Indoor localization determines target locations by analyzing wireless signal characteristics and is widely used in indoor emergent rescue, mobile healthcare, and intelligent warehousing. Fingerprint-based localization methods mostly adopt received signal strength (RSS), amplitude, or phase. However, in non-line-of-sight (NLOS) scenarios, these classic features are insufficient to accurately distinguish the locations of closely adjacent devices, resulting in limited localization accuracy. Therefore, we propose a heterogeneous spatiotemporal feature fusion (HSFF) and dual-channel convolutional broad learning networks (DC-BLN) for indoor localization. The method first couples phase difference (PD) and power delay profile (PDP) extracted from channel state information (CSI). These fused features are encoded into a three-channel image that preserves both domain and spatial characteristics. A lightweight DC-BLN is then designed to decouple deep spatiotemporal features and perform incremental broad expansion for fast online updates. A large number of tests are carried out in typical laboratory and meeting room, and the experimental results show that the proposed method achieves mean errors of 2.07 m (laboratory) and 1.42 m (meeting room), with corresponding standard deviations of 1.60 m and 0.94 m respectively. These results significantly outperform six existing baseline methods in localization accuracy and robustness.

Various malicious activities performed by the social bots have brought a crisis of trust to the online social networks. In this paper, we propose a social bot detection method, named Accou2vec, based on community walk. First, in order to cut off the attacking edges between the human and bot accounts, the deep autoencoder-like non-negative matrix factorization community detection algorithm is leveraged to divide the social graph into multiple subgraphs. Then, we design the community walk rule that controls the intra-community walk and inter-community walk differently, considering both the number of nodes and edges in the community. Subsequently, the graph representation learning is used to learn the representation vector of each account. Finally, the representation vectors of labeled social bots and human accounts are used to train the classifier for social bots detection. Extensive experimental results on two real-world datasets show the superior performance of the proposed method over the state-of-the-art.

Social network alignment aims to discover the potential correspondence between users across different social platforms. Recent advances in graph representation learning have brought a new upsurge to network alignment. Most existing representation-based methods extract local structural information of social networks from users’ neighborhoods, but the global structural information has not been fully exploited. Therefore, this manuscript proposes a dual graph convolutional networks-based method (DualNA) for social network alignment, which combines user representation learning and user alignment in a unified framework. Specifically, we design dual graph convolutional networks as feature extractors to capture the local and global structural information of social networks, and apply a two-part constraint mechanism, including reconstruction loss and contrastive loss, to jointly optimize the graph representation learning process. As a result, the learned user representations can not only preserve the local and global features of original networks, but also be distinguishable and suitable for the downstream task of social network alignment. Extensive experiments on three real-world datasets show that our proposed method outperforms all baselines. The ablation studies further illustrate the rationality and effectiveness of our method.

Various malicious activities performed by social bots have brought a crisis of trust to online social networks. Existing social bot detection methods often overlook the significance of community structure features and effective fusion strategies for multimodal features. To counter these limitations, we propose BotCF, a novel social bot detection method that incorporates community features and utilizes cross-attention fusion for multimodal features. In BotCF, we extract community features using a community division algorithm based on deep autoencoder-like non-negative matrix factorization. These features capture the social interactions and relationships within the network, providing valuable insights for bot detection. Furthermore, we employ cross-attention fusion to integrate the features of the account’s semantic content, properties, and community structure. This fusion strategy allows the model to learn the interdependencies between different modalities, leading to a more comprehensive representation of each account. Extensive experiments conducted on three publicly available benchmark datasets (Twibot20, Twibot22, and Cresci-2015) demonstrate the effectiveness of BotCF. Compared to state-of-the-art social bot detection models, BotCF achieves significant improvements in accuracy, with an average increase of 1.86%, 1.67%, and 0.47% on the respective datasets. The detection accuracy is boosted to 86.53%, 81.33%, and 98.21%, respectively.

User identity linkage across social networks aims to discover the potential correspondence between users across different social platforms. However, it is non-trivial to solve the practically relevant problem due to the following challenges. 1) User identity linkage requires analyzing relationships within individual networks as well as across networks, making it essential to preserve the intra-network and inter-network relationships. 2) The existing methods mostly ignore the data distribution of latent embeddings and lack additional constraints for enhancing the robustness of representations. Towards this end, we propose an adversarially regularized graph embedding-based method (ARUIL) for user identity linkage across social networks. Specifically, we first adopt a pair of graph auto-encoders with shared weights to embed the source and target networks from the structure space to a common latent vector space. Then, we design an effective dual constraint mechanism, intra-network relationship preserving and inter-network relationship preserving, to optimize the overall framework jointly. The former constraint based on network reconstruction aims to capture the original structural features of input networks. The latter one, inspired by the contrastive learning paradigm, seeks to minimize the distance between positive samples in the latent vector space and increase the distance from negative samples. Finally, adversarial regularization is introduced to enforce latent embeddings to match a prior Gaussian distribution to improve the generalization performance of our proposed method. Extensive experiments on two real-world social network datasets demonstrate that ARUIL outperforms the state-of-the-art baselines. The ablation study also illustrates the rationality and effectiveness of our proposed method.

