CN100367295C - Intelligent image steganalysis system based on three-layer architecture - Google Patents

Abstract

The invention discloses an intelligent image steganalysis analysis system based on a three-layer architecture, including a comprehensive database, an image library, a comprehensive database management module, an image library management module, a feature vector pre-extraction module, a steganalysis master control module and an attack module , as well as a dedicated steganalysis module for steganalysis algorithms that have been announced and have corresponding dedicated steganalysis algorithms, and a general steganalysis module for classification training for steganalysis algorithms that have been announced but have no corresponding dedicated steganalysis algorithms and an unpublished generalized general steganalysis module for steganographic algorithms. The present invention adopts a three-layer structure, and constructs a special steganalysis subsystem for the type of steganography algorithm, which has accuracy and applicability; uses an expert system to build the existing special steganalysis method into a model library and a rule library, and passes Human-computer interaction continuously updates the steganalysis rule library, which is intelligent; the combination of main element feature extraction and sample image library classification training improves computing efficiency and accuracy.

Description

Intelligent image steganalysis system based on three-layer architecture

technical field

The invention belongs to the field of computer security, and in particular relates to an intelligent image steganalysis system based on a three-layer structure.

Background technique

At present, the main technology to realize covert communication is steganography, which is an important branch of information hiding. Steganography studies how to hide the information to be transmitted in various carriers (such as: text, image, audio, video, etc.) in an imperceptible way. In recent years, with the development of network technology and multimedia technology, steganography has made great progress, and has been adopted by military agencies, government departments, financial institutions and other important departments related to the national economy and people's livelihood, and even used by terrorists to communicate on the Internet information. The abuse of steganography has brought potential serious harm to the country and society. How to effectively supervise the use of steganography and prevent the illegal application of steganography has become a concern of national security departments. Therefore, a technology that is opposed to steganography - steganalysis has been produced. Steganalysis is an attack on steganography, the purpose is to detect the existence of secret information and destroy the secret communication. Steganalysis is the key technology to solve the problem of illegal use of steganography. The improvement of steganalysis technology is conducive to preventing the illegal application of steganography, and can prevent the loss of confidential information, reveal illegal information, combat terrorism, and prevent disasters, thereby ensuring national security and social stability.

The basic working principle of image steganalysis is to extract the features of the detected image first, and judge whether the image hides the image according to whether the features of the image have been changed and the degree of change. According to the relationship between feature extraction and steganography algorithm, image steganalysis can be divided into two categories: one is to extract its proprietary features for a specific steganographic method, and to distinguish based on these proprietary features, which can be called special steganography Analysis (eg: Fridrich J., Goljan M., Du R.. "Reliable detection of LSBsteganography in color and grayscale images". Proceedings of ACMMultimedia Workshops-Multimedia and Security, 2001, 27-30 and Dumitrescu S., Xiaolin Wu, Zhe Wang. "Detection of LSB steganography via sample pair analysis". IEEE Transactions on Signal Processing, 2003, Vol.51(7), 1995-2007, etc.); the other type is to find features independent of specific steganographic methods, Discrimination based on these features can be called a general steganalysis technique (such as: Avcibas Ismail, Memon Nasir, Sankur Bulent. "Steganalysis using image quality metrics". IEEE Transactions on Image Processing, 2003, Vol.12(2), 221-229 and Hany Farid. "Detecting steganographic messages in digital images". Dartmouth College, Technology Report: TR20012412, 2000, etc.). Dedicated steganalysis technology can accurately detect hidden images using a certain steganographic method with high accuracy but low applicability. The overall accuracy of general steganalysis technology is not as good as that of special steganalysis technology, but its applicability is high. Therefore, it is far from enough to rely on a certain or a certain type of steganalysis algorithm in order to make steganalysis come into practical application.

Contents of the invention

The object of the present invention is to provide an intelligent image steganalysis system based on a three-layer architecture, which has high usability and accuracy and short response time.

