Cross-view image geo-localization (CVGL) is typically cast as cross-view retrieval, which matches a query image (e.g., a drone view) to its geo-tagged overhead counterpart in a large satellite image database. Supervised CVGL methods rely on large-scale paired annotations, resulting in high labeling cost and limited cross-domain generalization. Recent unsupervised cross-view geo-localization (UCVGL) approaches mine pseudo supervision via clustering or pseudo-sample generation, but viewpoint discrepancy often introduces noisy pseudo-labels in early training and makes it difficult to balance pseudo-label precision and coverage. To address these challenges, we propose a Progressive High-Confidence Pseudo-Labeling (PHPL) method. PHPL first generates high-confidence initial pseudo-labels through re-ranking-enhanced density clustering and cross-view label propagation, providing reliable cold-start supervision. Subsequently, a dynamic-margin mutual-matching mechanism adaptively relaxes the selection constraints as training progresses, progressively mining additional positive pairs to achieve a dynamic equilibrium between pseudo-label precision and coverage. Experiments demonstrate that, without relying on any annotations, our method generates pseudo-labels with 98.70% coverage and 100% precision on the University-1652 dataset. On both University-1652 and SUES-200 benchmarks, PHPL achieves superior retrieval performance compared to most existing unsupervised methods and approaches the performance of supervised counterparts.

Traditional pedestrian trajectory prediction models focus on spatio–temporal data without proper consideration of individual interactions with the environment, mutual interactions, and contextual information, resulting in low prediction performance in real applications. In this article, we propose a new pedestrian trajectory prediction model called spatial social force graph neural network (SSF-GNN). First, SSF-GNN adopts a gate recurrent unit (GRU) network and a CenterNet network to capture pedestrian trajectory features and environmental features from historical trajectory sequences. Particularly, SSF-GNN can quantify pedestrian interactions and context-awareness information based on social force. Second, SSF-GNN employs a graph neural network to integrate social influence and hidden states of pedestrians. The distance between adjacent trajectory points is approximated by the weighted average summation of pedestrian historical trajectories. Third, SSF-GNN employs a new interaction function between pedestrians by considering the distance between pedestrians, as well as the movement speed of pedestrians in the social force model, to accurately predict trajectories of pedestrians. Extensive experiments are conducted on two famous datasets, and the results demonstrate SSF-GNN’s outperforms the state-of-the-art models, where average displacement error (ADE) is reduced by more than 25.6%, and final displacement error (FDE) is reduced by more than 15.4%. When predicting a pedestrian’s trajectory in the next eight frames of locations, SSF-GNN outperforms other models significantly with an accuracy of 69.71%.

Current Android apps rely heavily on external storage. When using the external storage, apps apply different security strategies (e.g., randomizing file name, encrypting file content) to prevent privacy risks. Even so, we find that privacy risks still exist, i.e., information leakage of apps' file operations. Users follow their habits to run apps and some of the apps conduct file operations on external storage, which potentially expose users' regular activities. In this paper, we conduct the first empirical study on this problem and implement a file-operation-based pipeline, OP-PERUSE. Besides a dataset of 5,359,339 file operation events collected from the volunteers, we crawl 22,484 app records from the third-party app statistics websites. By combining these data, we get some timely and fine-grained information about the users, e.g., current affiliation, position, habits, etc. To further understand this problem's severity, we conduct a static code analysis on 15,098 apps. We find that 1,305 (8.64%) apps tend to collect file operation events, and more than half of these apps adopt the third-party SDKs which gather file operation events, indicating this problem could have persisted over a long period of time. To prevent this problem, we provide some security recommendations for different stakeholders.

