CN104637484A

CN104637484A - MP3 audio steganography detection method based on co-occurrence matrix analysis

Info

Publication number: CN104637484A
Application number: CN201510053970.2A
Authority: CN
Inventors: 王让定; 羊开云; 严迪群; 金超; 孙冉; 周劲蕾
Original assignee: Ningbo University
Current assignee: Yong Ming
Priority date: 2015-02-03
Filing date: 2015-02-03
Publication date: 2015-05-20
Anticipated expiration: 2035-02-03
Also published as: CN104637484B

Abstract

The invention discloses an MP3 audio steganography detection method based on co-occurrence matrix analysis. According to the method, steganography detection is performed by virtue of analyzing the quantified MDCT (Modified Discrete Cosine Transform) coefficient of main storage data of MP3 audio; transformation of the quantified MDCT coefficient of the audio can be directly or indrectly influenced by performing steganography operation in an audio compressed encoding process and the tiny transformation can be measured by use of the sensitive characteristic of intra-unite correlation of the quantified MDCT coefficient, so that in the method, a steganography analysis characteristic vector sensitive to the steganography operation is constructed according to the principle of the intra-unite correlation of the quantified MDCT coefficient of natural audio, and therefore, the method has generality and is capable of achieving detection effects for multiple algorithms of one type of steganography algorithm. The final steganography analysis characteristic vector constructed by the method is capable of roundly sensing the influence of steganography operation on the quantified MDCT coefficient in a horizontal direction, a vertical direction, a 45-degree angle direction and a 135-degree angle direction at the same time, so that the steganography detection rate is improved and the detection false rate is reduced.

Description

MP3 audio steganography detection method based on co-occurrence matrix analysis

Technical Field

The invention relates to an audio steganography detection technology, in particular to an MP3 audio steganography detection method based on symbiotic matrix analysis.

Background

Steganography is a means for hiding secret information by using redundancy of multimedia files, the secret information to be secretly transmitted can be converted into bit streams and hidden in the multimedia files serving as transmission carriers, and the hiding mode is steganography. Good steganographic algorithms have good imperceptibility and attack resistance. In order to monitor the illegal use of steganography on the internet, steganography detection techniques are proposed. The steganography detection technology is used for extracting and analyzing the characteristics of the multimedia file to be detected so as to judge whether the multimedia file contains the stego information. The carriers for steganography and steganalysis are mainly text, images, video, audio and the like.

Audio files have become a hot spot of interest to steganographers and steganography testers due to their widespread recent spread over the internet. At present, most of steganography detection algorithms for audio are concentrated in a non-compression domain, and correspondingly effective steganography detection algorithms are provided for some classical non-compression domain audio steganography algorithms. In recent years, some non-compressed domain universal steganalysis algorithms are also proposed, and the method has a detection effect on various non-compressed domain audio steganography algorithms. However, the existing steganography detection algorithm for compressed domain audio is only for a specific typical steganography tool, such as MP3Stego and the like, which cannot be used for other steganography algorithms for detecting MP3 audio.

Disclosure of Invention

The invention aims to solve the technical problem of providing an MP3 audio steganography detection method based on symbiotic matrix analysis, which has a detection effect on various MP3 audio steganography methods.

The technical scheme adopted by the invention for solving the technical problems is as follows: an MP3 audio steganography detection method based on co-occurrence matrix analysis is characterized by comprising the following steps:

selecting N uncompressed WAV audios with different change styles, wherein N is more than or equal to 100;

performing compression coding on each uncompressed WAV audio by using an MP3 audio 8HZ coder to obtain an uncompressed MP3 compressed audio corresponding to each uncompressed WAV audio, and forming an audio negative sample library by the obtained N uncompressed MP3 compressed audios;

steganographic information with different lengths and different contents is steganographically written on each uncompressed WAV audio by using an MP3Stego audio steganographic algorithm to obtain steganographic MP3 compressed audio corresponding to each uncompressed WAV audio, and a first-class audio positive sample library is formed by the obtained N steganographic MP3 compressed audio; steganographic information with different lengths and different contents is steganographically written on each uncompressed WAV audio by using a steganographic algorithm selected based on window types to obtain steganographic MP3 compressed audio corresponding to each uncompressed WAV audio, and a second-class audio positive sample library is formed by the obtained N steganographic MP3 compressed audio; steganographic information with different lengths and different contents is steganographically written in each uncompressed WAV audio by using a steganographic algorithm selected based on Huffman code table index to obtain steganographic MP3 compressed audio corresponding to each uncompressed WAV audio, and a third-class audio positive sample library is formed by the obtained N steganographic MP3 compressed audio;

a sample library composed of an audio negative sample library, a first audio positive sample library, a second audio positive sample library and a third audio positive sample library;

decompressing each sample in the sample library by using an MP3 audio lame decoder to obtain a WAV audio corresponding to each sample in the sample library; then, performing compression coding on the WAV audio corresponding to each sample in the sample library by using an MP3 audio lame coder to obtain a carrier estimation corresponding to each sample in the sample library after being recompressed;

fourthly, decompressing each sample in the sample library by using an MP3 audio lame decoder, and extracting 5 of each frame in each sample in the sample libraryTaking 576 quantized MDCT coefficients of each frame in each sample as a line, constructing a coefficient matrix by all quantized MDCT coefficients corresponding to each sample in the sample bank, and recording the coefficient matrix constructed by all quantized MDCT coefficients corresponding to the ith sample in the sample bank as X_i，