The intelligent image steganalysis system based on the three-layer architecture provided by the present invention is characterized in that the system includes a comprehensive database, an image library, a comprehensive database management module, an image library management module, a feature vector pre-extraction module, and a steganalysis master control system. module, a dedicated steganalysis module, a generalized steganalysis module for classification training, a generalized generalized steganalysis module, and an attack module. in:

The comprehensive database is used to store data supporting the operation of the system;

The image library is used to store the original image and the image after hiding the message;

The comprehensive database management module is used to maintain the data in the comprehensive database; the image database management module is used to maintain the image database and record the brief information of the image in the comprehensive database;

The feature vector pre-extraction module is used to pre-extract the feature vector information of the image in the image library, and the extracted feature vector information is stored in the comprehensive database;

The steganalysis master control module is used to schedule the special steganalysis module, the general steganalysis module for classification training, the generalized general steganalysis module and the attack module, to realize the steganalysis of the detection image;

Under the control of the steganalysis master control module, the dedicated steganalysis module selects an appropriate dedicated steganalysis algorithm from the model library according to the reasoning results of the reasoning machine, and conducts steganalysis on the detected image. If there is a hidden message in the analysis result , the detection image is transmitted to the attack module, otherwise the detection image is transmitted to the general steganalysis module for classification training, and the steganalysis result is written into the comprehensive database;

The general steganalysis module for classification training is under the control of the steganalysis master control module, and the steganalysis algorithm used for detecting images has been published but there is no corresponding dedicated steganalysis algorithm. According to the comprehensive database The image brief information table and the image feature vector table construct the training subset set, extract the feature vector set from the image sent by the special steganalysis module, and project the vectors in the feature vector set to the corresponding training subset for training and obtain Steganalysis result, if there is a hidden message in the analysis result, the detection image is sent to the attack module, otherwise the detection image is sent to the generalized general steganalysis module, and the steganalysis result is written into the comprehensive database;

Under the control of the steganalysis master control module, the generalized general steganalysis module constructs a training set according to the image brief information table and image feature vector table in the comprehensive database for the situation that the steganographic algorithm used for detecting images has not been announced, from The feature vector is extracted from the image sent by the general steganalysis module of classification training, and the feature vector is projected onto the training set for training and obtains the steganalysis result. If there is a hidden message in the analysis result, the detection image is sent to the attack module. Otherwise, do not do any processing on the detection image, and directly output the detection image;

Under the control of the steganalysis master control module, the attack module attacks the detected image transmitted from the special steganalysis module, the generalized steganalysis module for classification training or the generalized generalized steganalysis module, and outputs the attacked image.

The intelligent image steganalysis system based on the three-layer structure of the present invention has the following advantages and effects:

(1) Three-layer filtering, collaborative work

This system contains three serial steganalysis subsystems: dedicated steganalysis subsystem; generalized steganalysis subsystem for classification training; generalized generalized steganalysis subsystem. The tight coupling between the special steganalysis method and the general steganalysis method is realized, and the advantages of the accuracy of the special steganalysis algorithm and the usability of the general steganalysis algorithm are fully utilized, and the disadvantages of the two steganalysis methods are also realized Complementary, so that the steganalysis system can meet the actual use requirements.

(2) High availability and accuracy

During the implementation of this system, aiming at the two major performance indicators of accuracy and usability, some novel strategies were adopted in the system construction, such as: constructing a special steganalysis subsystem based on expert system technology for the special steganalysis algorithm, and making full use of the special steganalysis algorithm. Write analysis algorithm group advantages to improve usability; for general steganalysis algorithms, construct a generalized steganalysis subsystem for classification training and a generalized generalized steganalysis subsystem, especially in the generalized steganalysis subsystem for classification training, training The subset is a simplified sensitive set constructed for a specific steganographic algorithm, which can improve the accuracy of the general steganalysis algorithm while meeting the availability.

(3) Short response time

In order to shorten the response time, the following measures are taken: ①According to the two general steganalysis modules, the feature vector pre-extraction technology is adopted, and the feature vectors extracted from the image library are stored in the feature vector table of the comprehensive database, so as to avoid each steganalysis. All writing analysis requires feature vector extraction, which can shorten the response time; ②In the general steganalysis system for classification training, the feature vector has fewer elements, which can reduce the computational complexity and shorten the response time.

(4) intelligence

In this system, the expert system and pattern recognition technology in the field of artificial intelligence are used to make the process of steganalysis intelligent, and the performance of steganalysis is improved through human-computer interaction.

Description of drawings

Fig. 1 is the structural representation of the system of the present invention;

Fig. 2 is the steganalysis flow chart of the system of the present invention;

A schematic tree representation of rules in the knowledge base in Fig. 3;

Figure 4 is a flow chart of the steganalysis comprehensive decision-making module;

Fig. 5 is a schematic structural diagram of a dedicated steganalysis module;

Fig. 6 is a schematic structural diagram of a general steganalysis module for classification training;

FIG. 7 is a schematic structural diagram of a generalized generalized steganalysis module.

