CN104821169A - MP3Stegz steganography detecting method - Google Patents

MP3Stegz steganography detecting method Download PDF

Info

Publication number
CN104821169A
CN104821169A CN201510228165.9A CN201510228165A CN104821169A CN 104821169 A CN104821169 A CN 104821169A CN 201510228165 A CN201510228165 A CN 201510228165A CN 104821169 A CN104821169 A CN 104821169A
Authority
CN
China
Prior art keywords
byte
bytes
steganography
frame
audio file
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
CN201510228165.9A
Other languages
Chinese (zh)
Other versions
CN104821169B (en
Inventor
王让定
严迪群
金超
羊开云
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Ningbo University
Original Assignee
Ningbo University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ningbo University filed Critical Ningbo University
Priority to CN201510228165.9A priority Critical patent/CN104821169B/en
Publication of CN104821169A publication Critical patent/CN104821169A/en
Application granted granted Critical
Publication of CN104821169B publication Critical patent/CN104821169B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Abstract

The invention discloses an MP3Stegz steganography detecting method. The MP3Stegz steganography detecting method comprising the steps of opening an MP3 audio file to be detected in a binary stream manner, sequentially finding out each frame in a binary stream of the MP3 audio file, and determining whether each frame is subjected to MP3Stegz steganalysis or not by analyzing the 37th to the 41st bytes and the 42nd to the 56th bytes in the frame. The MP3Stegz steganography detecting method has the advantages that whether the MP3 audio file is subjected to MP3Stegz steganalysis or not can be accurately detected by analyzing the 37th to the 41st bytes and the 42nd to the 56th bytes in each frame in the binary stream of the MP3 audio file, and the MP3Stegz steganography detecting method is stable in performance, high in detecting accuracy and low in computation complexity.

