Steganalysis of adaptive JPEG steganography by selecting DCT coefficients according to embedding distortion

Abstract

According to the characteristics of adaptive JPEG steganography which determines the changed DCT coefficients based on embedding distortion, a new steganalysis method by selecting the DCT coefficients with small distortion values is proposed. Firstly, the principle of adaptive JPEG steganography through minimizing distortion is introduced. Secondly, the practicability of selecting the changed DCT coefficients according to distortion values is studied. Thirdly, the proposed steganalysis method is given and the embedding sensitivity of the steganalysis feature extracted from the selected DCT coefficients is analyzed. Lastly, the implement processes of the proposed method are presented and analyzed in details. In the experiments, PQt, PQe and J-UNIWARD steganography are used as examples to verify the effect of the proposed steganalysis method for adaptive JPEG steganography. A serial experimental results show the detection accuracy can be improved obviously, especially when the payload is relatively low.

1. Introduction

Image Steganography is the science and art of convert communication which try to embed the secret messages into innocuous-looking cover image [1]. The countermeasure against steganography technology is steganalysis [2] which focuses on detecting the presence of the secret messages. In recent years, with the development of Internet and steganography technologies, more and more algorithms and softwares are constantly emerging and can be got easily. It enables people to exchange their information conveniently. However, this also provides fertile grounds for illegal parties to disseminate their messages to each other secretly by utilizing steganography technologies. Therefore, image steganalysis which try to develop techniques for detecting this secret messages exchange is becoming more and more important.

JPEG is one of the most popular image formats on the internet, thus the steganography and steganalysis technology about JPEG image attract more attentions. For now, the steganography algorithms for JPEG image can be divided into non-adaptive steganography and adaptive steganography. The former includes Jsteg [3], MB1 [4], MB2 [5], Outguess [6], F5 [7], PQ (Perturbed Quantization) [8], MME (Modified Matrix Encoding) [9], nsF5 [10], etc. The latter includes PQt (texture-adaptive PQ), PQe (energy-adaptive PQ) [10], MOD (Model Optimized Distortion) [11], NPQ (Normalized Perturbed Quantization) [12], EBS (Entropy Block Steganography) [13], UED (Uniform Embedding Distortion) [14], J-UNIWARD (JPEG UNIversal WAvelet Relative Distortion) [15], SI-UNIWARD (Side-informed UNIWARD) [15] and so on. Moreover, in literature [16], a new framework for designing distortion functions of JPEG image is proposed by dividing the DCT coefficients into first-priority-group and first-priority-group. The adaptive JPEG steganography constrains the embedding changes to the textured or perceptual complex image regions, and then a higher level of stego-security can be achieved since the embedding noise is covered by the inhered noise. For the above adaptive JPEG steganography algorithms, the steganographic schemes are similar. They all define a distortion function which is related with statistical undetectability firstly and then the messages are embedded by encoding method. For example, as to PQt and PQe, the distortion function is defined according to the texture and energy measure of 8×8 DCT block respectively, and then the given messages are embedded by wet paper code [17]; as to MOD, NPQ, EBS, UED, J-UNIWARD and SI-UNIWARD, the different distortion functions are defined respectively and the messages are embedded while minimizing the distortion function by STCs (Syndrome-Trellis Codes) [18].

