Color images steganalysis using rgb channel geometric transformation measures

In recent years, information security has received a great deal of attention. To give an example, steganography techniques are used to communicate in a secret and invisible way. Digital color images have became a good medium for digital steganography due to their easy manipulation as carriers via Internet, e-mails, or used on websites. The main goal of steganalysis is to detect the presence of hidden messages in a digital media. The proposed method is a further extension of the authors previous work: steganalysis based on color feature correlation and machine learning classiﬁcation. Fusing features with those obtained from Color-Rich Models allows increasing the detectability of hidden messages in the color images. Our new proposition uses two types of features, computed between color image channels. The ﬁrst type of feature reﬂects local Euclidean transformations and the second one reﬂects mirror transformations. These geometric measures are obtained by the sine and cosine of gradient angles between all the color channels. Features are extracted from co-occurrence correlation matrices of measures. We demonstrate the efﬁciency of the proposed framework on three steganography algorithms designed to hide messages in images represented in the spatial domain: S-UNIWARD, WOW, and Synch-HILL. For each algorithm, we applied a range of different payload sizes. The efﬁciency of the proposed method is demonstrated by the comparison with the previous authors work and the Spatial Color Rich Model and CFA-Aware features for steganalysis.


INTRODUCTION
Steganalysis, the art of detecting hidden information, has received a great deal of attention in recent years.There are many researchers working on solutions ensuring the detection of hidden messages inside digital media.As a result, there are many techniques and methods that are currently used in the field of steganography and steganalysis [1].
Modern information security techniques demonstrate that cryptography alone is not enough to ensure the safe communication of a hidden message.Indeed, it is simple to corrupt, sabotage or delete a file containing secret/encrypted message, as they may be tracked.In addition, the presence of encrypted information itself is valuable information.Additionally, when any person finds and sees an encrypted message, this makes possible its decryption.For these reasons, it is common to work with steganography, encrypting the messages, and then hiding them in a digital medium.By the way, steganography is not intended to replace cryptography but supplement it to make the detectability of the secret messages more and more difficult [2].
More specifically, steganography is the art of hiding the presence of a communication, by embedding messages within a media such as audio, image or video files, in a way that is hard to detect.The steganographer objective is thus to hide the fact that there are information, hidden in a media [3].
Image steganography techniques based on the modification are predominantly classified into the spatial and frequency domains [4].In the spatial domain, pixel values are used directly to embed the message bits.In the frequency domains [5], the frequential coefficients are used to embed the message.Each domain has several different algorithms.Generally, steganography is made of two parts, messages are embedded inside the digital media in the first part (the embedding) and they are extracted in the second part (the extraction) [6], as illustrated in Fig. 1.
Although the embedded messages inside the digital medium involves some slight changes in this medium, these changes modify slight coefficient values of the image [18].These changes are difficult to identify by a common user.On the other hand, steganalysis research aims to develop some methods, theories and applications that are effectively able to detect these minor modifications in order to detect hidden messages in this medium.Although, the real-world uses significantly more color images than grayscale images, there is a lot of research in steganalysis of grayscale images compared to color images [7].
In this article, we describe further extensions of the recent method described by Addulrahman et al. [8].We propose new features to enhance the Color Rich Model [9], which is formed by co-occurrence matrices of residuals taken across the color channels.
The rest of this paper is organized as follows.Section 2 is dedicated to steganalysis methods for digital color images.Section 2.1 describes Color Spatial Model steganalysis, and Section 2.2 describes Color Filter Array aware features for steganalysis [22].We present a detailed description of our proposed method in Section 3 by recalling the color channel correlation and the mirror transformations.The ensemble classifier used in this work is explained in Section 4. Experimental results and comparisons are given in Section 5. Finally, Section 6 gives some conclusions and perspectives.

