Cryptography Reference
In-Depth Information
An enhanced version of the test can identify a hidden collection of
bits in some cases if the attacker can identify the pairs. The order of
pairsinanimagewithhiddeninformation should occur with equal
frequency, while that in a natural image should probably come with
some imperfection.
More sophisticated tests can be tuned to different applications.
The program JSteg hides information by changing the least signifi-
cant bit of the integer coefficients used in the JPEG algorithm. In
normal pictures, smaller coefficients are more common than larger
ones. The value of
1
is more than twice as common as the value of
2
,
a value that is in turn about twice as common as
3
. [Wes01] When the
least significant bits of these values are tweaked to hide information,
the occurrences equalize. The number of
1
sand
2
sbecomeequal,
the occurrences of
3
sand
4
s become equal, and so forth. If two coef-
ficients differ by only the least significant bits, then their occurrences
becomes equal as information is hidden.
The
χ
2
test can help identify JPEG photos where the coefficients
occur with too much similarity.
17.6.1 Wavelet Statistics
Another solution is to examine the statistics produced by applying
a set of functions to the image. Hany Farid noted that many of
the wavelet functions used to model images often produced dis-
tinctive statistical profiles. [RC95, Sha93, BS99] He applied one set,
the
quadrature mirror filters
(QMF) , at multiple scales and found
that the basic statistical profile of the coefficients generated by these
wavelet decompositions could predict the presence or absence of a
message in some cases. That is, the mean, variance, skewness and
kurtosis were different enough to be distinctive.
Basic programs like Jsteg and EzStego could be detected with ac-
curacy rates approach 98% while more careful programs like Out-
guesscouldbefoundasoftenas77%ofthetime. Ofcourse,the
success depended heavily on the size of the message encoded in the
images. The high success rate came when the hidden message was
about 5% of the carrier image's size. If the image size dropped, the
success rate dropped to next to nothing (2%).
Some of this success is no doubt due to the fact that a program
like Outguess only tries to balance the first-order statistics. Multi-
scale decompositions with more complicated statistics are still af-
fected by even these balanced tweaks. A more sophisticated version
of Outguess designed to keep the QMF statistics in balance could
probably defeat it. Of course, keeping the message small is one of
