EURASIP Journal on Applied Signal Processing 2005:17, 2749–2757 c ○ 2005 Hindawi Publishing Corporation Image Steganalysis with Binary Similarity Measures

We present a novel technique for steganalysis of images that have been subjected to least significant bit (LSB) type steganographic algorithms. The seventh and eighth bit planes in an image are used for the computation of several binary similarity measures. The basic idea is that the correlation between the bit planes as well the binary texture characteristics within the bit planes differs between a stego-image and a cover-image. These telltale marks can be used to construct a steganalyzer, that is, a multivariate regression scheme to detect the presence of a steganographic message in an image.


INTRODUCTION
Steganography refers to the science of "invisible" communication, where communication between two parties is undetectable by an eavesdropper. This is quite different from cryptography, where the goal is to make the content of the communications inaccessible to an eavesdropper. In contrast, steganographic techniques strive to hide the very presence of the message or communication itself from an observer. The subject is best explained in terms of the prisoner's problem [2], where Alice and Bob are two inmates who wish to communicate in order to hatch an escape plan. However, all communication between them is examined by the warden, Wendy, who will put them in solitary confinement at the slightest suspicion of covert communication. Specifically, in the general model for steganography we have Alice wishing to send a secret message m to Bob. In order to do so, she "embeds" m into a cover object c, to obtain the stego object s. The stego object is then sent through the public channel.
In a pure steganography framework, the technique for embedding the message is unknown to Wendy and shared as a secret between Alice and Bob. However, it is generally not considered as good practice to rely on the secrecy of the algorithm itself. In private key steganography Alice and Bob share a secret key, which is used to embed the message. The secret key, for example, can be a password used to seed a pseudorandom number generator to select pixel locations in an image cover object for embedding the secret message (possibly encrypted). Wendy has no knowledge about the secret key that Alice and Bob share, although she is aware of the algorithm that they could be employing for embedding messages. In public key steganography, Alice and Bob have private-public key pairs and know each other's public key.
As stated above, the goal of steganography is to communicate securely in a completely undetectable manner, such that an adversary should not be able to differentiate in any sense between cover objects (objects not containing any secret message) and stego objects (objects containing a secret message). In this context, steganalysis is the set of techniques that try to defeat the very purpose of steganography, by detecting the presence of hidden communication. Thus steganalysis aims to distinguish between cover objects and stego objects. The art of steganalysis is becoming increasingly more important in computer forensics, for screening and tracking documents that are suspect of criminal activities, and for information security to prevent leakage of unauthorized data. Conversely, steganalysis can be used to assess the weaknesses of steganographic algorithms.
In the past few years we have witnessed a great expansion in fields of steganography and steganalysis. Several new steganography methods are being proposed each year, most of which are followed by new and improved steganalysis techniques for their detection. The steganalysis techniques proposed in the literature could be categorized into two groups. First we have technique-specific steganalysis methods, which attack a specific embedding algorithm, such as the approach proposed in [3]. The second type of techniques is blind to the embedding method and could be used with any embedding algorithm. They are called universal steganalysis techniques. It is the second category that we will be looking at in this paper. For a review on current steganography and steganalysis techniques the reader is referred to [3,4,5,6,7,8].
As demonstrated previously in [9,10], the embedding process on a document leaves statistical artifacts, which could be used to distinguish between stego and cover versions. The argument that watermarking and steganography leave telltale effects is common to all the steganalytical methods. For example, Harmsen and Pearlman [5] assume that steganography affects the histograms of the images, which they measure via the center of gravity of the characteristic function of the RGB probability density functions (pdf). Farid assumes that correlation across wavelets bands is affected [1], while Avcibas et al. demonstrate that image quality metrics are perturbed [9]. Fridrich et al. assume that histogram of DCT coefficients are modified, as in [3,6], and that the lossless compression capacity of the LSB plane is diminished, as in [8].
In this paper, in order to capture these statistical artifacts and hence to determine the presence of hidden messages, we propose a set of binary similarity measures between successive bit planes. The basic idea is that, the correlation between the bit planes as well as the binary texture characteristics within the bit planes will differ between a stego image and a cover image. The seventh and eighth bit planes, and possibly others, are used to calculate these binary similarity measures. The proposed technique does not need a reference image and it works with both spatial and transform-domain embedding. The method is similar to that in [1,9], in that it exploits intrinsic statistical properties of images to reveal the presence of steganographic content.
The rest of this paper is organized as follows. In Section 2 we review binary similarity measures. In Section 3 we describe our steganalysis technique. In Section 4 we give simulation results and conclude with a brief discussion in Section 5.