Detailed ways

According to the steganographic algorithm that may be used in covert communication and whether the steganographic algorithm has a corresponding dedicated steganalysis algorithm and other factors, the steganographic algorithm is divided into three categories: ①The steganographic algorithm has been published, and there is a corresponding dedicated steganalysis algorithm Algorithm; ②The steganographic algorithm has been published, but there is no corresponding dedicated steganalysis algorithm; ③The steganographic algorithm has not been published. The present invention aims at three types of steganography algorithms, and builds an intelligent image steganalysis system with a three-layer structure. ); 2. Generalized steganalysis subsystem for classification training (the steganalysis algorithm used for covert communication belongs to the case ②); 3. Generalized generalized steganalysis subsystem (the steganalysis algorithm used for covert communication belongs to Situation ③).

The present invention will be further described below in conjunction with the accompanying drawings and specific embodiments.

As shown in Figure 1, the system of the present invention includes ten parts: comprehensive database 104, image library 105, comprehensive database management module 2, image library management module 3, feature vector pre-extraction module 4, steganalysis master control module 5, dedicated Steganalysis module 6, general steganalysis module 7 for classification training, generalized general steganalysis module 8 and attack module 9.

The steganalysis master control module 5 is used to schedule the special steganalysis module 6, the general steganalysis module 7 for classification training, the generalized general steganalysis module 8 and the attack module 9, to realize the steganalysis of the detected image. Under the control of the steganalysis master control module 5, the special-purpose steganalysis module 6 selects a suitable special-purpose steganalysis algorithm from the model library according to the inference result of the reasoning machine, and performs steganalysis on the detection image 101. If the analysis result If there is a hidden message, then the detection image 101 is sent to the attack module 9, otherwise the detection image 101 is sent to the general steganalysis module 7 of classification training, and the steganalysis result is written into the comprehensive database 104; Under the control of module 5, the steganalysis algorithm used for detecting images has been announced, and there is no corresponding special steganalysis algorithm at present. The general steganalysis module 7 for classification training is based on the image brief information in the comprehensive database The table and the image feature vector table construct the training subset set, extract the feature vector set from the image transmitted by the special steganalysis module 6, project the feature vector set to the corresponding training subset respectively for training and obtain the steganalysis results, If the analysis result has a hidden message, then the detection image 101 is sent to the attack module 9, otherwise the detection image 101 is sent to the generalized general steganalysis module 8, and the steganalysis result is written into the comprehensive database 104; Under the control of the control module 5, for the unpublished situation of the steganographic algorithm used in the detection image, the generalized general steganalysis module 8 writes the result of the steganalysis into the comprehensive database 104; Under control, for the situation that the steganographic algorithm used for detecting images has not been announced, the generalized universal steganalysis module 8 constructs a training set according to the image brief information table and image feature vector table in the comprehensive database 104, from the generalized steganographic algorithm for classification training Extract the feature vector from the image sent by the analysis module 7, project the feature vector to the training set for training and obtain the steganalysis result, if there is a hidden message in the analysis result, then send the detection image 101 to the attack module 9, otherwise it will not be detected The image 101 is subjected to any processing, and the detection image is output directly. Under the control of the steganalysis master control module 5, the attack module 9 attacks the detection image 101 transmitted from the special steganalysis module 6, the general steganalysis module 7 of classification training or the generalized general steganalysis module 8, The post-attack image 102 is output.

The image library management module 3 is responsible for maintaining the image library 105 used for general steganalysis, and recording the brief information of the image in the comprehensive database 104; the feature vector pre-extraction module 4 extracts the feature vector of the image in the pre-extracted image library 105 Information, the extracted feature vector information is stored in the comprehensive database 104.

Each part will be described in detail below.

(1) Comprehensive database 104

The comprehensive database 104 is used to store relevant data supporting the operation of the system. The data tables in the comprehensive database include: image brief information table (see table 1), image feature vector table (see table 2), detection image initial parameter table (see table 3 ), a special steganalysis result table (see Table 4) and a general steganalysis result table for classification training (see Table 5).

Table 1 Image Brief Information Table

file name steganographic algorithm Steganography Algorithm Type plane.jpg NULL 0 children.bmp STEG₁ 1 Lena.jpg STEG₂ 2

Each field is described as follows:

filename: the filename of the image;

Steganography algorithm: For the original image, this field value is NULL, otherwise it is the name of the steganography algorithm;

Steganographic algorithm type: If the image is an original image, the value of this field is 0; if it is an image after hiding a message, the value of this field is 1, indicating that the steganographic algorithm of the hidden image has a corresponding dedicated steganalysis algorithm, and the field is A value of 2 indicates that there is no corresponding dedicated steganalysis algorithm.

