An improved approach to steganalysis of JPEG images

Steganography secretly embeds additional information in digital products, the potential for covert dissemination of malicious software, mobile code, or information is great. To combat the threat posed by steganography, steganalysis aims at the exposure of the stealthy communication. In this paper, a new scheme is proposed for steganalysis of JPEG images, which, being the most common image format, is believed to be widely used for steganography purposes as there are many free or commercial tools for producing steganography using JPEG covers. First, a recently proposed Markov approach 1271 is expanded to the inter-block of the discrete cosine transform (DCT) and to the discrete wavelet transform (DWT). The features on the joint distributions of the transform coefficients and the features on the polynomial fitting errors of the histogram of the DCT coefficients are also extracted. All features are called original Expanded Features (EPF). Next, the EPF features are extracted from the calibrated version; these are called reference EPF features. The difference between the original and the reference EPF features is calculated, and then the original EPF features and the difference are merged to form the feature vector for classification. To handle the large number of developed features, the feature selection method of support vector machine recursive feature elimination (SVM-RFE) and a method of multi-class support vector machine recursive feature elimination (MSVM-RFE) are used to select features for binary classification and multi-class classification, respectively. Finally, support vector machines are applied to the selected features for detecting stego-images. Experimental results show that, in comparison to the Markov approach [27], this new scheme remarkably improves the detection performance on several JPEG-based steganographic systems, including JPHS, CryptoBola, F5, Steghide, and Model based steganography. (C) 2010 Elsevier Inc. All rights reserved.