Steganography is a technique for embedding secret messages into digital media while preserving perceptual integrity and avoiding detection. Robust steganography specifically enables secure communication through lossy channels with disturbances, where a critical challenge lies in the receiver's ability to accurately reconstruct hidden messages from corrupted stego data-a process termed error-correction. Recent advancements in stego coding schemes for robust steganography leverage probabilistic decoding to enhance message error-correction accuracy. These schemes employ Maximum-A-Posteriori (MAP) decoders that integrate channel knowledge, i.e. the probability distribution of stego symbols derived from received data, thus necessitating precise estimation of such channel knowledge. While existing approach for Channel Knowledge Estimation (CKE) relies on heuristic, handcrafted methods grounded in empirical assumptions, its effectiveness is limited by the inherent complexity of media content and the diversity of channel disturbance. Besides, it is not compatible with some of the embedding method for robust steganography. To address these limitations, we propose a deep learning-based framework for universal channel knowledge estimation, which significantly improves error-correction performance. Furthermore, we extend this framework to multi-channels robust steganography scenarios, formulating a novel multi-channels knowledge estimation paradigm to enhance message correctness through transmission in multiple channels. Experimental results on various state-of-the-art robust steganography methods demonstrate that our approach outperforms existing CKE methods and coding schemes.

Various malicious activities performed by the social bots have brought a crisis of trust to the online social networks. In this paper, we propose a social bot detection method, named Accou2vec, based on community walk. First, in order to cut off the attacking edges between the human and bot accounts, the deep autoencoder-like non-negative matrix factorization community detection algorithm is leveraged to divide the social graph into multiple subgraphs. Then, we design the community walk rule that controls the intra-community walk and inter-community walk differently, considering both the number of nodes and edges in the community. Subsequently, the graph representation learning is used to learn the representation vector of each account. Finally, the representation vectors of labeled social bots and human accounts are used to train the classifier for social bots detection. Extensive experimental results on two real-world datasets show the superior performance of the proposed method over the state-of-the-art.

Cross-view image geo-localization predicts the geographic location of a ground-view image by referencing geotagged satellite images. Existing methods commonly use a triplet loss function, which cannot fully exploit the large number of negative samples. While the InfoNCE loss can leverage multiple negative samples within a batch, it treats positive and negative samples equally, failing to emphasize the importance of positive samples. Additionally, when computing feature similarity, current methods consider only a single dimension, making it difficult to effectively mine hard negative samples with high similarity. To address these issues, this paper proposes a cross-view image geo-localization method based on weighted InfoNCE and multi-dimensional similarity measurement. In the InfoNCE, we assign an appropriate weight to the similarity score of positive samples, increasing their significance within the batch and guiding the model to learn the features of positive samples more effectively. During training, to better mine hard negative samples, we introduce a multi-dimensional similarity measurement method that integrates cosine similarity, Euclidean distance, and Manhattan distance, enabling a more comprehensive assessment of image similarity. Furthermore, we employ a weighted asymmetric bidirectional loss strategy to utilize the loss from both information streams. Experimental results demonstrate that our method achieves superior performance across multiple metrics on the CVUSA and CVACT datasets. Ablation studies further validate the effectiveness of the weighted InfoNCE, the bidirectional asymmetric loss strategy, and the multi-dimensional similarity measurement approach.

In multimedia social networks, the user's geo-location can be inferred by matching his shared images with the referenced satellite images, viz. cross-view image geo-localization. Although the existing most cross-view image geo-localization methods perform well in the center-misaligned scenario, in practical application, the shooting location of the query ground image is most likely not aligned with the center point of satellite images. Then, their geo-localization accuracy would drastically decrease. Therefore, we propose a novel cross-view image geo-localization model based on ground-to-satellite (G2S) transform, named CIG2S. First, the queried ground image is transformed into the aerial-view by spherical transform, generating G2S images, which could improve the similarity between ground and satellite images. Second, multiscale features are extracted from the original ground image, G2S images, and satellite images by twins-PCPVT. Furthermore, a dynamic similarity weighted loss function is designed to measure the distance between the query ground image and the referenced satellite image. Experimental results on three center-misaligned datasets, including VIGOR and the center-misaligned versions of CVUSA and CVACT, demonstrate that the proposed CIG2S model can significantly improve the geo-localization accuracy. For example, when compared with another vision-transformer-based model L2LTR-polar, CIG2S can outperform about 6.6% and 15.8% in the center-misaligned datasets CVUSA_CM and CVACT_CM.

