CN104821169B - A kind of Stego-detection method for MP3Stegz - Google Patents
A kind of Stego-detection method for MP3Stegz Download PDFInfo
- Publication number
- CN104821169B CN104821169B CN201510228165.9A CN201510228165A CN104821169B CN 104821169 B CN104821169 B CN 104821169B CN 201510228165 A CN201510228165 A CN 201510228165A CN 104821169 B CN104821169 B CN 104821169B
- Authority
- CN
- China
- Prior art keywords
- byte
- frame
- steganography
- bytes
- audio files
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Landscapes
- Signal Processing For Digital Recording And Reproducing (AREA)
- Management Or Editing Of Information On Record Carriers (AREA)
Abstract
The invention discloses a kind of Stego-detection method for MP3Stegz, its elder generation opens MP3 audio files to be detected in a manner of binary stream, then each frame is sequentially found from the binary stream of the MP3 audio files, then by analyzing the 37th~41 byte and the 42nd~56 byte in each frame, determine each frame whether through MP3Stegz steganography mistakes, advantage is by analyzing the 37th~41 byte and the 42nd~56 byte in every frame in the binary stream of the MP3 audio files, the MP3 audio files can be detected whether through MP3Stegz steganography mistakes exactly, and Robust Performance, Detection accuracy is high, computation complexity is low.
Description
The application is the divisional application for the application for a patent for invention that original applying number is 201310119750.6, its applying date is
On 04 08th, 2013, entitled " a kind of Stego-detection method for MP3Stegz ".
Technical field
The present invention relates to a kind of audio steganography detection technique, more particularly, to a kind of Stego-detection side for MP3Stegz
Method.
Background technology
Steganography is an important branch of Information hiding, it be it is a kind of by secret information be hidden in host signal and
Third party does not know the technology propagated in the presence of it by common signal channel.Stego-detection technology is then the opposition of Steganography
Technology, the purpose is to disclose in suspicious carrier signal with the presence or absence of secret information so that destroying covert communications.
As one of most popular audio format on current internet, MP3 audios are widely used, therefore are directed to
The Steganography and Stego-detection technology of MP3 audios also continue to develop in game.Occurs the steganography of some MP3 audios in recent years
Instrument, such as MP3Stego, UnderMP3Cover, MP3Stegz, at the same time for the Stego-detection side of various steganography instruments
Method also proposed in succession, and one is proposed as Qiao et al. proposes a kind of Stego-detection method for MP3Stego, Jin et al.
Kind is for Stego-detection method of UnderMP3Cover etc..However, the Stego-detection side currently for MP3Stegz steganography instruments
Method yet there are no specific report.
The content of the invention
The technical problems to be solved by the invention are to provide a kind of Stego-detection method for MP3Stegz, it can be accurate
MP3 audios really are detected whether by MP3Stegz steganography mistakes, and detection process is simple, computation complexity is low.
Technical solution is used by the present invention solves above-mentioned technical problem：A kind of Stego-detection side for MP3Stegz
Method, it is characterised in that comprise the following steps：
1. MP3 audio files to be detected are opened in a manner of binary stream；
2. finding out the first frame from the binary stream of the MP3 audio files, and it is present frame by the first frame definition found out；
3. whether 8 bits for judging each byte in the 37th~40 byte in present frame are character
II yard of the ASC of " X ", and whether 8 bits of the 41st byte in present frame are any one in character " 1 "~" 9 "
5. II yard of the ASC of character, if it is, performing step 4., otherwise, performs step；
4. judge to meet the following conditions with the presence or absence of continuous two bytes in the in present frame the 42nd~56 byte：Even
8 bits of the 1st byte in two continuous bytes are II yard of the ASC of character " # ", and in continuous two bytes
The 2nd byte 8 bits be character " " II yard of ASC, if it is present determine the MP3 audio files warp
MP3Stegz steganography mistakes, complete Stego-detection, otherwise, perform step 5.；
5. judge present frame whether be the MP3 audio files binary stream in last frame, if it is, determine should
MP3 audio files are completed Stego-detection, otherwise, are looked for from the binary stream of the MP3 audio files without MP3Stegz steganography mistakes
Go out next frame, using the frame as present frame, be then back to step and 3. continue to execute.