RELATED WORK
In recent years, there have been a few techniques involving color steganalysis methods.In this regard, the earliest work was reported by Fridrich et al. [7].The authors have developed an influential approach for color steganalysis to detect stego images which are created by embedding a message inside the pixels randomly (using the Last Significant Bit (LSB) steganography method).They have found the relative number of close colors pairs between the original image and the stego-image.Let us note (R1, G1, B1) and (R2, G2, B2) respectively the three color channels specifying the red, green and blue components of two color images.They show that if two colored pixels (R1, G1, B1) and (R2, G2, B2) for these two images are close, then the condition (R1 − R2)2 + (G1 − G2) 2 + (B1 − B2) 2 ≤ 3 must be satisfied.Thus, after the embedding process, the number of unique colors will be increased in stego images more than the number of unique colors in the cover image.
Fridrich et al. [10] have introduced a reliable steganalysis algorithm to detect LSB embedding in randomly non-sequential scattered pixels in both 24-bit color and grayscale images.In this method, the message length is derived by searching the lossless capacity in the LSB.Additionally, Westfeld and Pfitzman [11] have applied a robust statistical attack method based on statistical analysis of Pairs of Values (P oV s) that are exchanged during message embedding.This method detects very reliable stego images with hidden messages which are embedded in sequential pixels using EZ Stego, S-tools, J-Steg, and Steganos methods.A set of P oV s is used to detect the presence of secret messages in digital images.However, this method is not efficient with embedded messages in random pixels.
Ker, in [12], enhanced techniques for the detection of LSB Matching method from grayscale images into the color images experiment.Beginning with the outlining of Harmsen method [13], by using Histogram Characteristic Function (HCF ), Ker has described two new ways: the first one by calibrating the output Center Of Mass (COM ) using a down sampled image, and the second way by computing the adjacency histogram instead of the usual histogram to detect an additive noise based steganography.
Thiyagarajan et al. [14] has developed a steganalysis method based on color model conversion.Indeed, considering color images, to detect hidden messages, they convert Red (R), Green (G) and Blue (B) channels of the images to the Hue Saturation and Intensity (HSI) color model.Stego images are then generated by implementing different color image formats, using the last significant bit steganography method.Finally, cover and stego images are recognized using a threshold value which depends on the correlation between pixel pairs in terms of color components.
Lyu et al. [15] have described a steganalysis algorithm that exploits the inherent statistical regularities of the original images.The statistical model consists of first and higher order color wavelet statistics of noise residuals obtained using predictors of coefficients in Quadratic Mirror Filter (QM F ) decomposition of the image from all three color channels.Finally, they estimate that the addition of color statistics provides considerable improvement in overall detection accuracy.
Krichner et al. [16] proposed a steganalysis method to detect LSB replacement steganography in color images.Also, the authors have enhanced the Weighted Stego (W S) image steganalysis method [17] by replacing the cover predictor in W S with position specific predictors, to detect stego images produced from covers that exhibit traces of Color Filter Array (CF A) interpolation.This technique explains the local predictability of pixels, depending on their position in the (CFA) interpolation to compute the differences between cover images and stego images.The detector exploits only dependencies within a color channel due to color interpolation at cover generation.
Olguin-Garcia et al. [19] have developped a new approach for color image steganalysis depending on Histogram Characteristic Function Center of Mass (HCF CoM ) detecting histogram changes in each R, G,and B channels.The stego images are created by using LSB Matching steganography method.Then, the Probability Density Function (P DF ) is computed to find the adequate threshold, and different threshold values are determined with different payloads.
The most recent and efficient methods in color image steganalysis are explained in detail in the two following sections.

Color Spatial Rich Model steganalysis
As it is well known, embedding a message in an image modifies some pixel values.Indeed, this modification provides slight changes to the pixel values where the message is embedded.It is a difficult task to detect and extract the sensitive features.Many methods apply highpass filters to the target image, and then compute high order statistics on the filtered images.Goljan et al. [9] have introduced efficient color image features which are an extension of the Spatial Rich Model [18], produced from two different sets of features.First of all, this method extracts the noise residual from each color channel separately.Let us note that Xij is a pixel value of an 8-bit grayscale cover image.We can specify the red, green and blue channel of color images by the following formula: where: Many diverse submodels built from the differences between neighboring pixels are combined in the Rich Model, all of the submodels (Rij) ∈ R n 1 ×n 2 are formed from noise residual images of size n1× n2 computed using high pass filters of the following form: where: • q is the quantization step, • round is a function for rounding to an integer value.
The Spatio-Color Rich Model consists of two different components.On one hand, the Spatial Rich Model (SRM Q1) [18] with a fixed quantization q = 1 and truncation T = 2 yields a dimensionality of 12753 features.These features are computed from each R, G and B color channel separately.Finally, the three dimensionality features are added together to keep the same dimensionality as for grayscale images.On the other hand, from the same noise residuals (i.e.SRM Q1), the CRM Q1 builds a collection of 3D color co-occurrence matrices, taking three color values at the same position (across the three channels of each pixel).Thus, with fixed truncation T = 3 and quantization q = 1, CRM Q1 produces 5404 features per image.

