Information Hiding: Steganography and Steganalysis

Zoran Duric, Michael Jacobs, Sushil Jajodia

Center for Secure Information Systems George Mason University Fairfax, VA 22030

Abstract The goal of steganography is to insert a message into a carrier signal so that it cannot be detected by unintended recipients. Due to their widespread use and availability of bits that can be changed without perceptible damage of the original signal images, video, and audio are widespread carrier media. Steganalysis attempts to discover hidden signals in suspected carriers or at the least detect which media contain hidden signals. Therefore, an important consideration in steganography is how robust to detection is a particular technique. We review the existing steganography and steganalysis techniques and discuss their limitations and some possible research directions. Key words: Information hiding, steganography, steganalysis, watermarking

Introduction

Information hiding comprises such diverse topics as steganography, anonymity, covert channels, and copyright marking (Bauer, 1997). Most of these topics have a long history (Kahn, 1996; Petitcolas et al., 1999) and have found their way into everyday life and the popular culture (Johnson, 2000). With the advent of the Internet and the widespread use of digital media these topics have become especially important to people interested in either communicating secretly or protecting their digital works from unauthorized copying.
Email addresses: zduric@cs.gmu.edu (Zoran Duric), mjacobs1@gmu.edu (Michael Jacobs), jajodia@gmu.edu (Sushil Jajodia). URLs: cs.gmu.edu/~zduric/ (Zoran Duric), csis.gmu.edu/faculty/jajodia.html (Sushil Jajodia).

Preprint submitted to Elsevier Science

30 March 2004

Steganography, anonymity, and covert channels all refer to secret communications. Anonymity refers to communicating in a way that protects the identity of the sender and/or the receiver (Petitcolas et al., 1999). Covert channels refer to the means of secretly communicating a small amount of information across tightly monitored channels by exploiting possible loopholes in the communication protocols (Simmons, 1998). Digital steganography refers to modifying a digital object (cover) to encode and conceal a sequence of bits (message) to facilitate covert communication. Digital steganalysis refers to eorts to detect (and possibly prevent) such communication. Copyright marking refers to modifying a digital object so that its owner(s) can be identied. The goal of digital watermarking is to modify a digital object in a way that will both identify the owner and be hard to remove without destroying the object or making it unusable. Many types of digital objects can be considered (for information hiding) including text, arbitrary les, software, images, audio, and video les (Petitcolas et al., 1999; Katzenbeisser & Petitcolas, 2000; Johnson, 2000). In this survey we will focus on digital steganography of image les. There are several reasons for limiting survey of steganography to images only. Images are widespread on the Internet and can be used as carrier objects without raising much suspicion. They come in many formats, although JPEG and GIF are most dominant. (Conversely, audio les are usually in the MPEG3 format and videos are in either MPEG1 or MPEG2 formats.) Finally, most image les are quite large and have a lot of capacity for modication without noticeable damage to the image content. In digital watermarking we will briey discuss audio and video watermarking as well since there are many concerns about copyright protection of these object. Most steganographic methods operate in two steps. First, a cover object is analyzed to determine to what extent it can be modied so that the modications will not be easily observable. Second, the message bits are inserted into the cover object by making changes replaced by the message bits to create an altered cover object. In this chapter, cover object is an image in either bitmap or JPEG formats. The perceptually insignicant bits frequently correspond to the least signicant bits (LSBs) in the image representation: in bitmap images these bits correspond to a subset of the LSBs of the image pixels, in JPEG images they correspond to a subset of LSBs of the JPEG coecients. The outline of this chapter is as follows. In Section 2 we describe the basics of image le formats as they relate to this chapter. In Section 3 we describe the principles of the existing image steganography. In Section 4 we describe some existing steganalysis methods. In Section 5 we briey describe the relationship of steganography and watermarking. In Section 6 we review the existing work in this eld. Finally, in Section 7 we make a brief summary of the chapter and discuss some open issues in steganography and steganalysis. 2