User identity linkage across social networks aims to discover the potential correspondence between users across different social platforms. In this paper, we work towards linking users’ identities on diverse social networks by exploring user-generated texts. However, it is non-trivial to solve the problem due to the following challenges. 1) The existing methods rely on massive high-quality anchor links, but it is factually much too expensive or even impossible to acquire supervision information. 2) Users will express unique insights and personalized views on events with different topics in social activities, how to describe users under different topics presents a crucial challenge. Towards this end, we propose an unsupervised method (TPLink) for user identity linkage across social networks based on the topic partition of user-generated texts. Its core idea is that the semantic features exhibited in user-generated texts under different topics differ, but users’ viewpoints and attitudes towards a certain topic will not change with different platforms. Specifically, we first divide user-generated texts according to their topics and learn the topic-specific user representation to depict users at a fine-grained level. Subsequently, we adopt the topic distribution awareness-based similarity measurement to mine the correspondence between users across different networks. Through extensive experiments on the Instagram-Twitter dataset, we demonstrate that the proposed TPLink method significantly outperforms the state-of-the-art methods. The ablation studies further illustrate the rationality and effectiveness of our method.

Network entities have important asset mapping, vulnerability, and service delivery applications. In cyberspace, where the network structure is complex and the number of entities is large, effectively obtaining the relevant attributes of entities is a difficult task. Graph neural network-based approaches focus on target IP node messaging from neighboring nodes; however, the graph learning task ignores the heterophilous relationship of network entity identification (NEI) tasks in the graph structure and fails to effectively message from non-neighboring nodes. To address the limitations of the existing task, we propose a NEI model based on heterophilous graph learning (HpGraphNEI); HpGraphNEI converts heterophilous graphs under the NEI task into homophilous graphs and uses the graph learning mechanism to carry out attribute completion task for incomplete entity attributes. First, the acquired dataset is feature-extracted by network measurement, and the clustering algorithm is employed to divide the target nodes into communities. Second, the network topology graph is constructed to embed the node attribute information and neighborhood structure information into the graph in the form of feature vectors. Then, the global attention in the community is calculated according to the attention results, the edges with strong correlation in the network are filtered, the adjacency matrix is reconstructed, and then the updated node information is aggregated to complete the incomplete attribute completion. Fourth, the updated nodes are categorized to output network entity categories and construct network entity portraits based on the attribute completion nodes. We conducted a 2-month data collection in three real regions and successfully identified 6 types of network entities. Compared with the optimal baseline, all the metrics have significantly improved, with NEI accuracy above 93.74% and up to 96.28%, improved 2.27% to 2.69%.

Social bot detection methods using graph neural networks (GNNs) are thriving, but the structural complexity of GNN also brings more training costs on large-scale data and interpretability concerns. In this paper, we propose a social bot detection method, BotCS, which utilizes both the attribute and the structural features of the social graph at a smaller computational cost than GNN-based detection methods. BotCS makes a base prediction with a simple multilayer perceptron classifier (MLP) and then propagates the classification residuals of the training set to other nodes for further correction. Then, it smooths the corrected prediction by label propagation. With little end-to-end training, this course is low-cost and scalable. We analyze the local interaction pattern between bots and human users, and designed the corresponding residual propagation and smoothing rules from the local perspective, which ensures the interpretability of BotCS. Experimental results show that BotCS achieves similar detection results to state-of-the-art methods with one or two orders of magnitude fewer parameters.

Graph convolutional networks (GCNs) have attracted increasing research attention, which merits in its strong ability to handle graph data, such as the citation network or social network. Existing models typically use first-order neighborhood information to design specific convolution operations, which aggregate the features of all adjacent nodes. However, such models ignore the high-order spatial relationship among neighboring nodes in noisy data due to its modeling complexity. In this article, we propose a novel robust graph relational network to address this issue toward modeling high-order relationships in noisy data for graph convolution. Our key innovation lies in designing a generic relation network layer, which is used to infer the underlying relations among adjacent noisy nodes. Specifically, a fixed number of adjacent nodes for each node is chosen by solving the ridge regression problem, in which the regression coefficients are used to rank the adjacent nodes of each node in a graph. Furthermore, to mine the rich features, we extract high-order information from the nodes to significantly enhance the representation ability of the GCNs for extensive applications. We conduct extensive semisupervised node classification experiments on the noisy benchmark datasets, which clearly show that our model is superior to the existing methods and can achieve state-of-the-art performance.