The steganography detection method based on deep learning fuse feature extraction and classification into one model, which reduces the human intervention in feature extraction and obtains a higher detection accuracy than the traditional steganography detection method based on manual feature extraction. However, many existing steganography detection methods based on deep learning generally need to increase the depth and width of the model to further improve the detection accuracy, but it also brings the increase of parameters and Flops (FLoating point OPerations) of the model, resulting in a large consumption of computing resources. Therefore, this manuscript proposes a Convolutional Neural Network(CNN) steganography detection method based on ShuffleBottleneck and Attention mechanism (referred to as ShuffleBANet method, ShuffleBottleneck-Attention-Network Based Method). First, to enhance the network's recognition ability for steganography signals, high-pass filters are used to enhance the steganography feature signals and combined with the improved ShuffleBottleneck structure to enrich the residual features and improve the expression ability of features. Then, a large convolution kernel is used to increase the convolution field of view, and the channel attention mechanism SE (Squeeze and Excitation) and the spatial attention mechanism CA(CoordAttention) are used to capture the residual features between channels and the location information of steganography signals, respectively. Combined with the siamese network framework, the feature extraction backbone is constructed. Finally, the features of the backbone are fused to increase the diversity of features, cover features and stego features are classified using the Softmax function. In this manuscript, BossBase-1.01, BOWS2 and ALASKA#2 datasets are used as cover images, the classical and latest steganalysis methods are used to conduct extensive experiments on the stego images generated by both spatial domain and JPEG domain adaptive steganography algorithms. The experimental results show that compared with the latest SiaStegNet method and the classical SRNet method, the detection efficiency of the proposed method is significantly improved, and the number of parameters and Flops has been reduced by 7.04% / 76.23% and 70.92% / 84.49%, respectively, which provides a solution for the lightweight steganography detection model based on deep learning.

Website fingerprinting (WF) attacks can reveal the users' online privacy by the traffic analysis technique, even with the protection of the Tor anonymity network. Recent WF attacks tend to leverage the deep learning (DL) models, which require a large number of traffic samples for training. In this case, it is impractical for low-resource adversaries in reality. Thus, we propose a lightweight WF attack to tackle this challenge, i.e., Deep Quadruplet Fingerprinting (DQF), which only needs one training sample to obtain an accuracy of 87.1%. Regarding the overall design, DQF first combines the metric learning and meta-learning schemes. To improve the generalization ability of the trained model, DQF leverages the quadruplet networks as the architecture and modifies the quadruplet loss function. Besides, by taking the deep local fingerprinting features (DLFFs), DQF avoids losing a lot of discriminative information, which is a problem with previous attacks. To evaluate DQF, we use multiple typical datasets and conduct 11 different experiments. In closed-world settings, the accuracy of DQF can exceed the best baseline attack by 10%. In open-world settings, DQF steadily performs the best even in the most challenging scenario, namely, 1-shot learning, where previous attacks significantly degrade the performance or even fail.

Cross-view image geo-localization is a technique to determine the geographic location of the query image by matching it with geo-tagged aerial images. However, when the query image is captured at nighttime, the existing methods could not extract geographic-related information from low and uneven illumination areas effectively, thus geo-localizing the nighttime ground image with poor performance. In this work, we propose a cross-view and cross-day-night image geo-localization method (CCIGeo), which contains three branches, taking the query nighttime ground image, the supervision daytime ground image, and the reference satellite image as inputs, respectively. Inspired by knowledge distillation, the proposed method takes daytime ground image branch as the teacher model, which would supervise the nighttime ground image branch to overcome the interference of the uneven and low illumination, and pay more attention to the areas containing rich geographic-related information. And to better adapt to the cross-day-night environment, a dual-constraint loss function is designed inspired by the concept of knowledge distillation. Extensive experimental results show that CCIGeo significantly improves the performance on nighttime image geo-localization, exceeding the state-of-the-art (SOTA) methods by 1.83%, 3.84%, and 1.64% on three datasets.