Table 2 Image feature vector table

serial number steganographic algorithm Steganography Algorithm Type element name element value 001000001 STEG₁ 0 u 80 001000001 STEG₂ 0 σ 3000

The description of each field is as follows:

Number: the unique number of the feature vector;

Steganography algorithm: same as Table 1;

Steganographic algorithm type: same as Table 1;

Element name: the name of the element that makes up the feature vector, such as mean-u, variance-σ;

Element value: The element value of feature extraction.

Table 3 Initial parameter table of detection image

task number file name size file format 200512260001 plane.jpg 256×256 JPEG 200512260002 children.bmp 512×512 BMP

The description of each field is as follows:

Task number: the task number for performing steganalysis, which can uniquely identify the steganalysis task, and its number is automatically generated;

File name: the file name of the detected image;

size: detect the size of the image;

File format: detect the file format of the image.

Table 4 Dedicated Steganalysis Results Table

task number Steganalysis algorithm Test results 200512260001 RS 1 200512260002 Chi-square 0

The fields are explained as follows:

Task number: the task number for performing steganalysis, which can uniquely identify the steganalysis task, and its number is automatically generated;

Steganalysis algorithm: the name of the dedicated steganalysis algorithm used;

Detection result: store the result of steganalysis, if there is a hidden message, it is 1, otherwise it is 0.

Table 5 Intermediate result table of general steganalysis for classification training

task number The steganography algorithm corresponding to the training set detection value 200512260001 A_i 0.8 200512260001 A_j 0.9

The description of each field is as follows:

Task number: the task number for performing steganalysis, which can uniquely mark a steganalysis task, and its number is automatically generated;

Training set: the name of the steganography algorithm corresponding to the training set;

Detection value: the result of training the general steganography algorithm on the training set.

(2) Image library 105

The image library 105 includes an original image library (a collection of images without a hidden message) and an image library after a message is hidden (a collection of images after a message is hidden). In this system, the image library is stored in the computer hard disk in the form of a file, and the brief information of the image file is recorded in the image brief information table (see Table 1) of the comprehensive database.

(3) Integrated database management module 2

This module is used to maintain (add, delete, modify, query, backup, etc.) the data in the comprehensive database 104 .

(4) Image library management module 3

This module is used to maintain (add, delete, modify, query) the image files in the image library 105 and the image brief information table in the comprehensive database.

(5) Feature vector pre-extraction module 4

The generalized steganalysis module 7 and the generalized generalized steganalysis module 8 for classification training need to extract the feature vectors of the images in the image library 105 when performing steganalysis. In order to shorten the response time of steganalysis and avoid image feature vector extraction for every steganalysis, the feature vector pre-extraction module 4 pre-extracts the feature vector of the image from the image library 105 and stores it in the image feature vector of the comprehensive database 104 table (see Table 2), so that the image feature vector table can be directly used to construct the feature vector training set during steganalysis, and the feature vector of the image is stored in the feature vector table with the feature vector element as the basic unit, that is, each element is a record.

(6) Steganalysis master control module 5

As shown in Figure 2, for an image to be detected, the steganalysis master control module 5 first dispatches the special steganalysis module 6 to carry out steganalysis, if the analysis result shows that there is a hidden message, then starts the attack module 9 to detect the image. Attack and output the image after the attack; otherwise, start the general steganalysis module 7 of classification training to carry out steganalysis; then, if the steganalysis of the general steganalysis module 7 shows that the detection image has no hidden message, then start the generalized general steganalysis module 7. Steganalysis module 8 carries out steganalysis; Otherwise, start attack module 9 to attack the image and output the image after the attack; finally, if the generalized generalized steganalysis module 8 steganalysis shows that there is no steganographic message in the detection image, then Do not do any processing; otherwise start the attack module 9 to attack the image and output the image after the attack. It is not difficult to see that the present invention realizes the close coupling of the special steganalysis technology and the general steganalysis technology, fully exerts their respective advantages, and at the same time realizes the complementarity of each other's disadvantages, greatly improving the accuracy and usability of the steganalysis system.

