【作者】 刘祖根；

【导师】 平玲娣； 潘雪增；

【作者基本信息】 浙江大学 ， 计算机科学与技术， 2007， 博士

【摘要】 隐写术可用于实现隐蔽通讯，该技术可能被应用于不法活动和军事通讯。而隐写分析是能检测隐藏信息、获知信息长度甚至抽取隐藏信息的技术。研究隐写分析算法对防止机密数据通过隐写术泄漏、确保危害性信息不借助隐写术传递非常重要，因此获得了广泛关注。本论文研究以图像为载体的隐写分析算法。在研究隐写术、隐写分析理论和算法的基础上，应用“载体相关”的隐写分析思想，选择具有代表性的有损压缩类图像中的JPEG、原始类图像中的BMP和有限调色板类图像中的GIF三种格式图像为具体载体对象，研究和提出了三类隐写分析算法。论文的主要研究成果和工作为：(1)提出了基于“多域特征”的MDF_C(Multi-Domain Features in Color images)和MDF_G(Multi-Domain Features in Gray images)隐写分析算法。多域特征由代表原图像及其校准图像的函数关系的DCT域和空域统计量计算得到。MDF_C算法在DCT域计算彩色JPEG图像中交流系数的一维和二维统计量，在空域抽取原JPEG图像的解压图像内各颜色信道中和颜色信道两两之间DCT块边界两侧两个像素颜色之差的一维统计量，以及相邻像素位置的“颜色差值对”的二维统计量。采用相同算法从校准图像抽取如上统计量，并使用曼哈顿公式从两类图像的相同统计量计算得到36维特征向量。MDF_G算法在DCT域抽取原图像和校准图像中相同DCT位置交流系数的二维统计量，以及两种图像中两相邻DCT块内同一位置交流系数的二维统计量；在空域抽取两种解压图像亮度的二维统计量和一阶偏微分的二维统计量，求统计量的“直方图特征函数”的“块中心”得到26维特征向量。使用支持向量机设计的隐写分析算法的实验结果表明，同传统隐写分析算法比较，MDF_C算法的误检率降低了0.54％～48.23％，误检率大致相等时，检测率提高了0.47％～66％；MDF_G算法的误检率降低了0％～24.99％，误检率大致相等时，检测率提高了1.24％～67.81％；MDF_C和MDF_G算法对多种隐写术的总体检测性能比传统算法更高。(2)提出了基于“高阶微分特征”的HODF_G(High-Order Differential Features in Gray images)、HODF_C(High-Order Differential Features in Color images)和PCF(Principal-Component Features)隐写分析算法。HODF_G算法首先计算像素亮度、一阶和二阶全微分的直方图；然后计算像素亮度、一阶、二阶和三阶偏微分，以及一阶和二阶全微分等6个对象在图像中两相邻空间位置的共生矩阵；计算得到一个30维特征向量。HODF_C算法计算彩色BMP图像各颜色信道中上述统计量，并计算两颜色信道之间的统计量，得到一个136维的特征向量。PCF算法使用“主元分析法”对HODF_C算法的136维特征向量降维得到主元特征。以支持向量机为分类算法实现隐写分析算法。实验结果表明，同传统隐写分析算法比较，HODF_G算法的误检率降低了2.13％～29.63％，误检率大致相等时，检测率提高了3.56％～14.13％。HODF_C算法的误检率降低了5.42％～18.63％，检测率有不同程度的提高。PCF算法表现了更好的检测性能和鲁棒性。(3)提出了基于“图像子块颜色复杂度”的CCSB(Color Complexity in Sub-Block)、CCSB_DP(Color Complexity in Sub-Block Differentiated with Parity)和CCSB_CNC(Color Complexity in Sub-Block Classified with Number of Different Colors)隐写分析算法。CCSB算法将“图像子块的颜色复杂度”定义为一个像素索引值与它的邻近像素索引值之差的绝对值的和。将“颜色复杂度”区分成正、负颜色复杂度，并将二者划分为主、次两类；然后从图像中抽取上述多种“颜色复杂度”的一维统计量和二维统计量，计算得到28维特征向量。CCSB_DP算法根据“最佳奇偶匹配”法将CCSB算法中的统计量分为2类并计算得到56维特征向量。CCSB_CNC算法根据“图像子块中不同颜色数”将CCSB算法的统计量分布到更高维统计空间，计算得到44维特征向量。以支持向量机为分类算法设计隐写分析算法。实验结果表明，同传统隐写分析算法比较，CCSB算法的误检率大致降低了0.07％～81.17％，误检率大致相等或更低时，检测率提高了11.24％～50.78％。CCSB_DP算法的检测性能略逊于CCSB算法，而CCSB_CNC算法表现更优。更多还原