Description

A kind of Stego-detection method for MP3Stegz
The divisional application of the application's to be original applying number be application for a patent for invention of 201310119750.6, its applying date is on 04 08th, 2013, and denomination of invention is " a kind of Stego-detection method for MP3Stegz ".
Technical field
The present invention relates to a kind of audio steganography detection technique, especially relate to a kind of Stego-detection method for MP3Stegz.
Background technology
Steganography is an important branch of Information hiding, and it to be a kind ofly hidden in by secret information in host signal and not to know that it is deposited in case by technology that common signal channel is propagated third party.Stego-detection technology is then the opposition technology of Steganography, its objective is to disclose in suspicious carrier signal whether there is secret information so that destroy covert communications.
As one of audio format most popular on current internet, MP3 audio frequency is widely used, therefore for Steganography and the Stego-detection technology also development in game of MP3 audio frequency.There is the steganography instrument of some MP3 audio frequency in recent years, as MP3Stego, UnderMP3Cover, MP3Stegz etc., Stego-detection method meanwhile for various steganography instrument is also proposed in succession, proposes a kind of Stego-detection method etc. for UnderMP3Cover as the people such as Qiao propose a kind of people such as Stego-detection method, Jin for MP3Stego.But the Stego-detection method at present for MP3Stegz steganography instrument yet there are no concrete report.
Summary of the invention
Technical matters to be solved by this invention is to provide a kind of Stego-detection method for MP3Stegz, and it can detect that whether MP3 audio frequency is by MP3Stegz steganography mistake exactly, and testing process is simple, computation complexity is low.
The present invention solves the problems of the technologies described above adopted technical scheme: a kind of Stego-detection method for MP3Stegz, is characterized in that comprising the following steps:
1. MP3 audio file to be detected is opened in binary stream mode;
2. from the binary stream of this MP3 audio file, find out the first frame, and be present frame by the first frame definition found out;
3. judge whether 8 bits of each byte in 37th ~ 40 bytes in present frame are the ASC II yard of character " X ", and whether 8 bits of the 41st byte in present frame are the ASC II yard of any one character in character " 1 " ~ " 9 ", if, then perform step 4., otherwise, perform step 5.;
4. judge that whether there are continuous print two bytes in 42nd ~ 56 bytes in present frame meets the following conditions: 8 bits of the 1st byte in continuous print two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous print two bytes are the ASC II yard of character ". ", if existed, then determine that this MP3 audio file is through MP3Stegz steganography mistake, complete Stego-detection, otherwise, perform step 5.;
5. judge that whether present frame is the last frame in the binary stream of this MP3 audio file, if, then determine that this MP3 audio file is without MP3Stegz steganography mistake, complete Stego-detection, otherwise, from the binary stream of this MP3 audio file, find out next frame, using this frame as present frame, then return step and 3. continue to perform.
Described step 2. in from the binary stream of this MP3 audio file, find out the first frame process be: from the byte of the 1st in the binary stream of this MP3 audio file, byte-by-byte inquiry, when retrieving continuous print two bytes 8 bits separately and being followed successively by 1,111 1111 and 1111 101*, determine that the 1st byte in this continuous print two bytes is the byte that the first frame in the binary stream of this MP3 audio file starts, wherein, * represents binary number 0 or 1.
Described step 5. in from the binary stream of this MP3 audio file, find out next frame process be: the length calculating present frame according to the information in the frame head of present frame, from a byte after last byte of present frame, byte-by-byte inquiry, meet successively when retrieving continuous print three bytes 8 bits separately: be 1,111 1111, for 111* * * * *, high 4 is not 1 entirely, then determine that the 1st byte in this continuous print three bytes is the byte that the next frame in the binary stream of this MP3 audio file starts, wherein, * binary number 0 or 1 is represented
For a Stego-detection method of MP3Stegz, it is characterized in that comprising the following steps:
1) MP3 audio file to be detected is opened in binary stream mode;
2) from the binary stream of this MP3 audio file, find out the first frame, and be present frame by the first frame definition found out, then make count represent the order of steganography, the initial value of count is 0;
3) judge whether 8 bits of each byte in 37th ~ 40 bytes in present frame are the ASC II yard of character " X ", and whether 8 bits of the 41st byte in present frame are the ASC II yard of any one character in character " 1 " ~ " 9 ", if, then perform step 4), otherwise, perform step 6);
4) judge that whether there are continuous print two bytes in 42nd ~ 56 bytes in present frame meets the following conditions: 8 bits of the 1st byte in continuous print two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous print two bytes are the ASC II yard of character ". ", if existed, then make count=count+1, wherein, "=" is assignment herein, then performs step 5), otherwise, perform step 6);
5) export the order count of steganography, the reference position of steganography, and extract the size after the form of the secret information of steganography and the secret information encryption of steganography, then perform step 6);
6) judge that whether present frame is the last frame in the binary stream of this MP3 audio file, if so, then perform step 7), otherwise, from the binary stream of this MP3 audio file, find out next frame, using this frame as present frame, then return step 3) continue to perform;
7) whether the value judging count is 0, if so, then determines that this MP3 audio file is without MP3Stegz steganography mistake, completes Stego-detection, otherwise, determine that this MP3 audio file is through MP3Stegz steganography mistake, completes Stego-detection.
Described step 2) in from the binary stream of this MP3 audio file, find out the first frame process be: from the byte of the 1st in the binary stream of this MP3 audio file, byte-by-byte inquiry, when retrieving continuous print two bytes 8 bits separately and being followed successively by 1,111 1111 and 1111 101*, determine that the 1st byte in this continuous print two bytes is the byte that the first frame in the binary stream of this MP3 audio file starts, wherein, * represents binary number 0 or 1.
Described step 6) in from the binary stream of this MP3 audio file, find out next frame process be: the length calculating present frame according to the information in the frame head of present frame, from a byte after last byte of present frame, byte-by-byte inquiry, meet successively when retrieving continuous print three bytes 8 bits separately: be 1,111 1111, for 111* * * * *, high 4 is not 1 entirely, then determine that the 1st byte in this continuous print three bytes is the byte that the next frame in the binary stream of this MP3 audio file starts, wherein, * binary number 0 or 1 is represented.
Described step 5) in the reference position of steganography be the position of the 41st byte in present frame.
