Detection of Data Hiding in Binary Text Images Jun Cheng, Alex C. Kot, Jun Liu and Hong Cao School of Electrical and Electronic Engineering Nanyang Technological University Singapore [email protected] Abstract— We present in this paper a technique for the steganalysis of electronic binary text images. The proposed method utilizes the similarity between same characters or symbols. The proposed method can detect the existence of a secret message hidden by the embedding algorithms which hide information by flipping centers of L-shape patterns (COL).

I.

INTRODUCTION

The widely use of digital documents makes digital document image processing more and more useful. Datahiding in document images have received much attention recently and appears to be a new emerging technology. Some new techniques have been developed for data hiding in binary document images. One class of techniques for binary image data hiding is to change the value of individual selected pixels, such as the work in [3, 4, 5, 6, 7]. We call these techniques as pixel flipping techniques since they hide information in the image by flipping pixels. Here, flipping means changing the pixel from white to black or vice versa. Perceptual quality is controlled in these pixel flipping techniques to minimize the visible distortion. The purpose of steganography is to communicate information secretly so that others who inspect the objects being exchanged will not notice the existence of secret information hidden in the objects. As opposite to steganography, steganalysis is to detect the existence of the secret information in the objects and distinguish objects with secret information from objects without any secret information. Several methods have been proposed for the steganalysis of binary text images in [2, 9, 11, 12]. Binary text images can be categorized into two types. One type is clean image, which is converted electronically from a text file. In a clean text image, the same letters/characters/symbols within the same image are identical. This property eases the detection of the existence of secret message hidden by pixel flipping technique as the flipping of many pixels will destroy the property [11] or increase the compressed data rate [2]. The other type of images is scanned image, which always contain some scan noise in practice. The methods in [2, 9, 11] can detect the existence as well as estimate the message length without the knowledge of embedding algorithm. However, these methods can only work for clean images. The method in [12] can detect the existence of secret message in a noisy image; however, it

0-7803-9134-9/05/$20.00 ©2005 IEEE

needs some knowledge of the embedding algorithm, which may not be available in the detection process. Detection of the existence of secret message without the knowledge of embedding algorithm in binary noisy image is extremely difficult. One reason is that the locations where the pixels are flipped are hidden by the algorithm and different algorithms may use a totally different set of locations. Another reason is that the existing noisy pixels in the original image work as a cover of the new introduced noisy pixels by the embedding process while the noise level in original image may vary largely. In this paper, we propose a method which can detect the existence of a secret message without the knowledge of embedding algorithms. II. UNIFICATION OF EMBEDDING PROCESS To start with, we give a review of these embedding schemes by studying how these embedding algorithms preserve the quality of the images. These pixel flipping techniques study the flippability of each pixel by comparing it with its neighboring pixels. In [5,10], the authors come up with a flippablity score computation method by studying smoothness and connectivity in 3x3 neighborhoods. In [6], the authors choose 100 pairs of boundary patterns with the goal to preserve the overall shape of a character and minimize noticeable artifacts and distortion. In [3], the authors study the distortion introduced by flipping a pixel by subjective testing. In [7], the authors choose the pixels by flipping which the connectivity is preserved. Then these methods hide information by flipping the “flippable” pixels. One of the important observations is that most of the flippable pixels by these schemes can constitute an L-shape pattern as the pattern in Fig. 1 with its 8-connected neighboring pixels. Normally, more than 80% pixels being flipped by these schemes satisfy this condition.

Fig. 1 One example of L-shape patterns There are totally 16 L-shape patterns by complement, mirroring and rotation

The reason that all these schemes choose the center pixel of the above mentioned patterns as flippable pixel is that flipping of the center pixel of the pattern will not affect the smoothness and connectivity of the image [13]. We define set A= {pixel (u, v) |the 3x3 window centered at (u, v) is an Lshape pattern}, where (u, v) represents the coordinate of a pixel. The pixel in set A is called a center of L-shape pattern pixel (COL pixel). In general, all these embedding schemes choose pixels from set A for flipping, of course, different schemes may use a different subset. Also, different scheme may choose some additional pixels which do not belong to set A. In our analysis, we assume we have no knowledge in how the scheme chooses the subset from set A. As most of the pixels being flipped are pixels from set A, we detect the existence of secret message by detecting the flipping of pixels from set A. III.