The step 2. in the process of the first frame found out from the binary stream of the MP3 audio files be：From the MP3 sounds
The 1st byte in the binary stream of frequency file starts, byte-by-byte inquiry, when retrieving continuous respective 8 of two bytes
When binary number is followed successively by 1,111 1111 and 1111 101*, it is the MP3 to determine the 1st byte in this continuous two byte
The byte that the first frame in the binary stream of audio file starts, wherein, * represents binary number 0 or 1.
The step 5. in the process of next frame found out from the binary stream of the MP3 audio files be：According to current
Information in the frame head of frame calculates the length of present frame, since a byte after last byte of present frame,
Byte-by-byte inquiry, meets successively when retrieving continuous respective 8 bit of three bytes：For 1,111 1111, be 111*
* * *, high 4 be not all 1, it is determined that the 1st byte in this continuous three byte is the binary system of the MP3 audio files
The byte that next frame in stream starts, wherein, * represents binary number 0 or 1
A kind of Stego-detection method for MP3Stegz, it is characterised in that comprise the following steps：
1) MP3 audio files to be detected are opened in a manner of binary stream；
2) the first frame is found out from the binary stream of the MP3 audio files, and is present frame by the first frame definition found out,
Count is made to represent the order of steganography again, the initial value of count is 0；
3) whether 8 bits for judging each byte in the 37th~40 byte in present frame are character
II yard of the ASC of " X ", and whether 8 bits of the 41st byte in present frame are any one in character " 1 "~" 9 "
II yard of the ASC of character, if it is, performing step 4), otherwise, performs step 6)；
4) judge to meet the following conditions with the presence or absence of continuous two bytes in the in present frame the 42nd~56 byte：Even
8 bits of the 1st byte in two continuous bytes are II yard of the ASC of character " # ", and in continuous two bytes
The 2nd byte 8 bits be character " " II yard of ASC, if it is present make count=count+1, wherein,
"=" is assignment herein, then performs step 5), otherwise, performs step 6)；
5) the order count of steganography, the initial position of steganography are exported, and extracts the form of the secret information of steganography and hidden
The encrypted size of secret information write, then performs step 6)；
6) judge present frame whether be the MP3 audio files binary stream in last frame, if it is, performing step
It is rapid 7), otherwise, next frame is found out from the binary stream of the MP3 audio files, using the frame as present frame, is then back to step
3) continue to execute；
7) whether the value for judging count is 0, if it is, the MP3 audio files are determined without MP3Stegz steganography mistakes,
Stego-detection is completed, otherwise, it determines the MP3 audio files complete Stego-detection through MP3Stegz steganography mistakes.
The process for finding out the first frame in the step 2) from the binary stream of the MP3 audio files is：From the MP3 sounds
The 1st byte in the binary stream of frequency file starts, byte-by-byte inquiry, when retrieving continuous respective 8 of two bytes
When binary number is followed successively by 1,111 1111 and 1111 101*, it is the MP3 to determine the 1st byte in this continuous two byte
The byte that the first frame in the binary stream of audio file starts, wherein, * represents binary number 0 or 1.
The process for finding out next frame in the step 6) from the binary stream of the MP3 audio files is：According to current
Information in the frame head of frame calculates the length of present frame, since a byte after last byte of present frame,
Byte-by-byte inquiry, meets successively when retrieving continuous respective 8 bit of three bytes：For 1,111 1111, be 111*
* * *, high 4 be not all 1, it is determined that the 1st byte in this continuous three byte is the binary system of the MP3 audio files
The byte that next frame in stream starts, wherein, * represents binary number 0 or 1.
The initial position of steganography is the position of the 41st byte in present frame in the step 5).