For the typical non-adaptive JPEG steganography algorithms, many steganalysis methods have been proposed and achieved high detection accuracies [2]. As to the adaptive JPEG steganographic schemes, different steganalysis methods also have been investigated. In literature [19], the authors pointed out that the distortion function of MOD steganography has been overtrained to an incomplete cover model. Then, a targeted steganalysis method for MOD is proposed by utilizing the statistical features beyond the optimized model. For other adaptive JPEG steganography, the steganographic security is often evaluated by blind steganalysis. For example, in literature [10], the 274-dimensional feature vector consisting of 193 extended DCT features and 81Markov features proposed in [20] is used to detect PQt and PQe. The detection accuracy can only reach to 72% when payload is 0.1bpac (bits per non-zero AC DCT coefficient); in literature [14], the state-of-the-art CC-JRM (Cartesian Calibration JPEG Rich Model) [21] feature is employed to evaluate the security performances of UED steganography and the detection accuracy is about 60% when payload is 0.1bpac and QF (Quality Factor) is 75; in literature [15], the CC-JRM and SRM (Spatial Rich Model) [22] feature are combined for the detection performance of J-UNIWARD steganography and the detection accuracy is only 55% when payload is 0.1bpac. The steganographic security of SI-UNIWARD is higher than J-UNIWARD because the rounding error of precover image is utilized for the definition of distortion function.

From all above, it can be seen that the detection performance for adaptive JPEG steganography is difficult. This is because the embedding changes are constrained to the complicated image regions which are hard to model. However, the framework of adaptive JPEG steganography make the selection channel of steganography algorithm is public. Furthermore, the stego image is often modified slightly relative to cover image, thus the distortion values of DCT coefficients of stego image will not change or change slightly. Therefore, as to stego image, the steganalyzer can compute the distortion values of DCT coefficients firstly and then the most possibly changed DCT coefficients are selected for the steganalysis feature extraction. In literature [23] and [24], for UNIWARD [15] and WOW [25] steganography which are adaptive steganography in spatial domain, the effects of public selection channel for steganalysis have been discussed. However, for adaptive JPEG steganography, as far as we know, there has no research which pays attention to the public selection channel that would be utilized to improve the detection accuracy. Therefore, in this paper, the effect of selection channel on steganalysis of adaptive JPEG steganography is discussed and a steganalysis method based on DCT coefficient selection is proposed. Firstly, the principle of adaptive JPEG steganography is introduced. Secondly, the practicability of DCT coefficients selection is studied. Next, the proposed steganalysis method is given and the embedding sensitivity of the steganalysis feature extracted from the selected DCT coefficients is analyzed. Lastly, the implement process is presented in details. In the experiments, a series of experiments are implemented to verify the effectiveness of the proposed steganalysis method for some adaptive JPEG steganography algorithms.

 

2. Adaptive JPEG steganography by minimizing distortion

Let x = (x1,x2,⋯,xn) be a cover image and xi specifies the i th cover element (DCT coefficient). The message is binary bit stream and the corresponding stego image is denoted as y = (y1,y2,⋯,yn). The embedding distortion of stego image y is denoted as D(y), π(y) specifies the probability of x be modified into y. Then, the expected distortion can be expressed as:

where Υ denotes the set of all stego images into which x can be modified.

The minimal distortion adaptive steganography expect to embed a given payload of m bits with minimal possible distortion. The problem is to determine a distribution π that communicates a required payload while minimizing the distortion [18] :

where the entropy of the distribution π(y).

The optimal distribution π which satisfies Eq. (2) and (3) should has the Gibbs form [26]

where Z(λ) is the normalizing factor and parameter λ > 0.

When the distortion function D(y) is additive over the cover elements, the distortion caused by embedding changes can be expressed as:

where 0 ≤ ρi(yi) ≤ ∞ specifies the distortion caused by modifying cover element xi into stego element yi. In this case, the embedding changes do not interact and the probability π can be factorized into a product of marginal probabilities of changing the individual cover element.

where πλ(yi) specifies the probability of xi be modified into yi.

Then, the expected distortion and the maximal payload are:

In Eq. (7), (8), (9), for binary embedding and the bar denotes the operation of flipping the LSB, Ii = {xi-1,x,xi+1} for ternary embedding.

From all above, it can be seen that the adaptive JPEG steganography by minimizing distortion should include distortion function definition and coding method. The former mainly pays attention to measure the distortion caused by embedding changes while the latter should embed the messages and minimize the distortion at the same time. In addition, the cover elements should be modified according to Eq. (7) for simulate embedding [18].