Various malicious activities performed by social bots have brought a crisis of trust to online social networks. Existing social bot detection methods often overlook the significance of community structure features and effective fusion strategies for multimodal features. To counter these limitations, we propose BotCF, a novel social bot detection method that incorporates community features and utilizes cross-attention fusion for multimodal features. In BotCF, we extract community features using a community division algorithm based on deep autoencoder-like non-negative matrix factorization. These features capture the social interactions and relationships within the network, providing valuable insights for bot detection. Furthermore, we employ cross-attention fusion to integrate the features of the account’s semantic content, properties, and community structure. This fusion strategy allows the model to learn the interdependencies between different modalities, leading to a more comprehensive representation of each account. Extensive experiments conducted on three publicly available benchmark datasets (Twibot20, Twibot22, and Cresci-2015) demonstrate the effectiveness of BotCF. Compared to state-of-the-art social bot detection models, BotCF achieves significant improvements in accuracy, with an average increase of 1.86%, 1.67%, and 0.47% on the respective datasets. The detection accuracy is boosted to 86.53%, 81.33%, and 98.21%, respectively.

Nowadays, in Android ecosystem, to bypass current malware detections, adversaries often distribute the malicious and sensitive functions into different apps. These apps collude to conduct some malicious activities, such as illegally collecting the user’s sensitive data. To further understand the harm of app collusion, we conduct a real-world study. Besides the simple collusion case with two apps, which has been well studied, there are also some complicated collusion cases that have seldom been studied but would greatly endanger users’ privacy. These cases can be categorized into N-to-1 collusion, 1-to-N collusion, and chain-based collusion. To deal with such complicated collusion attacks and detect the hidden partners, a detection framework CSCdroid was proposed. CSCdroid obtains sensitive data flow and static features such as ICC (Inter-Component Communication) channels in apps through static analysis. Then it detects potential collusion apps by data flow linking. To show the effectiveness of CSCdroid, we apply it to the app dataset provided by DroidBench, and its F1 score can reach 0.91, which is better than the current existing work Amandroid and DIALDroid. We conduct experiments on a real-world app dataset (4,100 apps) with CSCdroid, and results show that 73 apps leak the user’s sensitive data. Some of the 73 apps present complex collusion scenarios with other apps. These complex collusion scenarios can result in the aggregation of sensitive information within an app, posing a significant threat to user privacy.

The widespread usage of user alignment technology raises a number of security and privacy concerns. This study suggests cross-platform network user alignment interference methods based on obfuscation strategy to mitigate the risk of significant protection of user social identity, which is easily mined jointly, for the cross-platform network user alignment algorithm based on social relationship.In order to decrease the accuracy of the classical algorithm for cross-platform alignment and safeguard user privacy, this paper suggests three interference methods based on obfuscation strategy: virtual user deployment strategy, virtual connection deployment strategy, and connection deletion strategy. These methods lower the risk of co-mining significant protected users’ social identities by deploying virtual users, deploying virtual connection relations, and deleting connection relations.This research identifies interference efficiency as appropriate evaluation metric. It is tested on Domain-adversarial Network Alignment and User Identity Linking Algorithm Based on Graph Auto-Encoders using the Foursquare-Twitter social network dataset. When five virtual nodes are added, the virtual user deployment strategy achieves up to 84% interference efficiency; when five similar nodes are added, the virtual connection deployment strategy achieves up to 82% interference efficiency; and when 90% of the target node’s connections are deleted, the connection deletion strategy achieves 80% interference efficiency. All three options offer effective means of protecting user privacy. In the process of actual implementation, it is vital to select the best technique based on the particular situation.

