Video steganalysis based on aliasing detection

C. Zhang, Y. Su and C. Zhang

A novel steganalysis approach is proposed against additive video steganography. Under the assumption of independence between the cover video and hidden data, the probability mass function of the frame difference signal of stego-video generally reveals the aliasing effect caused by embedding data. The proposed method successfully detects the hidden data in video with different compression bitrates by detecting the aliasing degree.

0.4 0.3 0.2 0.1 0 10

0.20 0.15 0.10 0.05 0 10

0.08 0.06 0.04 0.02 0 10

0 PMF of DS

10

0 PMF of DS

10

0 PMF of D

10

Fig. 1 PMF of DS, DW and D (plotting main points in interval of [210, 10] with zero or almost zero of other points)

Introduction: Steganalysis emerges and rapidly becomes highlighted in the eld of information security. The goal of steganalysis is to detect the presence of hidden data with little or no knowledge about the steganography algorithm. Video steganography can achieve large capacity covert communications; therefore, video steganalysis is a new hotspot in the eld of information security. This Letter proposes an effective video steganalysis algorithm, which is achieved by detecting the aliasing effect in the probability mass function of the frame difference signal caused by embedding the hidden data. Problem in steganalysis: A general steganography can be modelled as an addition of hidden data Wk(m, n) to the cover video frame Sk (m, n) either in the spatial domain or in transform domains, and the stego-video frame Xk(m, n) is represented by the commonly used equation [1]: Xk m; n Sk m; n ak m; nWk m; n k 1; 2; N 1

Steps: We use each four consecutive frames to construct a pair of difference signalsand, D1 (m, n) and D2 (m, n), which are converted into onedimensional column vectors by line scanning, denoted by d1 and d2: 8 h > D1 m; n Xkh m; n Xk1 m; n > > h h > Sk m; n Sk1 m; n aWkh m; n > > < h aWk1 m; n h h > > D2 m; n Xk2 m; n Xk3 m; n > h h h > Sk2 m; n Sk3 m; n aWk2 m; n > > : h aWk3 m; n

where ak(m, n) is a scaling factor to adjust the strength of hidden data based on perceptual characteristics, robustness properties etc., and N is the number of frames in the sequence. Wk(m, n), decided by the embedding algorithm, is independent of the cover video and of each other. The steganography method [2] modulates Wk(m, n) [ f21, 1g to carry the hidden data. For simplicity, ak(m, n) is considered to be a constant a over all the pixels and frames. Proposed method: To detect the steganographic methods, we utilise the features that should be sensitive to embedding modications while insensitive to the cover video. The hidden data are usually considered to be a high-frequency signal compared with the natural image, the energy of which is concentrated mainly in the low-frequency area. Therefore, we apply Haar wavelet lters to Xk(m, n) to yield lowpassed Xkl(m, n), which is the approximation of the cover image and the highh passed Xk (m, n), which is more sensitive to the hidden data. Owing to the linearity of wavelet transform, we obtain
h Xkh m; n Sk m; n aWkh m; n

The correlation between d1 and d2 still exists because of the similarity in adjacent frames. Hence we utilise Xkl (m, n), which is the approximation of the cover image to calculate the decorrelation matrix u for d1 and d2 to remove the impact of the cover video. Let V u[d1 d2]T [v1 v2]T; then the correlation matrix of V is a diagonal matrix. Then we construct the 3D-SD for V. v1 and v2 are, respectively, plotted on the x-axis and the y-axis. The cumulative values of their intersecting points can be plotted on the z-axis after normalisation. The 3D-SD of V for the sequences with and without steganographic data are shown in Fig. 2. A detection function E is dened to measure the aliasing degree: E
G 1 X zi; j maxi; j G z0; 0

where z (i, j) is the cumulative value of the selected point (i, j), which has larger value than that of the points in its four neighbours, G is the number of the points under such condition and max(i, j) gives the larger absolute value between i and j. So for each four consecutive frames a value of E is obtained, as shown in Fig. 3. When E is larger than a certain threshold T, the suspect frames are considered as containing the hidden data. T may vary with different video content, which is calculated by hypothesis testing (default T 1).
0.08 0.06 z-axis 0.04 0.02 0 10 z- axis 5 0 y-axis 5 10 10 5 0 x-axis 10 0.03 0.02 0.01 0 10 5 0 y -axis 5 10 10 5 0 x -axis 5