CFA-aware features steganalysis
Digital cameras capture color images using a single sensor in conjunction with a Color Filter Array (CF A) interpolation.The CF A allows us to capture only one part of the spectrum though the sensor so that only one color is measured at each pixel (red, blue or green) and so the resulting images are called mosaic images.To construct a color image, a demosaicking algorithm is used in order to interpolate each color plane (i.e.CF A interpolations).Several patterns exist for the color filter array, with the most common being Bayer CF A [20].During this process, the green color channel is the most important factor which determines the luminance of the color image, 50% of the pixels in the Bayer CF A structure are assigned to the green channel, while 25% are assigned to the red channel and 25% to the blue color channel [21].
Goljan et al. introduced in [22] the CFA-aware CRM for color image steganalysis.The features are made from two parts, the first one is the Color Rich Model CRM Q1 explained in section 2.1 with T ∈ {2, 3}.The second part is the CFA-aware feature, which consists of three combinations: RB/GG split, R/B/GG split and N II/IN I split.
Let us note, if X has a true-color image size of n1 × n2, where n1 and n2 are even numbers, (0 ≤ i < n1, 0 ≤ j < n2).Considering a typical Bayer mosaic, the G sub-image has twice as many pixels as the R and B sub-images.We A. N. Other must mention that, all the color images used in this method are cropped from one pixel position which is the upper left pixel corresponding to a non-interpolated blue in the Bayer CF A. The color noise residuals Z=(z First of all, the following four index sets must be generated: Four 3D co-occurrence matrices are computed from residual samples due to the above index sets.
From the above four co-occurrence matrices, three combinations of features are generated to form the total number of features with the CRM Q1 set: The first combination is called RB/GGsplit which generates 4146 features.C (R) (8) R/B/GG split represents the second set and produces 10323 features.This part can be considered as an important component in this method, because it gives a considerable number of features.It can be generated from the concatenation of C (R) The third set corresponds to the N II/IN I split; 'N' meaning non-interpolated and 'I' interpolated respectively, in the RGB triple.The 'NII' pixels correspond to the same set as RB but the two co-occurrence matrices are directionally symmetrized differently.This set generates 5514 features from two co-occurrence matrices: All these features are gathered in a one dimensional vector, while all detectors are trained as binary classifiers implemented using Kodovsky ensemble classifiers [26], as explained in the following Section 4.

FEATURES DESCRIPTION
Our proposition is to enrich the SCRM Q1 with an inter-channel correlation which is composed of three sets of features.The first set, produced by [9], gives 18157 features.The second set, produced by our first method [8], gives 3000 features.Additionally, the third set, produced by a second method, gives 3000 features; they are obtained from the new correlation of different R, G and B channel gradients, as shown in Table I.The following section recalls the RGB Channel Correlations which gives an explanation to our proposition, then section 4 explains the ensemble classifiers used in this approach.