X_{i} = [\begin{matrix} x_{1,1} & x_{1,2} & . . . & x_{1,575} & x_{1,576} \\ x_{2,1} & x_{2,2} & . . . & x_{2,575} & x_{2,576} \\ . & . & . & . & . \\ . & . & . & . & . \\ . & . & . & . & . \\ x_{N_{i}^{f}, 1} & x_{N_{i}^{f}, 2} & . . . & x_{N_{i}^{f}, 575} & x_{N_{i}^{f}, 576} \end{matrix}],

Wherein i is more than or equal to 1 and less than or equal to 4N, X_iHas a dimension ofRepresenting the total number of frames, x, contained in the ith sample in the sample bank_1,1、x_1,2、x_1,575、x_1,576Corresponding to the 1 st, 2 nd, 575 th and 576 th quantized MDCT coefficients, x, representing the 1 st frame in the ith sample in the sample bank_2,1、x_2,2、x_2,575、x_2,576Corresponding to the 1 st, 2 nd, 575 th and 576 th quantized MDCT coefficients representing the 2 nd frame in the ith sample in the sample bank, corresponding to the ith sample in the sample library1 st, 2 nd, 575 th and 576 th quantized MDCT coefficients of the frame;

fifthly, correcting the coefficient with the median value larger than 300 in the coefficient matrix formed by all the quantized MDCT coefficients corresponding to each sample in the sample library to obtain a new coefficient matrix corresponding to each sample in the sample library, and recording the new coefficient matrix corresponding to the ith sample in the sample library as X_i'；

Then according to the new coefficient matrix corresponding to each sample in the sample library, constructing a horizontal direction co-occurrence matrix, a vertical direction co-occurrence matrix, a 45-degree angle direction co-occurrence matrix and a 135-degree angle direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library, and enabling the X-ray detector to detect the X-ray detector to obtain the X-ray detector_i' the correspondence of the horizontal direction co-occurrence matrix, the vertical direction co-occurrence matrix, the 45 degree angle co-occurrence matrix and the 135 degree angle co-occurrence matrix is recorded as P_i,0、P_i,90、P_i,45And P_i,135A 1 is to P_i,0The element with the middle subscript (P, q) is marked as P_i,0(p,q)，Will P_i,90The element with the middle subscript (P, q) is marked as P_i,90(p,q)，Will P_i,45The element with the middle subscript (P, q) is marked as P_i,45(p,q)，Will P_i,135The element with the middle subscript (P, q) is marked as P_i,135(p,q)，Wherein p is more than or equal to 1 and less than or equal to 300, q is more than or equal to 1 and less than or equal to 300, and d represents the step length of the symbiotic matrix, x'_u,vRepresents X_i'the subscript in the middle is the coefficient at (u, v), x'_u,v+dRepresents X_i'the subscript in the middle is a coefficient, x'_u+d,vRepresents X_i'the subscript in the middle is the coefficient at (u + d, v), x'_u+d,v+dRepresents X_i' the subscript in the middle is the coefficient at (u + d, v + d);

constructing a characteristic vector containing 12 high-order statistical features of a horizontal direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library according to the horizontal direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library, and converting P into P_i,0The feature vector containing 12 high-order statistical features is denoted as F_i,0；

Constructing a feature vector containing 12 high-order statistical features of a vertical direction co-occurrence matrix of a new coefficient matrix corresponding to each sample in a sample library according to the vertical direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library, and converting P into P_i,90The feature vector containing 12 high-order statistical features is denoted as F_i,90；

Constructing a characteristic vector containing 12 high-order statistical features of the 45-degree angle direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library according to the 45-degree angle direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library, and converting P into P_i,45The feature vector containing 12 high-order statistical features is denoted as F_i,45；

Constructing a characteristic vector containing 12 high-order statistical features of the 135-degree angle direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library according to the 135-degree angle direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library, and converting P into P_i,135The feature vector containing 12 high-order statistical features is denoted as F_i,135；

Acquiring feature vectors containing 48 features of each sample in the sample library according to respective feature vectors of a horizontal direction co-occurrence matrix, a vertical direction co-occurrence matrix, a 45-degree angle direction co-occurrence matrix and a 135-degree angle direction co-occurrence matrix of a new coefficient matrix corresponding to each sample in the sample library, and recording the feature vector containing 48 features of the ith sample in the sample library as F_i，F_iIs F_i,0、F_i,90、F_i,45、F_i,135The 48 high-order statistical features contained in the four feature vectors are formed in sequence;

obtaining the characteristic vector which is estimated by the carrier and corresponds to each sample in the sample base after being recompressed and contains 48 characteristics in the same mode according to the operations from the step (r) to the step (c), and recording the characteristic vector which is estimated by the carrier and corresponds to the ith sample in the sample base after being recompressed and contains 48 characteristics as F_i ^*；