In the step 5) form of the secret information of steganography by the 42nd~56 byte in present frame meet with
Three bytes after the 2nd byte in continuous two bytes of lower condition determine：The 1st byte in continuous two bytes
8 bits be character " # " II yard of ASC, and 8 bits of the 2nd byte in continuous two bytes are word
Accord with II yard of the ASC of " ".
The encrypted size of the secret information of steganography is by the 40th byte in present frame in the step 5), with the 42nd
Meet that several bytes between the 1st byte in continuous two bytes of the following conditions determine in~56 bytes：Continuously
8 bits of the 1st byte in two bytes are II yard of the ASC of character " # ", and the 2nd in continuous two bytes
8 bits of byte are II yard of the ASC of character " ".
Compared with prior art, the advantage of the invention is that：
1) the 37th~41 byte and the 42nd~56 byte in every frame by analyzing MP3 audio files, Neng Gouzhun
The MP3 audio files really are detected whether through MP3Stegz steganography mistakes, and Robust Performance, Detection accuracy are high, it is complicated to calculate
Spend low.
2) by analyzing the 41st~56 byte in the frame crossed in MP3 audio files by MP3Stegz steganography, the company of finding
Two continuous bytes meet the following conditions：8 bits of previous byte be character " # " II yard of ASC, the latter word
8 bits of section are II yard of the ASC of character " "；Then the continuous of condition is met to this according to the 40th of this frame the byte
Two bytes the 1st byte between several bytes, the encrypted size of secret information can be obtained, according to this satisfaction
Continuous three bytes can obtain the form of secret information after the 2nd byte in continuous two bytes of condition, pass through
The 41st~56 byte in the frame crossed in analysis MP3 audio files by MP3Stegz steganography, can obtain rising when time steganography
Beginning position.
Embodiment
The present invention is described in further detail with reference to embodiments.
MP3Stegz is one of currently a popular MP3 steganography instruments, its steganography process is：After being encrypted by secret information
The byte that is converted into replace can embedding frame partial bytes, while it can believe secret before steganography secret information content itself
The extension name of breath and encrypted size steganography are into MP3.Its whole steganography process is broadly divided into two parts：Processing is concealed
Information, steganography secret information are in itself and its relevant information, processing secret information part are mainly completed：According to password to secret information
It is encrypted, and extracts extension name and encrypted size；Steganography secret information is in itself and its related information section is mainly root
The extension name and size and progress steganography of secret information itself extracted according to steganography method to front portion.
For the steganography principle of MP3Stegz, the present invention proposes that Detection accuracy is high, computation complexity is low is directed to
The Stego-detection method of MP3Stegz.
Embodiment one：
The Stego-detection method of the present embodiment comprises the following steps：
1. MP3 audio files to be detected are opened in a manner of binary stream.
2. finding out the first frame from the binary stream of the MP3 audio files, and it is present frame by the first frame definition found out.
In this particular embodiment, step 2. in the process of the first frame is found out from the binary stream of the MP3 audio files
For：Since the 1st byte in the binary stream of the MP3 audio files, byte-by-byte inquiry, when retrieving continuous two words
When saving respective 8 bit and being followed successively by 1,111 1111 and 1111 101*, the 1st in this continuous two byte is determined
The byte that byte starts for the first frame in the binary stream of the MP3 audio files, wherein, * represents binary number 0 or 1, i.e.,
1111 101* include 1,111 1010 and 1,111 1011.
3. whether 8 bits for judging each byte in the 37th~40 byte in present frame are character
II yard of the ASC of " X ", and whether 8 bits of the 41st byte in present frame are any one in character " 1 "~" 9 "
5. II yard of the ASC of character, if it is, performing step 4., otherwise, performs step.
4. judge to meet the following conditions with the presence or absence of continuous two bytes in the in present frame the 42nd~56 byte：Even
8 bits of the 1st byte in two continuous bytes are II yard of the ASC of character " # ", and in continuous two bytes
The 2nd byte 8 bits be character " " II yard of ASC, if it is present determine the MP3 audio files warp
MP3Stegz steganography mistakes, complete Stego-detection, otherwise, perform step 5..