RGB Channel Correlation
In this section, we introduce an inter-channel correlation measure, and demonstrate that it can be linked to first order Euclidean invariants (see Hilbert [23] for the invariant theory).Such invariants have mainly been used for stereo-matching [24].In this paper, we show that the information provided can enhance steganography detection.The underlying idea here, is that if one channel has been affected by steganography, the inter channel correlation will measure the local modifications.
Starting from the local correlation of red and green channels (similar to the correlation of red and blue channels): k+i ,l+j (11) with: • Wi,j, representing a small window centered in (i, j).
Considering (k, l) = (0, 0) and a limited development of and around (i, j), then: Developing this equation leads to four terms.Three of which are constant or not informative, then there is only one informative term : If only one channel has been altered locally, the gradient in this channel is modified.Consequently, the scalar product of two channel gradients reflects the change in the cosine of the difference between the two gradient angles.Similarly, we can apply the same computation for the red and blue channel and then obtain : As stated by Gouet et al. [24] (and following the Hilbert theory [23]), it is unnecessary to investigate the ∇X i,j term, as it is already implicitly contained in the first two expressions (Eq.13 and 14).
Normalizing these expressions, we obtain the cosine of rotation angles, between channel gradients: Fig. 2 illustrates our preprocessing steps [8] to obtain the cosine of rotation angles, between channel gradient.Note that gradients derivatives of each channel are estimated by a convolution with a [-1; 1] mask (horizontal and vertical).

Mirror transformations
In the preceding section, we have seen that the interchannel correlation is linked with the scalar product of gradients (i.e.Euclidean invariants).This means that if we are able to measure the absolute value of a rotation angle between two channel gradients, we still need the direction of the rotation, which is linked this time to Mirror transformations (as illustrated in Fig. 3).
Our proposition is to add two new features sets based on the determinants of channel gradients.Similar to that applied in the recent work of Abdulrahman et al. [8], the features are directly linked to the correlation in order to obtain new features of Sine of the gradients angle.Finally, as illustrated in Fig. 4, we normalize these determinants by gradient norms to obtain the sine of the rotations: with ∇X[0] (resp.∇X [1]) the first (resp.second) component of the vector ∇X i.e. corresponding to the horizontal and the vertical derivatives (see Fig. 4).

Complete feature set
Our features, are computed from C RG , C RB , S RG and S RB correlations by computing the co-occurrence matrices as in the Rich Model [18].We used different values of the quantization q ∈ {0.1, 0.3, 0.5, 0.7, 0.9, 1} with fixed truncation T =1.The reason for using these different values of quantization q is that G RG , G RB , S RG and S RB belong  to [−1, 1].Moreover, the use of these values gives more accurate features and avoids the generation of too many zero values caused by the truncation step in the cooccurrence vector.For each quantization, we obtain 12 submodels from methods 1 [8] and 12 submodels from the new proposed method 2 * .The submodels from the Color Rich Models [9] give 18157 features, those of the method 1 [8] give 3000 features, and those of our proposed method 2 give 3000 features.Accordingly, the final feature vector collects a final set of 24157 features.

THE ENSEMBLE CLASSIFIERS
An ensemble of classifiers [25] is a set of classifiers whose individual decisions are combined and organized into weighted or unweighted votes to classify the data sets (in this work, features represent these data sets, as detailed in the previous sub-section).
Modern steganalysis methods for digital images are based on feature extraction.These methods need machine learning techniques to detect if the media contains hidden messages or not.In our work, we choose ensemble classifiers [26] because of their efficient classification performance for large scale learning.
Kodovsky et al. [26] proposed ensemble classifiers † which is a machine learning tool for steganalysis, * For method 1 (resp.method 2) we use one symmetrized spam14h and one spam14v submodel, with 25 features each.We also use the minmax22h, minmax22v, minmax24, minmax34h, minmax34v, minmax41, minmax34, minmax48h, minmax48v, and minmax54 submodels with 45 features for each.All submodels are gathered in a one dimension vector to erect a dimensionality of (2 × 25 + 10 × 45) × 6 = 3000 features.For more details on submodels construction, the reader is invited to look at article [18].† Ensemble classifier is available at http://dde.binghamton.edu/download/ensemble.consisting of many classifier L independently trained (B l ) designed to keep complexity to a minimum and make the overall process simple.
Each base learner is trained on randomly selected subspaces d sub -dimensionals of the original feature space, from the entire full d-dimension feature space.The authors use Ficher Linear Discriminants (F LD) as base learners and the final decision is made by aggregating the decision of individual base learners.Let d be a full dimensional feature space, N trn and N tst the number of training and testing samples from each class.First, the classifiers construct a number L of F LD base learners (B l ) with l ∈ {1, ..., L}.Each one performs its learning on a subspace of d sub dimension, where d sub << d.From the i th image, a feature vector, fi ∈ R d , is extracted, and then mapped, such as R d → {0, 1}, where 0 stands for cover and 1 for stego.
In the learning phase, each classifier learns to map a feature vector fi, to the correct class number: Each classifier uses the training database to compute the orthogonal vector to the hyperplane separating the two classes.For a test feature, the l th base learner reaches its decision by computing a projection and comparing it to a threshold.After collecting all L decisions, the final classifier selects the class which has received the most votes.Then, the decision threshold of each base learner is adjusted to minimize the total detection error under an equal prior on the training data [26]: where PF A represents the false alarm probability and PMD the missed detection probability.