With the rapid development of Internet technologies, an increasing amount of auxiliary data can be readily obtained through Web services. To alleviate the data sparsity issue, auxiliary data based recommendation has emerged for better recommendation performance. However, existing auxiliary data based methods suffer from two problems. First, only the relation features related to the meta-paths are extracted from auxiliary data, which may lead to features useful for recommendation being lost irreversibly. Second, an assumption is made that an individual has the same preference over the identical characteristic of different items, which is often invalid and may lead to misleading recommendations. Actually, a user may place different importance on the same feature of different items, and an item may get different attention from the same feature of different users. In this paper, we propose a neural network framework, named Neural Attention Recommendation model (NARec), for auxiliary data based collaborative filtering. For the first problem, we characterize users and items from three aspects, namely latent features, attribute features, and meta-path based relation features, which can comprehensively extract the useful recommendation features from auxiliary data. Regarding the second problem, we integrate different user features and item features into an attention mechanism based rating prediction model for recommendation, which can adaptively characterize the personalized features of users and items. Extensive experiments on three real-world datasets demonstrate that NARec significantly outperforms the state-of-the-art recommendation methods in the rating prediction task.

Abstract To address the security risk caused by fixed offset mapping and the limited recoverability of random mapping used in image watermarking, a self‐embedding fragile image watermarking algorithm based on deneighbourhood mapping are proposed. First, the image is divided into several 2 × 2 blocks, and authentication watermark and recovery watermark are generated based on the average value of the image blocks. Then, the denighbourhood mapping is implemented as, for each image block, its mapping block is randomly selected outside its neighbourhood. Finally, the authentication watermark and the recovery watermark are embedded into the image block itself and its mapping block. Theoretical analysis indicates that in the case of continuous area tampering, the proposed watermarking algorithm can achieve a better recovery rate than that of the method based on the random mapping. The experimental results verify the rationality and effectiveness of the theoretical analysis. Moreover, compared with the existing embedding algorithms based on random mapping, chaos mapping, and Arnold mapping, in the case of continuous area tampering, the proposed algorithm also achieves a higher average recovery rate.

Traditional steganography methods are usually designed on a lossless channel; thus, messages are often not extracted correctly from an image transmitted over a lossy channel that includes attacks such as scaling. To address this issue, in recent years, the field of robust steganography has emerged. In this paper, the process of image scaling by interpolation is first observed and serves as the basis for proposing the idea of inverse interpolation. Subsequently, the idea of constructing an inverse interpolation equation set is proposed to solve the problem of intersectional blocks during the inverse interpolation process. Then, the scaling factor’s valid range of inverse interpolation is analyzed. Next, the inverse interpolation is successfully applied in robust image steganography. A method that combines antiscaling and antidetection is proposed. Afterward, actual tests on the top 9 mobile phone brands with 28 models and 2 social communication apps that are currently popular in China are done. The scaling factor’s valid range of the proposed method is verified to match the actual lossy channel. The experimental results show that the proposed method achieves a reliable extraction of embedded messages for common interpolation scaling attacks while maintaining high statistical detection resistance.

Currently, the popular Rich Model steganalysis features usually contain a large number of redundant feature components which may bring “curse of dimensionality” and large computation cost, but the existing feature selection methods are difficult to effectively reduce the dimensionality when there are many strongly correlated effective feature components. This paper proposes a novel selection method for Rich Model steganalysis features. First, the separability of each feature component in the submodels of Rich Model is measured based on the Fisher criterion, and the feature components are sorted in the descending order based on the separability. Second, the correlation coefficient between any two feature components in each submodel is calculated, and feature selection is performed according to the Fisher value of each component and the correlation coefficients. Finally, the selected submodels are combined as the final steganalysis feature. The results show that the proposed feature selection method can effectively reduce the dimensionalities of JPEG domain and spatial domain Rich Model steganalysis features without affecting the detection accuracies.

Cloud services have become an increasingly popular solution to provide different services to clients. More and more data are outsourced to the cloud for storage and computing. With this comes concern about the security of outsourced data. In recent years, homomorphic encryption, blockchain, steganography, and other technologies have been applied to the security and forensics of outsourced data. While encryption technologies such as homomorphic encryption and blockchain scramble data so that they cannot be understood, steganography hides the data so that they cannot be observed. Traditional steganography assumes that the environment is lossless. Robust steganography is grounded in traditional steganography and is proposed based on a real lossy social network environment. Thus, researchers, who study robust steganography, believe that the measurement should follow traditional steganography. However, the application scenario of robust steganography breaks through the traditional default lossless environment premise. It brings about changes in the focus of steganography algorithms. Simultaneously, the existing steganography methods miss the evaluation of applicability and ease of use. In this paper, “default parameters” are observed by comparing the process of robust image steganography with traditional image steganography. The idea of “perfecting default parameters” is proposed. Based on this, the attribute set of measuring robust image steganography is presented. We call it PRUDA (Payload, Robustness, ease of Use, antiDetection, and Applicability). PRUDA perfects default parameters observed in the process of traditional steganography algorithms. Statistics on image processing attacks in mobile social apps and analyses on existing algorithms have verified that PRUDA is reasonable and can better measure a robust steganography method in practical application scenarios.