5. judge present frame whether be the MP3 audio files binary stream in last frame, if it is, determine should
MP3 audio files are completed Stego-detection, otherwise, are looked for from the binary stream of the MP3 audio files without MP3Stegz steganography mistakes
Go out next frame, using the frame as present frame, be then back to step and 3. continue to execute.Here, judging whether present frame is the MP3 sounds
Last frame in the binary stream of frequency file uses common technology, such as after last byte in present frame without
When data are for reading in, it may be determined that the present frame is the last frame in the binary stream of the MP3 audio files.
In this particular embodiment, step 5. in the process of next frame is found out from the binary stream of the MP3 audio files
For：According to the information (layer, bitrateIndex, samplingFrequency, paddingBit) in the frame head of present frame
The length of present frame is calculated, since a byte after last byte of present frame, byte-by-byte inquiry, works as retrieval
Meet successively to continuous respective 8 bit of three bytes：For 1 111 1111, be 111* * * * *, high 4 it is incomplete
For 1 (being not required to low 4), it is determined that the 1st byte in this continuous three byte for the MP3 audio files two into
The byte that next frame in system stream starts, wherein, * represents binary number 0 or 1.
Embodiment two：
The Stego-detection method of the present embodiment comprises the following steps：
1) MP3 audio files to be detected are opened in a manner of binary stream.
2) the first frame is found out from the binary stream of the MP3 audio files, and is present frame by the first frame definition found out,
Count is made to represent the order of steganography again, the initial value of count is 0.
In this particular embodiment, the process of the first frame is found out in step 2) from the binary stream of the MP3 audio files
For：Since the 1st byte in the binary stream of the MP3 audio files, byte-by-byte inquiry, when retrieving continuous two words
When saving respective 8 bit and being followed successively by 1,111 1111 and 1111 101*, the 1st in this continuous two byte is determined
The byte that byte starts for the first frame in the binary stream of the MP3 audio files, wherein, * represents binary number 0 or 1, i.e.,
1111 101* include 1,111 1010 and 1,111 1011.
3) whether 8 bits for judging each byte in the 37th~40 byte in present frame are character
II yard of the ASC of " X ", and whether 8 bits of the 41st byte in present frame are any one in character " 1 "~" 9 "
II yard of the ASC of character, if it is, step 4) is performed, otherwise, it determines then present frame is performed without MP3Stegz steganography mistakes
Step 6).
4) judge to meet the following conditions with the presence or absence of continuous two bytes in the in present frame the 42nd~56 byte：Even
8 bits of the 1st byte in two continuous bytes are II yard of the ASC of character " # ", and in continuous two bytes
The 2nd byte 8 bits be character " " II yard of ASC, if it is present make count=count+1, wherein,
"=" is assignment herein, then performs step 5), otherwise, performs step 6).
5) the order count of steganography, the initial position of steganography are exported, and extracts the form of the secret information of steganography and hidden
The encrypted size of secret information write, then performs step 6).
Here, the initial position of steganography be present frame in the 41st byte position, be present frame in the 37th~
8 bits of each byte in 40 bytes are one after last byte of II yard of the ASC of character " X "
A byte.
Here, the form of the secret information of steganography is by meeting the companies of the following conditions in the 42nd~56 byte in present frame
Three bytes after the 2nd byte in continuous two bytes determine：8 two of the 1st byte in continuous two bytes into
Number processed is II yard of the ASC of character " # ", and 8 bits of the 2nd byte in continuous two bytes are character " "
II yard of ASC.Assuming that 8 bits of the 45th byte in present frame are 0,010 0011, it is the ASC II of character " # "
Code, 8 bits of the 46th byte in present frame are 0,010 1110, be II yard of the ASC of character " ", then steganography
The form of secret information is determined by three bytes after the 46th byte in present frame, i.e., by the 47th word in present frame
Section, the 48th byte and the 49th byte determine.