Described step 5) in the form of secret information of steganography determined by three bytes after the 2nd byte in continuous two bytes met the following conditions in the byte of 42nd ~ 56 in present frame: 8 bits of the 1st byte in continuous two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II yard of character ". ".
Described step 5) in steganography secret information encryption after size by the byte of the 40th in present frame, and several bytes between the 1st byte in continuous two bytes met the following conditions in 42nd ~ 56 bytes are determined: 8 bits of the 1st byte in continuous two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II yard of character ". ".
Compared with prior art, the invention has the advantages that:
1) by 37th ~ 41 bytes in every frame of analysis MP3 audio file and 42nd ~ 56 bytes, can detect that whether this MP3 audio file is through MP3Stegz steganography mistake exactly, and Robust Performance, Detection accuracy are high, computation complexity is low.
2) by analyzing 41st ~ 56 bytes in the frame crossed by MP3Stegz steganography in MP3 audio file, find continuous print two bytes to meet the following conditions: 8 bits of previous byte are the ASC II yard of character " # ", 8 bits of a rear byte are the ASC II yard of character ". "; Then according to several bytes between the 1st byte of the 40th continuous print that byte satisfies condition to this two bytes of this frame, the size after secret information encryption can be obtained, the form of secret information can be obtained according to continuous print three bytes after the 2nd byte in continuous print two bytes that this satisfies condition, by analyzing 41st ~ 56 bytes in the frame crossed by MP3Stegz steganography in MP3 audio file, the reference position when time steganography can be obtained.
Embodiment
Below in conjunction with embodiment, the present invention is described in further detail.
MP3Stegz is one of popular at present MP3 steganography instrument, its steganography process is: replacing by the byte converted to after being encrypted by secret information can the partial bytes of embedding frame, it is before the content of steganography secret information own simultaneously, can by the size steganography after the extension name of secret information and encryption in MP3.Its whole steganography process is broadly divided into two parts: process secret information, steganography secret information itself and relevant information thereof, and process secret information part mainly completes: be encrypted according to codon pair secret information, and extracts the size after extension name and encryption; The extension name that steganography secret information itself and related information section thereof mainly extract front portion according to steganography method and size and secret information itself carry out steganography.
For the steganography principle of MP3Stegz, the present invention proposes the Stego-detection method for MP3Stegz that Detection accuracy is high, computation complexity is low.
Embodiment one:
The Stego-detection method of the present embodiment comprises the following steps:
1. MP3 audio file to be detected is opened in binary stream mode.
2. from the binary stream of this MP3 audio file, find out the first frame, and be present frame by the first frame definition found out.
In this particular embodiment, step 2. in from the binary stream of this MP3 audio file, find out the first frame process be: from the byte of the 1st in the binary stream of this MP3 audio file, byte-by-byte inquiry, when retrieving continuous print two bytes 8 bits separately and being followed successively by 1,111 1111 and 1111 101*, determine that the 1st byte in this continuous print two bytes is the byte that the first frame in the binary stream of this MP3 audio file starts, wherein, * represent binary number 0 or 1, namely 1111 101* comprise 1,111 1010 and 1,111 1011.
3. judge whether 8 bits of each byte in 37th ~ 40 bytes in present frame are the ASC II yard of character " X ", and whether 8 bits of the 41st byte in present frame are the ASC II yard of any one character in character " 1 " ~ " 9 ", if, then perform step 4., otherwise, perform step 5..
4. judge that whether there are continuous print two bytes in 42nd ~ 56 bytes in present frame meets the following conditions: 8 bits of the 1st byte in continuous print two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous print two bytes are the ASC II yard of character ". ", if existed, then determine that this MP3 audio file is through MP3Stegz steganography mistake, complete Stego-detection, otherwise, perform step 5..
5. judge that whether present frame is the last frame in the binary stream of this MP3 audio file, if, then determine that this MP3 audio file is without MP3Stegz steganography mistake, complete Stego-detection, otherwise, from the binary stream of this MP3 audio file, find out next frame, using this frame as present frame, then return step and 3. continue to perform.At this, judge that whether present frame is that last frame in the binary stream of this MP3 audio file adopts common technology, as certificate countless after last byte in present frame for when reading in, can determine that this present frame is the last frame in the binary stream of this MP3 audio file.
In this particular embodiment, step 5. in from the binary stream of this MP3 audio file, find out next frame process be: according to the information (layer in the frame head of present frame, bitrateIndex, samplingFrequency, paddingBit) length of present frame is calculated, from a byte after last byte of present frame, byte-by-byte inquiry, meet successively when retrieving continuous print three bytes 8 bits separately: be 1 111 1111, for 111* * * * *, high 4 is not 1 (not requiring low 4) entirely, then determine that the 1st byte in this continuous print three bytes is the byte that the next frame in the binary stream of this MP3 audio file starts, wherein, * binary number 0 or 1 is represented.
Embodiment two:
The Stego-detection method of the present embodiment comprises the following steps:
1) MP3 audio file to be detected is opened in binary stream mode.
2) from the binary stream of this MP3 audio file, find out the first frame, and be present frame by the first frame definition found out, then make count represent the order of steganography, the initial value of count is 0.
In this particular embodiment, step 2) in from the binary stream of this MP3 audio file, find out the first frame process be: from the byte of the 1st in the binary stream of this MP3 audio file, byte-by-byte inquiry, when retrieving continuous print two bytes 8 bits separately and being followed successively by 1,111 1111 and 1111 101*, determine that the 1st byte in this continuous print two bytes is the byte that the first frame in the binary stream of this MP3 audio file starts, wherein, * represent binary number 0 or 1, namely 1111 101* comprise 1,111 1010 and 1,111 1011.
3) judge whether 8 bits of each byte in 37th ~ 40 bytes in present frame are the ASC II yard of character " X ", and whether 8 bits of the 41st byte in present frame are the ASC II yard of any one character in character " 1 " ~ " 9 ", if, then perform step 4), otherwise, determine that present frame is without MP3Stegz steganography mistake, then perform step 6).
4) judge that whether there are continuous print two bytes in 42nd ~ 56 bytes in present frame meets the following conditions: 8 bits of the 1st byte in continuous print two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous print two bytes are the ASC II yard of character ". ", if existed, then make count=count+1, wherein, "=" is assignment herein, then performs step 5), otherwise, perform step 6).