(7) Dedicated steganalysis module 6

The dedicated steganalysis module 6 builds an expert system for the dedicated steganalysis algorithm. The expert system is an intelligent software system that uses steganalysis domain knowledge and reasoning to solve image steganalysis problems. Due to the advantages of persistence, reliability, stability and decision comprehensibility of expert system, it provides scientific, accurate and efficient decision support for steganalyzers. At the same time, in order to make up for the weak computing power of the expert system, a steganalysis model library is added to enhance the decision support capability of the system.

According to the description of special steganalysis field knowledge, the structure of special steganalysis module facing special steganalysis algorithm is established, as shown in Figure 5, from the functional point of view, this module includes the following parts: knowledge base 110, model base 111 , a knowledge base management module 61 , an image parameter information acquisition module 62 , a model base management module 63 , an inference engine 64 , a steganalysis comprehensive decision-making module 65 and a human-computer interaction module 66 . The specific functions of the above-mentioned parts are described as follows:

●Knowledge base 110: also known as rule base, the rules are represented by production formula (IF P THEN Q, which means that if the fact P is established, then the behavior Q will be executed). By collecting the knowledge and experience of special image steganalysis, some typical special steganalysis algorithms are screened out, and according to the image type (palette image, true color image, JPEG image, etc.) Write algorithm type (LSB steganography algorithm, QIM steganography algorithm, etc.) and the effectiveness of steganalysis algorithm, and establish a rule base. In order to have a better understanding of the construction of the rule base, the following is an example. Figure 3 is a tree representation example of a three-layer rule base. The variables involved in the fact P and behavior Q in the rule tree are defined as follows: ① variable Rs _pesial indicates the result of special steganalysis, if its value is true, it means that there is a hidden watermark in the current image, otherwise there is no watermark information, the initial value of this variable is false; ②The variable ID _{cur_scheme} indicates the number of the currently selected steganalysis algorithm;③ The variable ID _{pre_scheme} indicates the number of the steganalysis algorithm selected last time. In the first layer, the value of this variable is 0; ④The variable End _mark indicates the end mark. If it is true, it means that the preparation is over, otherwise it is false, and the initial value is false. ; ⑤ The variable I _class represents the identification number of the current steganalyzed image type (for example, palette image I _class =1, true color image I _class =2, JPEG image I _class =3, etc.). The rules involved in path n in Figure 3 can be specifically expressed as follows:

if P _1n then Q _1n ;

if P _2n then Q _2n ;

if P _3n then Q _3n ;

in

P _1n : (ID _{pre_scheme} = 0)∧(End _mark ==false)∧(I _class ==n)∧(Rs _special ==false);

Q _1n : ID _{cur_scheme:} = A _1n ;

P _2n : (ID _{pre_scheme} ==A _1n )∧(End _mark ==false)∧(I _class ==n)∧(Rs _special ==false);

Q _2n : ID _{cur_scheme} := A _2n ;

P _3n : (ID _{pre_scheme} ==A _2n )∧(End _mark ==false)∧(I _class ==n)∧(Rs _special ==false);

Q _3n : End _mark : = true

From the regular expression, it is not difficult to find that the inference engine 64 can only have two results according to this rule: ① the number of the steganalysis algorithm to be selected; ② a dedicated steganalysis end sign. Based on this result, the steganalysis comprehensive decision-making module 65 determines whether to call the steganalysis algorithm currently selected by the model library or end the dedicated steganalysis.

●Model library 111: By collecting special image steganalysis knowledge and experience, some typical special steganalysis algorithms are screened out, and the functions of the algorithms are realized with program codes. The realization of steganographic algorithm functions is also called a mathematical model. The models are stored in the model repository 111;

Knowledge base management module 61: maintain the knowledge base 110 rules (addition, deletion, modification, query);

Image parameter information acquisition module 62: obtain the simple parameters of the detection image, and write the detection image initial parameter table of the comprehensive database 104, see Table 3;

●Model library management module 63: this module is responsible for maintaining (adding, deleting, modifying, querying) the steganalysis algorithm model in the model library 111;

Inference engine 64: The working principle of the inference engine 64 is to receive the facts transmitted from the steganalysis comprehensive decision-making module 65, directly match the rules in the knowledge base and execute the matching rules, and finally obtain the inference result, which is sent to the steganalysis Comprehensive decision-making module 65 and human-computer interaction module 66.