Here, the encrypted size of the secret information of steganography is by the 40th byte in present frame, with the 42nd~56 word
Meet that several bytes between the 1st byte in continuous two bytes of the following conditions determine in section：Continuous two bytes
In the 1st byte 8 bits be character " # " II yard of ASC, and 8 of the 2nd byte in continuous two bytes
Bit is II yard of the ASC of character " ".Assuming that 8 bits of the 45th byte in present frame are 0010
0011, it is II yard of the ASC of character " # ", 8 bits of the 46th byte in present frame are 0,010 1110, are characters
II yard of the ASC of " ", then the encrypted size of the secret information of steganography is by the 40th byte in present frame and present frame
All bytes between 45th byte determine, i.e., are determined by the 41st~44 byte in present frame.
6) judge present frame whether be the MP3 audio files binary stream in last frame, if it is, performing step
It is rapid 7), otherwise, next frame is found out from the binary stream of the MP3 audio files, using the frame as present frame, is then back to step
3) continue to execute.Here, judge present frame whether be the MP3 audio files binary stream in last frame using common
Technology, such as when no data is for reading in after last byte in present frame, it may be determined that the present frame is the MP3
Last frame in the binary stream of audio file.
In this particular embodiment, the process of next frame is found out in step 6) from the binary stream of the MP3 audio files
For：According to the information (layer, bitrateIndex, samplingFrequency, paddingBit) in the frame head of present frame
The length of present frame is calculated, since a byte after last byte of present frame, byte-by-byte inquiry, works as retrieval
Meet successively to continuous respective 8 bit of three bytes：For 1,111 1111, be 111* * * * *, high 4 be not all
1 (low 4 are not required), it is determined that the 1st byte in this continuous three byte is the binary system of the MP3 audio files
The byte that next frame in stream starts, wherein, * represents binary number 0 or 1.
7) whether the value for judging count is 0, if it is, the MP3 audio files are determined without MP3Stegz steganography mistakes,
Stego-detection is completed, otherwise, it determines the MP3 audio files complete Stego-detection through MP3Stegz steganography mistakes.
Whether above-described embodiment one only have detected MP3 audio files through MP3Stegz steganography mistakes, and embodiment two is being implemented
On the basis of example one, then the order count of each steganography, the initial position of steganography are outputed, and extracted the secret of steganography
The form of information and the encrypted size of the secret information of steganography.
For the validity of the method for the present invention and feasibility is better described, the Stego-detection method that is provided using embodiment two
Carry out Stego-detection experiment.
Stego-detection experiment one：
The process that Stego-detection is carried out to the MP3 audio files crossed without MP3Stegz steganography is：
1st, from internet at random download a MP3 format audio file (such as testcase.mp3),
The important parameter of testcase.mp3 as listed in table 1, then opens testcase.mp3 in a binary fashion.
The important parameter list of 1 MP3 audios testcase.mp3 of table
| File size | 3776512 bytes |
| Duration | 3 points 55 seconds |
| Sample frequency | 44.1KHz |
| Bit rate | 128Kbps |
2nd, since the 1st byte in the binary stream of testcase.mp3, byte-by-byte inquiry, when retrieving the 1378th
During with 1379 byte, since their own 8 bit is followed successively by 1,111 1111,1111 101*, meet to become
The condition of the first frame in the binary stream of testcase.mp3, it is thus determined that the 1378th byte is the two of testcase.mp3
The byte that the first frame in system stream starts, then using the first frame as present frame.
3rd, the 37th~41 byte in present frame, 8 bits of each byte before discovery in 4 bytes are checked
It is 1,111 1111, is not II yard of the ASC of character " X "；It is again seen that 8 bits of the 5th byte are 1111
1111, it is not II yard of the ASC of any one character in character " 1 "~" 9 ", it is thus determined that present frame is without MP3Stegz steganography
Cross.
