1 and c2 alternate over an area.The appearance would be a uniform colour somewhere inbetween.Colour cut (c1, c2) has many heterogenous pairs.The result is that R(0) 6= R′(0) and our assumption fails.This can be fixed by clever choice of colour cut.(I did not find any good examples.)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 27 / 41
![Page 42: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/42.jpg)
RS steganalysis The idea
Outline
1 Background
2 Pairs analysisThe characteristic sequenceHomogenous pairs
3 Where Pairs Analysis failsDithered backgrounds
4 RS steganalysisThe ideaThe resultCounter-measures
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 28 / 41
![Page 43: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/43.jpg)
RS steganalysis The idea
RS steganalysis
Proposed for true colour imagesUse information from all 8 bits of a pixelLinked to so-called lossless capacity
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 29 / 41
![Page 44: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/44.jpg)
RS steganalysis The idea
Pixel groups and smoothness
Divide image into pixel groups G1, G2, . . .
Disjoint groupsConsecutive pixels
Define the smoothness of a group G = (x1, x2, . . . , xn)
f (G) =n−1∑i=1
|xi − xi+1|.
High f (G) means sharp changes from pixel to pixel.Unusual for neighbour pixels in natural images
Compare f (F (G)) and f (G)
where F is flips pixels.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 30 / 41
![Page 45: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/45.jpg)
RS steganalysis The idea
Pixel groups and smoothness
Divide image into pixel groups G1, G2, . . .
Disjoint groupsConsecutive pixels
Define the smoothness of a group G = (x1, x2, . . . , xn)
f (G) =n−1∑i=1
|xi − xi+1|.
High f (G) means sharp changes from pixel to pixel.Unusual for neighbour pixels in natural images
Compare f (F (G)) and f (G)
where F is flips pixels.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 30 / 41
![Page 46: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/46.jpg)
RS steganalysis The idea
Pixel groups and smoothness
Divide image into pixel groups G1, G2, . . .
Disjoint groupsConsecutive pixels
Define the smoothness of a group G = (x1, x2, . . . , xn)
f (G) =n−1∑i=1
|xi − xi+1|.
High f (G) means sharp changes from pixel to pixel.Unusual for neighbour pixels in natural images
Compare f (F (G)) and f (G)
where F is flips pixels.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 30 / 41
![Page 47: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/47.jpg)
RS steganalysis The idea
Pixel groups and smoothness
Divide image into pixel groups G1, G2, . . .
Disjoint groupsConsecutive pixels
Define the smoothness of a group G = (x1, x2, . . . , xn)
f (G) =n−1∑i=1
|xi − xi+1|.
High f (G) means sharp changes from pixel to pixel.Unusual for neighbour pixels in natural images
Compare f (F (G)) and f (G)
where F is flips pixels.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 30 / 41
![Page 48: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/48.jpg)
RS steganalysis The idea
Bit flipping
Maps on a single pixelF+ : 2i ↔ 2i + 1F− : 2i ↔ 2i − 1F0 is the identity.
Maps on a group, say of four, G = (x1, x2, x3, x4)
F = [F0F+F+F0] = [0110]F (G) = (F0(x1), F1(x2), F1(x3), F0(x4))
Shifted bit flip−F = [F0F−F−F0] = [0− 1− 10]
We will use one map F and the shift −F .
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 31 / 41
![Page 49: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/49.jpg)
RS steganalysis The idea
Bit flipping
Maps on a single pixelF+ : 2i ↔ 2i + 1F− : 2i ↔ 2i − 1F0 is the identity.
Maps on a group, say of four, G = (x1, x2, x3, x4)
F = [F0F+F+F0] = [0110]F (G) = (F0(x1), F1(x2), F1(x3), F0(x4))
Shifted bit flip−F = [F0F−F−F0] = [0− 1− 10]
We will use one map F and the shift −F .
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 31 / 41
![Page 50: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/50.jpg)
RS steganalysis The idea
Bit flipping
Maps on a single pixelF+ : 2i ↔ 2i + 1F− : 2i ↔ 2i − 1F0 is the identity.
Maps on a group, say of four, G = (x1, x2, x3, x4)
F = [F0F+F+F0] = [0110]F (G) = (F0(x1), F1(x2), F1(x3), F0(x4))
Shifted bit flip−F = [F0F−F−F0] = [0− 1− 10]
We will use one map F and the shift −F .