Image Formats

An image is a two-dimensional array of image points or pixels. In gray level images each pixel is described by one number corresponding to its brightness. In color images each pixel is described by three numbers corresponding to the brightnesses of the three primary colorse.g., red, green, and blue. A typical image le has two parts, the header and the raster data. The header contains the magic number identifying the format, the image dimensions, and other format-specic information that describes how the raster data relates to image points or pixels. The raster data is a sequence of numbers that contains specic information about colors and brightnesses of image points. In a raw image format (e.g. BMP and PGM) the header contains the magic number and image dimensions. The raster data is a sequence of numbers corresponding to either one or three color values at each pixel (e.g. BMP and PGM). Raw (uncompressed) images are quite large and require a lot of storage space. Some space saving can be obtained by compressing the raster data by using loss-less compression (e.g. TIFF format). Frequently, raw images contain much more information than required. For example, in images saved for human viewing both the reduction of the number of possible colors and removal of some image details do not cause perceptible changes. In some formats (e.g. GIF) the image is saved using a reduced color set. Each pixel value is represented by a single number corresponding to an index in the color palette that is stored in the image header. The palette contains the information needed to restore colors of all image pixels. The image le can be made even smaller by using loss-less compression of the raster datae.g., run-length encoding represents a sequence of several pixels of the same color by just two numbers, the length and the color of the sequence (run). JPEG image format removes some image details to obtain considerable saving of storage space without much loss of image quality. The savings are based on the fact that humans are more sensitive to changes in lower spatial frequencies than in than the higher ones. In addition, it is believed that humans perceive brightness more accurately than chromaticity. JPEG thus uses Y CrCb format to save brightness information (Y ) in full resolution and chromaticity information (Cr and Cb) in half resolution. At the encoder side each channel is divided into 8 8 blocks and transformed using the two-dimensional discrete cosine transform (DCT). Let f (i, j), i, j = 0, . . . , N 1 be an N N image block in any of the channels and let F (u, v), u, v = 0, . . . , N 1 be its DCT transform. The relationship between f (i, j) and F (u, v) is given by
N 1 N 1 2 u(2i + 1) v(2j + 1) C(u)C(v) f (i, j) cos cos (1) N 2N 2N i=0 j=0

F (u, v) =

f (i, j) =

2 N

N 1 N 1

C(u)C(v)F (u, v) cos

u=0 v=0

u(2i + 1) v(2j + 1) cos (2) 2N 2N

where C(u) = 1/ 2 for u = 0 and C(u) = 1 otherwise. A DCT of an 8 8 block of integers is an 88 block of real numbers. The coecient F (0, 0) is the DC coecient and all others are called the AC coecients. JPEG divides the coecients by values from a quantization table to replace the real number values by integers (see Table 1). It is expected that many coecients for higher values of u + v become zero and that only a fraction of all coecients will remain nonzero. The coecients are reordered into a linear array by placing higher frequency coecients (higher values of u + v) at the end of the array; those coecients are most likely to be zeroes. Human coding is applied to all coecients from all blocks in the image; zero-valued coecients are encoded separately using special markers and their count for additional saving. A header consists of image type and dimensions, compression parameters, and the quantization table. It is combined with the Human encoded coecients packed as a sequence of bits to form a JPEG encoded image. On the decoder side the integer valued coecients are restored by Human decoding. The quantization is reversed and the inverse DCT (see Eq. (2)) is applied to obtain the image. Human coding is loss-less; the losses occur in quantization process.
(u,v) 0 1 2 3 4 5 6 7 0 16 12 14 14 18 24 49 72 1 11 12 13 17 22 35 64 92 2 10 14 16 22 37 55 78 95 3 16 19 24 29 56 64 87 98 4 24 26 40 51 68 81 103 112 5 40 58 57 87 109 104 121 100 6 51 60 69 80 103 113 120 103 7 61 55 56 62 77 92 101 99

Table 1 Default JPEG quantization table. The coecients are divided by their corresponding values and then rounded to the nearest integer.

Steganography

A typical steganographic embedding method has two parts. In the rst part a message is prepared and in the second it is embedded in the carrier object e.g., an image. The preparation can include compression and encryption. It 4