 

3. Selecting DCT coefficients based on embedding distortion

For adaptive JPEG steganography, the changed DCT coefficients are selected according to the embedding distortion. Let us suppose the embedding changes do not interact, thus the probability of changing the DCT coefficients can be denoted as:

Furthermore, the partial derivatives of p(y) with respect to distortion ρ is calculated,

In Eq. (11), the parameter λ > 0 is inverse proportion to embedding payload. Then, from Eq. (11), it can be seen that the changing probability p of DCT coefficient is monotonically decreasing with respect to distortion ρ. In other words, the small embedding distortion means high changing probability while the large embedding distortion means low changing probability. Compared with cover image, the stego image is modified slightly and the distortion values of DCT coefficients will not change or change slightly. Therefore, for the steganalyzers, the distortion values of suspicious image can be calculated firstly and then the most possibly changed DCT coefficients are selected for the steganalysis feature extraction. Next, PQt, PQe and J-UNIWARD steganography are used as examples, the DCT coefficients selection of adaptive JPEG steganography is studied.

PQt and PQe belong to the adaptive PQ steganography and the embedding distortions are defined according to the texture and energy measure respectively while J-UNIWARD steganography defines the embedding distortion by image wavelet decomposition coefficients. For these three adaptive JPEG steganography algorithms, the Lena image1 is used as cover image and the corresponding stego images are generated with different payloads. As to the stego image, the different percentages of DCT coefficients are selected according to embedding distortion from small to large and the percentages of the changed DCT coefficients which have been selected with respect to all the changed DCT coefficients are given.

In Fig. 1-(a), (b), for PQt and PQe, the percentage of the changed DCT coefficients which have been selected are shown when different percentage DCT coefficients are selected according to embedding distortion from small to large. From Fig. 1-(a), (b), it can be seen that the changed DCT coefficients can be got by selecting a small part of the DCT coefficients when the payloads are relative low. In Fig. 1-(c), for J-UNIWARD, the percentages of the changed DCT coefficients are shown when different percentage DCT coefficients are selected. From Fig. 1-(c), it also can be seen that the changed DCT coefficients can be got by selecting a small part of the DCT coefficients when payloads are relatively low.

Fig. 1.The percentage of the changed DCT coefficients which have been selected when different percentage DCT coefficients are selected: (a) PQt; (b) PQe; (c) J-UNIWARD.

From the above results, the following conclusions can be drawn for the selection of the changed DCT coefficients.

1) The selection of the changed DCT coefficients according to the embedding distortion is feasible for some adaptive JPEG steganography algorithms. From Fig.1, it can be seen that the changed DCT coefficients can be got when only a few DCT coefficients have been selected from Lena image with relatively low payload.

2) The number of the selected DCT coefficients which include all the changed DCT coefficients is much more than the number of the changed DCT coefficients. For PQt and PQe, it is because that the DCT coefficient distortion values for embedding are calculated by the texture and energy measure of the single decompressed JPEG image while the distortion values for DCT coefficients selection are calculated according to the double compressed stego image. Therefore, the distortion values will have some difference and this will affect the selection of DCT coefficients. In addition, steganography embedding also will affect the selection of DCT coefficients. For J-UNIWARD, the DCT coefficients are modified according to the probability given in Eq. (7), thus all the changed DCT coefficients can be got only when more DCT coefficients have been selected.

3) For different adaptive JPEG steganography algorithms, the percentages of the selected DCT coefficients which include all the changed DCT coefficients are different. For example, from Fig.1-(a) and (b), it can be seen that the percentages for selecting all the changed DCT coefficients are different for PQt and PQe. This is possible because that the affect caused by double compression and steganography embedding is more for PQe than for PQt. From Fig.1-(c), it can be seen that the percentage is higher for selecting all the changed DCT coefficients. This is because that the embedding changes of J-UNIWARD are implemented according to the probability given in Eq. (7) while the selection of DCT coefficients is according to the distortion values from small to large.