Ninthly, calculating the absolute value of the difference value of the feature vector of each sample in the sample library and the two corresponding features in the feature vector of the carrier estimation corresponding to each sample in the sample library after recompression to obtain the steganalysis feature vector containing 48 elements corresponding to each sample in the sample library, and performing steganalysis on the sample library corresponding to the ith sample and containing 48 elementsAnalyze the feature vector as Y_iIs a reaction of Y_iThe t-th element in (1) is marked as Y_i(t)，Y_i(t)＝|F_i(t)-F_i ^*(t) |, where t is greater than or equal to 1 and less than or equal to 48, F_i(t) represents F_iThe t-th feature of (1), F_i ^*(t) represents F_i ^*The t-th feature in (1), the symbol "|" is an absolute value symbol;

the method comprises the steps that normalization processing is carried out on the steganalysis characteristic vector corresponding to each sample in a sample library by the aid of the red (R) waves, and normalized steganalysis characteristic vectors corresponding to each sample in the sample library are obtained;

marking normalized steganalysis characteristic vectors corresponding to all samples belonging to an audio negative sample library in a sample library as-1, marking normalized steganalysis characteristic vectors corresponding to all samples belonging to a first type of audio positive sample library in the sample library as +1, inputting the normalized steganalysis characteristic vectors corresponding to all samples belonging to the audio negative sample library after marking and the normalized steganalysis characteristic vectors corresponding to all samples belonging to the first type of audio positive sample library into an SVM classifier for training to obtain a detection template of the MP3Stego audio steganalysis algorithm, and marking M as M₁；

Similarly, marking normalized steganalysis feature vectors corresponding to all samples belonging to the audio negative sample library in the sample library as-1, marking normalized steganalysis feature vectors corresponding to all samples belonging to the second type audio positive sample library in the sample library as +1, inputting the marked normalized steganalysis feature vectors corresponding to all samples belonging to the audio negative sample library and the normalized steganalysis feature vectors corresponding to all samples belonging to the second type audio positive sample library into an SVM classifier for training to obtain a detection template of the steganalysis algorithm selected based on window types, and marking the detection template as M₂；

Marking normalized steganalysis characteristic vectors corresponding to all samples belonging to an audio negative sample library in a sample library as-1, marking normalized steganalysis characteristic vectors corresponding to all samples belonging to a third type audio positive sample library in the sample library as +1, inputting the normalized steganalysis characteristic vectors corresponding to all samples belonging to the audio negative sample library after marking and the normalized steganalysis characteristic vectors corresponding to all samples belonging to the third type audio positive sample library into an SVM classifier for training to obtain a detection template of the steganalysis algorithm selected based on a Huffman code table index, and marking the detection template as M₃；

For any MP3 compressed audio to be detected, acquiring normalized steganalysis feature vectors corresponding to the MP3 compressed audio in the same way according to the processes from step (c) to step (r); then, respectively utilizing the detection template M of the MP3Stego audio steganography algorithm₁Detection template M of steganographic algorithm based on window type selection₂And a detection template M of a steganography algorithm based on Huffman code table index selection₃And detecting the normalized steganalysis feature vector corresponding to the MP3 compressed audio to determine whether the MP3 compressed audio is subjected to steganography and an audio steganography algorithm adopted by the steganography.

Step five, the new coefficient matrix X corresponding to the ith sample in the sample library_iThe acquisition process of' is: mixing X_i'the coefficient at the subscript in (u, v) is denoted as x'_u,v，Wherein,1≤v≤576，x_u,vrepresents X_iThe middle subscript is the coefficient at (u, v).

The step of_i,0The acquisition process comprises the following steps: f_i,0＝[F_i,0(1),F_i,0(2),F_i,0(3),F_i,0(4),F_i,0(5),F_i,0(6),F_i,0(7),F_i,0(8),F_i,0(9),F_i,0(10),F_i,0(11),F_i,0(12)]Wherein F is_i,0(1),F_i,0(2),…,F_i,0(12) Corresponding representation F_i,0The 1 st to 12 th high order statistical features in (c),

F_i,0(2)＝max(P_i,0)，

max () represents a function taking the maximum value,

P_i,0(P, P) represents P_i,0The middle subscript is the element at (P, P), P_i,0(P,300-P) represents P_i,0The middle subscript is the element at (p, 300-p);

according to F_i,0Respectively obtaining F in the same manner_i,90、F_i,45And F_i,135。

Compared with the prior art, the invention has the advantages that:

1) the method carries out steganography detection by analyzing the MDCT coefficient after the main data quantization of the MP3 audio is stored, because the transformation of the MDCT coefficient after the audio quantization can be directly or indirectly influenced by steganography operation in the audio compression coding process, and the fine transformation can be measured by the sensitive characteristic of the internal relevance of the MDCT coefficient after the quantization, the steganography analysis characteristic vector sensitive to the steganography operation is constructed according to the principle of the internal relevance of the MDCT coefficient after the natural audio quantization, so that the method has universality and can simultaneously have detection effect on a plurality of algorithms of steganography algorithms.