can be assumed that the sender and the intended recipient share a key that is used to encrypt the message. Either compression or the encryption is expected to produce a random-looking sequence of bits. In addition, since the message embedding needs to be reversible a small amount of formatting data such as a password and a message length needs to be included with the message. The formatting information and the message are concatenated and embedded into the cover using the same algorithm. Therefore, it will be assumed here that a message is a random bit sequence and only the message embedding and extraction processes will be considered. Similar to image compression, message embedding can rely on two dierent approaches. Loss-less embedding process modies an image le in a fully reversible way. For example, in a pgm le format the header can include comment lines. Additional comment lines could be added to embed any desired information. Alternatively, the image le could be enlarged by adding extra rows or columns and the information about the image modication could be added to the header. One example would be modifying run length encoding process to embed messages. During the encoding process the method checks all run lengths longer than one pixel. Suppose that a run length of ten pixels is considered and that one bit needs to be embedded. To embed a bit one the run length is split into two parts whose lengths add to ten, say nine and one; to embed a bit zero the run length is left unmodied. The receivers check all run lengths. Two run lengths of the same color are decoded as a one; otherwise a run length longer than one pixel, preceded and followed by run lengths of dierent colors, are decoded as a zero. Clearly, this technique relies on obscurity since detecting a le with information embedded by this technique is not hard. In the remainder of this chapter the focus will be on the lossy embedding techniques. Lossy steganography modies the raster data of the original image le to embed a message. Steganography relies on the same basic idea that underlies lossy image compressioni.e., changing image bits that are not perceptually signicant usually does not aect image quality. For example, in an uncompressed gray level image each pixel is represented by eight bits. A message can be embedded into an imagei.e. coverby modifying the least signicant bits of the pixel values to correspond to the message. An image of size 410 614 has 251, 740 pixels (see upper row of Fig. 1). If all LSBs are used it is possible to embed 94, 402 bytes into this image; this corresponds to a high-quality JPEG image of the same size (see lower row of Fig. 1). Insertion into the LSBs of a typical color image cannot be observed by a naked eye. If the message and the cover are uncorrelated, approximately 50% of the cover bits need to be changed to embed a message. If the number of message bits is larger than the number of pixels the message could be embedded using two or more bits LSBs per pixel. Conversely, if a message is shorter than the number of available cover LSBs it could be embedded into a fraction of the cover imagei.e., 5

Fig. 1. Uncompressed color images (upper row) were saved as JPEG images at 80% quality (lower row). The JPEG images were inserted into the LSBs of the uncompressed images. Dierences between uncompressed original images cannot be observed by a naked eye.

some cover pixels do not need to be considered.

3.1 Embedding by Modifying Carrier Bits

Steganographic methods use various approaches to embed messages into covers. First approach identies the carrier bitsi.e. the bits that will encode a messageand modies them to encode the message. These carrier bits could be one or more LSBs of selected bytes of raster datathe selection process itself can use a key to select these bytes in pseudo-random order. Also, the raster data can be either raw image bytes (brightnesses and colors), or JPEG coecients. Embedding is done by modifying the carrier bits suitably to encode the message. The message can be decoded from the carrier bits onlyi.e., the receiver identies the carrier bits and extracts the message using the key and the algorithm. These techniques can be compared using the following criteria (Westfeld, 2001): 1. The embedding rate the number of embedded bits per a carrier bit. 2. The embedding eciency the expected number of embedded message bits per modied carrier bit. 3. The change rate the average percentage of modied carrier bits. 6

Several techniques are used to embed messages into carrier bits. Three techniques will be described here: 1. Changing the carrier bits to match the message bits. 2. Using bit parity of bit blocks to encode message bits (Anderson & Petitcolas, 1998). 3. Matrix encoding of message bits into carrier bits (Westfeld, 2001). First, the embedding algorithm can compare the carrier bits and the message bits and change the carrier bits to match the message. Bit modication can be done by either bit ippingi.e. 0 1 or 1 0or by subtracting 1 from the byte value. For example, let the raster data bytes be 01000111 00111010 10011000 10101001, where the identied carrier bits are underlined. Using ipping to embed the message bits 0010 into the carrier bytes produces 01000110 00111010 10011001 10101000, where the modied bits are underlined. Using subtraction to embed the same message bits (0010) into the carrier bytes produces 01000110 00111010 10010111 10101000, where the modied bits are underlined. Clearly subtraction produces more bit modications, but the perceptual changes would be about the same as in the case of bit ipping. This technique has been used by various steganographic algorithms to embed messages in raw image data (gray and color images) and JPEG coecients. Clearly, the embedding rate is 1, the embedding eciency is 2, since about 50% of carrier bits get modied, and the change rate is 50%. An embedding method can consider blocks of carrier and message bits at a time to embed a message into a cover. Examples of these techniques include using bit parity and the matrix encoding. The bit parity approach can be used when the number of available carrier bits is at least n 1 times larger than the number of message bits. Block of n carrier bits are considered and their parity compared to the corresponding message bits. If the parity matches the message bit nothing is done, otherwise any of the n bits in the current block can be modied to make the parity and the message bit match. In this approach the embedding rate is 1/n, the embedding eciency is 2, and the change rate is 50%/n. The matrix encoding embeds k message bits using n cover bits, where n = 2k 1. The method embeds a k-bit code word x into an n-bit cover block a. 7