Cross-view image geo-localization is a technique that matches a query ground image with a geo-tagged satellite image. Due to the difference between ground and satellite views, the sky area frequently existing in the ground images is not possible to appear in the satellite images, which would interfere with the cross-view image matching. In this work, we argue that the sky area in the ground images would distract the feature and consequently reduce the accuracy of geo-localization. Therefore, we propose a four-branch framework to reduce the interference of sky area in cross-view image geo-localization (4SCIG), with two ground branches and two satellite branches. In two ground branches, the sky area in the ground image will be removed using two strategies. Meanwhile, in the two satellite branches, the satellite image would be aligned to ground-view by polar and projective transforms. Then, two sky-cropped ground images and two transformed satellite images will be input into the backbones of four branches, respectively. Finally, we design a multiple constraint loss (MCL) to optimize the four-branch framework. Extensive experiments on two standard datasets CVUSA and CVACT demonstrate that the proposed 4SCIG can significantly boost the geo-localization accuracy of previous methods.

Malicious traffic detection is a pivotal component in ensuring network security. Currently, deep learning-based malicious traffic detection methods have become mainstream. However, these studies lack comprehensive attention to the structural features of traffic and the time delay information between data packets. To address these issues, we propose a new malicious traffic detection model MTD-RTPE, which is built upon relative time-delay positional encoding and multi-head self-attention mechanisms. By analyzing the hierarchical structure of traffic, we integrated certain natural language processing (NLP) techniques into our method. We designed a relative time-delay positional encoding module to embed the relative time delay information between traffic data packets into the positional encoding. Leveraging multi-head self-attention, we extracted spatio-temporal features, which significantly enhanced our model’s ability to detect malicious traffic and improved its generalization capability. Based on experiments conducted on the USTC-TFC2016, CTU-Malware&Normal, and ISOT public datasets, the proposed model demonstrates commendable performance in terms of accuracy and handling imbalanced dataset testing.

The autoregressive-based model with the left-to-right generation order has been a predominant paradigm for generative linguistic steganography. However, such steganography does not perform well on semantic control and content planning, which is forced by the secret message during the generation process. To mitigate this issue and efficiently produce high-quality steganographic texts (stegotexts), we present aProgressiveNon-autoregressiveGenerative linguisticSteganography (PNG-Stega), which encodes secret messages and extends the context to generate stegotexts in a multi-round insertion manner. Each round continuously refines the generated steganographic sequences on the premise of the global information of the previous round, while striving to decline the adverse effects of steganographic encoding on text quality. Moreover, for enhancing the semantic internal dependency of stegotexts, we utilize a constraint word sequences extraction scheme to obtain keywords to initialize the skeleton of targeted stegotexts, then expand the existing keywords with insertion operations. Experimental results demonstrate that PNG-Stega outperforms compared methods in terms of imperceptibility and anti-steganalysis ability. In particular, PNG-Stega provides high information hiding efficiency, even exceeding the autoregressive methods by around 2 times.

Traditional steganography methods are usually designed on a lossless channel; thus, messages are often not extracted correctly from an image transmitted over a lossy channel that includes attacks such as scaling. To address this issue, in recent years, the field of robust steganography has emerged. In this paper, the process of image scaling by interpolation is first observed and serves as the basis for proposing the idea of inverse interpolation. Subsequently, the idea of constructing an inverse interpolation equation set is proposed to solve the problem of intersectional blocks during the inverse interpolation process. Then, the scaling factor’s valid range of inverse interpolation is analyzed. Next, the inverse interpolation is successfully applied in robust image steganography. A method that combines antiscaling and antidetection is proposed. Afterward, actual tests on the top 9 mobile phone brands with 28 models and 2 social communication apps that are currently popular in China are done. The scaling factor’s valid range of the proposed method is verified to match the actual lossy channel. The experimental results show that the proposed method achieves a reliable extraction of embedded messages for common interpolation scaling attacks while maintaining high statistical detection resistance.