5) export the order count of steganography, the reference position of steganography, and extract the size after the form of the secret information of steganography and the secret information encryption of steganography, then perform step 6).
At this, the reference position of steganography is the position of the 41st byte in present frame, and 8 bits being each byte in 37th ~ 40 bytes in present frame are a byte after last byte of the ASC II yard of character " X ".
At this, the form of the secret information of steganography is determined by three bytes after the 2nd byte in continuous two bytes met the following conditions in the byte of 42nd ~ 56 in present frame: 8 bits of the 1st byte in continuous two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II yard of character ". ".8 bits supposing the 45th byte in present frame are 0,010 0011, the ASC II yard of character " # ", 8 bits of the 46th byte in present frame are 0,010 1110, the ASC II yard of character ". ", then the form of the secret information of steganography is determined by three bytes after the byte of the 46th in present frame, is namely determined by the byte of the 47th in present frame, the 48th byte and the 49th byte.
At this, size after the secret information encryption of steganography is by the byte of the 40th in present frame, and several bytes between the 1st byte in continuous two bytes met the following conditions in 42nd ~ 56 bytes are determined: 8 bits of the 1st byte in continuous two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II yard of character ". ".8 bits supposing the 45th byte in present frame are 0,010 0011, the ASC II yard of character " # ", 8 bits of the 46th byte in present frame are 0,010 1110, the ASC II yard of character ". ", then steganography secret information encryption after size determined by all bytes between the 45th byte in the byte of the 40th in present frame and present frame, namely determined by the byte of 41st ~ 44 in present frame.
6) judge that whether present frame is the last frame in the binary stream of this MP3 audio file, if so, then perform step 7), otherwise, from the binary stream of this MP3 audio file, find out next frame, using this frame as present frame, then return step 3) continue to perform.At this, judge that whether present frame is that last frame in the binary stream of this MP3 audio file adopts common technology, as certificate countless after last byte in present frame for when reading in, can determine that this present frame is the last frame in the binary stream of this MP3 audio file.
In this particular embodiment, step 6) in from the binary stream of this MP3 audio file, find out next frame process be: according to the information (layer in the frame head of present frame, bitrateIndex, samplingFrequency, paddingBit) length of present frame is calculated, from a byte after last byte of present frame, byte-by-byte inquiry, meet successively when retrieving continuous print three bytes 8 bits separately: be 1,111 1111, for 111* * * * *, high 4 is not 1 (not requiring low 4) entirely, then determine that the 1st byte in this continuous print three bytes is the byte that the next frame in the binary stream of this MP3 audio file starts, wherein, * binary number 0 or 1 is represented.
7) whether the value judging count is 0, if so, then determines that this MP3 audio file is without MP3Stegz steganography mistake, completes Stego-detection, otherwise, determine that this MP3 audio file is through MP3Stegz steganography mistake, completes Stego-detection.
Whether above-described embodiment one only have detected MP3 audio file through MP3Stegz steganography mistake, and embodiment two is on the basis of embodiment one, output the order count of each steganography, the reference position of steganography again, and extract the size after the form of the secret information of steganography and the secret information encryption of steganography.
For validity and the feasibility of the inventive method are described better, the Stego-detection method utilizing embodiment two to provide carries out Stego-detection experiment.
Stego-detection experiment one:
The process of the MP3 audio file crossed without MP3Stegz steganography being carried out to Stego-detection is:
1, from the audio file (as testcase.mp3) downloading a MP3 format random the Internet, the important parameter of testcase.mp3 as listed in table 1, then opens testcase.mp3 in a binary fashion.
The important parameter list of table 1 MP3 audio frequency testcase.mp3
File size 3776512 bytes
Duration 3 points 55 seconds
Sample frequency 44.1KHz
Bit rate 128Kbps
2, from the byte of the 1st in the binary stream of testcase.mp3, byte-by-byte inquiry, when retrieving the 1378th and 1379 byte, due to their respective 8 bits be followed successively by 1,111 1111,1111 101*, meet the condition of the first frame become in the binary stream of testcase.mp3, therefore determine that the 1378th byte is the byte that the first frame in the binary stream of testcase.mp3 starts, then using the first frame as present frame.
3, check 37th ~ 41 bytes in present frame, finding that 8 bits of each byte in front 4 bytes are 1,111 1111, is not the ASC II yard of character " X "; 8 bits of same discovery the 5th byte are 1,111 1111, are not the ASC II yard of any one character in character " 1 " ~ " 9 ", therefore determine that present frame is without MP3Stegz steganography mistake.
4, check present frame be whether in the binary stream of testcase.mp3 last frame, when not being last frame, the length calculating present frame according to the information in the frame head of present frame is 418 bytes, and obtain last byte of present frame, be the 1796th byte, then byte-by-byte inquiry from the 1797th byte, meet successively when retrieving continuous print three bytes 8 bits separately: be 1,111 1111, for 111* * * * *, high 4 is not 1 (not requiring low 4) entirely, then determine that the 1st byte in this continuous print three bytes is the byte that the next frame in the binary stream of testcase.mp3 starts.
5, using next frame as present frame, continue whether to detect this present frame through MP3Stegz steganography mistake by said process 3 and 4, each frame is constantly detected according to the method, until the last frame in the binary stream of testcase.mp3, in testing process, find that all frames in the binary stream of testcase.mp3 all do not meet following two conditions simultaneously: in 5 bytes of 1. every 37th ~ 41 in frame, 8 bits of each byte in front 4 bytes are the ASC II yard of character " X ", the binary number of the 5th byte is the ASC II yard of any one character in character " 1 " ~ " 9 ", 2. have continuous two bytes met the following conditions in 42nd ~ 56 bytes in every frame: 8 bits of the 1st byte in continuous two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II yard of character ". ".Therefore, determine that this MP3 audio file is without MP3Stegz steganography mistake, so far completes Stego-detection.
Stego-detection experiment two:
The process of the MP3 audio file crossed through MP3Stegz steganography being carried out to Stego-detection is:
1, supposing that MP3 audio file to be detected is testcase_steg.mp3 herein, be that the testcase.mp3 in experiment one obtains for 4 times through MP3Stegz steganography, and the particular content of these 4 steganography as listed in table 2.
Table 2testcase_steg.mp3 audio file is by the list of the content of the order of steganography and each steganography
2, from the byte of the 1st in the binary stream of testcase_steg.mp3, byte-by-byte inquiry, when retrieving the 1378th and 1379 byte, due to their respective 8 bits be followed successively by 1,111 1111,1111 101*, meet the condition of the first frame become in the binary stream of testcase_steg.mp3, therefore determine that the 1378th byte is the byte that the first frame in the binary stream of testcase_steg.mp3 starts, then using the first frame as present frame.
