The Least Significant Bit (LSB) method is one of the most widespread and demanded steganographic methods nowadays. Detection and decoding the hidden information, embedded in a container using the LSB, is a challenging task, in particular, in conditions of low capacity of the hidden communication channel. The existing steganalysis algorithms developed to detect the LSB, as a rule, solve the main problem of steganalysis - the detection of a hidden communication channel. However, the problem of the additional information recovery remains unfulfilled. The important step in solving this problem is the evaluation of the hidden (steganographic) channel capacity. In the current work, a digital image is used as container. All the results obtained can also be applied to digital video, which is considered as a sequence of frames. The aim of the work is to get estimates for the value of the capacity of the hidden communication channel, formed by the LSB method. To achieve the aim of the work the following studies carried out: performed additional in-depth investigation of properties of the normalized gap of the maximum singular value of non-intersecting image blocks, obtained by standard splitting; studied properties of a discrete function y(QF), that determines the number of image blocks in which the normalized gap of maximum singular value increases when the image is re-saved to lossy format with quality factor QF. As a result of the research, the estimates of the value of the capacity of the hidden communication channel, created using the LSB method and based on a container in a lossy format, were obtained.
Steganography today is one of the most
powerful and widely used areas of information
security. One of the main questions here is who
holds such a powerful means of protection, since
the use of steganography, unfortunately, can lead
to the setting up of hidden communication with
anti-state, illegal, inhuman goals [
Today, one of the most widespread and
demanded steganographic methods is the least
significant bit modification method - LSB [
In [
Let F be the matrix of the digital image,
which is split in a standard way into
nonintersecting l×l-blocks with singular values [
= , where
is a norm of vector . Then the
normalized gap of the singular value i , i = 1,l is
determined as follows [
0 svdgapn (1) 1
The efficiency of algorithmic implementation
of the method proposed in [
The aim of the work is to obtain estimates for the value of the capacity of the hidden communication channel, formed using the LSB method, by identifying the corresponding additional properties of y(QF ).
Let the image were initially saved in a lossy
format; F1 is the matrix of the image, which is
subject to examination. Formally, it is saved in a
lossless format. If F1 is a steganographic
message, then we will assume that it is obtained
on the basis of a Jpeg container with a matrix F
. Let us apply to F1 the steganographic
transformation with the low capacity of the
hidden communication channel (for example,
1%), which formally represented as [
F1,1 = F1 + F ,
(1) where F is the matrix representation of the additional information, F1,1 is the matrix of the image-steganographic message. Let us define functions y (QF ) for F1 and F1,1 re-saving them with losses with all possible values of the quality factor QF. For a particular QF, as a rule, the value y (QF ) for F1,1 will be greater than that for F .
1 Geometrically it means that the y (QF ) graph for F1,1 will be higher along the ordinate than the y (QF ) graph for F1 whether the message or the container matches the matrix F . However, the
1 difference between the values of the function y (QF ) (between the corresponding graphs) will be different depending on whether the matrix F1
original image or corresponds to the steganographic message.
Let F1 be the matrix of the container, then the steganographic message (1) for it will be the first and only one. If F1 corresponds to the steganographic message, then for it (1) is a repeated steganographic transformation. Let us show that the primary transformation (1) with the help of the matrix F will "lift" the y (QF ) graph higher along the ordinate compared to the graph constructed for F1 , than repeated transformation using the same matrix F .
The steganographic transformation of the Jpeg container almost always leads to an increase in the smallest singular values and decrease in the normalized gap of the maximum singular value in the blocks involved in the steganographic transformation, thereby increasing the likelihood of the growth of the normalized gap of the maximum singular value when the image is resaved into a lossy format. If the additional information is embedded in the imagesteganographic message, then the normalized gap of the maximum singular value in blocks, involved in the primary steganographic transformation, is less than in the corresponding blocks of the original container. After the additional information is embedded in the steganographic message, the smallest singular values of the corresponding blocks involved in repeated steganographic transformation, which are no longer comparable to zero in those blocks that were involved in the primary transformation, can both decrease and increase. This fact can lead to both an increase and decrease in the normalized gap of the maximum singular value. Reembedding the additional information in the steganographic message will generally increase the resulting capacity of the hidden communication channel, additionally disturbing the singular values, but the relative change in the smallest singular values of the container blocks be greater than in the smallest singular values of steganographic message with the same disturbance. Thus, the number of blocks in which the normalized gap of the maximum singular value will increase at re-saving with losses of the steganographic message, obtained as a result of consecutive double steganographic transformation will be greater, than when resaving the primary steganographic message.
However, the degree of this increase will be less than the degree of increase using the same (which is characterized by matrix F ), but the primary steganographic message on an empty container.
Moreover, the degree of increase will be smaller the more the capacity of the hidden communication channel of the primary steganographic transformation. Indeed, the more the capacity of the hidden communication channel of the primary steganographic message, the more the number of container blocks, in which the normalized gap of the maximum singular value will decrease as a result of the steganographic transformation, the less the normalized gap of the maximum singular value in the blocks F1 involved in the steganographic transformation, the “higher” will be the graph of the function y (QF ) , obtained when re-saving F1 with losses.