2) The method utilizes the quantized MDCT coefficients of the audio to be detected to construct the symbiotic matrixes in four different directions, namely a horizontal direction symbiotic matrix, a vertical direction symbiotic matrix, a 45-degree angle symbiotic matrix and a 135-degree angle symbiotic matrix, and then constructs the eigenvector containing the high-order statistical characteristics of the symbiotic matrixes in each direction as the final steganalysis characteristic, so that the obtained final steganalysis characteristic vector can comprehensively and simultaneously sense the influence of steganography operation on the correlation of the quantized MDCT coefficients in the four directions, namely the horizontal direction, the vertical direction, the 45-degree angle and the 135-degree angle, the steganalysis detection rate is improved, and the false detection rate is reduced.

3) The method obtains corrected audio through the recompression process of the audio to be detected, simultaneously extracts the characteristic vectors of the audio to be detected and the corrected audio, and then takes the difference value of the two characteristic vectors as the final steganalysis characteristic vector, thus eliminating the interference of the audio characteristic change caused by the content style of the audio to the audio characteristic change caused by steganalysis, and ensuring that the method still has higher steganalysis rate under the condition of less embedded secret information.

Drawings

Fig. 1 is a block diagram of the overall implementation of the method of the present invention.

Detailed Description

The invention is described in further detail below with reference to the accompanying examples.

The overall implementation block diagram of the MP3 audio steganography detection method based on symbiotic matrix analysis provided by the invention is shown in FIG. 1, and the method comprises the following steps:

selecting N uncompressed WAV audios with different change styles, wherein N is more than or equal to 100.

In an implementation, N is 300, for example, 300 uncompressed WAV audios covering various audio styles that are currently typical and having an audio length of 15 seconds are selected.

In actual operation, the lengths of the N uncompressed WAV audios may be all the same, may be partially the same, or may be different from each other, that is, the lengths of the N uncompressed WAV audios are not required.

And secondly, performing compression coding on each uncompressed WAV audio by using an MP3 audio 8HZ coder to obtain an uncompressed MP3 compressed audio corresponding to each uncompressed WAV audio, and forming an audio negative sample library by the obtained N uncompressed MP3 compressed audios. Here, each uncompressed WAV audio is compression-encoded by using an MP3 audio 8HZ encoder, and actually, the MP3Stego audio steganography tool can be directly used to perform compression encoding on each uncompressed WAV audio without Stego information, and the MP3 compressed audio corresponding to each uncompressed WAV audio can also be obtained.

Steganographic information with different lengths and different contents is steganographically written on each uncompressed WAV audio by using an MP3Stego audio steganographic algorithm to obtain steganographic MP3 compressed audio corresponding to each uncompressed WAV audio, and a first-class audio positive sample library is formed by the obtained N steganographic MP3 compressed audio; steganographic information with different lengths and different contents is steganographically written on each uncompressed WAV audio by using a steganographic algorithm selected based on window types to obtain steganographic MP3 compressed audio corresponding to each uncompressed WAV audio, and a second-class audio positive sample library is formed by the obtained N steganographic MP3 compressed audio; steganographic information with different lengths and different contents is steganographically written in each uncompressed WAV audio by using a steganographic algorithm selected based on Huffman code table index to obtain steganographic MP3 compressed audio corresponding to each uncompressed WAV audio, and a third-class audio positive sample library is formed by the obtained N steganographic MP3 compressed audio.

And the audio negative sample library, the first type audio positive sample library, the second type audio positive sample library and the third type audio positive sample library form a sample library.

The MP3Stego audio steganography algorithm, the steganography algorithm selected based on window types and the steganography algorithm selected based on Hufffman code table indexes are all realized on the basis of an MP3 audio 8HZ encoder, an uncompressed WAV audio is compressed and encoded by an MP3 audio 8HZ encoder, and the MP3Stego audio steganography algorithm embeds secret information by adjusting the parity of the length of a main data block of an encoding parameter in the quantization encoding process; the steganographic algorithm selected based on the window type embeds the secret information by adjusting the window type of the MDCT coefficient change; the steganography algorithm based on Huffman code table index selection achieves the aim of steganography by adjusting the index of a code table in the process of performing Huffman coding on MDCT coefficients of quantization coding.

Decompressing each sample in the sample library by using an MP3 audio lame decoder to obtain a WAV audio corresponding to each sample in the sample library; and then, performing compression coding on the WAV audio corresponding to each sample in the sample library by using an MP3 audio lame coder to obtain a carrier estimation corresponding to each sample in the sample library after being recompressed.