4th, check present frame whether the last frame in the binary stream for being testcase.mp3, when not being last frame
When, the length that present frame is calculated according to the information in the frame head of present frame is 418 bytes, and obtains the last of present frame
One byte, is the 1796th byte, the then byte-by-byte inquiry since the 1797th byte, when retrieving continuous three words
Respective 8 bit is saved successively to meet：For 1,111 1111, be 111* * * * *, high 4 be not all 1 and (low 4 do not made
It is required that), it is determined that the 1st byte in this continuous three byte is that the next frame in the binary stream of testcase.mp3 is opened
The byte of beginning.
5th, using next frame as present frame, whether continue to detect the present frame through MP3Stegz steganography by the above process 3 and 4
Cross, each frame is constantly detected according to the method, the last frame in the binary stream of testcase.mp3, was being detected
Find that all frames in the binary stream of testcase.mp3 do not meet following two conditions at the same time in journey：1. per the in frame
In 37~41 5 bytes, 8 bits of each byte in preceding 4 bytes are II yard of the ASC of character " X ", and the 5th
The binary number of a byte is II yard of the ASC of any one character in character " 1 "~" 9 "；2. the 42nd~56 word in per frame
There are continuous two bytes for meeting the following conditions in section：8 bits of the 1st byte in continuous two bytes are character
II yard of the ASC of " # ", and II yard of the ASC that 8 bits of the 2nd byte in continuous two bytes are character " ".Cause
This, determines that the MP3 audio files without MP3Stegz steganography mistakes, so far complete Stego-detection.
Stego-detection experiment two：
The process that Stego-detection is carried out to the MP3 audio files crossed through MP3Stegz steganography is：
1st, assume that MP3 audio files to be detected are testcase_steg.mp3 herein, be in experiment one
What testcase.mp3 was obtained for 4 times through MP3Stegz steganography, and the particular content of this 4 steganography is as listed in table 2.
2 testcase_steg.mp3 audio files of table are by the list of the order of steganography and the content of each steganography
2nd, since the 1st byte in the binary stream of testcase_steg.mp3, byte-by-byte inquiry, when retrieving
1378th and during 1379 byte, since their own 8 bit is followed successively by 1,111 1111,1111 101*, meet into
For the condition of the first frame in the binary stream of testcase_steg.mp3, it is thus determined that the 1378th byte is testcase_
The byte that the first frame in the binary stream of steg.mp3 starts, then using the first frame as present frame.
3rd, the 37th~41 byte in present frame, 8 bits of each byte before discovery in 4 bytes are checked
It is 0,101 1000, is all II yard of the ASC of character " X ", it is again seen that 8 bits of the 5th byte is 0011
0100, it is II yard of the ASC of character " 4 "；The 42nd~56 byte in present frame is reexamined, finds 8 of the 46th byte
Binary number is 0,010 0011, is II yard of the ASC of character " # ", 8 bits of the 47th byte are 0,010 1110, are
II yard of the ASC of character " "；The order count of steganography is set to add 1 at this time.
4th, the order count of steganography and the initial position of steganography are exported, the order for detecting this steganography is the 1st time；It is hidden
The initial position write is the position of the 41st byte in present frame, as in the binary stream of testcase_steg.mp3
1418th byte.