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 31 / 41
![Page 51: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/51.jpg)
RS steganalysis The idea
Characteristic Groups
The groupsRegular group: f (G) < f (F (G))Singular group: f (G) > f (F (G))Useless group: f (G) = f (F (G))
The statisticsRF : number of regular groups under FSF : number of singular groups under FR−F : number of regular groups under −FS−F : number of singular groups under −F
RF , R−F , SF , S−F as functions of pp is number of pixels flipped by the embedding.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 32 / 41
![Page 52: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/52.jpg)
RS steganalysis The idea
Characteristic Groups
The groupsRegular group: f (G) < f (F (G))Singular group: f (G) > f (F (G))Useless group: f (G) = f (F (G))
The statisticsRF : number of regular groups under FSF : number of singular groups under FR−F : number of regular groups under −FS−F : number of singular groups under −F
RF , R−F , SF , S−F as functions of pp is number of pixels flipped by the embedding.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 32 / 41
![Page 53: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/53.jpg)
RS steganalysis The idea
Characteristic Groups
The groupsRegular group: f (G) < f (F (G))Singular group: f (G) > f (F (G))Useless group: f (G) = f (F (G))
The statisticsRF : number of regular groups under FSF : number of singular groups under FR−F : number of regular groups under −FS−F : number of singular groups under −F
RF , R−F , SF , S−F as functions of pp is number of pixels flipped by the embedding.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 32 / 41
![Page 54: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/54.jpg)
RS steganalysis The idea
Statistics plot
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 33 / 41
![Page 55: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/55.jpg)
RS steganalysis The result
Outline
1 Background
2 Pairs analysisThe characteristic sequenceHomogenous pairs
3 Where Pairs Analysis failsDithered backgrounds
4 RS steganalysisThe ideaThe resultCounter-measures
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 34 / 41
![Page 56: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/56.jpg)
RS steganalysis The result
Approximations
Approximations based on experimental investigationSF and RF are parabolicS−F and R−F are linear
RF (p) = a1p2 + b1p + c1, (3)
SF (p) = a2p2 + b2p + c2, (4)R−F (p) = a3p + b3, (5)S−F (p) = a4p + b4. (6)
11 unknowns (10 coefficients and p)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 35 / 41
![Page 57: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/57.jpg)
RS steganalysis The result
Approximations
Approximations based on experimental investigationSF and RF are parabolicS−F and R−F are linear
RF (p) = a1p2 + b1p + c1, (3)
SF (p) = a2p2 + b2p + c2, (4)R−F (p) = a3p + b3, (5)S−F (p) = a4p + b4. (6)
11 unknowns (10 coefficients and p)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 35 / 41
![Page 58: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/58.jpg)
RS steganalysis The result
Approximations
Approximations based on experimental investigationSF and RF are parabolicS−F and R−F are linear
RF (p) = a1p2 + b1p + c1, (3)
SF (p) = a2p2 + b2p + c2, (4)R−F (p) = a3p + b3, (5)S−F (p) = a4p + b4. (6)
11 unknowns (10 coefficients and p)
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 35 / 41
![Page 59: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/59.jpg)
RS steganalysis The result
Equations
ObservationsRF (p), SF (p), R−F (p), S−F (p) from stegogrammeRF (1− p), SF (1− p), R−F (1− p), S−F (1− p) by flipping all LSB-s.
AssumptionsRF (1/2) = SF (1/2)RF (0) = R−F (0)SF (0) = S−F (0).
11 equationsWith 11 unknowns, this can be solved
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 36 / 41
![Page 60: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/60.jpg)
RS steganalysis The result
Equations
ObservationsRF (p), SF (p), R−F (p), S−F (p) from stegogrammeRF (1− p), SF (1− p), R−F (1− p), S−F (1− p) by flipping all LSB-s.
AssumptionsRF (1/2) = SF (1/2)RF (0) = R−F (0)SF (0) = S−F (0).
11 equationsWith 11 unknowns, this can be solved
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 36 / 41
![Page 61: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/61.jpg)
RS steganalysis The result
Equations
ObservationsRF (p), SF (p), R−F (p), S−F (p) from stegogrammeRF (1− p), SF (1− p), R−F (1− p), S−F (1− p) by flipping all LSB-s.
AssumptionsRF (1/2) = SF (1/2)RF (0) = R−F (0)SF (0) = S−F (0).
11 equationsWith 11 unknowns, this can be solved
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 36 / 41
![Page 62: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/62.jpg)
RS steganalysis The result
The message length
p =x
x − 1/2,
where x is the smaller root of
s(d3 + d1)x2 + (d2 − d3 − d4 − 3d1)x + d1 − d2 = 0,
where
d1 = RF (p/2)− SF (p/2),
d2 = R−F (p/2)− S−F (p/2),
d3 = RF (1− p/2)− SF (1− p/2),
d4 = R−F (1− p/2)− S−F (1− p/2).
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 37 / 41
![Page 63: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/63.jpg)
RS steganalysis The result
Initial bias
Some experiments show estimates within ±1% of true lengthSome images have an initial bias
i.e. the cover image appear to have a short message.This must be taken into accountShort messages cannot be detected with certainty
Gaussian distribution: µ = 0, σ = 0.5%
Is it possible to estimate the initial bias?
Plot from Fridrich et al.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 38 / 41
![Page 64: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/64.jpg)
RS steganalysis The result
Example from Fridrich et al.
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 39 / 41
![Page 65: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/65.jpg)
RS steganalysis Counter-measures
Outline
1 Background
2 Pairs analysisThe characteristic sequenceHomogenous pairs
3 Where Pairs Analysis failsDithered backgrounds
4 RS steganalysisThe ideaThe resultCounter-measures
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 40 / 41
![Page 66: Higher-Order Statistics and Pairs · PDF fileHigher-Order Statistics and Pairs Analysis CSM25 Secure Information Hiding Dr Hans Georg Schaathun University of Surrey ... Miroslav Goljan,](https://reader034.vdocument.in/reader034/viewer/2022051601/5abcc2077f8b9a24028e3532/html5/thumbnails/66.jpg)
RS steganalysis Counter-measures
Good stego-systems?How do we foil higher-order statistics?
Stegogramme should resemble cover-imagenot necesserally visually... but statistically
Statistics-aware steganographyDesigned for specific higher-order statisticsStegogramme resembles cover with respect to statisticStill ad hoc approach
Dr Hans Georg Schaathun Higher-Order Statistics and Pairs Analysis Spring 2008 41 / 41