Decompressing each sample in the sample library by using an MP3 audio lame decoder, extracting 576 quantized MDCT coefficients of each frame in each sample in the sample library, taking the 576 quantized MDCT coefficients of each frame in each sample as a row, forming all quantized MDCT coefficients corresponding to each sample in the sample library into a coefficient matrix, and recording the coefficient matrix formed by all quantized MDCT coefficients corresponding to the ith sample in the sample library as X_i，

X_{i} = [\begin{matrix} x_{1,1} & x_{1,2} & . . . & x_{1,575} & x_{1,576} \\ x_{2,1} & x_{2,2} & . . . & x_{2,575} & x_{2,576} \\ . & . & . & . & . \\ . & . & . & . & . \\ . & . & . & . & . \\ x_{N_{i}^{f}, 1} & x_{N_{i}^{f}, 2} & . . . & x_{N_{i}^{f}, 575} & x_{N_{i}^{f}, 576} \end{matrix}],

Wherein i is more than or equal to 1 and less than or equal to 4N, X_iHas a dimension ofRepresenting the total number of frames, x, contained in the ith sample in the sample bank_1,1、x_1,2、x_1,575、x_1,576Corresponding to the second in the sample library1 st, 2 nd, 575 th, 576 th quantized MDCT coefficients, x, of the 1 st frame of i samples_2,1、x_2,2、x_2,575、x_2,576Corresponding to the 1 st, 2 nd, 575 th and 576 th quantized MDCT coefficients representing the 2 nd frame in the ith sample in the sample bank, corresponding to the ith sample in the sample libraryThe 1 st, 2 nd, 575 th, 576 th quantized MDCT coefficients of the frame.

Fifthly, correcting the coefficient with the median value larger than 300 in the coefficient matrix formed by all the quantized MDCT coefficients corresponding to each sample in the sample library to obtain a new coefficient matrix corresponding to each sample in the sample library, and recording the new coefficient matrix corresponding to the ith sample in the sample library as X_i'. In this embodiment, in step (v), the new coefficient matrix X corresponding to the ith sample in the sample bank_iThe acquisition process of' is: mixing X_i'the coefficient at the subscript in (u, v) is denoted as x'_u,v，Wherein,1≤v≤576，x_u,vrepresents X_iThe middle subscript is the coefficient at (u, v), x_u,vAlso denoted is the v-th quantized MDCT coefficient of the u-th frame in the i-th sample in the pre-modification sample bank.

Then, according to the new coefficient matrix corresponding to each sample in the sample library, constructing a horizontal direction co-occurrence matrix, a vertical direction co-occurrence matrix, a 45-degree angle direction co-occurrence matrix sum of the new coefficient matrix corresponding to each sample in the sample libraryCo-occurrence matrix of 135 degree angle, X_i' the correspondence of the horizontal direction co-occurrence matrix, the vertical direction co-occurrence matrix, the 45 degree angle co-occurrence matrix and the 135 degree angle co-occurrence matrix is recorded as P_i,0、P_i,90、P_i,45And P_i,135A 1 is to P_i,0The element with the middle subscript (P, q) is marked as P_i,0(p,q)，Will P_i,90The element with the middle subscript (P, q) is marked as P_i,90(p,q)，Will P_i,45The element with the middle subscript (P, q) is marked as P_i,45(p,q)，Will P_i,135The element with the middle subscript (P, q) is marked as P_i,135(p,q)，Wherein p is not less than 1 and not more than 300, q is not less than 1 and not more than 300, d represents the step size of the co-occurrence matrix, and in this embodiment, d is 2, x'_u,vRepresents X_i'the subscript in the middle is the coefficient at (u, v), x'_u,v+dRepresents X_i'the subscript in the middle is a coefficient, x'_u+d,vRepresents X_i'the subscript in the middle is the coefficient at (u + d, v), x'_u+d,v+dRepresents X_iThe' subscript in the middle is the coefficient at (u + d, v + d).

Here, since the ratio of the median of all quantized MDCT coefficients of an audio smaller than 300 is large, since the method of the present invention is to reduce the dimension of the co-occurrence matrix, the value of all coefficients larger than 300 in the coefficient matrix is replaced with 300, resulting in a new coefficient matrix with a value ranging from 0 to 300.

Constructing a horizontal co-occurrence matrix containing 1 of the new coefficient matrix corresponding to each sample in the sample library according to the horizontal co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample libraryFeature vector of 2 higher order statistical features, P_i,0The feature vector containing 12 high-order statistical features is denoted as F_i,0，F_i,0＝[F_i,0(1),F_i,0(2),F_i,0(3),F_i,0(4),F_i,0(5),F_i,0(6),F_i,0(7),F_i,0(8),F_i,0(9),F_i,0(10),F_i,0(11),F_i,0(12)]Wherein F is_i,0(1),F_i,0(2),…,F_i,0(12) Corresponding representation F_i,0The 1 st to 12 th high order statistical features in (c),

F_i,0(2)＝max(P_i,0)，

max () represents a function taking the maximum value,

constructing a feature vector containing 12 high-order statistical features of a vertical direction co-occurrence matrix of a new coefficient matrix corresponding to each sample in a sample library according to the vertical direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library, and converting P into P_i,90The feature vector containing 12 high-order statistical features is denoted as F_i,90，F_i,90＝[F_i,90(1),F_i,90(2),F_i,90(3),F_i,90(4),F_i,90(5),F_i,90(6),F_i,90(7),F_i,90(8),F_i,90(9),F_i,90(10),F_i,90(11),F_i,90(12)]Wherein F is_i,90(1),F_i,90(2),…,F_i,90(12) Corresponding representation F_i,90The 1 st to 12 th high order statistical features in F are obtained_i,90The formula adopted by the 1 st to 12 th high-order statistical features in the method and the acquisition F_i,0The 1 st to 12 th high order statistical characteristics in (b) are the same in formula.

