This text develops and formalizes the applications of machine learning in steganalysis. Steganography is the art of communicating a secret message, hiding the very existence of a secret message. This book is an introduction to steganalysis as part of the wider trend of multimedia forensics, as well as a practical tutorial on machine learning in this context. Part One Overview 31 Introduction 51.1 Real threat or hype? 51.2 Artificial Intelligence and Learning 61.3 How to read this book 72 Steganography and Steganalysis 92.1 Cryptography versus Steganography 92.2 Steganography 102.2.1 The Prisoners’ Problem 102.2.2 Covers – Synthesis and Modification 122.2.3 Keys and Kerckhoffs’ Principle 132.2.4 LSB embedding 152.2.5 Steganography and Watermarking 172.2.6 Different media types 182.3 Steganalysis 192.3.1 The Objective of Steganalysis 192.3.2 Blind and Targeted Steganalysis 202.3.3 Main approaches to steganalysis 212.3.4 Example: pairs of values 242.4 Summary and Notes 263 Getting Started with a Classifier 273.1 Classification 273.1.1 Learning Classifiers 283.1.2 Accuracy 293.2 Estimation and Confidence 293.3 Using libSVM 323.3.1 Training and testing 323.3.2 Grid search and Cross-Validation 333.4 Using Python 353.4.1 Why we use Python 353.4.2 Getting started with Python 363.4.3 Scientific Computing 373.4.4 Python Imaging Library 383.4.5 An example: Image Histogram 383.5 Images for Testing 393.6 Further Reading 41Part Two Features 434 Histogram Analysis 454.1 Early Histogram Analysis 454.2 Notation 464.3 Additive Independent Noise 464.3.1 The effect of noise 474.3.2 The Histogram Characteristic Function 484.3.3 Moments of the Characteristic Function 504.3.4 Amplitude of Local Extrema 544.4 Multi-dimensional Histograms 564.4.1 HCF Features for Colour Images 574.4.2 The Co-occurrence Matrix 584.5 Experiment and Comparison 645 Bit Plane Analysis 655.1 Visual Steganalysis 655.2 Auto-correlation Features 675.3 Binary Similarity Measures 695.4 Evaluation and Comparison 726 More Spatial Domain Features 756.1 The Difference Matrix 756.1.1 The EM features of Chen et al. 766.1.2 Markov Models and the SPAM features 786.1.3 Higher-order differences 806.1.4 Run-length analysis 816.2 Image Quality Measures 816.3 Colour Images 856.4 Experiment and Comparison 857 The Wavelets Domain 877.1 A Visual View 877.2 The Wavelet Domain 897.2.1 The Fast Wavelet Transform 897.2.2 Example: The Haar Wavelet 907.2.3 The Wavelet Transform in Python 917.2.4 Other Wavelet Transforms 927.3 Farid’s Features 947.3.1 The image statistics 947.3.2 The linear predictor 947.3.3 Notes 967.4 HCF in the wavelet domain 967.4.1 Notes and further reading 997.5 Denoising and the WAM features 997.5.1 The denoising algorithm 1007.5.2 Locally Adaptive LAW-ML 1017.5.3 Wavelet Absolute Moments 1037.6 Experiment and Comparison 1048 Steganalysis in the JPEG domain 1058.1 JPEG compression 1068.1.1 The compression 1068.1.2 Programming JPEG steganography 1088.1.3 Embedding in JPEG 1108.2 Histogram Analysis 1118.2.1 The JPEG histogram 1128.2.2 First-order Features 1158.2.3 Second-order Features 1178.2.4 Histogram Characteristic Function 1188.3 Blockiness 1208.4 Markov model based features 1228.5 Conditional Probabilities 1248.6 Experiment and Comparison 1259 Calibration Techniques 1279.1 Calibrated Features 1279.2 JPEG Calibration 1299.2.1 The FRI-23 feature