 

4. Steganalysis method based on DCT coefficients selection

From the above section, it can be seen that the changed DCT coefficients can be selected according to the embedding distortion. Therefore, the steganalyzer can calculate the distortion values of DCT coefficients according to the embedding distortion function firstly, and then extract the steganalysis feature from the selected DCT coefficients with small distortion values. Lastly, the classifier is trained by the steganalysis feature as well as the final steganalyzer. For steganalysis, the same percentage of DCT coefficients is selected, then the steganalysis feature is extracted and the detection is implemented by the trained classifier. In the following, the structure of the proposed steganalysis method is given firstly, then some analyses are presented and the detailed implement processes are described.

4.1 Structure of the proposed steganalysis method

For the steganalysis of adaptive JPEG steganography, the DCT coefficients with small distortion values can be selected for feature extraction and classifier training. However, it should be noticed that the percentage of the selected DCT coefficients varies with payload and the real payload is often unknown for the steganalyzer. Therefore, for a suspicious JPEG image, it is difficult to determine the appropriate percentage of the selected DCT coefficients for feature extraction and steganalysis. In fact, according to the characteristic of adaptive JPEG steganography, we know that it is favorable to the steganalysis of stego image with low payload when the percentage of the selected DCT coefficients is relatively low. On the contrary, the percentage of the selected DCT coefficients should be relatively high for the stego image with high payload.

Thus, the steganalyzer can construct different detector according to the actual demand. In other words, to obtain relatively high detection accuracy for steganography with low payload, relatively few DCT coefficients should be selected to extract steganalysis feature. By contrast, to detect steganography with high payload, much more DCT coefficients should be selected to extracted feature. Furthermore, we can improve the average detection accuracy for adaptive JPEG steganography with different payloads by selecting appropriate percentage of DCT coefficients. Based on the above analysis, a new steganalysis method for adaptive JPEG steganography is proposed, as shown in Fig. 2.

Fig. 2.The structure of the steganalysis method for adaptive JPEG steganography by selecting DCT coefficients.

From the Fig. 2, it can be seen that there are two main stages involved in the proposed steganalysis method by selecting the DCT coefficients, namely, the training stage and the testing stage. In the training stage, the training image set is constructed firstly, which includes the cover images and the corresponding stego images with different payloads from α1 to αm. Then, for each training image, the steganalysis feature is extracted from the DCT coefficients which are selected according to the distortion values from small to large. Lastly, the classifier is trained by the extracted steganalysis feature. In the testing stage, for the suspicious image, the same percentage of DCT coefficients is also selected according to the distortion values firstly, and then the steganalysis feature is extracted from these DCT coefficients. Finally, the extracted feature is tested by the trained classifier to obtain the detection result.

4.2 Analysis for the proposed steganalysis method

As shown in Fig. 2, the proposed steganalysis method extracts the steganalysis feature from the DCT coefficients which are selected according to the embedding distortion from small to large. The selection of DCT coefficients can increase the change rate of feature extraction source and improve the embedding sensitivity of steganalysis feature.

4.2.1 Change rate of feature extraction source

In Fig. 3, the relation between the average change rate and the percentage of the selected DCT coefficients are given for J-UNIWARD steganography with different payloads.

Fig. 3.The relation between change rate and percentage of the selected DCT coefficients.

From Fig. 3, it can be seen that the average change rate of the selected DCT coefficients will decrease when more DCT coefficients are selected. Therefore, in contrast to select all the DCT coefficients, the average change rate of feature extraction source can be increased markedly when only partial DCT coefficients with small distortion values are selected.