Constructing a characteristic vector containing 12 high-order statistical features of the 45-degree angle direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library according to the 45-degree angle direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library, and converting P into P_i,45The feature vector containing 12 high-order statistical features is denoted as F_i,45，F_i,45＝[F_i,45(1),F_i,45(2),F_i,45(3),F_i,45(4),F_i,45(5),F_i,45(6),F_i,45(7),F_i,45(8),F_i,45(9),F_i,45(10),F_i,45(11),F_i,45(12)]Wherein F is_i,45(1),F_i,45(2),…,F_i,45(12) Corresponding representation F_i,45The 1 st to 12 th high order statistical features in F are obtained_i,45The formula adopted by the 1 st to 12 th high-order statistical features in the method and the acquisition F_i,0The 1 st to 12 th high order statistical characteristics in (b) are the same in formula.

Constructing a characteristic vector containing 12 high-order statistical features of the 135-degree angle direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library according to the 135-degree angle direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample library, and converting P into P_i,135The feature vector containing 12 high-order statistical features is denoted as F_i,135，F_i,135＝[F_i,135(1),F_i,135(2),F_i,135(3),F_i,135(4),F_i,135(5),F_i,135(6),F_i,135(7),F_i,135(8),F_i,135(9),F_i,135(10),F_i,135(11),F_i,135(12)]Wherein F is_i,135(1),F_i,135(2),…,F_i,135(12) Corresponding representation F_i,135The 1 st to 12 th high order statistical features in F are obtained_i,135The formula adopted by the 1 st to 12 th high-order statistical features in the method and the acquisition F_i,0The 1 st to 12 th high order statistical characteristics in (b) are the same in formula.

Acquiring feature vectors containing 48 features of each sample in the sample library according to respective feature vectors of a horizontal direction co-occurrence matrix, a vertical direction co-occurrence matrix, a 45-degree angle direction co-occurrence matrix and a 135-degree angle direction co-occurrence matrix of a new coefficient matrix corresponding to each sample in the sample library, and recording the feature vector containing 48 features of the ith sample in the sample library as F_i，F_iIs F_i,0、F_i,90、F_i,45、F_i,135The 48 high-order statistical features contained in the four feature vectors are formed in sequence, namely F_i1 st to 12 th features in (b) are corresponding to F_i,01 st to 12 th higher order statistical feature of (1), F_i13 th to 24 th features in (b) are corresponding to F_i,901 st to 12 th higher order statistical feature of (1), F_iIs F to the 25 th to 36 th feature of_i,451 st to 12 th higher order statistical feature of (1), F_iThe 37 th to 48 th features in (b) correspond to F_i,1351 st to 12 th high order statistical features.

Obtaining the characteristic vector which is estimated by the carrier and corresponds to each sample in the sample base after being recompressed and contains 48 characteristics in the same mode according to the operations from the step (r) to the step (c), and recording the characteristic vector which is estimated by the carrier and corresponds to the ith sample in the sample base after being recompressed and contains 48 characteristics as F_i ^*. Firstly, decompressing the carrier estimation corresponding to each sample recompressed in the sample library by using an MP3 audio lamee decoder, extracting 576 quantized MDCT coefficients of each frame in the carrier estimation corresponding to each sample recompressed in the sample library, and decompressing the 576 quantized MDCT coefficients of each frame in the carrier estimation corresponding to each sample recompressedAs a row, all quantized MDCT coefficients corresponding to the carrier estimation after each sample in the sample library is recompressed form a coefficient matrix; then correcting the coefficient with the median value larger than 300 in the coefficient matrix formed by all quantized MDCT coefficients corresponding to the carrier estimation after each sample in the sample library is recompressed to obtain a new coefficient matrix corresponding to the carrier estimation after each sample in the sample library is recompressed; then constructing a horizontal direction co-occurrence matrix, a vertical direction co-occurrence matrix, a 45-degree angle direction co-occurrence matrix and a 135-degree angle direction co-occurrence matrix of a new coefficient matrix estimated by a carrier corresponding to each sample in the sample library after recompression; then constructing a feature vector containing 12 high-order statistical features of a horizontal direction co-occurrence matrix of a new coefficient matrix corresponding to carrier estimation after each sample in a sample library is recompressed, a feature vector containing 12 high-order statistical features of a vertical direction co-occurrence matrix, a feature vector containing 12 high-order statistical features of a 45-degree angle direction co-occurrence matrix, and a feature vector containing 12 high-order statistical features of a 135-degree angle direction co-occurrence matrix; and estimating respective eigenvectors of a horizontal direction co-occurrence matrix, a vertical direction co-occurrence matrix, a 45-degree angle direction co-occurrence matrix and a 135-degree angle direction co-occurrence matrix of the corresponding new coefficient matrix according to the carrier corresponding to each sample in the sample library after recompression, and acquiring the eigenvectors including 48 characteristics estimated by the carrier corresponding to each sample in the sample library after recompression.

