Steganography & Neural Nets

Digital images provide the perfect cover for hiding information. Anyone who's seen "The Da Vinci Code" knows this.

There's nothing knew about this concept; it even has its own name--steganography. What is new, however, is the emerging science of detecting such files, a field called "steganalysis."

"We’re taking very simple steganographic techniques and trying to find statistical measures that we can use to distinguish an innocent image from one that has hidden data," said Clifford Bergman, a math professor and researcher at Iowa State University. "One of the reasons we’re focusing on images is there’s lots of ‘room’ within a digital image to hide data. You can fiddle with them quite a bit and visually a person can’t see the difference."

"At the simplest level, consider a black and white photo--each pixel has a grayscale value between zero (black) and 255 (white)," added ISU math professor Jennifer Davidson, who with Bergman is working on a steganalysis project funded by the Midwest Forensics Resource Center. "So the data file for that photo is one long string of those grayscale numbers that represent each pixel."

Given the huge number of potential images to review and the variety and complexity of the embedding algorithms used, developing a quick and easy technique to review and detect images that contain hidden files is difficult. Bergman and Davidson are utilizing a artificial neural net (ANN) pattern recognition system to distinguish between innocent images and stego images.

Training the ANN involved obtaining a database of 1300 "clean" original images from Ed Delp at Purdue University. These images were then altered in eight different ways using different stego embedding techniques--involving sophisticated transfer techniques between the spatial and wavelet domain--to create a database of over 10,000 images. Once trained, the ANN can then apply its rules to new candidate images and classify them as either innocent or stego images.

"The ANN establishes kind of a threshold value," Bergman said. "If it falls above the threshold, it’s suspicious.

"If you can detect there’s something there, and better yet, what method was used to embed it, you could extract the encrypted data," Bergman continued. "But then you’re faced with a whole new problem of decrypting the data … and there are ciphers out there that are essentially impossible to solve using current methods."

In preliminary tests, the ANN was able to identify 92 percent of the stego images and flagged only 10 percent of the innocent images, and the researchers hope those results will get even better. An investigator with the Iowa Department of Criminal Investigation is currently field-testing the program to help evaluate its usefulness and a GUI is being developed to make the program more user friendly.

Posted by Jon Erickson at 10:50 AM  Permalink