3,37th ~ 41 bytes in present frame are checked, find that 8 bits of each byte in front 4 bytes are 0,101 1000, be all the ASC II yard of character " X ", same 8 bits finding the 5th byte are 0,011 0100, are the ASC II yard of character " 4 "; Reexamine 42nd ~ 56 bytes in present frame, find that 8 bits of the 46th byte are 0,010 0011, be the ASC II yard of character " # ", 8 bits of the 47th byte are 0,010 1110, are the ASC II yard of character ". "; The order count of steganography is now made to add 1.
4, export the order count of steganography and the reference position of steganography, detect that the order of this steganography is the 1st time; The reference position of steganography is the position of the 41st byte in present frame, is the 1418th byte in the binary stream of testcase_steg.mp3.
Extract the size after the form of the secret information of steganography and the secret information encryption of steganography, in the 1st steganography, by the 1st byte in continuous two bytes of meeting the following conditions in the byte of the 40th in present frame and 42nd ~ 56 bytes (for the first frame, be the 46th byte in the first frame) between all byte-extraction out: 8 bits of the 1st byte in continuous two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II yard of character ". ".Namely 41st ~ 45 bytes in present frame are extracted, their respective 8 bits are respectively 0,011 0100,0,011 0011,0,011 0010,0,011 0001,0,011 0011, wherein, 0011 0100 is the ASC II yard of character " 4 ", 0011 0011 is the ASC II yard of character " 3 ", 0011 0010 is the ASC II yard of character " 2 ", 0011 0001 is the ASC II yard of character " 1 ", 0011 0011 is the ASC II yard of character " 3 ", and the size namely obtained after the secret information encryption of steganography is 43213 bytes, in the 1st steganography, by the 2nd byte in continuous two bytes of meeting the following conditions in the byte of 42nd ~ 56 in present frame (for the first frame, be the 47th byte in the first frame) after three byte-extraction out, namely the 48th is extracted, 49th and the 50th byte, their respective 8 bits are respectively 0,110 0110, 01101100, 0111 0110, wherein, 0110 0110 is the ASC II yard of character " f ", 0110 1100 is the ASC II yard of character " l ", 0111 0110 is the ASC II yard of character " v ", namely represent that the form of the secret information of steganography is flv.
5, check that whether present frame is the last frame in the binary stream of testcase_steg.mp3, when not being last frame, the length calculating present frame according to the information in the frame head of present frame is 418 bytes, and last byte obtaining present frame is the 1796th byte in the binary stream of testcase.mp3, then byte-by-byte inquiry from the 1797th byte, when 8 bits retrieving each byte in continuous print three bytes meet successively: be 11111111, for 111* * * * *, high 4 is not 1 (not requiring low 4) entirely, then determine that the 1st byte in this continuous print three bytes is the byte that the next frame in the binary stream of testcase_steg.mp3 starts.
6, using next frame as present frame, continue whether to detect this present frame through MP3Stegz steganography mistake by said process 3 and 4, each frame is constantly detected according to the method, until the last frame in the binary stream of testcase.mp3, the 8944th frame in the binary stream of testcase_steg.mp3 is found in testing process, 8964th frame, 9009th frame meets following two conditions all simultaneously: in 5 bytes of 1. 37th ~ 41 in every frame, 8 bits of each byte in front 4 bytes are the ASC II yard of character " X ", 8 bits of the 5th byte are the ASC II yard of any one character in character " 1 " ~ " 9 ", 2. continuous two bytes met the following conditions are had in 42nd ~ 56 bytes in every frame: 8 bits of the 1st byte in continuous two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II yard of character ". ".For the 8944th frame, detect that the order for steganography is the 2nd time, the reference position of steganography is the 3739227th byte in the binary stream of testcase.mp3, and the form of the secret information of steganography is jpg, and the size after the secret information encryption of steganography is 7072 bytes; For the 8964th frame, detect that the order for steganography is the 3rd time, the reference position of steganography is the 3747586th byte in the binary stream of testcase.mp3, and the form of the secret information of steganography is mp3, and the size after the secret information encryption of steganography is 16432 bytes; For the 9009th frame, detect that the order for steganography is the 4th, the reference position of steganography is the 3766394th byte in the binary stream of testcase.mp3, and the form of the secret information of steganography is txt, and the size after the secret information encryption of steganography is 52 bytes.
7, now the value of count is 4, therefore determine that this MP3 audio file is through MP3Stegz steganography mistake, and the number of times of steganography is 4 times, so far completes Stego-detection.
Can illustrate that the inventive method can detect that whether MP3 audio file is through MP3Stegz steganography mistake accurately well by above-mentioned two experiments, and the size after the order of steganography, the reference position of steganography, the form of the secret information of steganography and the secret information encryption of steganography can be obtained accurately.This is enough to the validity and the feasibility that describe the inventive method.
Below for analyze the performance of the inventive method.
First kind sample is the MP3 audio file without MP3Stegz steganography: the audio file of the random MP3 format downloaded on 200 first the Internets, each MP3 audio file 3 ~ 5 minutes, 7 kinds of encoder type (comprising Lame, Xing, Gogo, Blade, FhG, Shine, Plugger), 3 kinds of coding modes (VBR (variable bit rate), ABR (mean speed) and CBR (fixed rate) three kinds, wherein in CBR situation, code rate comprises 96,112,128,160,192,256,320kbps etc.); Equations of The Second Kind sample is the MP3 audio file through MP3Stegz steganography: form is respectively 4 kinds of multimedia files of TXT, MP3, JPG, FLV as secret information, and enter in 200 samples of first kind sample by the random steganography of MP3Stegz, each 50 of the sample that finally generation difference steganography is 1 time, 2 times, 3 times, 4 times, totally 200.
Utilize the inventive method to carry out Stego-detection to all samples in above-mentioned two class samples, the false alarm rate of detection, loss and just inspection rate are as listed in table 3.
Table 3 utilizes the inventive method to carry out the result of Stego-detection to the MP3 audio file without MP3Stegz steganography and the MP3 audio file through MP3Stegz steganography
As can be seen from Table 3, whether the inventive method can operate through the steganography of MP3Stegz by 100% audio file correctly judging a first MP3 format.Table 4 gives and utilizes the inventive method to carry out the on average consuming time of Stego-detection to all samples in above-mentioned two class samples.
Table 4 utilizes the inventive method to carry out the on average consuming time of Stego-detection to all samples in above-mentioned two class samples
As can be seen from Table 4, the computation complexity of the inventive method is low, and operational efficiency is higher, and the MP3 audio file (3 ~ 5 minutes) of the first normal size of average detected one is consuming time between 0.3 second to 0.4 second, function admirable.