As we all know, in general, the high change rate of feature extraction source means high embedding sensitivity of steganalysis feature. Therefore, the detection accuracy would be improved by selecting the DCT coefficients according to the embedding distortion. In addition, we should notice that a certain amount of DCT coefficients is necessary for feature extraction even through the change rate will decrease when more much DCT coefficients are selected.

4.2.2 Analysis for embedding sensitivity of steganalysis Feature

For the sensitivity comparison of various features in steganalysis, the rate of the larger value to the smaller value of features before and after embedding is used to measure the sensitivity in [27] and [28]. Suppose a statistical feature before steganography is f, after embedding, it becomes f′. Then, the sensitivity measure value s of it to steganography is:

For two types of statistical features f1 and f2, after embedding, they are f′1 and f′2 respectively. Denote their sensitivities as s1 and s2, respectively. Then, the sensitivity measure values of them to steganography can be calculated using Eq. (12).

For the sensitivity comparison in [27] and [28], they let

If A > 1, then the feature f1 is considered superior to f2, in other words, f1 is more sensitive to embedding change than f2, and is more suitable for steganalysis. If A < 1, then f2 is superior to f1. Otherwise, these two types of features are comparable, i.e., they will get approximately equal accuracy when used for steganalysis.

By the above feature comparision method, the co-occurrence matrix feature extracted from the changed DCT coefficients is compared with the same feature extracted from all the DCT coefficients.

Let the DCT coefficient matrix of a JPEG image be represented with D = (Dij), where Dij denotes the (i, j)-th quantized DCT coefficient. Furthermore, let Z denotes the set of the changed DCT coefficients after embedding while P denotes the set of the unchanged DCT coefficients. Then, the set of the adjacent two DCT coefficients along the horizontal direction can be divided into two classes. One is S1 = {(Dij,Di,j+1)|Dij ∈ P and Di,j+1 ∈ P} and the other is S2 = {(Dij,Di,j+1)|Dij ∈ Z or Di,j+1 ∈ Z or Dij ∈ Z, Di,j+1 ∈ Z}.

Then, the co-occurrence matrix feature FAll(a, b) and FSel(a, b) can be represented as:

where δ(u, v) is a checking function (if and only if u = v, δ(u, v) = 1; otherwise, δ(u, v) = 0), a,b ∈ [-T,T], T denotes the truncation threshold. Moreover, M denotes the number of the elements which belong to the set S1 and S2 while N denotes the number of the elements which belong to the set S2.

According to the sensitivity measure method shown in Eq. (12), the sensitivity measure value of FAll(a,b) and FSel(a,b) can be denoted as the follows:

Furthermore, if suppose

We can get,

So, the feature FSel(a,b) is more sensitive to embedding changes than FAll(a,b).

Similarly, if suppose we also can get the feature FSel(a,b) more sensitive than the feature FAll(a,b).

From the above analysis, it can be seen that the co-occurrence matrix feature extracted from the changed DCT coefficients is more sensitive to embedding than the same feature extracted from all the DCT coefficients. For the other steganalysis feature, the similar analyses can be implemented. Noticed that, even through we can not select the changed DCT coefficients alone, the embedding sensitivity of the steganalysis feature extracted from the selected DCT coefficients also would be better. In Fig. 4, for PQt steganography with payload 0.05bpac, the sensitivity measure value (SMV) of the steganalysis feature FAll and FSel is given. Here, the feature FSel is extracted from the selected DCT coefficients (the percentage is 5%) and the threshold T = 4. So, the parameters a,b ∈ [-4,4] and the feature dimension is 81. From Fig. 4, it can be seen that the steganalysis feature FSel is more sensitive to FAll.

Fig. 4.Comparison for the sensitivity measure values of the steganalysis feature FSel and FAll.

4.3 Implement processes of the proposed steganalysis method

The detailed implement processes can be described as the following:

Step1: Constructing the training image set

The training image set is formed by cover images and stego images. One cover image and the corresponding stego image with certain payload is a training sample pair. All the training sample pairs are used for feature extraction.