Experimental setup and protocol
All our features are calculated and formed in a one dimensional vector from 10000 color covers and 10000 color stego images for each payload of steganography methods.These features are ready to enter in the classifier.The classifiers were implemented using the ensemble classifier [26] with many FLD as a base learner.In this paper, the detection accuracy is measured by the total probability of the average of testing errors under equal priors as in Eq. 19.5000 images from a database are randomly chosen for the training sets and 5000 for the testing sets.The ensemble classifiers apply a vote to estimate the error of detection.This process is repeated 10 times to obtain PE, the average of testing errors.PE quantify the detectability and are collected for each method and payload to evaluate the steganalysis method.Given the decision values, ROC curves are obtained.As illustrated in Fig. 8, the area under the ROC curves is calculated as the accuracy of the ensemble classifiers.

Image Dataset
A raw image is a class of computer file containing untouched pixel information coming from the digital camera sensor (i.e. the pure information).These files hold a large amount of meta-information about the image generated by the camera [27].
In our work, the color image database is very carefully built depending on the CF A idea.We collected raw images from two subsets which are the most standard, and have the highest number of images captured (i.e. the Dresden Image Database's [28] 3500 full-resolution Nikon digital camera raw color images and the Break Our Steganographic System (BOSSbase ‡ ), with 1000 Canon digital camera raw color images).
In order to obtain color images in Portable Pixel Map (P P M ) format of size 512×512, all images take the same CF A map layout, as illustrated in Fig. 6.For this process, two steps are required.The first consists of using a demosaicking algorithm to convert raw images into demosaicked images.The second step consists of cropping five areas from one image.Fig. 5 shows sample images produced by the cropping step.
First we used the demosaicking algorithm Patterned Pixel Grouping (PPG) from the dcraw software § to convert raw images into RGB images.As illustrated in Fig. 6, the obtained images are such that the Bayer Pattern is always of the type RGBG (red channel pixel is placed at an even position).We wrote a spatial code to start the crop from the red channel position.Indeed, from one image, this code randomly selected the red channel position and ‡ BOSSbase can be accessed at http://www.agents.cz/boss/BOSSFinal.§ dcraw code is available at http://www.cybercom.net/defin/dcraw.cropped five images using a size of 512×512 pixels, so that all blocks share the same CF A map layout.The final number of images is 10000 RGB color images with a size of 512×512.

Embedding methods
The stego images are obtained using three spatialdomain steganography algorithms.The first method is the Spatial-UNIversal WAvelet Relative Distortion (S-UNIWARD ¶ ) steganography algorithm [29].The second method is the Wavelet Obtained Weights (WOW ) steganography algorithm [30].Finally, the third method is the Synchronizing the Selection Channel (Synch-HILL * * ) steganography algorithm [31].
These algorithms are used to embed messages into color images by decomposing the R, G and B channels as three grayscale images and embedding the same proportion payload into each channel.Also, different tested payload sizes are used {0.01, 0.05, 0.1, 0.2, 0.3, 0.4 and 0.5} Bit Per Channel (BPC).¶ S-UNIWARD steganography method is available at http://dde.binghamton.edu/download/stego_algorithms/.WOW steganography method is available at http://dde.binghamton.edu/download/stego_algorithms/.