WeChat has earned more than one billion users worldwide. Research on the geolocation of WeChat users can not only discover the location of malicious users but also verify the validity of user privacy protection strategies. However, existing methods are susceptible to WeChat's location confusion strategies, resulting in intolerable geolocating errors. In this article, a WeChat user geolocation method based on user missequence state analysis (MSAG) is proposed. Different from the existing methods which usually rely on the relationship between reported and actual distances of nearby users, MSAG utilizes the relation between user order and actual distances to geolocate the target. By statistical analysis of sequence changes of nearby users under different actual distances, the distance range that causes nearby users missequence is determined. During geolocation, the distance range of the target is delimited by checking the missequence state of the target and a user with a known location. Finally, we discuss trilateration strategies for different abnormal situations. Experimental results show that MASG can achieve high-precision geolocation of WeChat users, the average error is less than 50 m, and 72% of geolocating errors are within 60 m; compared with existing typical algorithms, the average error is reduced by 23.7%-50.7%.

Social network user location inference technology has been widely used in various geospatial applications like public health monitoring and local advertising recommendation. Due to insufficient consideration of relationships between users and location indicative words, most of existing inference methods estimate label propagation probabilities solely based on statistical features, resulting in large location inference error. In this paper, a Twitter user location inference method based on representation learning and label propagation is proposed. Firstly, the heterogeneous connection relation graph is constructed based on relationships between Twitter users and relationships between users and location indicative words, and relationships unrelated to geographic attributes are filtered. Then, vector representations of users are learnt from the connection relation graph. Finally, label propagation probabilities between adjacent users are calculated based on vector representations, and the locations of unknown users are predicted through iterative label propagation. Experiments on two representative Twitter datasets - GeoText and TwUs, show that the proposed method can accurately calculate label propagation probabilities based on vector representations and improve the accuracy of location inference. Compared with existing typical Twitter user location inference methods - GCN and MLP-TXT+NET, the median error distance of the proposed method is reduced by 18% and 16%, respectively.

Considering that traditional image steganography technologies suffer from the potential risk of failure under lossy channels, an enhanced adaptive steganography with multiple robustness against image processing attacks is proposed, while maintaining good detection resistance. First, a robust domain constructing method is proposed utilizing robust element extraction and optimal element modification, which can be applied to both spatial and JPEG images. Then, a robust steganography is proposed based on “Robust Domain Constructing + RS-STC Codes,” combined with cover selection, robust cover extraction, message coding, and embedding with minimized costs. In addition, to provide a theoretical basis for message extraction integrity, the fault tolerance of the proposed algorithm is deduced using error model based on burst errors and decoding damage. Finally, on the basis of parameter discussion about robust domain construction, performance experiments are conducted, and the recommended coding parameters are given for lossy channels with different attacks using the analytic results for fault tolerance. A series of experimental results demonstrate that the proposed algorithm can extract embedded messages with significantly higher accuracy after different attacks, such as compression, noising, scaling and other attacks, compared with the state-of-the-art adaptive steganography, and robust watermarking algorithms, while maintaining good detection resistant performance.

Summary IP geolocation is usually used in fog computing to avoid high latency and discriminate malicious requests by judging the location of users. Existing delay measurement‐based IP geolocation approaches are not applicable to the network that has hierarchical topology and weak connectivity, and the precision of the classical Street‐Level Geolocation (SLG) method will decrease dramatically when the common routers are anonymous. In this paper, an IP geolocation method based on identification routers and local delay distribution similarity is proposed. The target IP's location at city‐level is firstly derived by matching its routing path with the identification routers that only forward packets to the same city. After that, the target IP's local delay between the nearest common router and the target IP is gathered, and the landmarks' are obtained at the same time. Finally, the location of the landmark that has the most similar local delay distribution with the target IP is taken as the geolocation result. Theoretical analysis and experimental results show that the proposed method can derive reliably geolocation results at city‐level for the target IP in the network with hierarchical architecture. Moreover, the geolocation accuracy of classical SLG method is improved obviously when the common routers are anonymous.

3D steganalysis aims to find the changes embedded through steganographic or information hiding algorithms into 3D models. This research study proposes to use new 3D features, such as the edge vectors, represented in both Cartesian and Laplacian coordinate systems, together with other steganalytic features, for improving the results of 3D steganalysers. In this way the local feature vector used by the steganalyzer is extended to 124 dimensions. We test the performance of the extended local feature set, and compare it to four other steganalytic features, when detecting the stego-objects watermarked by six information hiding algorithms.