Let the bits of x be xi , i = 1 . . . k and let the bits of a be aj , j = 1 . . . n. Let f be dened as xor of carrier bit indexes weighted by the bit values, i.e.
n

f (a) =
j=1

aj j

and let s = x f (a). A modied cover block a is then computed as a =

a,

s = 0 ( x = f (a))

a a . . . a . . . a , s = 0 1 2 s n

On the decoder side a k-bit message block x is obtained from an n-bit carrier block a by computing x = f (a). As an example let x = 101 and let a = 1001101. Therefore, f (1001101) = 001 100 101 111 = 111 s = 101 111 = 010 a = 1101101, i.e., the second bit was ipped to obtain f (a ) = f (1101101) = 101. The embedding rate of matrix encoding is k/n k/(2k 1); the embedding efciency is k2k /(2k 1); and the change rate is 1/(n + 1) 2k (for any (n = 2k 1)-bit carrier block there are n matched k-bit code words and one that is mismatched). Note that these numbers can change somewhat when JPEG coecients are used to embed messages (see (Westfeld, 2001) for details). 3.2 Embedding using Pairs of Values

Second approach utilizes perceptually similar pairs of values (PoVs) in raster data and modies them to embed steganographic data. The PoVs are divided into even and odd elements. Embedding is done by modifying selected raster data to match the message. There are four cases. 1. The raster symbol is an even element (s0 ) of some PoV (s0 , s1 ) and the message bit is 0: leave s0 unchanged. 2. The raster symbol is an even element (s0 ) of some PoV (s0 , s1 ) and the message bit is 1: replace s0 by s1 . 8

1. 2. 3. 4. 5. 6. 7. 8.

D {c0 }, C Cold \{c0 }; c c0 , Find color d C that is most distant from c D {c0 , d} {d0 , d1 }, C C\{d} while C = do Find color d C that is most distant from c Find two colors {di , di+1 } D so that {di, d} + {d, di+1} is minimal D {d0 , . . . , di, d, di+1 , . . .}, C C\ d, c d endwhile
Fig. 2. Sorting a color palette.

3. The raster symbol is an odd element (s1 ) of some PoV (s0 , s1 ) and the message bit is 0: replace s1 by s0 . 4. The raster symbol is an odd element (s1 ) of some PoV (s0 , s1 ) and the message bit is 1: leave s1 unchanged. If the message bits and raster data are uncorrelated, and the proportion of ones and zeros in the message is equal approximately half of the raster data need to be modied to embed a message. On the receiver (decoder) side the raster data are examined. Each raster symbol is interpreted as either even or odd element of some PoV. Even elements are decoded as zeros, odd elements are decoded as ones. An example of a steganographic technique that uses PoVs to embed messages is EzStego (by Romana Machado) used in reduced-color-set images. In a fullcolor-set (RGB) image each color is represented by three values corresponding to the red, green, and blue intensities. In a reduced color set the colors are sorted in lexicographic order; the sorted list of colors is called a palette. The palette is stored in the image header and the raster data are formed by replacing the colors by the corresponding indexes in the palette. If the palette has less than 256 colors the three-bytes per pixel full-color image can be represented using just one byte per pixel. To recover actual colors both the raster data and the palette are needed. Each raster data value is replaced by the corresponding color. Note that colors that are neighbors in the palette, and therefore are assigned indexes that dier by one, can correspond to colors that look very dierent. For example, it is possible that the palette colors with indexes 0, 100, and 101 correspond to RGB colors (5, 5, 5), (255, 5, 0), and (10, 10, 10), respectively. Thus, ipping a bit and changing a color from, say, 100 to 101 could create a visible artifact in the image. In EzStego this problem is solved by re-sorting the palette and grouping the new indexes pairwise so that they can be used as PoVs. Let the original palette be Cold = {ci , i = 0, ..., n 1}, let I(ci , Cold ) i be index of ci in Cold and let (a, b) be the distance between colors a and b. Sorting is done using the algorithm in Fig. 2. Note that this algorithm nds an approximation to the Traveling Salesperson problem in the color palette Cold , 9

where colors correspond to cities. The PoVs that the algorithm uses correspond to the indexes of sorted colors in the original palettei.e., the PoVs are (I(d2k , Cold ), I(d2k+1, Cold )), k = 0, . . . , n/2, where I(di , Cold ) is the index of color di in Cold and D = {d0 , d1 , . . . , dn1} is the sorted palette.