PROPOSED METHOD

We first segment the whole image to marks. We use the term ‘marks’ instead of ‘characters/letters/symbols’. Marks [8, 14] refer to letters, ligatures, figures and punctuation symbols and other symbols. These marks can be easily extracted by any standard segmentation technique. In our implementation, we segment the image into lines according to the horizontal profile and then segment each line into marks according to the vertical profile. All the marks are sorted according to their locations in the image. The following steps are carried out. 1. Start from the first mark and let it be the current mark. 2. Prescreen all the marks sorted after the current mark. Skip if the size is not close to that of the current mark. In our implementation, we reject any mark that has a size in either dimension which differs by more than 2 pixels compared with that of the current mark. 3. For every potential matched mark, find the alignment with the current mark to achieve minimum number of mismatched pixels and calculate the number of mismatched pixels. If the percentage of mismatched pixels is less than a predefined threshold T, the potential matched mark is considered as matched to the current mark. Inspired by the JBIG2 standard [8, 14], we use T as 21% of the pixel number enclosed in the bounding box of the current mark. All the marks matched to the current mark would be grouped together. The current mark is considered matched to itself if no other matched mark found. Consequently, a group with only one mark is formed. 4. Select the first mark of the remaining unmatched marks and let it be the new current mark. Repeat Step 2, 3 until all the marks have been grouped.

   x0 = round     



 n m   ∑∑ iB (i, j )    i =1 j =1  , y0 = round  i =1 j =1  n m n m   ∑∑ B(i, j )  ∑∑ B(i, j)   i =1 j =1  i =1 j =1    n

m

∑∑ jB(i, j) 

(1)

where round (⋅) is a rounding operation to an integer. A reference mark is determined for every group of marks created previously. Suppose a group with N marks M i , for i=1, 2…N, the pixel value (1 or 0) is represented by M i ( x, y ) , where (x, y) is the displacement of the pixel from the top-left corner of the mark. Then the average pixel value at (x, y) is given by   N M i ( x, y ) / N  . Ω M (x, y ) = round      i =1

∑

(2)

We then use the average mark Ω M as a reference and compare all the marks within the group with Ω M . The pixel value Ω M ( x, y ) of the reference Ω M is invariant with high confidence from embedding process as it is obtained by averaging all the marks in each group. However, M i ( x, y ) is directly affected by the flipping in the embedding process. We define the following probability:

ξ0 = P( M i ( x, y) ≠ ΩM ( x, y) | pixel( x, y ) is a COL pixel)

(3)

Experimentally, ξ0 is smaller than 0.5 for most of binary text images. In most cases, ξ0 ≤ 1 / 3 for scan images and MPDB images. We observe that the value of ξ0 will be increased in the embedding process. However, it is difficult to differentiate stego images with cover images based on ξ0 . We partition set A into two subsets A1 and A2 , where A1 consists of all isolated COL pixels and A2 consists of all nonisolated COL pixels. A COL pixel is isolated if none of its 8connected neighboring pixels is a COL pixel; otherwise, it is non-isolated. We observe that the flipping rate from set A1 differs from the flipping rate from set A2 if the embedding algorithm randomly chooses COL pixels for flipping. The reason is, for any pixel from A1 , the flipping of one pixel will not affect the flippability of any COL pixels in set A because all the pixels in A1 are isolated; while in A2 , flipping of one pixel will make at least one COL pixel unflippable. It is because the embedding algorithm in [3, 5, 6, 7] will not flip two neighboring pixels simultaneously for the purpose of imperceptibility. Instead of studying the increase of ξ0 , we now study the difference between ξ1 and ξ 2 , where

In Step 3, the alignment is done by first calculating the gravity center and then searching for the best match of the center of gravity within a w x w window.