Because of the strong temporal correlation between adjacent frames, the frame difference signal of the cover video can be commonly approximated by a Laplacian distribution. Consequently we construct a detective signal exploiting such a feature, which is
h h h Dm; n Xkh m; n Xk1 m; n Sk m; n Sk1 m; n |{z} DS

10

|{z}
DW

aWkh m; n

h aWk1 m; n

Fig. 2 3D-SD for cover video and stego-video (plotting main points in interval of [2 10] with zero or almost zero of other points) 10,
a Cover video b Stego-video

The probability mass function (PMF) HD of D can be calculated as the convolution of the PMF of DS and DW due to the independence [3], which is given by HD HDS HDW 4

where is the convolution operator. HDS and HDW are the PMF of DS and DW, respectively. Convolution shows that HD is the sum of the HDS that are scaled and shifted according to HDW, which results in an aliasing effect, as shown in Fig. 1. We design a three-dimensional scatter distribution diagram (called 3D-SD), which approximately denotes the joint probability mass function of two random variables. By adopting the 3D-SD to detect the degree of aliasing, our proposed steganalysis approach enables reliable detection of the presence of hidden data.

Results: Several sequences are chosen to test our proposed steganalysis method. The hidden messages are embedded in each frame of the sequences via (2), when a 3. Then these sequences are compressed by TM5 (MPEG-2 Test Model 5) with different bitrates r(r 2, 4 Mbit/s). The frames used in detection are selected by the average energy of frame difference signal in order to avoid the inuence of fast movement or global change in the scenes. The results are shown in Table 1, including the probability of false negative PFN for detecting the stego-video and the probability of false positive PFP for the cover videos. For the overall video sequence the judgment can be made by adopting a majority-takes-all strategy.

ELECTRONICS LETTERS 19th June 2008 Vol. 44 No. 13

4.5 4.0 3.5 3.0 value of E 2.5 2.0 1.5 1.0 0.5 0 0 10 20 30 40 50 60 70

cover video stego-video

Conclusions: A novel steganalysis approach has been presented for detecting the steganography model. Experimental results show that our proposed algorithm has effective performance even though the sequences are compressed with different bitrates. Acknowledgment: This work is supported by National High Technology Research and Development Programme of China (No. 2006AA01Z407) # The Institution of Engineering and Technology 2008 29 February 2008 Electronics Letters online no: 20080582 doi: 10.1049/el:20080582

80

90

100

frame number

C. Zhang, Y. Su and C. Zhang (School of Electronic information Engineering, Tianjin University, Tianjin 300072, Peoples Republic of China) E-mail: qianjian@tju.edu.cn References
1 Budhia, U., Kundur, D., and Zourntos, T.: Digital video steganalysis exploiting statistical visibility in the temporal domain, IEEE Trans. Inf. Forensics Secur., 2006, 1, (4), pp. 502 516 2 Hartung, F., and Girod, B.: Watermarking of uncompressed and compressed video, Signal Process., 1998, 66, (3), pp. 283 301 3 Woods, J., and Stark, H.: Probability and random processes with applications to signal processing (Prentice-Hall, Upper Saddle River, NJ, USA, 2001, pp. 139 147, 3rd edn.)

Fig. 3 Values of E for frames of cover video and stego-video

Table 1: PFN and PFP for different sequences with different bitrates
Sequence r 2 Mbit/s PFN PFP 4% 5% 0 0 1% r 4 Mbit/s PFN PFP 11% 1% 3% 13% 11% 4% 3% 1% 0 1%

Tempete 14% Container 1% Deadline 4% Flower 17% Student 13%

ELECTRONICS LETTERS 19th June 2008 Vol. 44 No. 13