Steganalysis

A goal of digital steganalysis is detecting image les that contain hidden information and if possible extracting that information. There are several levels of diculty in this problem. In the easiest case both the cover (clean) and the suspect image are given and a goal is to determine if they are dierent. Simple image processing, including image subtraction, can be used to accomplish this task. In a more dicult case only the suspect image is known, but both the encoding/embedding and the message decoding/extraction algorithms are known and available. The information is protected by a secret key (password) and the information can be extracted if the key can be guessed (e.g., see (Wayner, 2002)). In a more dicult case, given a suspect image a goal is to determine whether the image contains an embedded message. The result is given as certainty/probability that the image contains hidden information. The steganalysti.e., the agent performing steganalysishas access to images that have similar statistics as the suspect image. Westfeld and Ptzmann (Westfeld & A. Ptzmann, 1999) developed a simple but eective method for detecting steganographic content in images. The method uses a statistics that is derived from relative frequencies of Pairs of Values (PoV). It is described here for LSB steganographic insertion in JPEG image les. It was originally developed to detect messages inserted using the JPEG/Jsteg method. The method begins with a histogram of JPEG coecients that is created as they are output by the decoder. Let the JPEG coecients be drawn from the set A. Even though 0 A and 1 A, JPEG/Jsteg embeds messages by modifying LSBs of all coecients, except for 0 and 1; the other methods proposed in this paper will also not use 0 and 1 for information hiding. A PoV is the pair of coecients that have identical binary representations except for their LSBs which are 0 and 1, respectively. For a binary number (bit string) a we denote the corresponding PoV with a and a , where a = 2a and a = 2a + 1. For example, 118 and 119 are a PoV since their binary representations are (1110110, 1110111), and we would denote with a and a ) when a = 59 or 111011 in binary.. Let A \ {0, 1} = {a1 , a1 , a2 , a2 , a3 , a3 , . . . ak , ak } be organized into k PoV. At any step as the decoder processes the coecients, a histogram bin for x A 10

Fig. 3. Two natural images: a falcon (left) and a barley eld (right). Image sizes are 450 292 (falcon) and 480 320 (barley).

contains the number of coecients x output so far. In particular, hi is the number of occurrences of ai and hi is the number of occurrences of ai . In an unaltered image it could be expected that the frequencies of PoVs signicantly dier. In the portion of an image altered by JPEG/Jsteg these frequencies only depend on the relative frequencies of zeroes and ones in the hidden message. Therefore, if the frequencies of zeroes and ones in the message are approximately equal it could be expected that the PoVs have similar frequencies. The 2 statistic with k degrees of freedom is given by 2 k 1 k (hi hi )2 = , 2 i=0 hi + hi (3)

The probability that the image contains steganographic content is estimated by integrating the density function p=1 1 2
k 2

2 k

( k ) 0 2

e 2 x 2 dx

(4)

This method is illustrated on two images in Figure 3 for two cases. In the rst case, a random bit sequence of the same length as the number of available bits (number of coecients dierent than 0 and 1) was inserted in each of the images. In the second case, only 50% of the coecients were used for insertioni.e., every other coecient was skipped. Probabilities computed using Equation (4) are shown in Figure 4. It can be seen that in the full capacity insertion case the probability was almost always very close to 1. However, in the half capacity case (shown by the dashed line and marked by 1/2) the probability becomes 0 after more than 4000 coecients are used for the computation. When the density of insertion is 1/4 or less probabilities computed using Equation (4) become 0 everywhere. Based on these and other tests, it can be concluded that the method is quite eective for detecting 11

1 0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2 0.1 0 1/2

1 0.9 0.8 0.7 0.6 0.5 0.4 0.3 0.2 1/2 0.1 0
4

0.5

1.5

2.5 x 10

0.5

1.5

2.5

3.5

4 x 10
4

Fig. 4. Probabilities of detection of steganographic content for the images in Figure 3. Left: falcon, right: barley eld. Graphs show the probabilities computed for full capacity insertion (1:full line) and a half capacity insertion (1/2: dashed line).
1800
2000

1600

1800

1400

1600

1200

1400

1200

1000

1/8

1/8
2

1000

800

1/4

1/4
800

600
600

400

1/2
400

1/2

200 1 0 0 0.5 1 1.5 Coefficients 2 2.5 x 10 3

4

200 1 0 0 0.5 1 1.5 2 2.5 Coefficients 3 3.5 4 4.5 x 10

4

Fig. 5. 2 statistic computed for the images in Figure 3. Number of skipped bits is varied. The topmost curves correspond to the original (unaltered) images, the curves marked by 1, 1/2, 1/4, and 1/8 correspond to the relative insertion frequencies, e.g. 1/4 corresponds to changing 1 out of every 4 bits. The falcon image (left) has 25179 coecients available for embedding and the numbers of altered coecients in the four cases are: 12606, 6279, 3118, and 1569. The barley image (right) has 41224 coecients available for embedding and the numbers of altered coecients in the four cases are: 20544, 10256, 5099, and 2545.

