Results 1 - 10 of 88

Hide and Seek: An Introduction To Steganography

by Niels Provos, et al. , 2003
"... Although people have hidden secrets in plain sight— now called steganography—throughout the ages, the recent growth in computational power and technology has propelled it to the forefront of today’s ..."
Abstract - Cited by 182 (0 self) - Add to MetaCart
Although people have hidden secrets in plain sight— now called steganography—throughout the ages, the recent growth in computational power and technology has propelled it to the forefront of today’s

Detecting Hidden Messages Using Higher-Order Statistical Models

by Hany Farid - IN INTERNATIONAL CONFERENCE ON IMAGE PROCESSING , 2002
"... Techniques for information hiding have become increasingly more sophisticated and widespread. With high-resolution digital images as carriers, detecting hidden messages has become considerably more difficult. This paper describes a new approach to detecting hidden messages in images. The approach u ..."
Abstract - Cited by 118 (7 self) - Add to MetaCart
Techniques for information hiding have become increasingly more sophisticated and widespread. With high-resolution digital images as carriers, detecting hidden messages has become considerably more difficult. This paper describes a new approach to detecting hidden messages in images. The approach uses a wavelet-like decomposition to build higherorder statistical models of natural images. A Fisher linear discriminant analysis is then used to discriminate between untouched and adulterated images.

Detecting hidden messages using higher-order statistics and support vector machines

by Siwei Lyu, Hany Farid - In 5th International Workshop on Information Hiding , 2002
"... www.cs.dartmouth.edu/~{lsw,farid} Abstract. Techniques for information hiding have become increasingly more sophisticated and widespread. With high-resolution digital images as carriers, detecting hidden messages has become considerably more difficult. This paper describes an approach to detecting h ..."
Abstract - Cited by 109 (9 self) - Add to MetaCart
www.cs.dartmouth.edu/~{lsw,farid} Abstract. Techniques for information hiding have become increasingly more sophisticated and widespread. With high-resolution digital images as carriers, detecting hidden messages has become considerably more difficult. This paper describes an approach to detecting hidden messages in images that uses a wavelet-like decomposition to build higher-order statistical models of natural images. Support vector machines are then used to discriminate between untouched and adulterated images. 1
(Show Context)

Feature-based steganalysis for JPEG images and its implications for future design of steganographic schemes

by Jessica Fridrich - in Proc. Inf. Hiding Workshop, Springer LNCS
"... Abstract. In this paper, we introduce a new feature-based steganalytic method for JPEG images and use it as a benchmark for comparing JPEG steganographic algorithms and evaluating their embedding mechanisms. The detection method is a linear classifier trained on feature vectors corresponding to cove ..."
Abstract - Cited by 101 (13 self) - Add to MetaCart
Abstract. In this paper, we introduce a new feature-based steganalytic method for JPEG images and use it as a benchmark for comparing JPEG steganographic algorithms and evaluating their embedding mechanisms. The detection method is a linear classifier trained on feature vectors corresponding to cover and stego images. In contrast to previous blind approaches, the features are calculated as an L 1 norm of the difference between a specific macroscopic functional calculated from the stego image and the same functional obtained from a decompressed, cropped, and recompressed stego image. The functionals are built from marginal and joint statistics of DCT coefficients. Because the features are calculated directly from DCT coefficients, conclusions can be drawn about the impact of embedding modifications on detectability. Three different steganographic paradigms are tested and compared. Experimental results reveal new facts about current steganographic methods for JPEGs and new design principles for more secure JPEG steganography. 1
(Show Context)

Reliability and security in the codeen content distribution network

by Limin Wang, Kyoungsoo Park, Ruoming Pang, Vivek Pai, Larry Peterson - In USENIX Annual Technical Conference, General Track (2004
"... With the advent of large-scale, wide-area networking testbeds, researchers can deploy long-running distributed services that interact with other resources on the Web. The CoDeeN Content Distribution Network, deployed on PlanetLab, uses a network of caching Web proxy servers to intelligently distribu ..."
Abstract - Cited by 94 (16 self) - Add to MetaCart
With the advent of large-scale, wide-area networking testbeds, researchers can deploy long-running distributed services that interact with other resources on the Web. The CoDeeN Content Distribution Network, deployed on PlanetLab, uses a network of caching Web proxy servers to intelligently distribute and cache requests from a potentially large client population. We have been running this system nearly continuously since June 2003, allowing open access from any client in the world. In that time, it has become the most heavily-used long-running service on PlanetLab, handling over four million accesses per day. In this paper, we discuss the design of our system, focusing on the reliability and security mechanisms that have kept the service in operation. Our reliability mechanisms assess node health, preventing failing nodes from disrupting the operation of the overall system. Our security mechanisms protect nodes from being exploited and from being implicated in malicious activities, problems that commonly plague other open proxies. We believe that future services, especially peer-to-peer systems, will require similar mechanisms as more services are deployed on non-dedicated distributed systems, and as their interaction with existing protocols and systems increases. Our experiences with CoDeeN and our data on its availability should serve as an important starting point for designers of future systems. 1
(Show Context)

Higher-Order Wavelet Statistics and their Application to Digital Forensics

by Hany Farid, Siwei Lyu - in IEEE Workshop on Statistical Analysis in Computer Vision , 2003
"... We describe a statistical model for natural images that is built upon a multi-scale wavelet decomposition. The model consists of first- and higher-order statistics that capture certain statistical regularities of natural images. We show how this model can be useful in several digital forensic applic ..."
Abstract - Cited by 81 (9 self) - Add to MetaCart
We describe a statistical model for natural images that is built upon a multi-scale wavelet decomposition. The model consists of first- and higher-order statistics that capture certain statistical regularities of natural images. We show how this model can be useful in several digital forensic applications, specifically in detecting various types of digital tampering.
(Show Context)