Ninthly, calculating the absolute value of the difference value of the two corresponding features in the feature vector of each sample in the sample library and the feature vector of the carrier estimation corresponding to each sample in the sample library after recompression to obtain the steganalysis feature vector containing 48 elements corresponding to each sample in the sample library, and recording the steganalysis feature vector containing 48 elements corresponding to the ith sample in the sample library as Y_iIs a reaction of Y_iThe t-th element in (1) is marked as Y_i(t)，Y_i(t)＝|F_i(t)-F_i ^*(t) |, where t is greater than or equal to 1 and less than or equal to 48, F_i(t) represents F_iThe t-th feature of (1), F_i ^*(t) represents F_i ^*The symbol "|" is an absolute value symbol.

And (c) performing normalization processing on the steganalysis characteristic vector corresponding to each sample in the sample library by using the existing normalization processing technology to obtain the normalized steganalysis characteristic vector corresponding to each sample in the sample library.

Marking normalized steganalysis characteristic vectors corresponding to all samples belonging to an audio negative sample library in a sample library as-1, marking normalized steganalysis characteristic vectors corresponding to all samples belonging to a first type of audio positive sample library in the sample library as +1, inputting the normalized steganalysis characteristic vectors corresponding to all samples belonging to the audio negative sample library after marking and the normalized steganalysis characteristic vectors corresponding to all samples belonging to the first type of audio positive sample library into an SVM classifier for training to obtain a detection template of the MP3Stego audio steganalysis algorithm, and marking M as M₁。

Similarly, marking normalized steganalysis feature vectors corresponding to all samples belonging to the audio negative sample library in the sample library as-1, marking normalized steganalysis feature vectors corresponding to all samples belonging to the second type audio positive sample library in the sample library as +1, inputting the marked normalized steganalysis feature vectors corresponding to all samples belonging to the audio negative sample library and the normalized steganalysis feature vectors corresponding to all samples belonging to the second type audio positive sample library into an SVM classifier for training to obtain a detection template of the steganalysis algorithm selected based on window types, and marking the detection template as M₂。

Marking normalized steganalysis characteristic vectors corresponding to all samples belonging to the audio negative sample library in the sample library as-1, and marking normalized steganalysis characteristic vectors corresponding to all samples belonging to the third type audio positive sample library in the sample library as-1The analysis feature vector is marked as +1, then the marked normalized steganalysis feature vectors corresponding to all samples belonging to the audio negative sample library and the normalized steganalysis feature vectors corresponding to all samples belonging to the third class audio positive sample library are input into an SVM classifier for training to obtain a detection template of the steganalysis algorithm selected based on the Huffman code table index, and the detection template is marked as M₃。

To further illustrate the feasibility and effectiveness of the method of the present invention, experiments were conducted.

The result of a steganalysis of MP3 compressed audio may be one of four cases: 1) the MP3 compressed audio to be detected is a secret-containing carrier, and the judgment result of the steganography detection method is also the secret-containing carrier and belongs to True Positive (True Positive); 2) the MP3 compressed audio to be detected is an original carrier, and the carrier is judged to be a secret carrier by a steganography detection method and belongs to False Positive and False alarm (False Positive); 3) the MP3 compressed audio to be detected is an original carrier, and the judgment result of the steganography detection method is also the original carrier and belongs to True negativity (True Negative); 4) the MP3 compressed audio to be detected is a secret carrier, and the steganography detection method judges that the audio is an original carrier and belongs to false negative and false alarm (Falsenegtive).

When a plurality of MP3 compressed audio frequencies are detected, the detection accuracy, false alarm rate and false alarm rate can be respectively expressed by the following formulas:

acquiring normalized steganography analysis feature vectors corresponding to 100 MP3 compressed audios respectively according to the processes from the third step to the third step for 50 steganographic MP3 compressed audios obtained by steganography through an MP3Stego audio steganography algorithm and 50 clean non-steganographic MP3 compressed audios in the same way; then using M₁The normalized steganalysis feature vectors corresponding to the 100 MP3 compressed audios are detected, 48 audios which belong to true positives, 2 audios which belong to false alarms, 47 audios which belong to true negatives and 3 audios which belong to false alarms, and the detection results are listed in Table 1.

Table 1 shows the detection results of steganographic MP3 compressed audio and non-steganographic MP3 compressed audio obtained by steganography with MP3Stego audio steganography algorithm

Acquiring normalized steganography analysis feature vectors corresponding to 100 MP3 compressed audios respectively by 50 steganography MP3 compressed audios obtained by steganography based on window type selection and 50 clean non-steganography MP3 compressed audios in the same way according to the processes from the third step to the third step; then using M₂The normalized steganalysis feature vectors corresponding to the 100 MP3 compressed audios are detected, 49 audios which belong to true positives, 1 audio which belong to false alarms, 50 audio which belong to true negatives and 0 audio which belongs to false alarms, and the detection results are listed in Table 2.

TABLE 2 detection results of steganographic MP3 compressed audio and non-steganographic MP3 compressed audio steganographically obtained using a steganographic algorithm based on window type selection

Acquiring normalized steganography analysis feature vectors corresponding to 100 MP3 compressed audios respectively according to the processes from the third step to the third step for 50 steganography MP3 compressed audios obtained by steganography based on Huffman code table index selection and 50 clean non-steganography MP3 compressed audios in the same way; then using M₃The normalized steganalysis feature vectors corresponding to the 100 MP3 compressed audios are detected, 44 audios belonging to true positives, 6 audios belonging to false alarms, 42 audios belonging to true negatives and 8 audios belonging to false alarms, and the detection results are listed in Table 3.