steganographic content when all of the redundant bits are used. Similar (high detection) results can be obtained for short messages if they are inserted into available bits (coecients) at the beginning of the image le. When a shorter message is spread over all available bits this detection method (Westfeld & A. Ptzmann, 1999) becomes much less eective. However, it is not true that 2 statistics are not useful for detection in this situation. If 2 statistic is computed using Equation (3) it can be seen that insertion of random bit sequences lowers 2 considerably. Figure 5 shows 2 curves of the original (unaltered) images in Figure 3, as well as 2 curves of the 12

altered images with insertion frequencies 1, 1/2, 1/4, and 1/8. Note that bit insertion does not change the number of degrees of freedom for 2 statistic. Since any bit insertion generally lowers 2 statistic, a new method for detecting steganographic content based on a direct use of the statistic could possibly be designed.

Relationship of Steganography to Watermarking

The goal of digital watermarking is to modify a digital object in a way that will both identify the owner and be hard to remove without destroying the object or making it unusable. In addition, it is desirable that digital watermarks survive normal image processing and manipulation including resizing, printing and scanning, and some compression, e.g. high quality JPEG (Cox et al., 2001). Note that steganography has dierent goalsi.e., hide the existence of messageand that information hidden using approaches described in Sec. 3 would not survive those kinds of processing (Johnson, 2000). Another very important dierence is in the amount of information that is transferred in steganography and watermarking. While a goal of steganography is to transfer messages usually many bits long, a digital watermark transfers one bit of information only. Namely, the detector checks an image and reports the degree of certainty that it contains a particular watermark. Nevertheless, a watermarked image is typically more signicantly modied by the watermarking algorithm than is desirable in steganography. The main reason is that a key parameter used to determine how strong a watermark can be is the Just Noticeable Dierence (JND)i.e., a watermark strength has to be such that the dierence between a watermarked image and its unwatermarked version is not noticeable by human viewing. To determine the JND mathematical models of human perceptual system are employed. In both steganography and watermarking a key can be used to determine which parts of an image will be used for embedding. However, a major difference is that in watermarking the key denes the watermark. For example, in the Patchwork algorithm (Gruhl & Bender, 1998) n pixel pairs are chosen according to a key Kp . Let the pixel values be (ai , bi ), i = 1, . . . , n. For randomly chosen pixels it is expected that
n i=1

(ai bi ) 0.

The watermark is embedded by replacing pixel values ai by ai + d and bi by bi d in the image data; d 1 is chosen to be small. To check if an image 13

contains a watermark embedded using key Kp , the key is used to select n pixel pairs (ai , bi ), i = 1, . . . , n. A watermark is present if
n i=1

(ai bi ) 2nd.

Other watermarking algorithms generate random sequences of bits that are inserted into, say, medium frequency DCT coecients of an image (Cox et al., 2001). Watermarks are detected by computing cross-correlation between the watermark and the coecients. Since the watermark is random and uncorrelated with the coecients the result is signicantly dierent from zero only if the watermark is present.

Literature Survey

Digital steganography is a relatively new research eld (Anderson & Petitcolas, 1998; Johnson & Jajodia, 1998a; Katzenbeisser & Petitcolas, 2000). The term steganalysis was introduced by Johnson and Jajodia (Johnson & Jajodia, 1998b) who discussed various ways that anomalies introduced by some steganographic techniques could be exploited to detect the presence of steganographic data in images. Detailed survey of early algorithms and software for steganography and steganalysis can be found in (Katzenbeisser & Petitcolas, 2000; Johnson, 2000; Wayner, 2002). Maes (Maes, 1998) demonstrated that artifacts produced by steganographic software can sometimes be discovered by simple histogram analysis of images ltered by a Laplacian operator. The rst quantitative technique for steganalysis was designed by Westfeld and Ptzmann (Westfeld & A. Ptzmann, 1999). They exploited the fact that many steganographic techniques change the frequencies of pairs of values (pairs of colors, gray levels, or JPEG coecients) during a message embedding process. Their method was shown to be eective in detecting messages hidden by several steganographic techniques. This research prompted interest in both improving statistical detection techniques (Dumitrescu et al., 2002; Farid, 2002; Lyu & Farid, 2002; Fridrich1, 2001; Fridrich et al., 2000, 2001, 2002; Westfeld, 2002) as well as building new steganographic methods that would be dicult to detect by statistical methods (Frantz, 2002; Newman et al., 2002; Provos, 2001; Westfeld, 2001). Various attempts have been made to make steganograms dicult to detect including reducing their capacity or payload and spreading the message across the whole carrier. Anderson and Petitcolas (Anderson & Petitcolas, 1998) suggested using the parity of bit groups to encode zeroes and ones; large groups 14