Currently, the popular Rich Model steganalysis features usually contain a large number of redundant feature components which may bring “curse of dimensionality” and large computation cost, but the existing feature selection methods are difficult to effectively reduce the dimensionality when there are many strongly correlated effective feature components. This paper proposes a novel selection method for Rich Model steganalysis features. First, the separability of each feature component in the submodels of Rich Model is measured based on the Fisher criterion, and the feature components are sorted in the descending order based on the separability. Second, the correlation coefficient between any two feature components in each submodel is calculated, and feature selection is performed according to the Fisher value of each component and the correlation coefficients. Finally, the selected submodels are combined as the final steganalysis feature. The results show that the proposed feature selection method can effectively reduce the dimensionalities of JPEG domain and spatial domain Rich Model steganalysis features without affecting the detection accuracies.

Cloud services have become an increasingly popular solution to provide different services to clients. More and more data are outsourced to the cloud for storage and computing. With this comes concern about the security of outsourced data. In recent years, homomorphic encryption, blockchain, steganography, and other technologies have been applied to the security and forensics of outsourced data. While encryption technologies such as homomorphic encryption and blockchain scramble data so that they cannot be understood, steganography hides the data so that they cannot be observed. Traditional steganography assumes that the environment is lossless. Robust steganography is grounded in traditional steganography and is proposed based on a real lossy social network environment. Thus, researchers, who study robust steganography, believe that the measurement should follow traditional steganography. However, the application scenario of robust steganography breaks through the traditional default lossless environment premise. It brings about changes in the focus of steganography algorithms. Simultaneously, the existing steganography methods miss the evaluation of applicability and ease of use. In this paper, “default parameters” are observed by comparing the process of robust image steganography with traditional image steganography. The idea of “perfecting default parameters” is proposed. Based on this, the attribute set of measuring robust image steganography is presented. We call it PRUDA (Payload, Robustness, ease of Use, antiDetection, and Applicability). PRUDA perfects default parameters observed in the process of traditional steganography algorithms. Statistics on image processing attacks in mobile social apps and analyses on existing algorithms have verified that PRUDA is reasonable and can better measure a robust steganography method in practical application scenarios.

With the dimension of steganalysis feature increases rapidly, ensemble steganalysis has become the trend, and its performance is greatly influenced by the selection of feature subspaces. In order to select feature subspaces more effectively to improve the performance of ensemble steganalysis, a feature subspace selection algorithm based on Fisher criterion is proposed. The proposed selection algorithm computes weight for each feature component according to its Fisher criterion value and a base probability value, then selects the feature components with the probabilities in proportion to their weights. When it is used to improve the ensemble steganalysis, the appropriate base probability value is searched by steps. Experimental results show that for J-UNIWARD (JPEG UNIversal WAvelet Relative Distortion) steganography, the proposed feature subspace selection algorithm can select more effective feature subspaces, and enhance the detection performance of GFR (Gabor Filter Residual) feature.

Abstract Current typical adaptive steganography algorithms take the detection resistant capability into account adequately but usually cannot extract the embedded secret messages correctly when stego images suffer from compression attack. In order to solve this problem, a framework of adaptive steganography resisting JPEG compression and detection is proposed. Utilizing the relationship between Discrete Cosine Transformation (DCT) coefficients, the domain of messages embedding is determined; for the maximum of the JPEG compression resistant ability, the modifying magnitude of different DCT coefficients caused by messages embedding can be determined; in order to ensure the completely correct extraction of embedded messages after JPEG compression, error correct codes are used to encode the messages to be embedded; on the basis of the current distortion functions, the distortion value of DCT coefficients corresponding to the modifying magnitude in the embedding domain can be calculated; to improve the detection resistant ability of the stego images and realize the minimum distortion embedding, syndrome‐trellis codes are used to embed the encoded messages into the DCT coefficients that have a smaller distortion value. Based on the proposed framework, an adaptive steganography algorithm resisting JPEG compression and detection is designed, which utilizes the relationship between coefficients in a DCT block and the means of that in three adjacent DCT blocks. The experimental results that demonstrate the proposed algorithm not only has a good JPEG compression resistant ability but also has a strong detection resistant performance. Comparing with current J‐UNIWARD steganography under quality factor 85 of JPEG compression, the extraction error rates without pre‐compression decrease from about 50% to nearly 0, while the stego images remain a good detection resistant ability comparing with a typical robust watermarking algorithm, which shows the validity of the proposed framework. Copyright © 2016 John Wiley & Sons, Ltd.