Step2: Extracting the steganalysis feature

For each image of the training samples, the following processes are implemented:

1) The distortion values of all the DCT coefficients of the sample image are computed according to the distortion function of adaptive JPEG steganography algorithm;

2) The DCT coefficients are sorted according to the distortion values from small to large;

3) A given percentage of DCT coefficients are selected from the DCT coefficients with the smallest distortion;

4) The steganalysis feature is extracted from the selected DCT coefficients.

Step3: Training the classifier

After the steganalysis features have been extracted, the classifier is trained as the final steganalyzer. It should be noticed that different classifiers should be trained for different detection performance. For example, as to J-UNIWARD steganography with payload 0.1bpac, the training image set should only include the cover image and the corresponding stego image with payload 0.1bpac, and then the classifier is trained by the feature extracted from the selected DCT coefficients with certain percentage. Moreover, for different steganography and payload, the training set and classifier are all different.

Step4: Steganalysis

In the steganalysis stage, for the suspicious image, the same percentage of DCT coefficients are selected according to the distortion values from small to large firstly, and then the steganalysis feature is extracted from these DCT coefficients. Finally, the extracted feature is tested by the trained classifier to obtain the detection result.

For the proposed method, the DCT coefficients for feature extraction are selected according to the embedding distortion function. Therefore, in contrast to blind steganalysis, the proposed method belongs to the targeted steganalysis in some sense. In addition, for a suspicious image, the payload is often unknown and we can not determine the optimal percentage parameter for the selection of DCT coefficients. However, we can improve the average detection accuracy for adaptive JPEG steganography with payload in a given range by selecting appropriate percentage of DCT coefficients. That is to say, the payload of a suspicious image is not needed. Certainly, we can get better detection performance if the payload of the suspicious image can be got. However, estimating the payload is rather difficult especially for modern schemes whose detection requires high-dimensional statistical features.

 

5. Experimental results and analysis

5.1 Image Database and Experiment setup

In the experiments, the original images are from BossBase-1.01 [29]. For PQt and PQe, all these grayscale images are converted into JPEG image with QF 85, and then stego images are generated with payload 0.05, 0.1, 0.15, 0.2, 0.3, 0.4, and 0.5bpac (bits per non-zero AC DCT coefficient) respectively, the QF of double-compression is 70. For J-UNIWARD, all these original grayscale images are converted into JPEG image with QF 75. Then, the stego images are generated with the same seven payloads. In all experiments, ensemble classifier [30] is used for the training and testing. The proportion of training set to test set is 7:3, the detection accuracy is defined as (PTP+PTN)/2, PTP, PTN denotes the probability of true positive and true negative respectively. The final detection accuracy is the average value of ten duplicate experiments. In subsection 5.4, for each steganography algorithm, the training set contains 7000 cover images and corresponding stego images with different payloads. The testing set contains the remaining 3000 cover images and corresponding stego images. The proportion of stego images with different payloads is same for the training and testing set.

5.2 Effect of selecting possibly changed DCT coefficients

In the section, CC-JRM [21] feature extracted from the selected DCT coefficients is utilized to detect the adaptive JPEG steganography PQt, PQe and J-UNIWARD with certain payload.

5.2.1 Steganalysis of PQt and PQe steganography

As to PQt, the embedding distortion is defined according to the texture measure of DCT blocks. So the given percentage of DCT coefficients should be selected from the highest texture measure to the lowest texture measure. Furthermore, CC-JRM is extracted from these selected DCT coefficients and used to detect PQt. The relations between the detection accuracies and the percentages of the selected DCT coefficients are shown in Table 1.

Table 1.Detection accuracies for PQt when different percentages of DCT coefficients are selected

From the experimental results in Table 1, it can be seen that the detection accuracy for PQt will be improved by selecting the DCT coefficients. Moreover, the improvement is quite obvious when payload is relatively low.