The encrypted size of secret information of the form and steganography of the secret information of steganography is extracted, in the 1st steganography,
By the 40th byte in present frame with meeting the 1st word in continuous two bytes of the following conditions in the 42nd~56 byte
All byte-extractions between section (being the 46th byte in the first frame for the first frame) come out：In continuous two bytes
The 1st byte 8 bits be character " # " II yard of ASC, and 8 of the 2nd byte in continuous two bytes
Binary number is II yard of the ASC of character " ".Extract the 41st~45 byte in present frame, their own 8 two
System number is respectively 0,011 0100,0,011 0011,0,011 0010,0,011 0001,0,011 0011, wherein, 0,011 0100
It is II yard of the ASC of character " 3 " for II yard of the ASC of character " 4 ", 0,011 0011,0,011 0010 be the ASC II of character " 2 "
Code, 0,011 0001 be II yard of the ASC of character " 1 ", and 0,011 0011 be II yard of the ASC of character " 3 ", that is, obtains the secret of steganography
The encrypted size of information is 43213 bytes；In the 1st steganography, it will meet in the 42nd~56 byte in present frame
After the 2nd byte (being the 47th byte in the first frame for the first frame) in continuous two bytes of the following conditions
Three byte-extractions come out, that is, extract the 48th, the 49th and the 50th byte, their own 8 bit point
Not Wei 0,110 0110,0,110 1100,0,111 0110, wherein, 0,110 0110 be character " f " II yard of ASC, 0,110 1100
It is II yard of the ASC of character " v " for II yard of the ASC of character " l ", 0,111 0110, that is, the form for representing the secret information of steganography is
flv。
5th, check present frame whether the last frame in the binary stream for being testcase_steg.mp3, when not being last
During one frame, the length that present frame is calculated according to the information in the frame head of present frame is 418 bytes, and obtains present frame
Last byte be testcase.mp3 binary stream in the 1796th byte, then since the 1797th byte by
Byte is inquired about, when 8 bits for retrieving each byte in continuous three bytes meet successively：For 1,111 1111,
1 (being not required to low 4) is not all for 111* * * * *, high 4, it is determined that the 1st byte in this continuous three byte
The byte started for the next frame in the binary stream of testcase_steg.mp3.
6th, using next frame as present frame, whether continue to detect the present frame through MP3Stegz steganography by the above process 3 and 4
Cross, each frame is constantly detected according to the method, the last frame in the binary stream of testcase.mp3, was being detected
In journey find testcase_steg.mp3 binary stream in the 8944th frame, the 8964th frame, the 9009th frame at the same time meet with
Lower two conditions：1. in the 37th~41 5 bytes in per frame, 8 bits of each byte in preceding 4 bytes are equal
For II yard of the ASC of character " X ", 8 bits of the 5th byte are the ASC of any one character in character " 1 "~" 9 "
II yard；2. there are continuous two bytes for meeting the following conditions in the 42nd~56 byte in per frame：In continuous two bytes
8 bits of the 1st byte are II yard of the ASC of character " # ", 8 two of the 2nd byte in continuous two bytes into
Number processed is II yard of the ASC of character " ".For the 8944th frame, the order detected as steganography is the 2nd time, the initial position of steganography
For the 3739227th byte in the binary stream of testcase.mp3, the form of the secret information of steganography is jpg, steganography
The encrypted size of secret information is 7072 bytes；For the 8964th frame, the order detected as steganography is the 3rd time, steganography
Initial position be the 3747586th byte in the binary stream of testcase.mp3, the form of the secret information of steganography is
Mp3, the encrypted size of secret information of steganography is 16432 bytes；For the 9009th frame, detect be for the order of steganography
The 4th, the initial position of steganography are the 3766394th byte in the binary stream of testcase.mp3, and the concealed of steganography is believed
The form of breath is txt, and the encrypted size of secret information of steganography is 52 bytes.
7th, the value of count is 4 at this time, it is thus determined that the MP3 audio files are through MP3Stegz steganography mistakes, and the number of steganography
For 4 times, Stego-detection is so far completed.
It can illustrate that the method for the present invention can accurately detect that MP3 audio files are well by above-mentioned two experiment
It is no through MP3Stegz steganography mistakes, and can accurately obtain the order of steganography, the initial position of steganography, the secret information of steganography
Form and the encrypted size of the secret information of steganography.This validity and feasibility that are enough to illustrate the method for the present invention.
It is that the performance of the method for the present invention is analyzed below.
First kind sample is the MP3 audio files without MP3Stegz steganography：The 200 first MP3 downloaded at random on internet
The audio file of form, each MP3 audio files 3~5 minutes, 7 kinds of encoder types (including Lame, Xing, Gogo,
Blade, FhG, Shine, Plugger), (VBR (variable bit rate), ABR (Mean Speed) and CBR are (fixed for 3 kinds of coding modes
Speed) three kinds, in the case of wherein CBR, code rate includes 96,112,128,160,192,256,320kbps etc.)；Second class
Sample is the MP3 audio files through MP3Stegz steganography：It is respectively 4 kinds of multimedia files of TXT, MP3, JPG, FLV by form
As secret information, and by the random steganography of MP3Stegz steganography respectively is finally produced into 200 samples of first kind sample
1 time, 2 times, 3 times, each 50, totally 200, the sample of 4 times.