of pixels could be used to encode a single bit, the bits that need to be changed could be chosen in a way that would make detection hard. Others have suggested matching the cover and the message (Crandall, 1998; Provos, 2001). From a set of possible covers, the one that most closely matches the message would be used. Provos (Provos, 2001) designed a steganographic method OutGuess that spreads a message over a JPEG le; the unused coecients are adjusted to make the coecient histogram of the modied le as similar as possible to the histogram of the original non-stego image. This limits the bandwidth of the method since at any frequency at least 50% of all coecients must remain unchanged for the adjustment step. Provos also experimented with matching the message and the cover as was rst suggested by Crandall (Crandall, 1998); however, although he compared his messages with some thousands of images he reported that in the best case the best match between the cover and the message was only slightly better than 50% (chance), which is corroborated by results on string matching (Atallah et al., 1993). Westfeld (Westfeld, 2001) designed a steganographic algorithm F 5 that uses matrix coding to minimize the modications of the LSBs. His method rst discovers the number of available bits and then spreads the message bits over the whole le. To reduce detectability F 5 decrements the coecent value to change bits unlike Jsteg (Upham, 2004) and OutGuess (Provos, 2001) that use bit complement to change bits. Farid (Farid, 2002; Lyu & Farid, 2002) successfully used statistical learning techniques to train classiers to detect images containing hidden messages. Higher-order statistics of the wavelet coecients of images were used as features; each image was represented by several hundred features. Experiments were performed on 10,000 natural images; several steganographic methods were tested. Training was done using all original images and a small subset of altered images; testing was done on the remaining altered images. It is not clear if this technique could be extended to work on unseen images, i.e. when the known clean images are not available. Fridrich et al. (Fridrich1, 2001) developed a method for detecting changes in uncompressed images previously stored in JPEG format. Very small changes on uncompressed images could be detected using this method. Recently Newman et al. (Newman et al., 2002) published a steganographic method that preserved JPEG compatibility. The method stored at most one bit of information per an 8 8 image block. In other work Fridrich et al. (Fridrich et al., 2000, 2001, 2002) reported several techniques for detecting steganographic content in images. If a message is inserted into the LSBs of an image, some features of the image change in a manner that depends on the message size. A possible shortcoming of these methods is that they depend on empirical observations about the feature values of cleani.e., unmodiedimages. However, the authors have demonstrated very promising results on their data sets. Dumitrescu et al. (Dumitrescu et al., 2002) present an approach related to (Fridrich et al., 15

2001) in which they use several features of sample pairs computed from a modied image to estimate the percentage of changed LSBs. The method relies on an assumption about the feature values in unmodied images. Frantz (Frantz, 2002) recently proposed using mimicking functions (Wayner, 2002) to ensure that the JPEG coecient histogram of a modied image is the same as the histogram of the originali.e., unmodiedimage. The author assumed that given two binary sequences of the same length the second sequence could be transformed to have the same proportions of zeroes and ones as the rst sequence. The method was not fully implemented since the author assumed that the transformation could be carried out.

Conclusions

Survey of methods for steganography and steganalysis was presented. It was shown that most methods used in digital steganography can be divided into embedding by modifying carrier bits and embedding using pairs of values. These methods were described formally and their uses, merits, and requirements were discussed. Various approaches to steganalysis were discussed; chisquare method was described and examples of its application were shown. Relationship between steganography and watermarking was also discussed and it was argued that, although supercially similar, these two elds have many dierences and should be treated separately. There are very few formal results in steganography and steganalysis. It is not known what are practical limits on message size so that detection can be avoided using any detection approach based on image statistics. Practical limits on message size so that detection can avoided by existing methods of steganalysis have been partially established empirically. It has been proposed (Wayner, 2002) that codes mimicking natural image statistics could be designed and used in image steganography; however, practical algorithms utilizing this idea have not been developed yet.