Claims (6)

1., for a Stego-detection method of MP3Stegz, it is characterized in that comprising the following steps:
1) MP3 audio file to be detected is opened in binary stream mode;
2) from the binary stream of this MP3 audio file, find out the first frame, and be present frame by the first frame definition found out, then make count represent the order of steganography, the initial value of count is 0;
3) judge whether 8 bits of each byte in 37th ~ 40 bytes in present frame are the ASC II yard of character " X ", and whether 8 bits of the 41st byte in present frame are the ASC II yard of any one character in character " 1 " ~ " 9 ", if, then perform step 4), otherwise, perform step 6);
4) judge that whether there are continuous print two bytes in 42nd ~ 56 bytes in present frame meets the following conditions: 8 bits of the 1st byte in continuous print two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous print two bytes are the ASC II yard of character ". ", if existed, then make count=count+1, wherein, "=" is assignment herein, then performs step 5), otherwise, perform step 6);
5) export the order count of steganography, the reference position of steganography, and extract the size after the form of the secret information of steganography and the secret information encryption of steganography, then perform step 6);
6) judge that whether present frame is the last frame in the binary stream of this MP3 audio file, if so, then perform step 7), otherwise, from the binary stream of this MP3 audio file, find out next frame, using this frame as present frame, then return step 3) continue to perform;
7) whether the value judging count is 0, if so, then determines that this MP3 audio file is without MP3Stegz steganography mistake, completes Stego-detection, otherwise, determine that this MP3 audio file is through MP3Stegz steganography mistake, completes Stego-detection.
2. a kind of Stego-detection method for MP3Stegz according to claim 1, it is characterized in that described step 2) in from the binary stream of this MP3 audio file, find out the first frame process be: from the byte of the 1st in the binary stream of this MP3 audio file, byte-by-byte inquiry, when retrieving continuous print two bytes 8 bits separately and being followed successively by 11111111 and 1111101*, determine that the 1st byte in this continuous print two bytes is the byte that the first frame in the binary stream of this MP3 audio file starts, wherein, * binary number 0 or 1 is represented.
3. a kind of Stego-detection method for MP3Stegz according to claim 1 and 2, it is characterized in that described step 6) in from the binary stream of this MP3 audio file, find out next frame process be: the length calculating present frame according to the information in the frame head of present frame, from a byte after last byte of present frame, byte-by-byte inquiry, meet successively when retrieving continuous print three bytes 8 bits separately: be 11111111, for 111*****, high 4 is not 1 entirely, then determine that the 1st byte in this continuous print three bytes is the byte that the next frame in the binary stream of this MP3 audio file starts, wherein, * binary number 0 or 1 is represented.
4. a kind of Stego-detection method for MP3Stegz according to claim 3, is characterized in that described step 5) in the reference position of steganography be the position of the 41st byte in present frame.
5. a kind of Stego-detection method for MP3Stegz according to claim 4, it is characterized in that described step 5) in the form of secret information of steganography determined by three bytes after the 2nd byte in continuous two bytes met the following conditions in the byte of 42nd ~ 56 in present frame: 8 bits of the 1st byte in continuous two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II yard of character ". ".
6. a kind of Stego-detection method for MP3Stegz according to claim 5, it is characterized in that described step 5) in steganography secret information encryption after size by the byte of the 40th in present frame, and several bytes between the 1st byte in continuous two bytes met the following conditions in 42nd ~ 56 bytes are determined: 8 bits of the 1st byte in continuous two bytes are the ASC II yard of character " # ", and 8 bits of the 2nd byte in continuous two bytes are the ASC II yard of character ". ".
CN201510228165.9A 2013-04-08 2013-04-08 A kind of Stego-detection method for MP3Stegz Active CN104821169B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201510228165.9A CN104821169B (en) 2013-04-08 2013-04-08 A kind of Stego-detection method for MP3Stegz