Key-Value stores provide scalable metadata service for distributed file systems. However, the metadata's organization itself, which is organized using a directory tree structure, does not fit the key-value access pattern, thereby limiting the performance. To address this issues, we propose a distributed file system with a flattened and fine-grained division metadata service, LocoMeta, to bridge the performance gap between file system metadata and key-value stores. LocoMeta is designed to bridge the gap between file metadata to key-value store with two techniques. First, LocoMeta flattens the directory content and structure, which organizes file and directory index nodes in a flat space while reversely indexing the directory entries. Second, it exploits a fine-grained division method to improve the key-value access performance. Evaluations show that LocoMeta with eight nodes boosts the metadata throughput by five times, which approaches 93 percent throughput of a single-node key-value store, compared to 18 percent in the state-of-the-art IndexFS.

In order to attract attention to the malicious use of large‐scale operation of applications, Hydra‐Bite, an Android device privacy leak path implemented by splitting traditional malicious application and restructuring to a collaborative application group, is proposed in this paper. For Hydra‐Bite, firstly, traditional privacy stealing Trojan is analyzed to obtain the permission set. And the permission set redundancy elimination splitting algorithm is subsequently adopted to extract the simplest key permission set and split the set by functions so as to form the collaborative application group. Then, a covert channel is adopted for the intergroup Apps to remove the information’s taint tagged by security methods. Meanwhile, a communication medium selection algorithm and an information normalization coding method are proposed to improve the efficiency and the concealing property for taints removal. Finally, collaborative external transmission of information is realized on the basis of intragroup Apps’ communication. The experimental results show that Hydra‐Bite could resist the detecting and killing of about 60 security engines such as Kaspersky, McAfee, and Qihoo‐360 in VirusTotal platform and capture the privacy information of the devices of different versions from Android 4.0 to Android 7.0. Hydra‐Bite can resist the killing of the following two methods, the typical detection tool Androguard based on “permission‐API” and the typical static taint tracking tool FlowDroid. Compared with traditional privacy stealing Trojan, Hydra‐Bite has higher information capture rate and stronger antikilling performance.

With the dimension of steganalysis feature increases rapidly, ensemble steganalysis has become the trend, and its performance is greatly influenced by the selection of feature subspaces. In order to select feature subspaces more effectively to improve the performance of ensemble steganalysis, a feature subspace selection algorithm based on Fisher criterion is proposed. The proposed selection algorithm computes weight for each feature component according to its Fisher criterion value and a base probability value, then selects the feature components with the probabilities in proportion to their weights. When it is used to improve the ensemble steganalysis, the appropriate base probability value is searched by steps. Experimental results show that for J-UNIWARD (JPEG UNIversal WAvelet Relative Distortion) steganography, the proposed feature subspace selection algorithm can select more effective feature subspaces, and enhance the detection performance of GFR (Gabor Filter Residual) feature.

Fingerprinting attacks are one of the most severe threats to the security of networks. Fingerprinting attack aims to obtain the operating system information of target hosts to make preparations for future attacks. In this paper, a fingerprint hopping method (FPH) is proposed based on software-defined networks to defend against fingerprinting attacks. FPH introduces the idea of moving target defense to show a hopping fingerprint toward the fingerprinting attackers. The interaction of the fingerprinting attack and its defense is modeled as a signal game, and the equilibriums of the game are analyzed to develop an optimal defense strategy. Experiments show that FPH can resist fingerprinting attacks effectively.

Aiming at the existing IP geolocation approaches does not consider the errors of landmarks and delay; a new geolocation approach-utilized landmark calibration is proposed in this paper. At first, we find out these landmarks shared the nearest common router with a target IP by path detection; second, a deviation is assigned to each related landmark according to the corresponding organization and network connectivity; then, while the landmark’s location is regarded as the points within a possible area, target IP geolocation can be converted into a constrained optimization problem; at last, we can get the location estimation of the target IP by solving the above problem, as well as the real deviation of each landmark. The algorithm analysis and experimental results show that, when a landmark is not located in its claimed position, our geolocation approach can give a location for the measured target IP, as well as the location of the nearest common router for the unmeasured target IP.

Code obfuscation is intended to thwart reverse engineering by making programmes hard to understand. Call chains collected by stack tracing can be used to understand the behaviour of programmes. To hinder reverse analysis of stack tracing, a binary code obfuscation method based on random obfuscated table and hash coding is proposed. Random obfuscated table is used to map call addresses while call and ret instructions are executing. Hash coding and random value can be used to encode and decode the data of stack frames in the run‐time programmes. Experiment and analysis show that the obfuscation can effectively impede stack trace analysis and increase the cost of reverse analysis for programmes.