Steganalysis comprehensive decision-making module 65: the working flow chart of this module is shown in Figure 5, and the specific steps are as follows:

① Construct fact P: Assign values to the variables Rs _spesial , ID _{cur_scheme} , ID _{pre_scheme} , End _mark , and I _class involved in the rules in the knowledge base. If you enter this module for the first time, then ID _{cur_scheme} : = 0, ID _{pre_scheme} : = 0 , End _mark :=false, Rs _spesial :=jalse, I _class are the type value of detection image; Otherwise carry out ID _{pre_scheme} :=ID _{cur_scheme} assignment operation;

②Call the inference engine: pass the fact P to the inference engine, and obtain the inference result, if the End _mark in the inference result is true, turn to step ④;

③Call the steganographic algorithm model: According to the value of the variable ID _{cur_scheme} , select the steganographic analysis algorithm from the model library to perform steganographic analysis on the detected image. If the steganographic analysis result has a hidden image, assign true to the variable Rs _spesial and jump to Step ④, otherwise go to step ① and repeat;

④ steganalysis result processing: if Rs _spesial ==true, then prompt to human-computer interaction module 66 that there is hidden message; , see Table 4.

●Human-computer interaction module 66: an interface for human-computer interaction, responsible for receiving instructions given by steganalyzers, and returning the processing results of reasoning or steganalysis comprehensive decision-making module to steganalyzers.

(8) General steganalysis module for classification training 7

As shown in FIG. 6 , the general steganalysis module for classification training includes: a principal element feature vector subset construction module 71 , a principal element feature vector extraction module 72 , a general steganalysis module 73 and a steganalysis decision module 74 . Among them, the main element feature vector subset construction module 71 filters out the steganographic algorithm set A={A _i |1≤i≤n in which the value of the steganographic algorithm type field in the table is 2 according to the image brief information table in the comprehensive database 104 }, and for each steganography algorithm A _i , construct the principal element feature vector subset Ω _i according to the image feature vector table, where Ω _i =I ₀ ∪I _i , and I ₀ represents the feature vector construction extracted from the original image library The subset of principal element feature vectors, I _i represents the subset of principal element feature vectors constructed by the steganographic algorithm A _i steganographic image library. The so-called principal element eigenvector is a vector composed of elements that are more sensitive when the general steganalysis algorithm conducts steganalysis on the training set. Therefore, the eigenvector elements of each eigenvector subset are determined by the corresponding steganographic algorithm.

The principal element feature vector extraction module 72 is responsible for extracting the principal element feature vector V _i from the detection image with reference to the corresponding principal element feature vector subset Ω _i for each steganography algorithm A _i , wherein the elements of the principal element feature vector V _i and The vector elements in the principal element feature vector subset Ω _i are the same.

The general steganalysis module 73 has a training function. For each steganographic algorithm A _i , it projects the corresponding principal element feature vector V _i onto the principal element feature vector subset Ω _i for training, and obtains the training result Dt _i , and The result is used as the steganalysis intermediate result, written into the general steganalysis intermediate result table of classification training in the comprehensive database 104, see Table 5, and sent to the steganalysis decision module 74.

The steganalysis decision-making module 74 firstly calculates the maximum value Dt _max of the set Dt according to the training result set Dt={Dt ₁ , Dt ₂ , . . . , Dt _n }, that is, Dt _max =max{Dt ₁ , _Dt2 ,..., _Dtn }. Then compare Dt _max with the detection threshold T in the comprehensive database 104, if Dt _max≥T , it will prompt that there is a hidden message, otherwise it will prompt that there is no hidden message.

From the above principles of steganalysis, it is not difficult to find that for the simplified steganalysis of highly sensitive subsets, on the one hand, the accuracy of steganalysis can be improved, and on the other hand, the complexity of the algorithm can be reduced.

(9) Generalized general steganalysis module 8

As shown in FIG. 7 , the generalized generalized steganalysis module 8 includes a feature vector set construction module 81 , a feature vector extraction module 82 and a generalized steganalysis module 83 with a training function. Wherein, the feature vector set construction module 81 constructs the feature vector set Ω according to the image brief information table 106 and the image feature vector table 107 in the comprehensive database 104, wherein Ω=I ₀ ∪ I _steg , and I ₀ represents the feature vector extracted from the original image library The constructed feature vector subset, I _steg represents the feature vector subset constructed by all the steganographic algorithm steganographic image databases.

The feature vector extraction module 82 extracts a feature vector v from the detected image, wherein the elements of the feature vector v are the same as the vector elements in the feature vector set Ω.