For PQe, the embedding distortion is defined according to the energy measure of DCT blocks. So the given percentage of DCT coefficients should be selected from the highest energy measure to the lowest energy measure. Then, CC-JRM is extracted from these selected DCT coefficients. The detection performances for PQe steganography are shown in Table 2.

Table 2.Detection accuracies for PQe when different percentages of DCT coefficients are selected

From the experimental results in Table 2, it can be seen that the detection accuracy for PQe also can be improved by extracting feature from the selected DCT coefficients. Contrast to PQt, more DCT coefficients should be selected in order to obtain the high detection accuracy for the same payload. This is because the changed DCT coefficients can be got only when more DCT coefficients have been selected (as shown in Fig. 1-(a) and (b)).

5.2.2 Steganalysis of J-UNIWARD steganography

For J-UNIWARD, the relations between the detection accuracies and the percentages of the selected DCT coefficients with respect to all DCT coefficients are shown in Table 3.

Table 3.Detection accuracies for J-UNIWARD when different percentages of DCT coefficients are selected

From the experimental results in Table 3, it can be seen that the detection accuracies for J-UNIWARD also can be improved by selecting the DCT coefficients.

5.3 Detection performances of different steganalysis features

In this part, the CC-PEV [31], CC-CHEN [32] and CC-JRM features extracted from the selected DCT coefficients are compared with the same features extracted from all the DCT coefficients for the steganalysis of PQt, PQe and J-UNIWARD.

In Table 4, the detection performances with different features are compared for PQt. The features CC-PEV-S, CC-CHEN-S and CC-JRM-S denote the three typical steganalysis features extracted from the selected DCT coefficients according to the embedding distortion.

Table 4.Detection performances for PQt with different features

From Table 4, it can be seen that the detection accuracy can be improved only if the features are extracted from the selected DCT coefficients. For example, when payload is 0.05bpac, the detection accuracy of CC-PEV, CC-CHEN and CC-JRM is 54.17%, 54.22%, and 62.11% while the detection accuracy of the corresponding features extracted from the selected DCT coefficients is 66.67%, 64.33%, and 74.94%.

The detection performances for PQe with different features are shown in Table 5. From Table 5, it also can be found that the detection accuracy for PQe can be improved by extracting feature from the selected DCT coefficients. This is particularly obvious when the payload is relative low.

Table 5.Detection performances for PQe with different features

The detection performances for J-UNIWARD are shown in Table 6. From Table 6, it can be seen that the detection accuracies of CC-PEV, CC-CHEN and CC-JRM are poor when payload is low. However, if the same features are extract from the selected DCT coefficients, the detect accuracy can be improved greatly. For example, when payload is 0.05bpac, the detection accuracy of the three original features is only 50%, 50.33%, and 50.61% while it can reach 65.00%, 59.00% and 68.72% if the same features are extracted from the selected DCT coefficients.

Table 6.Detection performances for J-UNIWARD with different features

5.4 Detection performances of the proposed steganalysis method

For real steganalysis, the payload is often unknown, and the appropriate percentage of the selected DCT coefficients is difficult to be determined for steganalysis feature extraction. However, we can construct different detector to meet the demand. For example, if we want to make good average detection accuracy for PQt steganography with payload from 0.05bpac to 0.5bpac, we should extract the feature from cover images and the corresponding stego images by selecting the appropriate percentage of DCT coefficients. Then, classifier is trained by the extracted feature to get the detector for PQt steganography. In Table 7, the detection accuracies of CC-JRM-S extracted from different percentages of DCT coefficients are given for PQt steganography with payload from 0.05bpac to 0.5bpac.