Abstract Current typical adaptive steganography algorithms take the detection resistant capability into account adequately but usually cannot extract the embedded secret messages correctly when stego images suffer from compression attack. In order to solve this problem, a framework of adaptive steganography resisting JPEG compression and detection is proposed. Utilizing the relationship between Discrete Cosine Transformation (DCT) coefficients, the domain of messages embedding is determined; for the maximum of the JPEG compression resistant ability, the modifying magnitude of different DCT coefficients caused by messages embedding can be determined; in order to ensure the completely correct extraction of embedded messages after JPEG compression, error correct codes are used to encode the messages to be embedded; on the basis of the current distortion functions, the distortion value of DCT coefficients corresponding to the modifying magnitude in the embedding domain can be calculated; to improve the detection resistant ability of the stego images and realize the minimum distortion embedding, syndrome‐trellis codes are used to embed the encoded messages into the DCT coefficients that have a smaller distortion value. Based on the proposed framework, an adaptive steganography algorithm resisting JPEG compression and detection is designed, which utilizes the relationship between coefficients in a DCT block and the means of that in three adjacent DCT blocks. The experimental results that demonstrate the proposed algorithm not only has a good JPEG compression resistant ability but also has a strong detection resistant performance. Comparing with current J‐UNIWARD steganography under quality factor 85 of JPEG compression, the extraction error rates without pre‐compression decrease from about 50% to nearly 0, while the stego images remain a good detection resistant ability comparing with a typical robust watermarking algorithm, which shows the validity of the proposed framework. Copyright © 2016 John Wiley & Sons, Ltd.

Aiming at the existing IP geolocation approaches does not consider the errors of landmarks, a new geolocation approach utilized landmark calibration is proposed in this paper. At first, by assigning a deviation, the location of the landmark with low reliability is regarded as a possible area, then geolocating the target IP can be converted into a constrained optimization problem, finding the location estimation of target IP by solving this problem, as well as the real deviation of landmark. The algorithm analysis and experimental results show that, when a landmark is not located in its claimed position, our geolocation approach can still give a location for the target IP.

Current typical adaptive Steganography algorithms cannot extract the embedded secret messages correctly after compression. In order to solve this problem, a JPEG-compression resistant adaptive steganography algorithm is proposed. Utilizing the relationship between DCT coefficients, the domain of messages embedding is determined. The modifying magnitude of different DCT coefficients can be determined according to the quality factors of JPEG compression. To ensure the completely correct extraction of embedded messages after JPEG compression, the RS codes is used to encode the messages to be embedded. Besides, based on the current energy function in the PQe steganography and the distortion function in J-UNIWARD Steganography, the corresponding distortion value of DCT coefficients is calculated. With the help of that, STCs is used to embed the encoded messages into the DCT coefficients, which have a smaller distortion value. The experimental results under different quality factors of JPEG compression and different payloads demonstrate that the proposed algorithm not only has a high correct rate of extracted messages after JPEG compression, which increases from about 60% to nearly 100% comparing with J-UNIWARD steganography under quality factor 75 of JPEG compression, but also has a strong detection resistant performance.

For the problem that traditional approaches for IP geolocation based on delay measurement are difficult to apply to network with weak connectivity such as China's Internet, in this paper, we utilize its hierarchical topology and proposed an approach of City-level geolocation based on routing feature. Taking IPs with known geographical location as reference nodes, this approach extracts identifying IPs of candidate regions or cities based on decision tree learning algorithm. We match the path of the target with IPs above called identifying features, and then select the region or city whose identifying feature is contained on the target's path as geolocation result. This approach improves the average accuracy for the Internet with weak connectivity hierarchical topology to 93% vs. 73% for the previous learning-based geolocation approach.

Adaptive JPEG steganographic schemes are difficult to preserve the image texture features in all scales and orientations when the embedding changes are constrained to the complicated texture regions, then a steganalysis feature extraction method is proposed based on 2 dimensional (2D) Gabor filters. The 2D Gabor filters have certain optimal joint localization properties in the spatial domain and in the spatial frequency domain. They can describe the image texture features from different scales and orientations, therefore the changes of image statistical characteristics caused by steganography embedding can be captured more effectively. For the proposed feature extraction method, the decompressed JPEG image is filtered by 2D Gabor filters with different scales and orientations firstly. Then, the histogram features are extracted from all the filtered images.Lastly, the ensemble classifier is used to assemble the proposed steganalysis feature as well as the final steganalyzer. The experimental results show that the proposed steganalysis feature can achieve a competitive performance by comparing with the other steganalysis features when they are used for the detection performance of adaptive JPEG steganography such as UED, JUNIWARD and SI-UNIWARD.