Steganalysis of JPEG Images: Breaking the F5 Algorithm

by Jessica Fridrich, Miroslav Goljan, Dorin Hogea - in 5th International Workshop on Information Hiding , 2002
"... Abstract. In this paper, we present a steganalytic method that can reliably detect messages (and estimate their size) hidden in JPEG images using the steganographic algorithm F5. The key element of the method is estimation of the cover-image histogram from the stego-image. This is done by decompress ..."
Abstract - Cited by 77 (5 self) - Add to MetaCart
Abstract. In this paper, we present a steganalytic method that can reliably detect messages (and estimate their size) hidden in JPEG images using the steganographic algorithm F5. The key element of the method is estimation of the cover-image histogram from the stego-image. This is done by decompressing the stego-image, cropping it by four pixels in both directions to remove the quantization in the frequency domain, and recompressing it using the same quality factor as the stego-image. The number of relative changes introduced by F5 is determined using the least square fit by comparing the estimated histograms of selected DCT coefficients with those of the stegoimage. Experimental results indicate that relative modifications as small as 10% of the usable DCT coefficients can be reliably detected. The method is tested on a diverse set of test images that include both raw and processed images in the JPEG and BMP formats. 1 Overview of Steganography and Steganalysis Steganography is the art of invisible communication. Its purpose is to hide the very
(Show Context)

Steganalysis using higher-order image statistics

by Siwei Lyu, Hany Farid - IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY , 2006
"... Techniques for information hiding (steganography) are becoming increasingly more sophisticated and widespread. With high-resolution digital images as carriers, detecting hidden messages is also becoming considerably more difficult. We describe a universal approach to steganalysis for detecting the p ..."
Abstract - Cited by 65 (2 self) - Add to MetaCart
Techniques for information hiding (steganography) are becoming increasingly more sophisticated and widespread. With high-resolution digital images as carriers, detecting hidden messages is also becoming considerably more difficult. We describe a universal approach to steganalysis for detecting the presence of hidden messages embedded within digital images. We show that, within multi-scale, multi-orientation image decompositions (e.g., wavelets), first- and higher-order magnitude and phase statistics are relatively consistent across a broad range of images, but are disturbed by the presence of embedded hidden messages. We show the efficacy of our approach on a large collection of images, and on eight different steganographic embedding algorithms.

Eliminating steganography in Internet traffic with active wardens

by Gina Fisk, Mike Fisk, Christos Papadopoulos, Josh Neil - in IH ’02: Revised Papers from the 5th International Workshop on Information Hiding , 2002
"... Abstract. Active wardens have been an area of postulation in the community for nearly two decades, but to date there have been no published implementations that can be used to stop steganography as it transits networks. In this paper we examine the techniques and challenges of a high-bandwidth, unat ..."
Abstract - Cited by 59 (0 self) - Add to MetaCart
Abstract. Active wardens have been an area of postulation in the community for nearly two decades, but to date there have been no published implementations that can be used to stop steganography as it transits networks. In this paper we examine the techniques and challenges of a high-bandwidth, unattended, real-time, active warden in the context of a network firewall. In particular, we concentrate on structured carriers with objectively defined semantics, such as the TCP/IP protocol suite rather than on the subjective, or unstructured carriers such as images that dominate the information hiding literature. We introduce the concept of Minimal Requisite Fidelity (MRF) as a measure of the degree of signal fidelity that is both acceptable to end users and destructive to covert communications. For unstructured carriers, which lack objective semantics, wardens can use techniques such as adding noise to block subliminal information. However, these techniques can break the overt communications of structured carriers which have strict semantics. We therefore use a specification-based approach to determine MRF. We use MRF to reason about opportunities for embedding covert or subliminal information in network protocols and develop both software to exploit these channels, as well as an active warden implementation that stops them. For unstructured carriers, MRF is limited by human perception, but for structured carriers, well known semantics give us high assurance that a warden can completely eliminate certain subliminal or covert channels. 1

Traffic aggregation for malware detection

by Ting-fang Yen, Michael K. Reiter , 2008
"... Stealthy malware, such as botnets and spyware, are hard to detect because their activities are subtle and do not disrupt the network, in contrast to DoS attacks and aggressive worms. Stealthy malware, however, does communicate to exfiltrate data to the attacker, to receive the attacker’s commands, ..."
Abstract - Cited by 55 (4 self) - Add to MetaCart
Stealthy malware, such as botnets and spyware, are hard to detect because their activities are subtle and do not disrupt the network, in contrast to DoS attacks and aggressive worms. Stealthy malware, however, does communicate to exfiltrate data to the attacker, to receive the attacker’s commands, or to carry out those commands. Moreover, since malware rarely infiltrates only a single host in a large enterprise, these communications should emerge from multiple hosts within coarse temporal proximity to one another. In this paper, we describe a system called TĀMD (pronounced “tamed”) with which an enterprise can identify candidate groups of infected computers within its network. TĀMD accomplishes this by finding new communication “aggregates ” involving multiple internal hosts, i.e., communication flows that share common characteristics. We describe characteristics for defining aggregates—including flows that communicate with the same external network, that share similar payload, and/or that involve internal hosts with similar software platforms—and justify their use in finding infected hosts. We also detail efficient algorithms employed by TĀMD for identifying such aggregates, and demonstrate a particular configuration of TĀMD that identifies new infections for multiple bot and spyware examples, within traces of traffic recorded at the edge of a university network. This is achieved even when the number of infected hosts comprise only about 0.0097 % of all internal hosts in the network.
(Show Context)