SIMILARITY MEASURES ON BINARY IMAGES
In the proposed steganalysis scheme we investigate statistical features extracted from the lower-order bit planes of images for the presence of hidden messages. Since each bit plane is also a binary image, we start by considering similarity measures between two binary images. We assume that any steganographic manipulation on an image will alter the patterns in the neighborhood of a bit in its bit plane as well as across the bit planes. In other words, the planar-quantal bit patterns will be affected. An evidence of such telltale effect can be found in the probability of bit transitions.
One might argue if straightforward bit plane correlations cannot be used for the steganalysis purpose. However, the evidence of any change is too weak if we measure only bit correlations across bit planes. In this study, we have found that it is more relevant to make comparisons based on binary texture statistics. Let x i = {x i,k |, k = 1, . . . , K} be the sequences of bits representing the K neighborhood pixels (K = 4 and includes N, W, S, and E neighbors), where the index i runs over all the image pixels. We assume images of size M × N. Let us define the 5-point stencil function χ r,s as follows: These four variables {a, b, c, d} can be interpreted as the onestep co-occurrence values of a binary image. Using the above definitions, several binary image similarity measures can be defined as shown in Table 1. A good review of similarity measures can be found in [11]. Almost all the measures in Table 1 have an intuitive interpretation; for example, the fifth measure dm 5 , Sokal and Sneath's similarity measure 4, yields the conditional probability that LSBs of seventh bit plane is in the same state (1 or 0) given the state of the LSBs in the eighth bit plane. The measure is an average over both states acting as predictors and it has a range of 0 to 1. In this table, the measures dm 1 to dm 10 are obtained for seventh and eighth bit planes of the image, separately. These measures form an adaptation of the classical binary string similarity measures, such as in Sokal and Sneath [12].
Sokal and Sneath similarity measure 2 Kulczynski similarity measure 1 Sokal and Sneath similarity measure 3 Sokal and Sneath similarity measure 4 Sokal and Sneath similarity measure 5 Ochiai similarity measure Binary Lance and Williams nonmetric dissimilarity measure There are three categories of similarity measures derived from these scores.
(i) The first group consists of the computed similarity differences, dm i = m 7th i − m 8th i , i = 1, . . . , 10, across the 7th and 8th bit planes.
(ii) The second group consists of histogram and entropic features. We first normalize the histograms of the agreement scores for the bit planes (indicated by the superscript b): Based on these normalized four-bin histograms, we define the minimum histogram difference dm 11 and the absolute histogram difference measure dm 12 , binary mutual entropy dm 13 , and binary Kullback Leibler distance dm 14 , as also given in Table 1.
(iii) The third set of measures dm 15 , . . . , dm 18 are somewhat different in that we use the neighborhood-weighting mask proposed by Ojala [13]. For each binary image we obtain a 512-bin histogram based on the weighted neighborhood, where the score is given by S = 7 i=0 x i 2 i by weighting  the eight-directional neighbors as shown in Figure 1. Defining S 7 n as the count of the nth histogram bin in the 7th bit plane and S 8 n the corresponding one in the 8th plane, after normalizing these 512-bin histograms, we can define Ojala minimum histogram difference dm 15 and Ojala absolute histogram difference measure dm 16 , Ojala mutual entropy dm 17 , and Ojala Kullback-Leibler distance dm 18 as given in Table 1.
In Figure 2 we show how Stools algorithm modifies the LSB and 7-8 bit plane correlations in terms of the Ojala Kullback-Leibler distance (measure dm 18 in Table 1) as a function of embedded message size. In the active warden case where message has to be embedded robustly, deeper bit plane   correlations (5-6 bit planes) should be taken into account. In Digimarc [14] example, as shown in Figure 3, we see the same monotonic trend in the Ojala entropy measure (dm 18 in Table 1) as a function of watermark strength. In Figure 4, the effects of the F5 [15] embedding algorithm on the 5-6 bit planes (dm 17 , the Ojala entropy in Table 1) are illustrated. Finally, variations of dm 7 , dm 8 , dm 9 measures in Table 1 across 7-8 bit planes as a function of embedded message length for F5 [15] algorithm are shown in Figure 5.