Current typical adaptive Steganography algorithms cannot extract the embedded secret messages correctly after compression. In order to solve this problem, a JPEG-compression resistant adaptive steganography algorithm is proposed. Utilizing the relationship between DCT coefficients, the domain of messages embedding is determined. The modifying magnitude of different DCT coefficients can be determined according to the quality factors of JPEG compression. To ensure the completely correct extraction of embedded messages after JPEG compression, the RS codes is used to encode the messages to be embedded. Besides, based on the current energy function in the PQe steganography and the distortion function in J-UNIWARD Steganography, the corresponding distortion value of DCT coefficients is calculated. With the help of that, STCs is used to embed the encoded messages into the DCT coefficients, which have a smaller distortion value. The experimental results under different quality factors of JPEG compression and different payloads demonstrate that the proposed algorithm not only has a high correct rate of extracted messages after JPEG compression, which increases from about 60% to nearly 100% comparing with J-UNIWARD steganography under quality factor 75 of JPEG compression, but also has a strong detection resistant performance.

Adaptive JPEG steganographic schemes are difficult to preserve the image texture features in all scales and orientations when the embedding changes are constrained to the complicated texture regions, then a steganalysis feature extraction method is proposed based on 2 dimensional (2D) Gabor filters. The 2D Gabor filters have certain optimal joint localization properties in the spatial domain and in the spatial frequency domain. They can describe the image texture features from different scales and orientations, therefore the changes of image statistical characteristics caused by steganography embedding can be captured more effectively. For the proposed feature extraction method, the decompressed JPEG image is filtered by 2D Gabor filters with different scales and orientations firstly. Then, the histogram features are extracted from all the filtered images.Lastly, the ensemble classifier is used to assemble the proposed steganalysis feature as well as the final steganalyzer. The experimental results show that the proposed steganalysis feature can achieve a competitive performance by comparing with the other steganalysis features when they are used for the detection performance of adaptive JPEG steganography such as UED, JUNIWARD and SI-UNIWARD.

For analyzing the multiple least-significant bits (MLSB) steganography, a pixel group trace model is presented. Based on this model and some statistical characteristics of images, two quantitative steganalysis methods are proposed for two typical MLSB steganography paradigms. The pixel group trace model simulates the MLSB embedding by exclusive or operation, and traces the transition relationship among the possible structures of the pixel group's value by some trace pixel group subsets. Then, the estimation equations of embedding ratio are derived from the transition probability matrix among trace subsets and the symmetry of regular and singular pixel group sets. Finally, a series of experimental results for the case of triple pixel group show that the proposed steganalysis methods can estimate the low embedding ratio with smaller error, especially, for some cases, the interquartile range of the estimation errors is smaller than the best one of the others by more than 45%.

Steganalysis is the reasonable method to detect whether the transmitted media content contains secret messages (e.g. business secrecy). This paper proposes two steganalysis methods to estimate the modification ratio of F5 steganography and its improved version that are popularly used to hide secrecy in images. The proposed methods measure the distance between the coefficient histogram of a given image and that of an estimated stego image. The distance is measured based on relative entropy that has the superiority of measuring the distance between two distributions. The estimated modification ratio can be used to distinguish the stego images marked by F5 steganography or its improved version from the original images. Experimental results are given to show that the proposed methods outperform the existing quantitative steganalysis methods against F5 steganography and its improved version.