【Abstract】 Steganography is the art and science of hiding messages and it can be applied inillegal application and military communications. As the technology of detection ofsteganography, estimation of message length and extraction of hidden data,steganalysis can prevent confidential data from revealing through steganographicschemes and ensure dangerous information not be transfered. Therefore, steganalysis isvery significant for information security and has attracted a great deal of attention.As the most popular formats of images, JPEG, BMP and GIF images are oftenselected as covers for information hiding. In this paper, based on the studies oftraditional theories and algorithms on steganography and steganalysis, applying thethought of cover-related steganalsis, we proposed three kinds of steganalyticalgorithms for detecting embedded data in JPEG, BMP and GIF formats ofcover-images, respecitivly. The results are summarized as follows:(1) Two steganalytic algorithms, MDF_C and MDF_G, were proposed based onmulti-domain features. MDF_C and MDF_G represent multi-domain features in colorimages and in gray images respectively. Multi-domain features were calculated fromstatistics extracted in discrete cosine transform (DCT) domain and in spatial domainthat denote the functional relations between an original image and its calibratedversion. MDF_C extracted one-dimensional (1-D) and two-dimensional (2-D) statisticsof alternating current (AC) coefficients in DCT domain. In spatial domain ofdecompressed versions of the original color JPEG images, MDFC computed 1-Dstatistics of differences of every two colors which located at two sides of borders ofDCT blocks in each channel and in two different channels. Meanwhile, 2-D statisticscounted pairs of differences of two colors distributed at two adjacent locations in eachchannel and in two different channels. Similar statistics in DCT and spatial domainswere collected for the calibrated images. Manhattan Distance formula was used tocalculate features from the same statistics of original and calibrated images and a 36-dimensional feature vector was extracted from a color JPEG image. MDFG collected2-D statistics of pairs of AC coefficients at two same locations distributed in DCTdomains of an original gray JPEG image and its calibrated version. 2-D statistics werealso utilized to count pairs of AC coefficients which located at the same DCT positionsin two adjacent DCT blocks in an image. In spatial domain, MDF_G extracted 2-Dstatistics of intensities and of the first order partial differentiations in twodecompressed images respectively. 26-dimensional feature vector was obtained by calculating centers of mass of histogram character function of these statistics.Support vector machine were utilized to implement steganalytic algorithms basedon the two kinds of feature vectors. Experimental results showed that the falsepositives of MDF_C were 0.54% to 48.23% lower than those of traditional steganalyticschemes. When the false positives were roughly equal with each other, the truepositives of MDF_C were 0.47% to 66% higher than those of traditional steganalyticschemes. Similarly, for MDF_G, the false positives decreased 0% to 24.99% and thetrue positives increased 1.24% to 67.81%. MDF_C and MDF_G algorithms providedbetter detecting performances than traditional schemes.(2) Three steganalytic methods, named as HODF_G, HODF_C and PCF, wereintroduced based on high-order differential features (HODF). HODF_G and HODF_Crepresent HODF in gray images and in color images respectively. PCF was denoted asprincipal-component features. Firstly, HODF_G computed histogram statistics of threeobjects such as intensity, first-order and second-order total differentiations respectively.Secondly, co-occurrence matrix statistics were calculated for each of 6 objects whichare intensity, first-order, second-order and third-order partial differentiations,first-order and second-order total differentiations distributed at two adjacent locationsin images respectively. Features were obtained from these statistics to form a30-dimensional feature vector. HODF_C computed 136-dimensional features fromabove statistics in each of three channels and statistics between every two of threechannels. The method of principal components analysis was utilized in PCF method toreduce dimension of feature vector of HODF_C. Support vector machine was used toimplement steganalytic algorithms.Experimental results demonstrated that the false positives of HODF_G were2.13% to 29.63% lower than those of traditional steganalytic schemes. When the falsepositives were roughly equal with each other, the true positives of HODF_G were3.56% to 14.13% higher than those of traditional steganalytic schemes. Similarly, forHODF_C, the false positives were 5.42% to 18.63% lower and the true positivesincreased to some different extents. PCF method provided more effective and robustdetecting performances than traditional algorithms.(3) Three steganalytic methods, designated as CCSB, CCSB_DP and CCSB_CNC,were proposed based on color complexity in sub-block (CCSB) of images. CCSB_DPdifferentiates CCSB with parity and CCSB CNC classifies CCSB into differentclasses according to the number of different colors in a sub-block. The distance fromone index to another was computed as absolute value of the difference between the twoindexes. In CCSB algorithm, color complexity was defined as the sum of distances from one index to the others in a sub-block of an image. Color complexity wasdifferentiated as positive and negative ones and they were further classified intoprimary and secondary ones. A 28-dimensional feature vector was then extracted froma gray GIF image through collecting one-dimensional and two-dimensional statistics ofabove multiple kinds of color complexities. CCSB_DP differentiated statistics ofCCSB as two classes and got 56-dimensional features according to the concept ofoptimal parity assignment. CCSB_CNC distributed the color complexities into higherdimensional spaces based on the number of different colors in a sub-block andobtained 44-dimensional features. Support vector machine was utilized to designsteganalytic algorithms.Experimental results showed that the false positives of CCSB were 0.07% to81.17% lower than those of traditional steganalytic schemes. When the false positiveswere roughly equal with each other, the true positives of CCSB were 11.24% to50.78% higher than those of traditional steganalytic schemes. CCSB_DP providedworse detecting performance than CCSB, but CCSB_CNC was better than CCSB.更多还原