Stego key searching for LSB steganography on JPEG decompressed image

Abstract

At present, steganalysis research focuses on detecting the existence of a hidden message. However, extracting the hidden information, i.e., an extracting attack, is crucial in obtaining effective evidence in computer forensics. Due to the difficulty of an extracting attack, research in this field is limited. In steganography with a stego key, an extracting attack is equivalent to recovering the stego key. In this paper we study a method for recovering the stego key in least significant bit (LSB) steganography with a decompressed JPEG image as the cover image. Firstly, the recovery of the stego key is translated into a cryptanalysis problem for a sequential cipher. The method for recovering the stego key is based on estimating the modification positions. The minimum size of the data used to recover the stego key successfully is discussed. Secondly, when a decompressed JPEG image is used as the cover image, the probability of recovering the cover pixels using recompression is discussed. Recompression is used to compute the error of the estimated sequence. Finally, an algorithm to recover the stego key in LSB steganography with a decompressed JPEG image as the cover image is proposed. The experimental results for the steganographic software, Hide and Seek 4.1 and its variant, which is a typical representative of LSB steganography, show that the proposed method can successfully recover the stego key in LSB replacement and LSB matching, i.e., the extracting attack is successful, and it outperforms three previous methods in terms of computational complexity.

摘要

创新点

目前隐写分析的研究主要集中于隐藏消息的存在性检测。然而能否隐藏消息的提取, 即提取攻击, 对于计算机取证中能否获取重要证据起着重要作用。对于基于隐写密钥的隐写术, 提取攻击等价于恢复隐写密钥。本文的主要创新点如下: 首先, 将恢复隐写密钥转化为一个序列密码的密码分析问题, 得到了成功恢复隐写密钥所需的样本量。 然后, 利用重复压缩估计成功恢复载体像素的概率, 进而计算估计序列的误差值。 最后, 提出了以 JPEG 解压缩图像为载体的 LSB 隐写密钥恢复方法。