For hiding messages into multiple least significant bit (MLSB) planes, a new weighted stego-image (WS)\ steganalysis method is proposed to estimate the ratio of messages hidden into each bit plane. First, a new WS with multiple weights is constructed, and it is proved that when the squared Euclidean distance between the WS and the cover image is minimal, the weight parameters are equal to the embedding ratios in MLSB planes. Afterward, based on this result and an estimation of cover image, a simple estimation equation is derived to estimate the embedding ratio in each bit plane. Experimental results show that the new steganalysis method performs more stably with the change of embedding ratios than typical structural steganalysis, and outperforms the typical structural steganalysis method on the estimation accuracy when the embedding ratio in any bit plane is larger than 0.4.

Multimedia content is a suitable carrier for secret communication. This paper focuses on the steganalysis technique which aims to get the forensic of secrecy existing in multimedia carriers. A key concern for designing a blind steganalysis algorithm is the selection of statistic features. The Probability Density Function (PDF) moment and Characteristic Function (CF) moment are two typical kinds of statistic features commonly used in blind steganalysis. And generally, the features are computed from the subbands of transform domains, such as the wavelet coefficient subbands, the prediction subbands of wavelet coefficients, the prediction error subbands of wavelet coefficients, the wavelet coefficient subbands of image noise, and the log prediction error subbands of wavelet coefficients. To decide which feature is more sensitive to message embedding and useful for steganalysis is important and urgent. Till now, few works have focused on this topic, and they can only give some experimental results without theoretical analysis. Additionally, few frequency subbands have been investigated. To solve this problem, this paper reviews existing feature computing algorithms, compares the two kinds of features, the PDF moments and the CF moments, by analyzing the change trends of the statistic distribution parameters of various frequency subbands before and after message embedding, and so that provides a theoretical basis for the steganalysis feature selection and extraction. These theoretical results are further confirmed by experimental results. This is the first work to provide thorough theoretical analysis on so many feature computing algorithms. It is expected to provide valuable information to researchers or engineers working in the field of steganography forensics or steganalysis.

A new compressed video secure steganography (CVSS) algorithm is proposed. In the algorithm, embedding and detection operations are both executed entirely in the compressed domain, with no need for the decompression process. The new criteria employing statistical invisibility of contiguous frames is used to adjust the embedding strategy and capacity, which increases the security of proposed algorithm. Therefore, the collusion resistant properties are obtained. Video steganalysis with closed loop feedback manner is design as a checker to find out obvious bugs. Experimental results showed this scheme can be applied on compressed video steganography with high security properties.

Abstract stage‐wise steganalysis system that utilizes the collusion scheme among sucessive video frames is proposed. The effect of local motion interfering detection precision is studied. The local motion and message embedded in video frame is treated as a bimodal noise. To detect the existence of the embedded message, blockwise correlation‐based feature extraction scheme is proposed to reduce the local motion interfering effect. The video steganalysis process is divided into two stages. In the first stage, suspicious video frames will be recognized by decision module employing features extracted with a light‐weight collusion scheme, for the real‐time requirement. In the second stage, suspicious frames will be analyzed critically by the present powerful image steganalysis algorithms. Moreover, the determined principle is also studied to reduce the false positive rate in the first stage. Experimental results show the satisfying performance of the proposed system. Copyright © 2008 John Wiley & Sons, Ltd.

Replacement of least-significant bit plane is one of the popular steganography techniques in digital images because of its extreme simplicity. But it is more difficult to precisely estimate the rate of secret message embedded by replacement of multiple least-significant bit (MLSB) planes of a carrier object. In order to model the MLSB embedding, a lemma is introduced to prove the transition relationships among some trace subsets. Then, based on these transition relationships, two novel steganalysis frameworks are designed to detect two kinds of distinct MLSB embedding methods. A series of experiments show that the proposed steganalysis frameworks are highly sensitive to MLSB steganography, and can estimate the rate of secret message with higher accuracy. Furthermore, these frameworks can fully meet the need to distinguish stego images under low false positive rate, especially when the embedded message is short.