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201310119750.6A CN103236265B (en) 2013-04-08 2013-04-08 A kind of Stego-detection method for MP3Stegz
CN201510228165.9A CN104821169B (en) 2013-04-08 2013-04-08 A kind of Stego-detection method for MP3Stegz

Related Parent Applications (1)

Application Number Title Priority Date Filing Date
CN201310119750.6A Division CN103236265B (en) 2013-04-08 2013-04-08 A kind of Stego-detection method for MP3Stegz

Publications (2)

Publication Number Publication Date
CN104821169A true CN104821169A (en) 2015-08-05
CN104821169B CN104821169B (en) 2018-04-17

Family

ID=48884301

Family Applications (2)

Application Number Title Priority Date Filing Date
CN201310119750.6A Expired - Fee Related CN103236265B (en) 2013-04-08 2013-04-08 A kind of Stego-detection method for MP3Stegz
CN201510228165.9A Active CN104821169B (en) 2013-04-08 2013-04-08 A kind of Stego-detection method for MP3Stegz

Family Applications Before (1)

Application Number Title Priority Date Filing Date
CN201310119750.6A Expired - Fee Related CN103236265B (en) 2013-04-08 2013-04-08 A kind of Stego-detection method for MP3Stegz

Country Status (1)

Country Link
CN (2) CN103236265B (en)

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105913856A (en) * 2016-04-20 2016-08-31 深圳大学 Audio tampering detection method and system based on amplitude co-occurrence vector characteristics
CN106228981A (en) * 2016-08-03 2016-12-14 中山大学 A kind of MP3 self adaptation steganography method based on compression domain

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104485109B (en) * 2013-01-22 2017-09-29 宁波大学 A kind of compressed domain audio digital extraction method based on index value
CN104282310B (en) * 2014-09-26 2017-05-03 宁波大学 Steganography detection method for audio subjected to MP3Stego steganography
CN104637484B (en) * 2015-02-03 2017-09-29 宁波大学 A kind of MP3 audio steganography detection methods based on Co-occurrence Matrix Analysis

Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030009670A1 (en) * 2001-04-02 2003-01-09 Digimarc Corporation Background watermark processing
US20030026447A1 (en) * 2001-06-22 2003-02-06 Jessica Fridrich Reliable detection of LSB steganography in color and grayscale images
JP2004080412A (en) * 2002-08-19 2004-03-11 Oki Electric Ind Co Ltd Electronic watermark embedding device, electronic watermark detection device, and program
US20070104325A1 (en) * 2005-11-09 2007-05-10 Jong Lim Apparatus and method of detecting steganography in digital data
CN101494051A (en) * 2008-01-23 2009-07-29 武汉大学 Detection method for time-domain audio LSB hidden write
CN101908203A (en) * 2010-07-13 2010-12-08 中国科学院软件研究所 Image and audio recoding-based steganography prevention method
CN102097098A (en) * 2011-02-25 2011-06-15 宁波大学 Digital steganography and digital extraction methods with compressed audio as masking carrier

Patent Citations (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20030009670A1 (en) * 2001-04-02 2003-01-09 Digimarc Corporation Background watermark processing
US20030026447A1 (en) * 2001-06-22 2003-02-06 Jessica Fridrich Reliable detection of LSB steganography in color and grayscale images
JP2004080412A (en) * 2002-08-19 2004-03-11 Oki Electric Ind Co Ltd Electronic watermark embedding device, electronic watermark detection device, and program
US20070104325A1 (en) * 2005-11-09 2007-05-10 Jong Lim Apparatus and method of detecting steganography in digital data
CN101494051A (en) * 2008-01-23 2009-07-29 武汉大学 Detection method for time-domain audio LSB hidden write
CN101908203A (en) * 2010-07-13 2010-12-08 中国科学院软件研究所 Image and audio recoding-based steganography prevention method
CN102097098A (en) * 2011-02-25 2011-06-15 宁波大学 Digital steganography and digital extraction methods with compressed audio as masking carrier

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
严迪群等: "基于Hufman编码的大容量MP3隐写算法", 《四川大学学报(自然科学版)》 *

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105913856A (en) * 2016-04-20 2016-08-31 深圳大学 Audio tampering detection method and system based on amplitude co-occurrence vector characteristics
CN106228981A (en) * 2016-08-03 2016-12-14 中山大学 A kind of MP3 self adaptation steganography method based on compression domain
CN106228981B (en) * 2016-08-03 2019-07-19 中山大学 A kind of adaptive steganography method of MP3 based on compression domain

Also Published As

Publication number Publication date
CN103236265B (en) 2015-10-14
CN104821169B (en) 2018-04-17
CN103236265A (en) 2013-08-07

Similar Documents

Publication Publication Date Title
CN103236265B (en) A kind of Stego-detection method for MP3Stegz
CN101458810B (en) Vector map watermark method based on object property characteristic
CN104282310B (en) Steganography detection method for audio subjected to MP3Stego steganography
WO2004048911A3 (en) System and method for tracking environmental emission reductions
CN103065278B (en) A kind of multi-stage authentication method for shp layer integrality
CN106330611A (en) Anonymous protocol classification method based on statistical feature classification
CN106531176B (en) The digital watermarking algorithm of audio signal tampering detection and recovery
CN107993669A (en) Voice content certification and tamper recovery method based on modification least significant digit weight
CN107369125A (en) Robust watermarking detection method and device for data flow
CN105490777A (en) Satellite telemetry data outlier elimination pre-processing method
CN101794378A (en) Rubbish image filtering method based on image encoding
CN104637484B (en) A kind of MP3 audio steganography detection methods based on Co-occurrence Matrix Analysis
CN105070297B (en) A kind of MP3 audio compressions history detection method
CN109165545A (en) A kind of new signal characteristic extracting methods based on fractal dimension
CN102098346B (en) Method for identifying flow of P2P (peer-to-peer) stream media in unknown flow
WO2007109019A3 (en) Method for processing sensor data within a particle stream by a kstore
CN115510915A (en) Known radar signal sorting method based on gating cycle network principle
CN102214218B (en) System and method for retrieving contents of audio/video
CN101609675A (en) A kind of fragile audio frequency watermark method based on barycenter
CN108737399B (en) Snort alarm data aggregation method based on corner mark random reading
CN103745725B (en) A kind of audio frequency watermark embedding grammar based on constant Q transform
CN101667423A (en) Compressed domain high robust voice/music dividing method based on probability density ratio
CN104123945B (en) Embedding method and extracting method for wav-format audio information
CN105163181A (en) Online video program classification method and device thereof
CN103902905B (en) Malicious code generator identification method and system based on software structure cluster

Legal Events

Date Code Title Description
C06 Publication
PB01 Publication
EXSB Decision made by sipo to initiate substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant