CN103236265A - MP3Stegz steganography detecting method - Google Patents
MP3Stegz steganography detecting method Download PDFInfo
- Publication number
- CN103236265A CN103236265A CN2013101197506A CN201310119750A CN103236265A CN 103236265 A CN103236265 A CN 103236265A CN 2013101197506 A CN2013101197506 A CN 2013101197506A CN 201310119750 A CN201310119750 A CN 201310119750A CN 103236265 A CN103236265 A CN 103236265A
- Authority
- CN
- China
- Prior art keywords
- byte
- latent
- frame
- bytes
- audio file
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Landscapes
- Signal Processing For Digital Recording And Reproducing (AREA)
- Management Or Editing Of Information On Record Carriers (AREA)
Abstract
The invention discloses an MP3Stegz steganography detecting method. The MP3Stegz steganography detecting method: opening an MP3 (moving picture experts group audio layer-3) audio file to be detected in a binary stream manner; sequentially finding out every frame in a binary stream of the MP3 audio file; and determining whether every frame is subjected to MP3Stegz steganalysis or not by analyzing the 37th to the 41st bytes and the 42nd to the 56th bytes in the frame. The MP3Stegz steganography detecting method has the advantages that the MP3 audio file can be accurately detected whether to be subjected to MP3Stegz steganalysis or not by analyzing the 37th to the 41st bytes and the 42nd to the 56th bytes in every frame in the binary stream of the MP3 audio file, and the MP3Stegz steganography detecting method is stable in performance, high in detecting accuracy and low in computation complexity.
Description
Technical field
The present invention relates to that a kind of audio frequency is latent writes detection technique, especially relate to a kind of latent writing detection method at MP3Stegz.
Background technology
Steganography is an important branch of Information hiding, and it is a kind of technology that is hidden in secret information in the host signal and does not know the third party to propagate by common signal channel under the situation of its existence.Conceal and write the opposition technology that detection technique then is Steganography, its objective is to disclose whether have secret information in the suspicious carrier signal so that destroy covert communications.
As one of most popular audio format on the present internet, the MP3 audio frequency has obtained using widely, and therefore Steganography and the latent detection technique of writing at the MP3 audio frequency also constantly develops in game.The latent writing tools that has occurred some MP3 audio frequency in recent years, as MP3Stego, UnderMP3Cover, MP3Stegz etc., meanwhile the latent writing detection method at various latent writing toolss is also proposed in succession, has proposed people such as a kind of latent writing detection method at MP3Stego, Jin as people such as Qiao and has proposed a kind of latent writing detection method at UnderMP3Cover etc.Yet the latent writing detection method at the latent writing tools of MP3Stegz yet there are no concrete report at present.
Summary of the invention
Technical matters to be solved by this invention provides a kind of latent writing detection method at MP3Stegz, and whether it can detect the MP3 audio frequency exactly and be write by MP3Stegz is latent, and testing process is simple, computation complexity is low.
The present invention solves the problems of the technologies described above the technical scheme that adopts: a kind of latent writing detection method at MP3Stegz is characterized in that may further comprise the steps:
1. open MP3 audio file to be detected in the binary stream mode;
2. from the binary stream of this MP3 audio file, find out first frame, and first frame definition that will find out is present frame;
3. judge whether 8 bits of each byte in the 37th～40 byte in the present frame are the ASC II sign indicating number of character " X ", and whether 8 bits of the 41st byte in the present frame are the ASC II sign indicating number of any character in character " 1 "～" 9 ", if, then execution in step 4., otherwise execution in step 5.;
4. judge whether exist two continuous bytes to meet the following conditions in the 42nd～56 byte in the present frame: 8 bits of the 1st byte in two continuous bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in two continuous bytes are the ASC II sign indicating number of character ". ", if exist, then definite this MP3 audio file conceals through MP3Stegz and write, finish the latent detection of writing, otherwise execution in step 5.;
5. judge that whether present frame is the last frame in the binary stream of this MP3 audio file, if, then definite this MP3 audio file was write without MP3Stegz is latent, finish the latent detection of writing, otherwise, from the binary stream of this MP3 audio file, find out next frame, this frame as present frame, is returned step then and 3. continues to carry out.
Described step is found out first frame in 2. from the binary stream of this MP3 audio file process is: the 1st byte from the binary stream of this MP3 audio file begins, byte-by-byte inquiry, be followed successively by 11111111 and during 1111101* when retrieving continuous two bytes, 8 bits separately, determine the byte that the 1st byte in these two continuous bytes begins for first frame in the binary stream of this MP3 audio file, wherein, * represents binary number 0 or 1.
Described step is found out next frame in 5. from the binary stream of this MP3 audio file process is: the length that goes out present frame according to the information calculations in the frame head of present frame, a byte after last byte of present frame, byte-by-byte inquiry, satisfy successively when retrieving continuous three bytes, 8 bits separately: be 11111111, be 111*****, high 4 is not 1 entirely, then determine the byte that the 1st byte in these three continuous bytes begins for the next frame in the binary stream of this MP3 audio file, wherein, * represents binary number 0 or 1
A kind of latent writing detection method at MP3Stegz is characterized in that may further comprise the steps:
1) opens MP3 audio file to be detected in the binary stream mode;
2) find out first frame from the binary stream of this MP3 audio file, and first frame definition that will find out is present frame, makes count represent the latent order of writing again, the initial value of count is 0;
3) judge whether 8 bits of each byte in the 37th～40 byte in the present frame are the ASC II sign indicating number of character " X ", and whether 8 bits of the 41st byte in the present frame are the ASC II sign indicating number of any character in character " 1 "～" 9 ", if, then execution in step 4), otherwise, execution in step 6);
4) judge in the 42nd～56 byte in the present frame whether exist two continuous bytes to meet the following conditions: 8 bits of the 1st byte in two continuous bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in two continuous bytes are the ASC II sign indicating number of character ". ", if exist, then make count=count+1, wherein, "=" is assignment herein, and execution in step 5 then), otherwise, execution in step 6);
5) output conceals the order count that writes, the latent reference position of writing, and extracts the form of the latent secret information of writing and the size after the latent secret information encryption of writing, and execution in step 6 then);
6) judge that whether present frame is the last frame in the binary stream of this MP3 audio file, if then execution in step 7), otherwise, from the binary stream of this MP3 audio file, find out next frame, this frame as present frame, is returned step 3) then and continues to carry out;
7) whether the value of judging count is 0, if, determine that then this MP3 audio file write without MP3Stegz is latent, finish the latent detection of writing, otherwise, determine that this MP3 audio file write through MP3Stegz is latent, finish the latent detection of writing.
Described step 2) process of finding out first frame in from the binary stream of this MP3 audio file is: the 1st byte from the binary stream of this MP3 audio file begins, byte-by-byte inquiry, be followed successively by 11111111 and during 1111101* when retrieving continuous two bytes, 8 bits separately, determine the byte that the 1st byte in these two continuous bytes begins for first frame in the binary stream of this MP3 audio file, wherein, * represents binary number 0 or 1.
The process of finding out from the binary stream of this MP3 audio file in the described step 6) is: the length that goes out present frame according to the information calculations in the frame head of present frame, a byte after last byte of present frame, byte-by-byte inquiry, satisfy successively when retrieving continuous three bytes, 8 bits separately: be 11111111, for 111*****, high 4 be not 1 entirely, then determine the byte that the 1st byte in these three continuous bytes begins for the next frame in the binary stream of this MP3 audio file, wherein, * represents binary number 0 or 1.
The latent reference position of writing is the position of the 41st byte in the present frame in the described step 5).
The form of the latent secret information of writing is determined by three bytes after the 2nd byte in continuous two bytes that meet the following conditions in the 42nd～56 byte in the present frame in the described step 5): 8 bits of the 1st byte in continuous two bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II sign indicating number of character ". ".
Size after the latent secret information of writing is encrypted in the described step 5) is by the 40th byte in the present frame, and several bytes between the 1st byte in continuous two bytes that meet the following conditions in the 42nd～56 byte are determined: 8 bits of the 1st byte in continuous two bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II sign indicating number of character ". ".
Compared with prior art, the invention has the advantages that:
1) by the 37th～41 byte and the 42nd～56 byte in every frame of analyzing the MP3 audio file, can detect this MP3 audio file exactly and whether write through MP3Stegz is latent, and performance sane, detect the accuracy rate height, computation complexity is low.
2) by analyzing in the MP3 audio file by the 41st～56 byte in the latent frame of writing of MP3Stegz, find two continuous bytes to meet the following conditions: 8 bits of previous byte are the ASC II sign indicating number of character " # ", and 8 bits of a back byte are the ASC II sign indicating number of character ". "; Several bytes between the 1st byte of two the continuous bytes that satisfy condition to this according to the 40th byte of this frame then, can obtain the size after secret information is encrypted, can obtain the form of secret information according to three continuous bytes after the 2nd byte in these two continuous bytes that satisfy condition, by analyzing in the MP3 audio file by the 41st～56 byte in the latent frame of writing of MP3Stegz, can obtain when time latent reference position of writing.
Embodiment
Describe in further detail below in conjunction with the present invention of embodiment.
MP3Stegz is one of at present popular latent writing tools of MP3, its the latent process of writing is: but use the partial bytes of replacing the embedding frame by the byte that converts to after the secret information encryption, simultaneously it latent write the content of secret information own before, can be with the extension name of secret information and latent the writing among the MP3 of size after encrypting.It is whole latent write process and is broadly divided into two parts: handle secret information, latent secret information itself and the relevant information thereof write, handle the secret information part and mainly finish: according to password secret information is encrypted, and extracts size after extension name and the encryption; Latent write secret information itself and related information section mainly is according to steganography method extension name and itself the concealing of size and secret information of last extracting section to be write.
At the latent principle of writing of MP3Stegz, the present invention proposes and detect accuracy rate height, the latent writing detection method at MP3Stegz that computation complexity is low.
Embodiment one:
The latent writing detection method of present embodiment may further comprise the steps:
1. open MP3 audio file to be detected in the binary stream mode.
2. from the binary stream of this MP3 audio file, find out first frame, and first frame definition that will find out is present frame.
In this specific embodiment, step is found out first frame in 2. from the binary stream of this MP3 audio file process is: the 1st byte from the binary stream of this MP3 audio file begins, byte-by-byte inquiry, be followed successively by 11111111 and during 1111101* when retrieving continuous two bytes, 8 bits separately, determine the byte that the 1st byte in these two continuous bytes begins for first frame in the binary stream of this MP3 audio file, wherein, * represent binary number 0 or 1, namely 1111101* comprises 11111010 and 11111011.
3. judge whether 8 bits of each byte in the 37th～40 byte in the present frame are the ASC II sign indicating number of character " X ", and whether 8 bits of the 41st byte in the present frame are the ASC II sign indicating number of any character in character " 1 "～" 9 ", if, then execution in step 4., otherwise execution in step 5..
4. judge whether exist two continuous bytes to meet the following conditions in the 42nd～56 byte in the present frame: 8 bits of the 1st byte in two continuous bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in two continuous bytes are the ASC II sign indicating number of character ". ", if exist, then definite this MP3 audio file conceals through MP3Stegz and write, finish the latent detection of writing, otherwise execution in step 5..
5. judge that whether present frame is the last frame in the binary stream of this MP3 audio file, if, then definite this MP3 audio file was write without MP3Stegz is latent, finish the latent detection of writing, otherwise, from the binary stream of this MP3 audio file, find out next frame, this frame as present frame, is returned step then and 3. continues to carry out.At this, judge that whether present frame is that last frame in the binary stream of this MP3 audio file adopts common technology, as no datat can be when reading in after last byte in the present frame, can determine that this present frame is the last frame in the binary stream of this MP3 audio file.
In this specific embodiment, step is found out next frame in 5. from the binary stream of this MP3 audio file process is: according to the information (layer in the frame head of present frame, bitrateIndex, samplingFrequency, paddingBit) calculate the length of present frame, a byte after last byte of present frame, byte-by-byte inquiry, satisfy successively when retrieving continuous three bytes, 8 bits separately: be 11111111, be 111*****, high 4 do not require low 4 for 1(entirely), then determine the byte that the 1st byte in these three continuous bytes begins for the next frame in the binary stream of this MP3 audio file, wherein, * represents binary number 0 or 1.
Embodiment two:
The latent writing detection method of present embodiment may further comprise the steps:
1) opens MP3 audio file to be detected in the binary stream mode.
2) find out first frame from the binary stream of this MP3 audio file, and first frame definition that will find out is present frame, makes count represent the latent order of writing again, the initial value of count is 0.
In this specific embodiment, step 2) process of finding out first frame in from the binary stream of this MP3 audio file is: the 1st byte from the binary stream of this MP3 audio file begins, byte-by-byte inquiry, be followed successively by 11111111 and during 1111101* when retrieving continuous two bytes, 8 bits separately, determine the byte that the 1st byte in these two continuous bytes begins for first frame in the binary stream of this MP3 audio file, wherein, * represent binary number 0 or 1, namely 1111101* comprises 11111010 and 11111011.
3) judge whether 8 bits of each byte in the 37th～40 byte in the present frame are the ASC II sign indicating number of character " X ", and whether 8 bits of the 41st byte in the present frame are the ASC II sign indicating number of any character in character " 1 "～" 9 ", if, then execution in step 4), otherwise, determine that present frame write without MP3Stegz is latent, execution in step 6 then).
4) judge in the 42nd～56 byte in the present frame whether exist two continuous bytes to meet the following conditions: 8 bits of the 1st byte in two continuous bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in two continuous bytes are the ASC II sign indicating number of character ". ", if exist, then make count=count+1, wherein, "=" is assignment herein, and execution in step 5 then), otherwise, execution in step 6).
5) output conceals the order count that writes, the latent reference position of writing, and extracts the form of the latent secret information of writing and the size after the latent secret information encryption of writing, and execution in step 6 then).
At this, the latent reference position of writing is the position of the 41st byte in the present frame, and 8 bits that are each byte in the 37th～40 byte in the present frame are last byte byte afterwards of the ASC II sign indicating number of character " X ".
At this, the form of the latent secret information of writing is determined by three bytes after the 2nd byte in continuous two bytes that meet the following conditions in the 42nd～56 byte in the present frame: 8 bits of the 1st byte in continuous two bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II sign indicating number of character ". ".8 bits of supposing the 45th byte in the present frame are 00100011, it is the ASC II sign indicating number of character " # ", 8 bits of the 46th byte in the present frame are 00101110, it is the ASC II sign indicating number of character ". ", then the form of the latent secret information of writing is determined by three bytes after the 46th byte in the present frame, is namely determined by the 47th byte in the present frame, the 48th byte and the 49th byte.
At this, size after the latent secret information of writing is encrypted is by the 40th byte in the present frame, and several bytes between the 1st byte in continuous two bytes that meet the following conditions in the 42nd～56 byte are determined: 8 bits of the 1st byte in continuous two bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II sign indicating number of character ". ".8 bits of supposing the 45th byte in the present frame are 00100011, it is the ASC II sign indicating number of character " # ", 8 bits of the 46th byte in the present frame are 00101110, it is the ASC II sign indicating number of character ". ", size after then the latent secret information of writing is encrypted is determined by all bytes between the 45th byte in the 40th byte in the present frame and the present frame, and is namely definite by the 41st～44 byte in the present frame.
6) judge that whether present frame is the last frame in the binary stream of this MP3 audio file, if then execution in step 7), otherwise, from the binary stream of this MP3 audio file, find out next frame, this frame as present frame, is returned step 3) then and continues to carry out.At this, judge that whether present frame is that last frame in the binary stream of this MP3 audio file adopts common technology, as no datat can be when reading in after last byte in the present frame, can determine that this present frame is the last frame in the binary stream of this MP3 audio file.
In this specific embodiment, the process of finding out from the binary stream of this MP3 audio file in the step 6) is: according to the information (layer in the frame head of present frame, bitrateIndex, samplingFrequency, paddingBit) calculate the length of present frame, a byte after last byte of present frame, byte-by-byte inquiry, satisfy successively when retrieving continuous three bytes, 8 bits separately: be 11111111, be 111*****, high 4 do not require low 4 for 1(entirely), then determine the byte that the 1st byte in these three continuous bytes begins for the next frame in the binary stream of this MP3 audio file, wherein, * represents binary number 0 or 1.
7) whether the value of judging count is 0, if, determine that then this MP3 audio file write without MP3Stegz is latent, finish the latent detection of writing, otherwise, determine that this MP3 audio file write through MP3Stegz is latent, finish the latent detection of writing.
Whether above-described embodiment one has only detected the MP3 audio file and had write through MP3Stegz is latent, and embodiment two is on the basis of embodiment one, export each latent order count that writes, the latent reference position of writing again, and extracted the size after the form that conceals the secret information of writing is encrypted with the latent secret information of writing.
Be validity and the feasibility that the inventive method is described better, the latent writing detection method that utilizes embodiment two to provide conceals writes test experience.
The latent test experience one of writing:
To concealing the process of writing detection without the latent MP3 audio file of writing of MP3Stegz be:
1, from downloading the audio file (as testcase.mp3) of a MP3 format on the Internet at random, important parameter such as the table 1 of testcase.mp3 are listed, open testcase.mp3 with binary mode then.
The important parameter tabulation of table 1 MP3 audio frequency testcase.mp3
| File size | 3776512 bytes |
| Duration | 3 minutes 55 seconds |
| Sample frequency | 44.1KHz |
| Bit rate | 128Kbps |
2, the 1st byte from the binary stream of testcase.mp3 begins, byte-by-byte inquiry, when retrieving the 1378th and 1379 bytes, because their 8 bits separately are followed successively by 11111111,1111101*, satisfy the condition of first frame in the binary stream that becomes testcase.mp3, therefore determine the byte that first frame in the binary stream that the 1378th byte is testcase.mp3 begins, then with first frame as present frame.
3, the 37th～41 byte in the inspection present frame finds that 8 bits of each byte in preceding 4 bytes are 11111111, is not the ASC II sign indicating number of character " X "; 8 bits of the 5th byte of same discovery are 11111111, are not the ASC II sign indicating numbers of any one character in character " 1 "～" 9 ", and therefore definite present frame was write without MP3Stegz is latent.
4, check present frame whether be in the binary stream of testcase.mp3 last frame, when being not last frame, the length that obtains present frame according to the information calculations in the frame head of present frame is 418 bytes, and last byte of acquisition present frame, be the 1796th byte, then since the 1797th the byte-by-byte inquiry of byte, satisfy successively when retrieving continuous three bytes, 8 bits separately: be 11111111, be 111*****, high 4 do not require low 4 for 1(entirely), the byte that begins of the next frame in the binary stream that is testcase.mp3 of the 1st byte in definite these three continuous bytes then.
5, with next frame as present frame, whether continue to detect these present frames by said process 3 and 4 write through MP3Stegz is latent, constantly detect each frame according to the method, last frame in the binary stream of testcase.mp3, all frames in testing process in the binary stream of discovery testcase.mp3 all do not satisfy following two conditions simultaneously: 1. in 5 bytes of the 37th～41 in every frame, 8 bits of each byte in preceding 4 bytes are the ASC II sign indicating number of character " X ", and the binary number of the 5th byte is the ASC II sign indicating number of any one character in character " 1 "～" 9 "; 2. continuous two bytes that meet the following conditions are arranged in the 42nd～56 byte in every frame: 8 bits of the 1st byte in continuous two bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II sign indicating number of character ". ".Therefore, determine that this MP3 audio file write without MP3Stegz is latent, so far finish the latent detection of writing.
The latent test experience two of writing:
To concealing the process of writing detection through the latent MP3 audio file of writing of MP3Stegz be:
1, suppose that MP3 audio file to be detected is testcase_steg.mp3 herein, being the testcase.mp3 of experiment in one writes 4 times and obtains through MP3Stegz is latent, and these 4 times latent particular content such as the tables of writing 2 are listed.
Table 2 testcase_steg.mp3 audio file is by the tabulation of the latent order of writing and each latent content of writing
| The latent order of writing | The latent content of writing |
| ? | Type | Form | Encrypt the back size |
| The 1st time | Video | FLV | 43213 bytes |
| The 2nd time | Picture | JPG | 7072 bytes |
| The 3rd time | Audio frequency | MP3 | 16432 bytes |
| The 4th | Text | TXT | 52 bytes |
2, the 1st byte from the binary stream of testcase_steg.mp3 begins, byte-by-byte inquiry, when retrieving the 1378th and 1379 bytes, because their 8 bits separately are followed successively by 11111111,1111101*, satisfy the condition of first frame in the binary stream that becomes testcase_steg.mp3, therefore determine the byte that first frame in the binary stream that the 1378th byte is testcase_steg.mp3 begins, then with first frame as present frame.
3, the 37th～41 byte in the inspection present frame, 8 bits of finding each byte in preceding 4 bytes are 01011000, all be the ASC II sign indicating number of character " X ", find that equally 8 bits of the 5th byte are 00110100, be the ASC II sign indicating number of character " 4 "; Reexamining the 42nd～56 byte in the present frame, find that 8 bits of the 46th byte are 00100011, is the ASC II sign indicating number of character " # ", and 8 bits of the 47th byte are 00101110, is the ASC II sign indicating number of character ". "; Make this moment the latent order count that writes add 1.
4, the latent order count that writes of output and the latent reference position of writing, detecting the latent order of writing of this time is the 1st time; The latent reference position of writing is the position of the 41st byte in the present frame, is the 1418th byte in the binary stream of testcase_steg.mp3.
Extract the form of the latent secret information of writing and the size after the latent secret information encryption of writing, in the 1st latent writing, with the 1st byte in continuous two bytes that meet the following conditions in the 40th byte in the present frame and the 42nd～56 byte (for first frame, be the 46th byte in first frame) between all byte-extraction come out: 8 bits of the 1st byte in continuous two bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II sign indicating number of character ". ".Namely extract the 41st～45 byte in the present frame, their 8 bits separately are respectively 00110100,00110011,00110010,00110001,00110011, wherein, 00110100 is the ASC II sign indicating number of character " 4 ", 00110011 is the ASC II sign indicating number of character " 3 ", 00110010 is the ASC II sign indicating number of character " 2 ", 00110001 is the ASC II sign indicating number of character " 1 ", 00110011 is the ASC II sign indicating number of character " 3 ", and the size that namely obtains after the latent secret information of writing is encrypted is 43213 bytes; In the 1st latent writing, with the 2nd byte in continuous two bytes that meet the following conditions in the 42nd～56 byte in the present frame (for first frame, being the 47th byte in first frame) afterwards three byte-extraction come out, namely extract the 48th, the 49th and the 50th byte, their 8 bits separately are respectively 01100110,01101100,01110110, wherein, 01100110 is the ASC II sign indicating number of character " f ", 01101100 is the ASC II sign indicating number of character " l ", 01110110 is the ASC II sign indicating number of character " v ", and namely the form of the latent secret information of writing of expression is flv.
5, check that whether present frame is the last frame in the binary stream of testcase_steg.mp3, when being not last frame, the length that obtains present frame according to the information calculations in the frame head of present frame is 418 bytes, and last byte that obtains present frame is the 1796th byte in the binary stream of testcase.mp3, then since the 1797th the byte-by-byte inquiry of byte, 8 bits of each byte in retrieving three continuous bytes satisfy successively: be 11111111, be 111*****, high 4 do not require low 4 for 1(entirely), the byte that begins of the next frame in the binary stream that is testcase_steg.mp3 of the 1st byte in definite these three continuous bytes then.
6, with next frame as present frame, whether continue to detect these present frames by said process 3 and 4 write through MP3Stegz is latent, constantly detect each frame according to the method, last frame in the binary stream of testcase.mp3, the 8944th frame in testing process in the binary stream of discovery testcase_steg.mp3, the 8964th frame, the 9009th frame all satisfies following two conditions simultaneously: 1. in 5 bytes of the 37th～41 in every frame, 8 bits of each byte in preceding 4 bytes are the ASC II sign indicating number of character " X ", and 8 bits of the 5th byte are the ASC II sign indicating number of any one character in character " 1 "～" 9 "; 2. continuous two bytes that meet the following conditions are arranged in the 42nd～56 byte in every frame: 8 bits of the 1st byte in continuous two bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II sign indicating number of character ". ".For the 8944th frame, detecting to concealing the order of writing is the 2nd time, the 3739227th byte in the binary stream that the latent reference position of writing is testcase.mp3, the form of the latent secret information of writing is jpg, the size after the latent secret information of writing is encrypted is 7072 bytes; For the 8964th frame, detecting to concealing the order of writing is the 3rd time, the 3747586th byte in the binary stream that the latent reference position of writing is testcase.mp3, the form of the latent secret information of writing is mp3, the size after the latent secret information of writing is encrypted is 16432 bytes; For the 9009th frame, detecting to concealing the order of writing is the 4th, the 3766394th byte in the binary stream that the latent reference position of writing is testcase.mp3, the form of the latent secret information of writing is txt, the size after the latent secret information of writing is encrypted is 52 bytes.
7, this moment count value be 4, therefore determine that this MP3 audio file write through MP3Stegz is latent, and the latent number of times of writing is 4 times, so far finish the latent detection of writing.
Can illustrate well that by above-mentioned two experiments the inventive method can detect the MP3 audio file accurately and whether write through MP3Stegz is latent, and the size after can obtaining the form of the latent order of writing, the latent reference position of writing, the latent secret information of writing and the latent secret information of writing accurately and encrypting.This has been enough to illustrate validity and the feasibility of the inventive method.
Below for the performance of the inventive method is analyzed.
First kind sample is for concealing the MP3 audio file of writing without MP3Stegz: the audio file of the MP3 format of downloading at random on the 200 first the Internets, each MP3 audio file 3～5 minutes, 7 kinds of encoder type (comprising Lame, Xing, Gogo, Blade, FhG, Shine, Plugger), 3 kinds of coding modes (VBR(variable bit rate), ABR(mean speed) and the CBR(fixed rate) three kinds, wherein under the CBR situation, code rate comprises 96,112,128,160,192,256,320kbps etc.); The second class sample is for concealing the MP3 audio file of writing through MP3Stegz: form is respectively 4 kinds of multimedia files of TXT, MP3, JPG, FLV as secret information, and by MP3Stegz latent writing in 200 samples of first kind sample at random, produce latent each 50 in sample writing 1 time, 2 times, 3 times, 4 times respectively at last, totally 200.
Utilize the inventive method that all samples in the above-mentioned two class samples are concealed and write detection, the false alarm rate of detection, loss and just inspection rate such as table 3 are listed.
Table 3 utilizes the inventive method to concealing the result who writes detection without the latent MP3 audio file of writing of MP3Stegz with through the latent MP3 audio file of writing of MP3Stegz
As can be seen from Table 3, whether the inventive method can 100% audio file that judges rightly a first MP3 format passes through the latent write operation of MP3Stegz.Table 4 has provided and has utilized the inventive method that all samples in the above-mentioned two class samples are concealed to write the on average consuming time of detection.
Table 4 utilizes the inventive method that all samples in the above-mentioned two class samples are concealed and writes the on average consuming time of detection
As can be seen from Table 4, the computation complexity of the inventive method is low, and operational efficiency is higher, and the MP3 audio file of average detected one first normal size (3～5 minutes) is consuming time between 0.3 second to 0.4 second, function admirable.
Claims (9)
1. latent writing detection method at MP3Stegz is characterized in that may further comprise the steps:
1. open MP3 audio file to be detected in the binary stream mode;
2. from the binary stream of this MP3 audio file, find out first frame, and first frame definition that will find out is present frame;
3. judge whether 8 bits of each byte in the 37th～40 byte in the present frame are the ASC II sign indicating number of character " X ", and whether 8 bits of the 41st byte in the present frame are the ASC II sign indicating number of any character in character " 1 "～" 9 ", if, then execution in step 4., otherwise execution in step 5.;
4. judge whether exist two continuous bytes to meet the following conditions in the 42nd～56 byte in the present frame: 8 bits of the 1st byte in two continuous bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in two continuous bytes are the ASC II sign indicating number of character ". ", if exist, then definite this MP3 audio file conceals through MP3Stegz and write, finish the latent detection of writing, otherwise execution in step 5.;
5. judge that whether present frame is the last frame in the binary stream of this MP3 audio file, if, then definite this MP3 audio file was write without MP3Stegz is latent, finish the latent detection of writing, otherwise, from the binary stream of this MP3 audio file, find out next frame, this frame as present frame, is returned step then and 3. continues to carry out.
2. a kind of latent writing detection method at MP3Stegz according to claim 1, it is characterized in that the process of finding out first frame during described step 2. from the binary stream of this MP3 audio file is: the 1st byte from the binary stream of this MP3 audio file begins, byte-by-byte inquiry, be followed successively by 11111111 and during 1111101* when retrieving continuous two bytes, 8 bits separately, determine the byte that the 1st byte in these two continuous bytes begins for first frame in the binary stream of this MP3 audio file, wherein, * represents binary number 0 or 1.
3. a kind of latent writing detection method at MP3Stegz according to claim 1 and 2, it is characterized in that the process of finding out next frame during described step 5. from the binary stream of this MP3 audio file is: the length that goes out present frame according to the information calculations in the frame head of present frame, a byte after last byte of present frame, byte-by-byte inquiry, satisfy successively when retrieving continuous three bytes, 8 bits separately: be 11111111, be 111*****, high 4 is not 1 entirely, then determine the byte that the 1st byte in these three continuous bytes begins for the next frame in the binary stream of this MP3 audio file, wherein, * represents binary number 0 or 1.
4. latent writing detection method at MP3Stegz is characterized in that may further comprise the steps:
1) opens MP3 audio file to be detected in the binary stream mode;
2) find out first frame from the binary stream of this MP3 audio file, and first frame definition that will find out is present frame, makes count represent the latent order of writing again, the initial value of count is 0;
3) judge whether 8 bits of each byte in the 37th～40 byte in the present frame are the ASC II sign indicating number of character " X ", and whether 8 bits of the 41st byte in the present frame are the ASC II sign indicating number of any character in character " 1 "～" 9 ", if, then execution in step 4), otherwise, execution in step 6);
4) judge in the 42nd～56 byte in the present frame whether exist two continuous bytes to meet the following conditions: 8 bits of the 1st byte in two continuous bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in two continuous bytes are the ASC II sign indicating number of character ". ", if exist, then make count=count+1, wherein, "=" is assignment herein, and execution in step 5 then), otherwise, execution in step 6);
5) output conceals the order count that writes, the latent reference position of writing, and extracts the form of the latent secret information of writing and the size after the latent secret information encryption of writing, and execution in step 6 then);
6) judge that whether present frame is the last frame in the binary stream of this MP3 audio file, if then execution in step 7), otherwise, from the binary stream of this MP3 audio file, find out next frame, this frame as present frame, is returned step 3) then and continues to carry out;
7) whether the value of judging count is 0, if, determine that then this MP3 audio file write without MP3Stegz is latent, finish the latent detection of writing, otherwise, determine that this MP3 audio file write through MP3Stegz is latent, finish the latent detection of writing.
5. a kind of latent writing detection method at MP3Stegz according to claim 4, it is characterized in that described step 2) in from the binary stream of this MP3 audio file, find out first frame process be: the 1st byte from the binary stream of this MP3 audio file begins, byte-by-byte inquiry, be followed successively by 11111111 and during 1111101* when retrieving continuous two bytes, 8 bits separately, determine the byte that the 1st byte in these two continuous bytes begins for first frame in the binary stream of this MP3 audio file, wherein, * represents binary number 0 or 1.
6. according to claim 4 or 5 described a kind of latent writing detection methods at MP3Stegz, it is characterized in that the process of finding out in the described step 6) is: the length that goes out present frame according to the information calculations in the frame head of present frame from the binary stream of this MP3 audio file, a byte after last byte of present frame, byte-by-byte inquiry, satisfy successively when retrieving continuous three bytes, 8 bits separately: be 11111111, be 111*****, high 4 is not 1 entirely, then determine the byte that the 1st byte in these three continuous bytes begins for the next frame in the binary stream of this MP3 audio file, wherein, * represents binary number 0 or 1.
7. a kind of latent writing detection method at MP3Stegz according to claim 6 is characterized in that the latent reference position of writing is the position of the 41st byte in the present frame in the described step 5).
8. a kind of latent writing detection method at MP3Stegz according to claim 7, the form that it is characterized in that the latent secret information of writing in the described step 5) is determined by three bytes after the 2nd byte in continuous two bytes that meet the following conditions in the 42nd～56 byte in the present frame: 8 bits of the 1st byte in continuous two bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II sign indicating number of character ". ".
9. a kind of latent writing detection method at MP3Stegz according to claim 8, it is characterized in that the size after the latent secret information encryption of writing is by the 40th byte in the present frame in the described step 5), and several bytes between the 1st byte in continuous two bytes that meet the following conditions in the 42nd～56 byte are determined: 8 bits of the 1st byte in continuous two bytes are the ASC II sign indicating number of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II sign indicating number of character ". ".
Priority Applications (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310119750.6A CN103236265B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
| CN201510228165.9A CN104821169B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201310119750.6A CN103236265B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
Related Child Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510228165.9A Division CN104821169B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN103236265A true CN103236265A (en) | 2013-08-07 |
| CN103236265B CN103236265B (en) | 2015-10-14 |
Family
ID=48884301
Family Applications (2)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310119750.6A Expired - Fee Related CN103236265B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
| CN201510228165.9A Active CN104821169B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
Family Applications After (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201510228165.9A Active CN104821169B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
Country Status (1)
| Country | Link |
|---|---|
| CN (2) | CN103236265B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104282310A (en) * | 2014-09-26 | 2015-01-14 | 宁波大学 | Steganography detection method for audio subjected to MP3Stego steganography |
| CN104485109A (en) * | 2013-01-22 | 2015-04-01 | 宁波大学 | Index value-based compressed domain audio digital extracting method |
| CN104637484A (en) * | 2015-02-03 | 2015-05-20 | 宁波大学 | MP3 audio steganography detection method based on co-occurrence matrix analysis |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105913856A (en) * | 2016-04-20 | 2016-08-31 | 深圳大学 | Audio tampering detection method and system based on amplitude co-occurrence vector characteristics |