STEGANALYSIS TECHNIQUE BASED ON BINARY MEASURES
We hypothesize that binary similarity measures between bit planes will differ in their patterns between clean and stego images, that is, the statistics will be modified as a consequence of message embedding. This is the basis of our steganalyzer that aims to classify images as stego and cover images. In fact, embedding information in any bit plane modifies the correlation between that plane and its contiguous neighbors. For example, for LSB steganography, one expects a decreased similarity between the seventh and the eighth bit planes of the image as compared to its unmarked version, due to randomization of the eighth plane. Hence, similarity measures between these two LSBs should yield higher scores in a clean image as compared to a stego image, as the embedding process destroys the preponderance of bit-pair matches. Note that the same procedure generalizes quite easily to detect messages in any other bit plane. Furthermore, our results indicate that we can even build steganalyzer for non-LSB embedding techniques like the recent F5 algorithm [15]. This is because a technique like F5 (and many other robust watermarking techniques, which can be used for steganography in an active warden framework [2]) results in the modification of the correlation between bit planes.

Classifier design
We have used support vector machines (SVM) classifier [16].
In support vector machine (SVM) [17], the underlying idea rests on the minimization of the training set error, or the maximization of the summed distances between the separating hyperplane and the subset of closest data points (the support vectors). (1) An equal number of marked (with varying message lengths) and unmarked images are randomly chosen for the design step. Since the number of embeddable images varies as a function of both the message size and the steganographic algorithm, the number of stego images with a given message length used in the marked category of the training set is determined with their empirical statistics in mind. For example, given a specific method, if there are twice as many images with 1% message lengths as compared to 5% messages, then the training set will contain twice as many images with 1% message as images with 5% messages. (2) The trained classifier is then tested against the remaining set of unseen unmarked and marked images which consists of images with 1% embedding, 5% embedding, . . . , denoted respectively as 1P, 5P, . . . . (3) The above procedure is repeated 5 times, resulting in 5 different classifiers and the average of the classifier performances is computed.

Experimental setup
An initial database consisting of 1800 natural images was used [19]. The images were converted to grayscale and the borders around them were cropped, resulting in images of size 640 × 480 pixels, after which they were recompressed with a quality factor of 75. This database was augmented with the stego versions of these images using 5 different embedding techniques, and different message lengths were employed. Since the actual steganographic capacity of a given image is dependent on the content of the image as well as the embedding technique used, we used a variety of message lengths to create our dataset.