Table 7.Detection accuracies of CC-JRM-S extracted from different percentage of DCT coefficients

From Table 7, it can be seen that the average detection accuracy is best for PQt steganography with 0.05 to 0.5bpac when 5% DCT coefficients are selected. Similarly, the detector can be constructed for other demand. The difference lies in the construction of the training set and the percentage of the selected DCT coefficients. For example, if we want to make good average detection accuracy for PQt steganography whose payloads are from 0.1 to 0.5bpac. Then, the training set should include the cover images and the corresponding stego images whose payloads are from 0.1bpac to 0.5bpac. Furthermore, the percentage of the selected DCT coefficients for feature extraction will be high.

In the following, the steganalysis method by selecting DCT coefficients (SBSD) is compared with the steganalysis method based on all the DCT coefficients (SBAD). In the experiments, the CC-JRM-S is used for steganalysis. The detection accuracies of the two steganalysis method for PQt, PQe and J-UNIWARD are shown in Table 8-10, the symbols ‘—‘ denotes the stego images with the corresponding payload are not used for training and testing. The “5%”, “6%” and so on in Table 8-10 specify the percentage of the selected DCT coefficients with respect to all the DCT coefficients of JPEG image.

Table 8.Performance comparisons for steganalysis of PQt based on SBAD and SBSD

Table 9.Performance comparisons for steganalysis of PQe based on SBAD and SBSD

Table 10.Performance comparisons for steganalysis of J-UNIWARD based on SBAD and SBSD

From Table 8, it can be seen that the average detection accuracy of SBSD is 84.71% when the payloads of stego images are from 0.05 to 0.5bpac. The average detection accuracy can reach 97.63% when the payloads are from 0.4 to 0.5bpac. For the same payloads, the average detection accuracies of SBAD are 79.98% and 97.36% respectively. In other words, the SBSD can achieve better average detection accuracy than the SBAD. Especially, contrast to SBAD, the SBSD can make much better detection accuracy for PQt with low payload. For example, for PQt with payload 0.05bpac, the detection accuracy of SBSD is 68.33% while it is only 55.50% achieved by SBAD.

From Table 9, it can be seen that the SBSD also can improve the average detection accuracy for PQe. In addition, for the PQe steganography with low payload, the improvement of detection accuracy is more obvious. For example, for PQe with payload 0.05bpac, the detection accuracy of SBSD is 74.88% while it is only 58.38% achieved by SBAD.

From Table 10, it can be seen that the SBSD also can improve the average detection accuracy for J-UNIWARD. As to the low payload, the improvement is more obvious. For example, for J-UNIWARD with payload 0.1bpac, the detection accuracy of SBSD is 67.11% while it is only 52.88% achieved by SBAD.

From all above it can be found that the SBSD method can improve the average detection accuracy for PQt, PQe and J-UNIWARD. When payload is low, the improvement is quite obvious. Notice that, for PQt, when less DCT coefficients are selected for feature extraction, the detection accuracy for high payload such as 0.3, 0.4, 0.5bpac will decrease possibly even if the average accuracy will be improved. It is similar for PQe and J-UNIWARD. However, in actual application, the payload is often relatively low, so the proposed steganalysis method is appropriate for PQt, PQe and J-UNIWARD.

 

6. Conclusions

In this paper, a steganalysis method by selecting the possibly changed DCT coefficients is proposed to enhance the sensitivity of steganalysis feature and improve the detection accuracy. The experimental results show the proposed method can improve the average detection accuracy for the three adaptive JPEG steganography with different payloads. Especially, the improvements are obvious for low payloads. For other adaptive JPEG steganography, such as UED, the changed DCT coefficients are relatively large when the payload is low. Therefore the detection accuracy only will be improved slightly because the embedding changes of large DCT coefficients can not be captured effectively by the existing feature. As to NPQ, EBS and SI-UNIWARD, the changed DCT coefficients are relatively scattered and are difficult to be selected accurately because the rounding error of precover is unknown for steganalyzer, so the improvement is also not obvious by selecting DCT coefficients. In the future, the new steganalysis method should be developed for these adaptive JPEG steganography.