6th European Conference - Academic Conferences

Detection of YASS Using Calibration by Motion Estimation
Kesav Kancherla and Srinivas Mukkamala
(ICASA) / (Canes) / New Mexico Institute of Mining and Technology USA
kancherla@cs.nmt.edu
srinivas@cs.nmt.edu
Abstract: Through this paper we propose a new approach to thwart defects of current blind steganalysis
methods. “Yet Another Steganographic Scheme” (YASS) is a robust steganographic scheme that embeds data in
random locations based on a secret key. Due to this randomization the current steganalysis schemes such as
self calibration methods do not detect YASS. In this work, we present a new calibration method using Motion
Estimation and extract higher order features. In our methodology motion estimation technique is applied on an
image, to estimate its actual image. We assume that the estimated image captures the features of the actual
image, due to spatial redundancy in the images. We extract two sets of features; DCT based features from DCT
domain and Markov model based features from spatial domain, and apply Support Vector Machines (SVMs) on
these feature sets. Our approach against YASS using different block sizes (9, 10, 12, and 14), compression rates
(50-50, 50/75, and 75/75) and coefficients used for embedding data (12 and 19) obtained an accuracy of about
95%, even for bigger block lengths and low embedding rates. This methodology can be used as blind
steganalysis technique, as detection is based on modification of an image rather than steganographic scheme.
Keywords: blind steganalysis, Discrete Cosine Transform (DCT), motion estimation, steganalysis, Support
Vector Machines (SVM)
1. Introduction
Steganography is the science of embedding data into cover object in covert communication. The rapid
growth in internet and digital media causes an increasing threat of using steganography for covert
communication. Steganographic images are not perceivable to human eye but embedding data into
images change the statistics of images. The goal of a steganalyst is to use these statistical changes
to detect the presence of any hidden message.
Fridrich used second order statistics in her research of self-calibration method for blind Steganalysis
(Fridrich, 2004: 67-81). In self-calibration technique, a given image is first decompressed and few
rows and columns are cropped. The cropped image is recompressed using the same quality factor,
and difference between the features extracted from actual image and cropped image is used to detect
steganograms. To detect well-known steganographic schemes like Outguess, F5 and Model Based
steganography schemes (Provos, 2001: 24; Westfeld, 2001: 289-302; Sallee, 2005: 167-190); Farid
proposed the use of wavelet based features for JPEG Steganalysis (Lyu and Farid, 2002: 340-354),
Shi proposed the use of transition matrix as features for detecting steganograms (Shi et al, 2006: 249-
264), Fridrich used merged Discrete Cosine Transform (DCT) and Markov features for implementing a
multi-class JPEG steganalysis classification (Pevny and Fridrich, 2007: 1-13) and Chen proposed
Markov based features using intra-block and inter-block correlation of DCT coefficients (Chen and
Shi, 2008: 3029-3032).
Outguess embeds data by replacing least significant bit and preserves the first order statistics by
performing additional changes, F5 algorithm uses matrix embedding to reduce the number of changes
needed to embed data. And Model-based steganography tries to preserve histograms of individual
AC DCT models after embedding the data. However the current steganalysis techniques can detect
these steganography methods. “Yet Another Steganography Scheme” (YASS) by (Solanki, Sarkar
and Manjunath, 2007: 16-31) is a new steganography scheme that resists the above steganalysis
methods. YASS embeds data at random locations and uses Quantization Index Modulation (QIM) to
increase robustness of data. Even though it cannot be detected using current self-calibration
methods, embedding data still changes the statistical properties of image.
In (Li, Shi and Huang, 2008: 139-148), the authors present a targeted attack on YASS. They showed
that due to QIM embedding scheme used in YASS, there is an increase in number of zero DCT
coefficients in stego image. Thus there is a notable difference between statistics of embedded block
and the actual block. They also identified the fact that embedding is not random enough for detection
of YASS. However this approach does not work when there are modifications in algorithm. In the
method proposed by (Kodovský, Pevný and Fridrich, 2010: 1-11), the authors used various well
known steganalysis methods for detection of YASS. They used Subtractive Pixel Adjacency Model
143