References R.J. Anderson and F. Petitcolas. On the limits of steganography. IEEE Journal on Selected Areas in Communications, 16:474481, 1998. M.J. Atallah, P. Jacquet, and W. Szpankowski, A probabilistic analysis of pattern matching problem, Random Structures and Algorithms, 4:191213, 1993. F.L. Bauer. Decrypted SecretsMethods and Maxims of Cryptology. SpringerVerlag, Berlin, Germany, 1997. 16

R. Crandall. Some notes on steganography. 1998. Available at http://os.inf.tu-dresden.de/westfeld/crandall.pdf. I.J. Cox, M.L. Miller, and J.A. Bloom. Digital Watermarking, Morgan Kaufmann, San Francisco, CA, 2001. S. Dumitrescu, X. Wu, and Z. Wang. Detection of LSB steganography via sample pair analysis, LNCS 2578, Springer-Verlag, Berlin Heidelberg, pp. 355372, 2002. H. Farid. Detecting hidden messages using higher-order statistical models. Proc. Int. Conf. on Image Processing, Rochester, NY, 2002. S. Lyu and H. Farid. Detecting hidden messages using higher-order statistics and support vector machines, LNCS 2578, Springer-Verlag, Berlin Heidelberg, pp. 34354, 2002. E. Frantz. Steganography preserving statistical properties, LNCS 2578, Springer-Verlag, Berlin Heidelberg, pp. 278294, 2002. J. Fridrich, M. Goljan, and R. Du. Steganalysis based on JPEG compatibility., Proc. SPIE Multimedia Systems and Applications IV, Denver, CO, 2001. J. Fridrich, R. Du, and M. Long. Steganalysis of LSB encoding in color images. Proc. IEEE Int. Conf. on Multimedia and Expo, Vol. 3, pp. 1279 1282, 2000. J. Fridrich, M. Goljan, and R. Du. Detecting LSB Steganography in color and gray-scale images, IEEE Multimedia Magazine, pp. 2228, October 2001. J. Fridrich, M. Goljan, and D. Hogea. Steganalysis of JPEG images: Breaking the F5 algorithm, LNCS 2578, Springer-Verlag, Berlin Heidelberg, pp. 310 323, 2002. D. Gruhl and W. Bender. Information hiding to foil the casual counterfeiter, In Information Hiding Workshop, Lecture Notes in Computer Science(1525), Springer-Verlag, New York, 1998. N. Johnson, Z. Duric, and S. Jajodia. Information Hiding: Steganography and Watermarking Attacks and Countermeasures., Kluwer Academic Publishers, Boston, 2000. N. Johnson and S. Jajodia. Exploring steganography: Seeing the unseen. IEEE Computer, 31:2634, 1998. N. Johnson and S. Jajodia. Steganalysis of images created using current steganography software. Proc. Int. Workshop on Information Hiding, LNCS 1525, Springer-Verlag, Berlin, pp. 273289, 1998. Joint Photographic Experts Group. http://www.jpeg.org/public/jpeghomepage.htm. D. Kahn. The CodebreakersThe Story of Secret Writing. Scribner, New York, 1996. S. Katzenbeisser and F.A.P. Petitcolas(eds.). Information Hiding: Techniques for Steganography and Digital Watermarking, Artech House, Norwood, MA, 2000. M. Maes. Twin Peaks: The Histogram Attack on Fixed Depth Image Watermarks, Proc. Int. Workshop on Information Hiding, LNCS 1525, SpringerVerlag, Berlin, pp. 290305, 1998. 17

R.E. Newman, I.S. Moskowitz, L.W. Chang, and M.M. Brahmadesam. A steganographic embedding undetectable by JPEG compatibility steganalysis, LNCS 2578, Springer-Verlag, Berlin Heidelberg, pp. 258277, 2002. F. Petitcolas, R.J. Anderson, and M. Kuhn. Information HidingA Survey. Proceedings of the IEEE, 87:10621078, 1999. N. Provos. Defending against statistical steganalysis. Proc. 10th USENIX Security Symposium, pp. 323325, 2001. G.J. Simmons. The history of subliminal channels, IEEE J. Select. Areas Commun., 16:452462, 1998. D. Upham. Jsteg V4. available at: http://www.funet./pub/crypt/steganography. P. Wayner. Disappearing Cryptography. 2nd ed., Morgan Kaufmann, San Francisco, 2002. A. Westfeld. F5a steganographic algorithm: High capacity despite better steganalysis. Proc. Information Hiding Workshop, LNCS 2137, SpringerVerlag, Berlin, pp. 289-302, 2001. A. Westfeld. Detecting low embedding rates. Proc. Information Hiding Workshop, LNCS 2578, Springer-Verlag, Berlin Heidelberg, pp. 324-339, 2002. A. Westfeld and A. Ptzmann. Attacks on steganographic systems. Proc. Information Hiding Workshop, LNCS 1768, Springer-Verlag, New York, pp. 61-75, 1999.

18