The general steganalysis module 83 has a training function, and the feature vector v is projected onto the feature vector set Ω for training, and the training result Dt is obtained, and then Dt is compared with the detection threshold T in the comprehensive database 104, and if Dt≥T, it prompts There is a hidden message, otherwise it prompts that there is no hidden message.

From the structure diagram, it seems that the generalized generalized steganalysis module 8 and the generalized steganalysis module 7 based on principal element features are basically similar in steganalysis, for example, both adopt the same steganalysis method. However, compared with the general steganalysis module 7 based on principal element features, the generalized general steganalysis module has its own characteristics in the construction of the training set and feature vector extraction, which are specifically shown in: ①Construction of the feature vector set construction module 81 In the feature vector set Ω of the hidden image, the steganographic algorithm corresponding to the feature vector set of the hidden image is more extensive, which is all the published steganographic algorithms; element composition.

Since the selection of the feature vector elements of the feature vector set and the selection of the image library balance the sensitivity of the steganalysis algorithm to all steganographic algorithms, it has wide applicability and can effectively make up for the performance of the first two steganalysis modules. Insufficient indicators.

(10) Attack module 9

The goal of attacking the detection image is to make the secret message not be extracted correctly in the detection picture after the attack, that is, to destroy the progress of the secret communication, and at the same time try to crack the secret message.

Claims (5)

1. An intelligent image steganalysis system based on a three-layer architecture, characterized in that: the system includes a comprehensive database (104), an image library (105), an integrated database management module (2), and an image library management module (3) , feature vector pre-extraction module (4), steganalysis master control module (5), special steganalysis module (6), general steganalysis module for classification training (7), generalized general steganalysis module (8) and attack module (9); where: The comprehensive database (104) is used to store data supporting the operation of the system; The image storehouse (105) is used to store the original image and the image after hiding the message; The comprehensive database management module (2) is used for maintaining the data in the comprehensive database (104); The image library management module (3) is used to maintain the image library (105), and record brief image information in the comprehensive database (104); The feature vector pre-extraction module (4) is used to pre-extract the feature vector information of the image in the image library (105), and the feature vector information extracted is stored in the comprehensive database (104); The steganalysis master control module (5) is used for dispatching the special steganalysis module (6), the general steganalysis module (7) for classification training, the generalized general steganalysis module (8) and the attack module (9), realizing Steganalysis of detected images; Under the control of the steganalysis master control module (5), the special steganalysis module (6) selects a suitable special steganalysis algorithm from the model library according to the inference result of the reasoning machine, and performs steganalysis on the detected image, If there is a hidden message in the analysis result, the detection image is sent to the attack module (9), otherwise the detection image is sent to the general steganalysis module (7) for classification training, and the steganalysis result is written into the comprehensive database (104) ; The general steganalysis module (7) for classification training is under the control of the steganalysis master control module (5), and the steganalysis algorithm used for detecting images is published but there is no corresponding dedicated steganalysis algorithm at present According to the image brief information table and the image feature vector table in the comprehensive database (104), the training subset set is constructed, and the feature vector set is extracted from the image sent by the special steganalysis module (6), and the vector in the feature vector set is Project to the corresponding training subsets for training and obtain steganalysis results. If the analysis results have hidden messages, the detection image is sent to the attack module (9), otherwise the detection image is sent to the generalized general steganalysis module (8 ), and write the steganalysis result into the comprehensive database (104); The generalized general steganalysis module (8) is under the control of the steganalysis master control module (5), and for the situation that the steganographic algorithm used for detecting images has not been announced, according to the image brief information table in the comprehensive database (104) and The image feature vector table constructs the training set, extracts the feature vector from the image transmitted by the general steganalysis module (7) of the classification training, projects the feature vector to the training set for training and obtains the steganalysis result, if the analysis result has If the message is hidden, the detection image is sent to the attack module (9), otherwise the detection image is not processed and the detection image is directly output; The attack module (9) is under the control of the steganalysis master control module (5), from the special steganalysis module (6), the general steganalysis module (7) of classification training or the generalized general steganalysis module (8 ) to attack the detection image transmitted, and output the image after the attack. 2. The system according to claim 1, characterized in that: the comprehensive database (104) includes an image brief information table, an image feature vector table, a detection image initial parameter table, a special steganography result table and a general steganography for classification training. Write a table of analysis results. 3. The system according to claim 1 or 2, characterized in that: the dedicated steganalysis module (6) includes a knowledge base (110), a model base (111), a knowledge base management module (61), an image parameter Information acquisition module (62), model library management module (63), inference engine (64), steganalysis comprehensive decision-making module (65) and human-computer interaction module (66); The model library (111) is used to store the mathematical models of existing published special steganalysis algorithms; The knowledge base (110) is used to store steganalysis rules; The model library management module (63) is responsible for maintaining the steganalysis algorithm model in the model library (111); The knowledge base management module (61) is used to maintain the knowledge base rules; Image parameter information obtaining module (62) is used for obtaining the simple parameter of detection image, and writes in the comprehensive database (104); The inference engine (64) matches the rules directly from the knowledge base (110) according to the facts transmitted from the steganalysis comprehensive decision-making module (65), executes the rules to obtain inference results, and transmits the inference results to the steganalysis comprehensive decision-making module (65) and human-computer interaction module (66); Steganalysis comprehensive decision-making module (65) is processed according to the following steps: Step (A): Construct fact P, and pass fact P as parameter, pass reasoning machine (64) module and carry out reasoning; Step (B): If the end mark End _mark in the reasoning result is false, then select the corresponding steganalysis algorithm model from the model library (111) according to the number ID _{cur_scheme} value of the currently selected steganalysis algorithm, and use the model Perform steganalysis on the detected image; if the variable end mark End _mark in the inference result is true, then go to step (C); if the selected steganalysis algorithm determines that the detected image has no hidden message, go to step (A), otherwise Go to step (C); Step (C): According to the special steganalysis result Rs _spesial value, form the steganalysis result, write the steganalysis result into the comprehensive database (104), and output it to the man-machine interface, and provide it to the steganalyzer ; The human-computer interaction module (66) is used to receive the instructions given by the steganalyzer, and at the same time return the processing results of the reasoning machine (64) and the steganalytical comprehensive decision-making module (65) to the steganalyst. 4. system according to claim 3, it is characterized in that: the general steganalysis module (7) of described classification training comprises main element feature vector subset construction module (71), main element feature vector extraction module (72) , a general steganalysis module (73) and a steganalysis decision module (74); wherein, The principal element feature vector subset construction module (71) screens out the steganographic algorithm set A={A _i |1≤i in which the value of the steganographic algorithm type field in the table is 2 according to the image brief information table in the comprehensive database (104) ≤n}, and for each steganography algorithm A _i , construct the principal element feature vector subset Ω _i according to the image feature vector table, where Ω _i =I ₀ ∪I _i , I ₀ represents the feature extracted from the original image library The principal element feature vector subset constructed by the vector, I _i represents the principal element feature vector subset constructed by the image library after the steganography algorithm A _i steganography; The principal element feature vector extraction module (72) refers to the corresponding principal element feature vector subset Ω _i for each steganography algorithm A _i , and extracts the principal element feature vector V _i from the detection image, wherein the elements of the principal element feature vector V _i Same as the vector elements in the principal element feature vector subset Ω _i ; For each steganographic algorithm A _i , the general steganalysis module (73) projects the corresponding principal element feature vector V _i onto the principal element feature vector subset Ω _i for training, obtains the training result Dt _i , and converts the result As an intermediate result of steganalysis, it is written into the general steganalysis intermediate result table of the classification training of the comprehensive database (104), and sent to the steganalysis decision-making module (74); The steganalysis decision-making module (74) first calculates the maximum value Dt max of the set Dt according to the training result set Dt={Dt ₁ , Dt ₂ ,...,Dt _n }, that is, Dt _max = _max {Dt ₁ , Dt ₂ ,..., Dt _n }; Then compare Dt _max with the detection threshold T in the comprehensive database (104), if Dt _max ≥ T, it will prompt that there is a hidden message, otherwise it will prompt that there is no hidden message. 5. system according to claim 4, it is characterized in that: described generalized universal steganalysis module (8) comprises feature vector set construction module (81), feature vector extracting module (82) and the general steganagram with training function Write analysis module (83); Wherein, The feature vector set construction module (81) constructs the feature vector set Ω according to the image brief information table and the image feature vector table in the comprehensive database (104); Feature vector extraction module (82) is used for extracting feature vector V from detection image, wherein the element of feature vector V is identical with the vector element in feature vector set Ω; The general steganalysis module (83) is used to project the feature vector V onto the feature vector set Ω for training to obtain the training result Dt, and then compare Dt with the detection threshold T in the comprehensive database (104), if Dt≥T Then it prompts that there is a hidden message, otherwise it prompts that there is no hidden message.

Images