For analyzing the multiple least-significant bits (MLSB) steganography, a pixel group trace model is presented. Based on this model and some statistical characteristics of images, two quantitative steganalysis methods are proposed for two typical MLSB steganography paradigms. The pixel group trace model simulates the MLSB embedding by exclusive or operation, and traces the transition relationship among the possible structures of the pixel group's value by some trace pixel group subsets. Then, the estimation equations of embedding ratio are derived from the transition probability matrix among trace subsets and the symmetry of regular and singular pixel group sets. Finally, a series of experimental results for the case of triple pixel group show that the proposed steganalysis methods can estimate the low embedding ratio with smaller error, especially, for some cases, the interquartile range of the estimation errors is smaller than the best one of the others by more than 45%.

The model-based steganographic algorithm MB2 modified the blockiness after secret messages are embedded, which makes the existed detection algorithm based on border artifacts invalidate. By further researching on the embedding principle of MB2, this paper analyzes the coefficients alteration results of given stego image after re-embedding with maximum messages. Based on the conclusions, this paper proposes an evaluation method for the relativity between intra-block pixels, the approximately linear relationship between the evaluated value and embedding ratio is derived by experiments. Based on these, an embedding ratio estimation method to MB2 is proposed. Experimental results show that the proposed method can estimate the embedding ratio of MB2 effectively.

Steganalysis is the reasonable method to detect whether the transmitted media content contains secret messages (e.g. business secrecy). This paper proposes two steganalysis methods to estimate the modification ratio of F5 steganography and its improved version that are popularly used to hide secrecy in images. The proposed methods measure the distance between the coefficient histogram of a given image and that of an estimated stego image. The distance is measured based on relative entropy that has the superiority of measuring the distance between two distributions. The estimated modification ratio can be used to distinguish the stego images marked by F5 steganography or its improved version from the original images. Experimental results are given to show that the proposed methods outperform the existing quantitative steganalysis methods against F5 steganography and its improved version.

For hiding messages into multiple least significant bit (MLSB) planes, a new weighted stego-image (WS)\ steganalysis method is proposed to estimate the ratio of messages hidden into each bit plane. First, a new WS with multiple weights is constructed, and it is proved that when the squared Euclidean distance between the WS and the cover image is minimal, the weight parameters are equal to the embedding ratios in MLSB planes. Afterward, based on this result and an estimation of cover image, a simple estimation equation is derived to estimate the embedding ratio in each bit plane. Experimental results show that the new steganalysis method performs more stably with the change of embedding ratios than typical structural steganalysis, and outperforms the typical structural steganalysis method on the estimation accuracy when the embedding ratio in any bit plane is larger than 0.4.

Multimedia content is a suitable carrier for secret communication. This paper focuses on the steganalysis technique which aims to get the forensic of secrecy existing in multimedia carriers. A key concern for designing a blind steganalysis algorithm is the selection of statistic features. The Probability Density Function (PDF) moment and Characteristic Function (CF) moment are two typical kinds of statistic features commonly used in blind steganalysis. And generally, the features are computed from the subbands of transform domains, such as the wavelet coefficient subbands, the prediction subbands of wavelet coefficients, the prediction error subbands of wavelet coefficients, the wavelet coefficient subbands of image noise, and the log prediction error subbands of wavelet coefficients. To decide which feature is more sensitive to message embedding and useful for steganalysis is important and urgent. Till now, few works have focused on this topic, and they can only give some experimental results without theoretical analysis. Additionally, few frequency subbands have been investigated. To solve this problem, this paper reviews existing feature computing algorithms, compares the two kinds of features, the PDF moments and the CF moments, by analyzing the change trends of the statistic distribution parameters of various frequency subbands before and after message embedding, and so that provides a theoretical basis for the steganalysis feature selection and extraction. These theoretical results are further confirmed by experimental results. This is the first work to provide thorough theoretical analysis on so many feature computing algorithms. It is expected to provide valuable information to researchers or engineers working in the field of steganography forensics or steganalysis.

In this paper, an authentication watermark algorithm for JPEG images is proposed, which is basing on the current watermark algorithm proposing and realizing a counterfeiting attack for the current watermarking algorithm security. In order to reduce the miss alarm caused by the mode of embedding watermark, in this algorithm the watermark embedded coefficients are as a factor of the watermark generation, and embedding watermark information by adopting the lowest bit substitute, so as to resist the counterfeiting attack effectively and improve the security of the current algorithm. The theoretical analysis and the realization show that the watermark algorithm presented by this paper has a lower miss alarm probability compared with the current algorithm, and further more the algorithm security.

A new compressed video secure steganography (CVSS) algorithm is proposed. In the algorithm, embedding and detection operations are both executed entirely in the compressed domain, with no need for the decompression process. The new criteria employing statistical invisibility of contiguous frames is used to adjust the embedding strategy and capacity, which increases the security of proposed algorithm. Therefore, the collusion resistant properties are obtained. Video steganalysis with closed loop feedback manner is design as a checker to find out obvious bugs. Experimental results showed this scheme can be applied on compressed video steganography with high security properties.