ξ1 = P( M i ( x, y) ≠ ΩM ( x, y) | pixel ( x, y) ∈ A1 )

(4)

ξ 2 = P( M i ( x, y) ≠ ΩM ( x, y) | pixel ( x, y) ∈ A2 )

(5)

For a n × m binary region B with its pixel value B(i, j ) , for i = 1,2...n, j = 1,2...m , the center of gravity is computed using

(ξ1 − ξ2 ) calculated from most of the original images is very

We

observe

in

our

experiments

that

value

small. The flipping of the pixels from set A will increase the

0.12 Original Stego 0.1

0.08

ξ1-ξ2

value. Since the variance of (ξ1 − ξ2 ) is smaller compared with the change due to the embedding process, we select a threshold ϑ to differentiate most of the stego images with cover images. The threshold ϑ can be set by minimizing the total detection error. An image is classified as a stego image if its corresponding value (ξ1 − ξ2 ) is larger than the threshold; otherwise, it is classified as a cover image.

0.06

EXPERIMENT RESULT

To evaluate the proposed steganalysis technique, we have conducted a large number of experiments. The test images are chosen from NIST machine print database (MPDB). It contains different font types and font sizes. We do not use the image with small font sizes (4, 5, 6) and large font sizes (17, 20) as they are not widely used in practice. A total of 135 images are used in our test. We employ the four schemes in [3, 5, 6, 7] to hide random message into the original image to create a database of stego images. Then we apply the proposed method to detect them. A threshold is chosen by minimizing the total detection error based on the distribution of (ξ1 − ξ2 ) from the cover images and stego images. The probability distribution of (ξ1 − ξ2 ) is given in Fig. 2. The left side curve indicates the distribution of (ξ1 − ξ2 ) for 135 original images. The right side curve indicates the distribution of (ξ1 − ξ2 ) for 540 stego images embedded by four different algorithms. We choose the threshold ϑ as 0.04. Then 91.8% of the stego images embedded using Wu’s scheme, 99.3% stego images embedded using Yang’s scheme, 97.8% stego images embedded using Pan’s scheme, 88.9% stego images embedded using Mei’s method are successfully detected, and 2.2% of the cover images are wrongly classified as stego images. The accuracy of the detection result relies on the variance of (ξ1 − ξ2 ) from the original images as well as the amount of increment of (ξ1 − ξ2 ) accompanied with the embedding process. The increment of (ξ1 − ξ2 ) is image dependent. The value of (ξ1 − ξ2 ) from cover images (o) and stego images (+) embedded by different algorithms are shown in Fig. 3.

0.04

0.02

0

0

20

40

60 80 Image seq.

100

120

140

(a) Wu’s scheme 0.1 original stego

0.09 0.08 0.07 0.06 ξ1-ξ2

IV.

0.05 0.04 0.03 0.02 0.01 0

0

20

40

60 80 Image seq.

100

120

140

(b) Yang’s scheme 0.1 Original Stego

0.09 0.08

0.14

0.07

0.12

ξ1-ξ2

0.06

The probability

0.1

0.05 0.04

0.08

0.03

0.06 The threshold

0.02

0.04

0.01 0.02

0 0

0

0.01

0.02

0.03

0.04

0.05 0.06 ξ1－ ξ2

0.07

0.08

0.09

0.1

Fig. 2 The probability distribution of (ξ1 − ξ2 ) The left side curve indicates the distribution of cover images. The right side curve indicates the distribution of stego images.

0

20

40

60 80 Image seq.

(c) Pan’s scheme

100

120

140

0.1 Original stego

0.09

REFERENCE [1]

0.08

ξ1-ξ2

0.07 0.06

[2]

0.05

[3]

0.04 0.03

[4]

0.02

[5]

0.01 0

0

20

40

60 80 Image seq.