When re-embedding additional information into a steganographic message formed with a relatively significant primary capacity of the hidden channel, there will be a significant number of blocks, where, after repeated steganographic transformation, the normalized gap of the maximum singular value will increase, rather than decrease, in comparison with the normalized gap of the maximum singular value in the block of the input steganographic message. This will lead to the fact that when re-saving a steganographic message obtained as a result of a double steganographic transformation, although the graph of the function y (QF ) will be higher than the graph of a similar function for the input steganographic message (obtained as a result of a single steganographic transformation), this difference will be the smaller, the larger was the capacity of the hidden channel of primary steganographic transformation. It was confirmed in practice by the results of a computational experiment, in which the following sets of digital images were involved: • •
M Tif – 500 images in lossless format (Tiff)
(150 images from 4cam_auth base [
M Tif to the Jpeg format with QF=70, 75, 80 respectively (the most frequently used quality factors in practice).
At the first stage, additional information was embedded into the original image (with or without loss) with the capacity of the hidden communication channel of 1, 5, 10%. The original image-container and the obtained steganographic messages were re-saved into lossy format (Jpeg) with all quality factors QF 1,2,...100. As a result, discrete functions container), y1(QF ) , y0 (QF ) (for the y5 (QF ) ,
y10 (QF ), QF 1,2,...100 for the steganographic message were determined, characterizing the
respectively. A value change in the function y0 (QF ) was considered as a quantitative characteristic of the image change as a result of the primary steganographic transformation: 1
(2) 100 T0,i = y0 (QF ) − yi (QF )2 2 ,
1 i 1,5,10.
At the second stage, additional information was re-embedded with the channel capacity of 1% into the steganographic messages generated at the first stage (the matrix of additional information F was randomly generated, the same matrix was used for steganographic messages with the channel capacity of 1, 5, 10%, formed on the basis of one container ). Steganographic messages obtained after the repeated steganographic transformation were re-saved with losses (Jpeg format) with QF 1,2,...100. As a result, discrete functions
y10,1(QF ) , y1,1(QF ) ,
y5,1(QF ) , QF 1,2,...100 were obtained for steganographic messages with the channel capacity of the primary steganographic transformation of 1, 5, 10%, respectively. By analogy with (2), the following value was considered as a quantitative characteristic of the change in the image-steganographic message after repeated transformation:
1 100 Ti,1 = yi (QF ) − yi,1(QF )2 2 ,
1 i 1,5,10.
(3)
The experimental results for the original images in the lossy format for the case of the Jpeg format with the quality factor QF=75 are shown in Fig. 1 and in Table 1, where can be observed the general tendency of qualitative changes in the values of estimates (2), (3) with increasing the capacity of the hidden channel of the primary steganographic transformation: decreasing the mode of the histogram of values Ti,1 with a simultaneous increase in the value in the mode; decreasing the length of the interval of possible values Ti,1 by decreasing the maximum value. Ti,1 . The quality results obtained are typical for lossy images, regardless of the specifics of the format (Jpeg) and the quality factor used (QF=75). Using a different lossy format (for example, Jpeg2000) or a different quality factor will only change the quantitative indicators of the histograms.
Analysis of the numerical values of (2), (3) using the obtained histograms (Fig. 1) allows us to make conclusions, that the following points are important for evaluation the value of the capacity of the hidden channel: • If for image, which is under examination the value then the
Ti,1 125, • • steganographic transformation were not applied to it; If 61 Ti,1 , then for analyzed image the capacity of the hidden channel is <5%, here the image can be a "clean" container; If 26 Ti,1 , then for analyzed image the capacity of the hidden channel is <10%.
The results obtained at this stage of the
research are not final, the quantitative estimates
obtained for the capacity of the hidden channel
are one-sided (upper estimates), such that they
depend on the value of the capacity of the hidden
channel of the primary stegano-transformation
of the image in the Jpeg format (QF=75). By
expanding the computational experiment, by
increasing the variety of values of the capacity
of the hidden channel for the primary
steganotransformation (for example, from 1 to К% with a
step h%), the results obtained can be made more
precise, what will be done in the development of
the direct method for evaluating the capacity of
the hidden communication channel. Using a
different lossy format (for example, Jpeg2000) or
a different quality factor QF will change the
quantitative indicators of histograms, therefore,
the development of a method requires quantitative
characteristics for all possible (most used) values
of the quality factor. Taking into account their
possible variety, the preliminary step of
determining QF for a container in a lossy format
is required before using the method for estimating
the capacity of the hidden communication
channel. It can be done using, for example, the
method proposed in [
The paper studied the properties of the normalized gap of the maximum singular value of the image matrix blocks, a discrete function y(QF ), that corresponds to the image in the conditions of its re-saving with losses with different quality factors and represents the number of blocks in which the normalized gap of the maximum singular value increases as a result of re-saving.
It is found that: 1. The number of image-steganographic message blocks, for which normalized gap of T1,1 Max 124
Min 2.4
T5,1 Max 61
Min 1.7
T10,1 Max 26
Min 2 the maximum singular value increases when re-saving with losses, is greater, than in magecontainer regardless of the container format (with/without losses); 2. The primary steganographic transformation of a digital image using a matrix F changes («lifts» along the ordinate) the graph of the function y (QF ) higher, than a repeated steganographic transformation using the same matrix F ; 3. The higher the capacity of the hidden communication channel of the primary steganographic transformation, the smaller the difference between corresponding functions y(QF ) for steganographic messages, obtained by single and double steganographic transformations, while the same matrix F is used to re-embed additional information regardless of the capacity of the hidden communication channel of the primary steganographic message.
As a result of the studies, one-sided estimates (from above) of the capacity of the hidden communication channel were obtained in the conditions of the image-container in the Jpeg format (QF=75). The conducted studies and the obtained results indicate that the chosen direction is promising for evaluating the capacity of the hidden communication channel of the primary steganographic transformation of a digital image and is currently being continued by the authors.