This paper explores two multiclass steganalysis schemes to recognize stego algorithms in use. First of all, Xuan's universal steganalysis is improved to distinguish cover and stego images by the means of applying Bhattacharyya distance to select the most important features. Then, more attentions are paid to design two schemes to recognize stego algorithms with respect to accuracy, reliability and the decision-making cost. Experimental works show that the proposed schemes have satisfactory performance on Jpeg steganography like Jsteg, F5, Outguess and MB2.

To improve the correct detection ratio of existing universal detection methods for image steganography, a new universal steganalysis method based on wavelet package transform (WPT) is presented. Firstly, decompose image into three scales through WPT to obtain 85 coefficient subbands together, and extract the multi-order absolute characteristic function moments of histogram from them as features. And then, normalize these features and combine them to a 255-D feature vector for each image. Lastly, according to this vector, a back-propagation (BP) neural network is designed to classify cover and stego images. A series of experiments validate the performance of proposed method for four kinds of typical steganography of BMP and JPEG images, such as LSB, SS (Spread spectrum), Jsteg and F5 steganography methods. Results show that the proposed method can detect the stego and original images reliably, and the average detection accuracy of our method exceeds those of its closest competitors by at least 7.7% and up to 16.5%.

Abstract stage‐wise steganalysis system that utilizes the collusion scheme among sucessive video frames is proposed. The effect of local motion interfering detection precision is studied. The local motion and message embedded in video frame is treated as a bimodal noise. To detect the existence of the embedded message, blockwise correlation‐based feature extraction scheme is proposed to reduce the local motion interfering effect. The video steganalysis process is divided into two stages. In the first stage, suspicious video frames will be recognized by decision module employing features extracted with a light‐weight collusion scheme, for the real‐time requirement. In the second stage, suspicious frames will be analyzed critically by the present powerful image steganalysis algorithms. Moreover, the determined principle is also studied to reduce the false positive rate in the first stage. Experimental results show the satisfying performance of the proposed system. Copyright © 2008 John Wiley & Sons, Ltd.

Replacement of least-significant bit plane is one of the popular steganography techniques in digital images because of its extreme simplicity. But it is more difficult to precisely estimate the rate of secret message embedded by replacement of multiple least-significant bit (MLSB) planes of a carrier object. In order to model the MLSB embedding, a lemma is introduced to prove the transition relationships among some trace subsets. Then, based on these transition relationships, two novel steganalysis frameworks are designed to detect two kinds of distinct MLSB embedding methods. A series of experiments show that the proposed steganalysis frameworks are highly sensitive to MLSB steganography, and can estimate the rate of secret message with higher accuracy. Furthermore, these frameworks can fully meet the need to distinguish stego images under low false positive rate, especially when the embedded message is short.

Trivedi et al. presented an effective LMP (locally most powerful) method (2005) to estimate the secret key for sequential steganography in mid- and high-frequency of DCT domain. In this paper, we proposed an improved LMP algorithm, which not only can reliably estimate the secret key for mid- and high-frequency sequential embedding, but also for the case of low-frequency. Moreover, the application of improved algorithm for DWT sequential steganography is discussed. Results of experiment show the performance of improved algorithm is desirable for low-, mid- and high-frequency steganography in DCT domain and in the subbands of DWT domain.

This paper presents a novel watermarking scheme that constructs two zero-watermarks from its host image. One is robust to signal process and central cropping, which is constructed from low-frequency coefficients in discrete wavelet transform (DWT) domain of its host image; the other is robust to general geometric distortions as well as signal process, which is constructed from DWT coefficients of log-polar mapping (LPM) of its host image. During the second watermark generating, we select two Scale Invariant Feature Transform (SIFT) feature descriptors to locate two invariant points, one of which is regarded as the origin of LPM and both are as reference points in correcting rotation distortion. Experiments show that our scheme is effective and outperforms the previous watermarking schemes in resisting signal process, aspect ratio change, scaling and shearing.

To solve the two major drawbacks of Baptista-type chaotic cryptosystemexcessive length of ciphertext and unbalance frequency of bit 0 to bit 1, the lower bound of the expectation of the cipher-to-plaintext ratio is worked out by the ciphertext entropy, and the approximation formula is presented to calculate the expectation of bit 0 frequency of ciphertext. In order to improve the efficiency of Baptita-type cryptosystem, the plaintext-block size is analytically influenced upon its lower bound and the encryption time, then N-truncated Huffman coding is introduced into the scheme so as to approximately reach the lower bound. Numerical paradigms prove the validity of the analysis.

This paper presents a dynamic regular groups steganalysis (DRS) algorithm to detect LSB steganography. This algorithm dynamically selects an appropriate mask for each image to reduce the initial bias, and estimates' the LSB embedding message ratio by constructing equations with the statistics of regular groups in image. Experimental results show that this algorithm is more accurate and has a lower missing rate and false1 alarm rate than the conventional RS method and some other powerful steganalysis approaches present recently.