| CN106228981B (en) * | 2016-08-03 | 2019-07-19 | 中山大学 | A kind of adaptive steganography method of MP3 based on compression domain |
Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20030009670A1 (en) * | 2001-04-02 | 2003-01-09 | Digimarc Corporation | Background watermark processing |
| US20030026447A1 (en) * | 2001-06-22 | 2003-02-06 | Jessica Fridrich | Reliable detection of LSB steganography in color and grayscale images |
| JP2004080412A (en) * | 2002-08-19 | 2004-03-11 | Oki Electric Ind Co Ltd | Electronic watermark embedding device, electronic watermark detection device, and program |
| US20070104325A1 (en) * | 2005-11-09 | 2007-05-10 | Jong Lim | Apparatus and method of detecting steganography in digital data |
| CN101494051A (en) * | 2008-01-23 | 2009-07-29 | 武汉大学 | Detection method for time-domain audio LSB hidden write |
| CN101908203A (en) * | 2010-07-13 | 2010-12-08 | 中国科学院软件研究所 | Image and audio recoding-based steganography prevention method |
| CN102097098A (en) * | 2011-02-25 | 2011-06-15 | 宁波大学 | Digital steganography and digital extraction methods with compressed audio as masking carrier |
-
2013
- 2013-04-08 CN CN201310119750.6A patent/CN103236265B/en not_active Expired - Fee Related
- 2013-04-08 CN CN201510228165.9A patent/CN104821169B/en active Active
Patent Citations (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20030009670A1 (en) * | 2001-04-02 | 2003-01-09 | Digimarc Corporation | Background watermark processing |
| US20030026447A1 (en) * | 2001-06-22 | 2003-02-06 | Jessica Fridrich | Reliable detection of LSB steganography in color and grayscale images |
| JP2004080412A (en) * | 2002-08-19 | 2004-03-11 | Oki Electric Ind Co Ltd | Electronic watermark embedding device, electronic watermark detection device, and program |
| US20070104325A1 (en) * | 2005-11-09 | 2007-05-10 | Jong Lim | Apparatus and method of detecting steganography in digital data |
| CN101494051A (en) * | 2008-01-23 | 2009-07-29 | 武汉大学 | Detection method for time-domain audio LSB hidden write |
| CN101908203A (en) * | 2010-07-13 | 2010-12-08 | 中国科学院软件研究所 | Image and audio recoding-based steganography prevention method |
| CN102097098A (en) * | 2011-02-25 | 2011-06-15 | 宁波大学 | Digital steganography and digital extraction methods with compressed audio as masking carrier |
Non-Patent Citations (2)
| Title |
|---|
| 严迪群: "压缩域音频隐写与隐写分析中若干问题的研究", 《宁波大学博士论文》 * |
| 陈益如，王让定，严迪群: "基于Huffman码表索引的MP3Stego隐写分析方法", 《计算机工程与应用》 * |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104485109A (en) * | 2013-01-22 | 2015-04-01 | 宁波大学 | Index value-based compressed domain audio digital extracting method |
| CN104485109B (en) * | 2013-01-22 | 2017-09-29 | 宁波大学 | A kind of compressed domain audio digital extraction method based on index value |
| CN104282310A (en) * | 2014-09-26 | 2015-01-14 | 宁波大学 | Steganography detection method for audio subjected to MP3Stego steganography |
| CN104282310B (en) * | 2014-09-26 | 2017-05-03 | 宁波大学 | Steganography detection method for audio subjected to MP3Stego steganography |
| CN104637484A (en) * | 2015-02-03 | 2015-05-20 | 宁波大学 | MP3 audio steganography detection method based on co-occurrence matrix analysis |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104821169B (en) | 2018-04-17 |
| CN104821169A (en) | 2015-08-05 |
| CN103236265B (en) | 2015-10-14 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Chang et al. | Location based robust audio watermarking algorithm for social TV system | |
| CN103236265A (en) | MP3Stegz steganography detecting method | |
| AU2005241532B2 (en) | Identification of input files using reference files associated with nodes of a sparse binary tree | |
| CN102799605B (en) | A kind of advertisement detecting method and system | |
| KR102614021B1 (en) | Audio content recognition method and device | |
| Liu et al. | A novel speech content authentication algorithm based on Bessel–Fourier moments | |
| CN101458810A (en) | Vector map watermark method based on object property characteristic | |
| CN104282310B (en) | Steganography detection method for audio subjected to MP3Stego steganography | |
| CN102074240A (en) | Digital audio watermarking algorithm for copyright management | |
| CN104216964A (en) | Non-word segmentation emergent topic detection method for microblog | |
| CN103871405A (en) | AMR audio authenticating method | |
| CN110545284A (en) | Domain name detection method and system for antagonistic network | |
| CN105304091B (en) | A kind of voice tamper recovery method based on DCT | |
| Wu et al. | Robust and blind audio watermarking algorithm in dual domain for overcoming synchronization attacks | |
| Altun et al. | Morphological steganalysis of audio signals and the principle of diminishing marginal distortions | |
| CN101394402A (en) | Method for fast code changing in large range to audio information to break virus | |
| CN101350198B (en) | Method for compressing watermark using voice based on bone conduction | |
| CN102867513A (en) | Pseudo-Zernike moment based voice content authentication method | |
| CN105895109B (en) | A kind of digital speech evidence obtaining and tamper recovery method based on DWT and DCT | |
| Guo et al. | An audio digital watermarking algorithm against A/D and D/A conversions based on DCT domain | |
| CN104091104B (en) | Multi-format audio perceives the characteristics extraction of Hash certification and authentication method | |
| CN101676992A (en) | Method for analyzing echo steganography | |
| CN105070297A (en) | MP3 audio compression history detection method | |
| CN108513140B (en) | Method for screening repeated advertisement segments in audio and generating wool audio | |
| CN101667423A (en) | Compressed domain high robust voice/music dividing method based on probability density ratio |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C14 | Grant of patent or utility model | ||
| GR01 | Patent grant | ||
| CF01 | Termination of patent right due to non-payment of annual fee | ||
| CF01 | Termination of patent right due to non-payment of annual fee |
Granted publication date: 20151014 Termination date: 20180408 |