Improvement of Information Fusion Based Audio Steganalysis

In the paper we extend an existing information fusion based audio steganalysis approach by three different kinds of evaluations: The first evaluation addresses the so far neglected evaluations on sensor level fusion. Our results show that this fusion removes content dependability while being capable of achieving similar classification rates (especially for the considered global features) if compared to single classifiers on the three exemplarily tested audio data hiding algorithms. The second evaluation enhances the observations on fusion from considering only segmental features to combinations of segmental and global features, with the result of a reduction of the required computational complexity for testing by about two magnitudes while maintaining the same degree of accuracy. The third evaluation tries to build a basis for estimating the plausibility of the introduced steganalysis approach by measuring the sensibility of the models used in supervised classification of steganographic material against typical signal modification operations like de-noising or 128kBit/s MP3 encoding. Our results show that for some of the tested classifiers the probability of false alarms rises dramatically after such modifications. 1. MOTIVATION AND INTRODUCTION Steganalysis, as the technique to detect hidden communication channels in media files or streams, is one of a number of important techniques to establish trust in media data. Like other such techniques (e.g. source identification as in digital camera forensics 21 ) it becomes increasingly a hot topic in environments where a high level of trust in media data is required, such as high security network areas or secure long term archiving. Especially in the latter case an archiving of malware or hidden channels might have yet unforeseeable consequences for the trust in complete digital archives in the future. From previous work applying information fusion in steganalysis it is known that fusion is a good method to improve the performance of a steganalysis approach in practical evaluations in terms of universality (Kharrazi et al. 1 ) or detection performance (Pevny and Fridrich 2 , Kraetzer and Dittmann 3 ), and thereby the overall value of steganalysis as a security mechanism. This paper extends previous considerations from Kraetzer and Dittmann 3 on the application of information fusion in audio steganalysis by following three closely related test goals: A. Completion of the information fusion based audio steganalysis approach presented in Kraetzer and Dittmann 3 by practical observations on sensor level fusion B. Integration of global features into the fusion based steganalysis approach, aiming for more accurate decisions derived in multi-level information fusion C. Verification of the plausibility of the introduced steganalysis approach for two common audio processing operations (MP3 encoding and de-noising) For addressing the first goal, additional/alternative source sensors are implemented in software to accompany the original audio signal. This idea is similar to work by Ru et al. 5 , Ozer 4 et al. and Avcibas 6 , where signal processing operations (de-noising 4,6 and linear predictive coding 5 ) are used to generate an assumably unmarked version of the signal as a reference signal in non-blind steganalysis. Our approach uses the same basic assumption that by signal processing an alternative version of a stego-file can be created where the hidden message can no longer be retrieved. In contradiction to the previous approaches by Ru et al. 5 , Ozer 4 et al. and Avcibas 6 the newly generated alternative signals are not used as reference. Instead we fuse original and alternative signal on sensor level, to generate our alternative source sensor output. The test results achieved here using three exemplarily selected data hiding algorithms show that the content influence is reduced dramatically, while the subsequent classifications show similar classification accuracies. Based on the results we believe that by employing content removing operations in fusion based steganalysis the gap between universality enhancing and application specific approaches might be reduced. For the second test goal of the paper, the feature extractor used in Kraetzer and Dittmann 3 (AAST, the AMSL Audio Steganalysis Toolset) is re-evaluated and enhanced here for the possibilities of generating useful global features for steganalysis. The newly generated global features are then incorporated into the fusion based steganalysis approach and their impact to complexity and classification performance is evaluated, showing that they result in similar classification accuracies while at the same time dramatically reducing the time required for the computation of the classification. For the third goal, the verification of the plausibility of the introduced steganalysis approach, models generated for steganographic algorithms in the training phase of supervised classification are used in testing to classify the output of common (non-malicious) audio signal modifications (de-noising and MP3 compression). This is done to measure the error rates achieved, to show which impact those signal modifications have especially on the false positive rates. Thereby the plausibility of the models used in this steganalysis approach in terms of sensibility against other kinds of signal modifications is verified. The results show, that indeed the risk of false alarms is increased in some cases to 100% by performing non-malicious signal modifications. The rest of this paper is structured as follows: section 2 summarizes the complete test scenario design for test goals A, B and C, including the test setup. Section 3 describes the test results for all three test goals identified above, while section 4 summarizes our work and highlights directions for future work. 2. THE TEST SCENARIO Based on the goals defined for this work, this section summarizes the complete test scenario (consisting of the test design and a description of the test setup).