Table 3 detection results of steganographic MP3 compressed audio and non-steganographic MP3 compressed audio obtained by steganographic algorithm based on huffman code table index selection

As can be seen from tables 1 to 3, the method of the present invention has a good detection effect on the steganographic MP3 compressed audio obtained by steganography using the MP3Stego audio steganography algorithm, the steganographic MP3 compressed audio obtained by steganography using the steganography algorithm selected based on the window type, and the steganographic MP3 compressed audio obtained by steganography using the steganography algorithm selected based on the huffman code table index, and has a low false alarm rate and a low false alarm rate, wherein the steganographic MP3 compressed audio obtained by steganography using the steganography algorithm selected based on the window type has a best detection effect, a highest detection accuracy, and a lowest false alarm rate and false alarm rate. This fully demonstrates that the method of the present invention is feasible and efficient relative to the common steganographic detection algorithm.

Claims

1. An MP3 audio steganography detection method based on co-occurrence matrix analysis is characterized by comprising the following steps:

decompressing each sample in the sample library by using an MP3 audio lame decoder, extracting 576 quantized MDCT coefficients of each frame in each sample in the sample library, taking the 576 quantized MDCT coefficients of each frame in each sample as a row, forming all quantized MDCT coefficients corresponding to each sample in the sample library into a coefficient matrix, and recording the coefficient matrix formed by all quantized MDCT coefficients corresponding to the ith sample in the sample library as X_i，Wherein i is more than or equal to 1 and less than or equal to 4N, X_iHas a dimension of Representing the total number of frames, x, contained in the ith sample in the sample bank_1,1、x_1,2、x_1,575、x_1,576Corresponding to the 1 st, 2 nd, 575 th and 576 th quantized MDCT coefficients, x, representing the 1 st frame in the ith sample in the sample bank_2,1、x_2,2、x_2,575、x_2,576Corresponding to the 1 st, 2 nd, 575 th and 576 th quantized MDCT coefficients representing the 2 nd frame in the ith sample in the sample bank, corresponding to the ith sample in the sample library1 st, 2 nd, 575 th and 576 th quantized MDCT coefficients of the frame;

Constructing a 45-degree angle of a new coefficient matrix corresponding to each sample in the sample library according to a 45-degree angle direction co-occurrence matrix of the new coefficient matrix corresponding to each sample in the sample libraryThe feature vector of the direction co-occurrence matrix, which contains 12 high-order statistical features, is P_i,45The feature vector containing 12 high-order statistical features is denoted as F_i,45；

Ninthly, calculating the absolute value of the difference value of the two corresponding features in the feature vector of each sample in the sample library and the feature vector of the carrier estimation corresponding to each sample in the sample library after recompression to obtain the steganalysis feature vector containing 48 elements corresponding to each sample in the sample library, and recording the steganalysis feature vector containing 48 elements corresponding to the ith sample in the sample library as Y_iIs a reaction of Y_iThe t-th element in (1) is marked as Y_i(t)，Wherein t is more than or equal to 1 and less than or equal to 48, F_i(t) represents F_iThe t-th feature of (1), F_i ^*(t) represents F_i ^*The t-th feature in (1), the symbol "|" is an absolute value symbol;

Marking normalized steganalysis characteristic vectors corresponding to all samples belonging to the audio negative sample library in the sample library as-1, and marking normalized steganalysis characteristic vectors corresponding to all samples belonging to the third type audio positive sample library in the sample libraryAnd if the sum is +1, inputting the normalized steganalysis feature vectors corresponding to all the marked samples belonging to the audio negative sample library and the normalized steganalysis feature vectors corresponding to all the samples belonging to the third-class audio positive sample library into an SVM classifier for training to obtain a detection template of the steganalysis algorithm selected based on the Hufffman code table index, and marking the detection template as M₃；

2. The MP3 audio steganography detection method based on co-occurrence matrix analysis according to claim 1, wherein the new coefficient matrix X corresponding to the ith sample in the sample bank in the fifth step_iThe acquisition process of' is: mixing X_i'the coefficient at the subscript in (u, v) is denoted as x'_u,v，Wherein,1≤v≤576，x_u,vrepresents X_iThe middle subscript is the coefficient at (u, v).

3. Co-occurrence matrix analysis based on the claims 1 or 2The MP3 audio steganography detection method is characterized in that F is adopted in the step_i,0The acquisition process comprises the following steps: f_i,0＝[F_i,0(1),F_i,0(2),F_i,0(3),F_i,0(4),F_i,0(5),F_i,0(6),F_i,0(7),F_i,0(8),F_i,0(9),F_i,0(10),F_i,0(11),F_i,0(12)]Wherein F is_i,0(1),F_i,0(2),…,F_i,0(12) Corresponding representation F_i,0The 1 st to 12 th high order statistical features in (c),

F_i,0(2)＝max(P_i,0)，

max () represents a function taking the maximum value,