Results and Discussion
This section contains the experimental results of our proposed method.We illustrate these results in Table II.S-UNIWARD, WOW and Synch-HILL methods were tested with different relative payloads {0.01, 0.05, 0.1, 0.2, 0.3, 0.4, 0.5} (bpc) against three approaches: method 1 [8], the Color Rich Model [9] and the CFA-aware features steganalysis [22].We used the same set of payload values with the same embedding methods.Our proposed second method, that uses both the sine and cosine of the gradients angle, achieved higher performance by registering 88.76%, 87.93% and 88.07%detection rates for S-UNIWARD, WOW and synch-HILL respectively (with the payload 0.5 bpc).The Color Rich Model method [9] is less efficient because it achieved respectively 86.14%, 85.27% and 85.25% detection.Also, the CFA-aware features method [22] is less efficient because it achieved respectively 87.61%, 87.04% and 87.42% detection rates.Close to the CFA-aware features method, the method of Abdulrahman et al. [8] is less efficient because it achieved respectively 87.54%, 86.63% and 86.77% detection rates.We noted the same trend with the rest of the payload values, as shown in Table II.Additionally, as shown in Table II, the method of Abdulrahman et al. [8], that uses the cosine of the gradients angle, achieved higher performance than Color Rich Model method [9]; by registering 87.54%, 86.63% and 86.77% detection rates for S-UNIWARD, WOW and synch-HILL respectively with the payload 0.5 bpc.For the same payloads range, the Color Rich Model method [9] is less efficient because it achieved respectively 86.14%, 85.27% and 85.25% detection rates on the same test samples.Also, as shown in Table II, our proposed second method, that uses the sine and cosine of the gradients angle, achieved higher performance than CFA-aware features steganalysis method [22]; by registering 88.76%, 87.93% and 88.07%detection rates for S-UNIWARD, WOW and synch-HILL respectively with the payload 0.5 bpc.The CFA-aware features steganalysis method [22] is less efficient because it achieved respectively 87.61%, 87.04% and 87.42% detection rates on the same test samples.
Moreover, curves in Fig. 7 (a) S-UNIWARD, (b) WOW and (c) synch-HILL steganography method also, illustrate the comparison between the proposed second method and the compared methods.As a result, the average testing error of the proposed second method is less than the first proposition, the Color Rich Model and CFA-aware features method.That proves the importance of the additional 3000 features proposed by the second method.
Another experiment involved embedding the entire payload in only one channel of the color image, i.e. with payload 0.2 bpc and 0.4 bpc in the green channel only.In this case, the detection rate becomes higher than the same payload distributed equally between the three color channels.Table III illustrates the comparison of detection rates between the S-UNIWARD, WOW and synch-HILL methods with payloads 0.2 bpc and 0.4 bpc embedded in one channel only and in the three channels separately.Fig. 8 (a), (b) and (c) show the ROC curves, illustrating the performance of our method 2. Finally, this experiment revealed that it is easier to detect a hidden message in only one channel than a message that is spread across all channels.

d 1 d
2 d 3 are treated and added together, the same thing is applied to C (G1) d 1 d 2 d 3 and C (G2) d 1 d 2 d 3 as in Eq.'s 5 and 6.C (RB)

5 DOI: 10 Figure 4 .
Figure 4. Features of extraction: Sine of the gradients angles extracting information from the direction of the local rotation.

7 DOI: 10 Figure 6 .
Figure 6.The preprocessing steps for building our database depending on the CF A idea.

Figure 7 .
Figure 7. Avarage testing error PE as a function of the payload for (a) S-UNIWARD,(b) WOW and (c) WOW steganography methods, comparison between the steganalysis methods (Color Rich Model, CFA-aware features steganalysis, method 1 [8] and proposed method 2).

Table I .
Features description with their dimmensionalities corresponding to q and T .

Table III .
Our proposed method 2 detection rate of S-UNIWARD, WOW and Synch-HILL steganography methods at 0.2 bpc and 0.4 bpc payload embedding in the green channel compares with equal embedding in three channels.
[9]this paper, we have proposed new features for steganalysis of color images.Starting from the Color Rich Model proposed by Goljan et al.[9], we have shown that this method could be greatly enhanced by considering

Table II .
[8]erical values of the average testing error PE and the detection rate P D % for three steganography methods.For easier navigation the dark gray background column presents the first method of Abdulrahman et al.[8]and the light gray background column presents the second proposed method.