Embedding methods and message lengths
The embedding methods were chosen on the basis of most current steganographic algorithms available. The embedding algorithms used in our experiments were LSB, LSB +/−, OutGuess−, OutGuess+, and F5. The LSB and LSB +/− techniques operate in the spatial domain, but with LSB the leastsignificant bit of each pixel value is flipped, whereas with LSB +/− the pixel values are incremented or decremented by 1. The second set of techniques which include OutGuess [20], with + and − flags, and F5 [15] operates in the JPEG domain by modifying the least significant bit of DCT coefficients.
There are different approaches in the literature in choosing the length of the stego message being embedded. Farid [1] chooses n × n pixels from the central region of a randomly chosen image. Another approach is to take constant length messages, say at 100, 500, or 1000 bits. But in both approaches the actual message size has no proportionality with the actual image size. In order to avoid these problems, we have used the following approach in defining the message length: we assumed that p bits could be embedded in each pixel value, regardless of the depth of the pixels, that is, 8 or 24 bit/pixel, where p is a fraction 0 < p < 1. Thus the message length consists of a percentage point of the total number of pixels, and the length is independent of the type of image format, bmp or jpeg, but proportional to the size of the image. Furthermore, since the sizes of all images in our experiments were equal, the actual message lengths were also constant. Thus we considered four message lengths, 1%, 5%, 10%, and 15%, respectively denoted by the symbols 1P, 5P, 10P, and 15P. Table 2  database. One can notice that as the message length grows, the number of images that can be accommodated decreases; in fact, with methods such as Outguess this decrease is quite sharp.

Classification results
Statistics from the original unmarked images as well as the stego images were obtained by computing the binary similarity measures, introduced in Section 2. Thus a vector of length 18 was obtained for each image. These vectors were then used to train and test the classifier, where we used 720 marked and 720 unmarked images in the training process. The classifier was trained with all embedding percentages from 1% to 15%. For example in the Outguess−, the classifier was presented with 720 unmarked and 720 marked images, where the marked images consisted of 318 images with 1P message, 298 with 5P, and 104 with 10P. Images with 15P messages were not used in this case since very few of them are available. In Table 3, we give the test stage classification accuracy. Here accuracy is defined as the area under the ROC curve obtained from the classifier, where the ROC curves are obtained by first designing a classifier and then testing the data unseen to the classifier against the trained classifier at the same time moving the separating hyperplane. As the separating hyperplane is moved, the false alarm rate changes, and we get the corresponding detection rate. Also the obtained ROC curves for each embedding technique could be seen in Figures 6 and 7. The most closely related publication to our work is by Farid [1] in which higher-order statistics of wavelet components are used for detecting hidden messages. But due to the fact that the results are presented differently a direct comparison was not possible. So in order to make a fair comparison between the two proposed techniques, we have used the publicly available matlab script from the website (www.cs.dartmouth.edu/∼farid/) to calculate the proposed feature set, and then used our design and testing process on the obtained features. The results in Figures 6 and 7 show that the two methods are close competitors in that the proposed BSM method proves superior for the LSB and LSB+/− embedding techniques while Farid's method proves superior in the case of the F5 and Outguess+/− techniques.

CONCLUSIONS
In this paper, we have addressed the problem of steganalysis of images. We have developed a technique for discriminating between cover images and stego images obtained from various steganographic methods. Our approach is based on the hypothesis that steganographic schemes leave telltale evidence between bit planes of lower significance, which in turn can be exploited for detection. The steganalyzer has been instrumented with binary image similarity measures and a classifier. Simulation results with commercially available steganographic techniques indicate that the proposed steganalyzer is effective in classifying stego and cover images.
Although tests have been run on LSB-based steganography, initial results have shown that it can easily generalize to the active warden case by taking deeper bit plane correlations into account. For example as in [9] we are able to detect Digimarc [14] when the measures are computed for highersignificance bit planes.
After this proof-of-concept design, the stegoanalyzer can be improved by judicious selection of the feature set in Table 1, for example, via SFFS (sequential floating feature search) algorithm. For the non-LSB techniques both image quality metrics [9] and binary similarity measures can be used jointly. Finally, given the fact that our algorithm and that of Farid [1] outperform each other for different steganographic methods and that neither one is uniformly superior to the other one, their complementary role should be exploited, for example, in a decision fusion scheme.