100

120

140

(d) Mei’s scheme Fig. 3 Scattered plots for (ξ1 − ξ2 ) calculated from cover images and stego images created by different algorithms

[6]

[7]

[8] [9]

V.

CONCLUSIONS

In this paper, we proposed a method to detect the existence of secret message hidden by the algorithms which use COL pixels. The proposed method can detect the existence of a secret message if the embedding rate exceeds certain predetermined threshold based on the images. Based on the 135 NIST text images, our experimental results show that the proposed steganalysis technique can achieve over 90% accuracy on average for pattern-based embedding algorithms. The performance of the detector can be further improved by using a sub-set from set A2 where the pixels in the sub-set satisfy the condition that the flipping of the pixel will not make the pixel become an isolated COL pixel. The proposed method can be extended to estimate the message length, provided that some prior knowledge of the embedding algorithm is known. The weakness of the proposed steganalysis techniques is the selection of the threshold ϑ . The threshold we choose is based on 135 images from MPDB. Future work will be focused on finding a formal way to determine the threshold.

[10]

[11] [12]

[13] [14]

[15]

[16]

J. Fridrich, M.Goljan, and R.Du, “Reliable detection of lsb steganography in color and grayscale images”, in Porc. Of the ACM Workshiop on Multimedia Security, Ottawa, CA, May 2001, pp.27-30. M. Jiang, X.Wu, E.K.Wong, and N. Memon, “Quantitative Steganalysis of binary images”, in Proc. of IEEE ICIP pp29-32, 2004. G. Pan, Y.J.Hui, and Z. H. Wu, “ A novel data hiding method for twocolor images”, in Lecture Notes in Computer Science . Oct. 2001, vol. 2229, Springer . H. Lu, A. C. Kot., J. Cheng; “Secure data hiding in binary document images for authentication”, ISCAS 2003. vol. 3. May 2003, pp. III-806 - III-809. M. Wu, E. Tang, and B. Liu, “Data hiding in digital binary image,” in IEEE ICME 2000. New York City, NY, USA, July 2000. Q. Mei, E.K. Wong, and N. Memon, “Data hiding in binary text documents,” SPIE Proc Security and Watermarking of Multimedia Contents III, Jan. 2001 H. Yang and A. C. Kot, "Data Hiding for Text Document Image Authentication by Connectivity-Preserving” in Proc. of IEEE ICASSP, pp II 505-508,March 2005 Paul G. Howard, “Text image compression using soft pattern matching,” The Computer Journal, vol. 40, no. 2-3, 1997 M. Jiang, X. Wu, E.K. Wong and N. Memon, “Steganalysis of boundary-based steganography using autoregressive model of digital boundaries”, in IEEE Int’l Conf on pattern recognition, 2004 M. Wu and B. Liu, “Data Hiding in Binary Image for Authentication and Annotation”, IEEE Trans. On Multimedia, vol. 6, NO. 4, pp528538, August 2004 J. Cheng, A. C. Kot, J. Liu and H. Cao, “Steganalysis of binary text images”, in Proc. of IEEE ICASSP, pp IV 689-692,March 2005 J. Cheng, A. C. Kot, J. Liu and H. Cao, “Steganalysis of data hiding in binary text images”, in Proc. of 2005 IEEE International Symposium on Circuits and Systems J. Cheng and A. C. Kot, “Objective distortion measure for binary images”, in Proc. of IEEE TENCON 2004, pp355-358 P. Howard and F.Kossentini et al., “The emerging JBIG 2 standard,” IEEE Trans on Circuit and Systems for Video Technilogy, vol. 8, pp. 838-848, 1998 Sorina Dumitrescu and Xiaolin Wu, “Steganalysis of LSB Embedding in Multimedia Signals”, in IEEE ICME 2002. August 2002 pp:581 – 584. vol.1 J. Fridrich, M. Goljan, D. Hogea, and D. Soukal, “Quantitative steganalysis of digital images: Estimating the secret message length,” ACM Multimedia Systems Journal, vol. 9, no.3, pp. 288-302, 2003