Pooled Steganalysis via Model Discrepancy

Abstract

Pooled steganalysis aims to discover the guilty actor(s) among multiple normal actor(s). Existing techniques mainly rely on the high-dimension and time-consuming features. Moreover, the minor feature distance between cover and stego is detrimental to pooled steganalysis. To overcome these issues, this paper focuses on the discrepancy of the statistical characteristics of transmitted multiple images and designs a model-based effective pooled steganalysis strategy. Facing the public and monitored channel, without using the feature extractions, pooled steganalysis collects a set of images transmitted by a suspicious actor and use the corresponding distortion values as the statistic representation of the selected image set. Specifically, the normalized distortion of the suspicious image set generated via normal/guilty actor(s) is modelled as a normal distribution, and we apply maximum likelihood estimation (MLE) to estimate the parameter (cluster center) of the distribution by which we can represent the defined model. Considering the tremendous distortion difference between normal and stego image sets, we can deduce that the constructed model can effectively discover and reveal the existence of abnormal behavior of guilty actors. To show the discrepancy of different models, employing the logistic function and likelihood ratio test (LRT), we construct a new detector by which the ratio of cluster centers is turned into a probability. Depending on the generated probability and an optimal threshold, we make a judgment on whether the dubious actor is normal or guilty. Extensive experiments demonstrate that, compared to existing pooled steganalysis techniques, the proposed scheme exhibits great detection performance on the guilty actor(s) with lower complexity.