set 1299.2.2 The Pevný features and Cartesian Calibration 1319.3 Calibration by Downsampling 1329.3.1 Down-sampling as calibration 1339.3.2 Calibrated HCF-COM 1349.3.3 The sum and difference images 1369.3.4 Features for colour images 1389.3.5 Pixel Selection 1399.3.6 Other Features based on Downsampling 1419.3.7 Evaluation and Notes 1429.4 Calibration in General 1429.5 Progressive Randomisation 143Part Three Classifiers 14510 Simulation and Evaluation 14710.1 Estimation and Simulation 14710.1.1 The binomial distribution 14710.1.2 Probabilities and Sampling 14810.1.3 Monte Carlo simulations 15010.1.4 Confidence intervals 15110.2 Scalar measures 15210.2.1 Two error types 15210.2.2 Common scalar measures 15410.3 The Receiver Operating Curve 15510.3.1 The libSVM API for Python 15610.3.2 The ROC curve 15810.3.3 Choosing a Point on the ROC Curve 16010.3.4 Confidence and variance 16110.3.5 The area under the curve 16310.4 Experimental Methodology 16410.4.1 Feature Storage 16510.4.2 Parallel computation 16610.4.3 The dangers of large-scale experiments 16710.5 Comparison and hypothesis testing 16710.5.1 The hypothesis test 16810.5.2 Comparing two binomial proportions 16810.6 Summary 17011 Support Vector Machines 17111.1 Linear Classifiers 17111.1.1 Linearly Separable Problems 17211.1.2 Non-separable Problems 17511.2 The kernel function 17911.2.1 Example: the XOR function 17911.2.2 The SVM algorithm 18011.3 --SVM 18211.4 Multi-class methods 18311.5 One-class methods 18411.5.1 The one-class SVM solution 18511.5.2 Practical problems 18611.5.3 Multiple hyperspheres 18711.6 Summary 18712 Other Classification Algorithms 18912.1 Bayesian Classifiers 19012.1.1 Classification Regions and Errors 19112.1.2 Misclassification risk 19212.1.3 The naïve Bayes classifier 19312.1.4 A security criterion 19412.2 Estimating Probability Distributions 19512.2.1 The histogram 19512.2.2 The kernel density estimator 19612.3 Multivariate Regression Analysis 20112.3.1 Linear Regression 20112.3.2 Support Vector Regression 20212.4 Unsupervised Learning 20412.4.1 K-means clustering 20412.5 Summary 20613 Feature Selection and Evaluation 20713.1 Overfitting and Underfitting 20713.1.1 Feature Selection and Feature Extraction 20913.2 Scalar feature selection 20913.2.1 Analysis of Variance 21013.3 Feature Subset Selection 21213.3.1 Subset Evaluation 21313.3.2 Search Algorithms 21313.4 Selection using Information Theory 21413.4.1 Entropy 21513.4.2 Mutual Information 21613.4.3 Multivariate Information 21913.4.4 Information Theory with Continuous Sets 22113.4.5 Estimation of entropy and information 22213.4.6 Ranking Features 22313.5 Boosting feature selection 22513.6 Applications in Steganalysis 22813.6.1 Correlation coefficient 22913.6.2 Optimised feature vectors for JPEG 22914 The Steganalysis Problem 23314.1 Different use cases 23314.1.1 Who are Alice and Bob? 23314.1.2 Wendy’s role 23514.1.3 Pooled Steganalysis 23614.1.4 Quantitative Steganalysis 23714.2 Images and Training Sets 23814.2.1 Choosing Cover Source 23814.2.2 The Training Scenario 24114.2.3 The Steganalytic Game 24414.3 Composite Classifier Systems 24614.3.1 Fusion 24614.3.2 A multi-layer classifier for JPEG 24814.3.3 Benefits of composite classifiers 24914.4 Summary 24915 Future of the Field 25115.1 Image Forensics 25115.2 Conclusions and notes 253Bibliography 255Index 263