All samples in above-mentioned two classes sample are carried out with Stego-detection, the false alarm rate of detection, leakage using the method for the present invention
Inspection rate and positive inspection rate are as listed in table 3.
Table 3 is using the method for the present invention to the MP3 audio files without MP3Stegz steganography and through MP3Stegz steganography
MP3 audio files carry out the result of Stego-detection
From table 3 it is observed that the method for the present invention can 100% audio file for correctly judging a first MP3 format be
The no steganography by MP3Stegz operates.Table 4 give using the method for the present invention to all samples in above-mentioned two classes sample into
The average of row Stego-detection takes.
Table 4 carries out all samples in above-mentioned two classes sample using the method for the present invention the average time-consuming of Stego-detection
As can be seen from Table 4, the computation complexity of the method for the present invention is low, and operational efficiency is higher, and average detected one is first just
The MP3 audio files (3~5 minutes) of Chang great little are taken between 0.3 second to 0.4 second, function admirable.
Claims (3)
- A kind of 1. Stego-detection method for MP3Stegz, it is characterised in that comprise the following steps：1) MP3 audio files to be detected are opened in a manner of binary stream；2) the first frame is found out from the binary stream of the MP3 audio files, and is present frame by the first frame definition found out, then is made Count represents the order of steganography, and the initial value of count is 0；3) whether 8 bits for judging each byte in the in present frame the 37th~40 byte are character " X " II yard of ASC, and whether 8 bits of the 41st byte in present frame are any one character in character " 1 "~" 9 " II yard of ASC, if it is, performing step 4), otherwise, performs step 6)；4) judge to meet the following conditions with the presence or absence of continuous two bytes in the in present frame the 42nd~56 byte：Continuously 8 bits of the 1st byte in two bytes are II yard of the ASC of character " # ", and the in continuous two bytes the 2nd 8 bits of a byte are II yard of the ASC of character " ", if it is present count=count+1 is made, wherein, herein "=" is assignment, then performs step 5), otherwise, performs step 6)；5) export the order count of steganography, the initial position of steganography, and extract the form and steganography of the secret information of steganography The encrypted size of secret information, then performs step 6)；The initial position of steganography is the position of the 41st byte in present frame in the step 5)；The form of the secret information of steganography in the 42nd~56 byte in present frame by meeting following article in the step 5) Three bytes after the 2nd byte in continuous two bytes of part determine：8 of the 1st byte in continuous two bytes Bit is II yard of the ASC of character " # ", and 8 bits of the 2nd byte in continuous two bytes are character II yard of the ASC of " "；The encrypted size of the secret information of steganography is by the 40th byte in present frame in the step 5), with the 42nd~56 Meet that several bytes between the 1st byte in continuous two bytes of the following conditions determine in a byte：Continuous two 8 bits of the 1st byte in byte are II yard of the ASC of character " # ", and the 2nd byte in continuous two bytes 8 bits be character " " II yard of ASC；6) judge present frame whether be the MP3 audio files binary stream in last frame, if it is, perform step 7) next frame, otherwise, is found out from the binary stream of the MP3 audio files, using the frame as present frame, is then back to step 3) Continue to execute；7) whether the value for judging count is 0, if it is, determining that the MP3 audio files without MP3Stegz steganography mistakes, are completed Stego-detection, otherwise, it determines the MP3 audio files complete Stego-detection through MP3Stegz steganography mistakes.
- A kind of 2. Stego-detection method for MP3Stegz according to claim 1, it is characterised in that the step 2) process for finding out the first frame in from the binary stream of the MP3 audio files is：From the binary stream of the MP3 audio files The 1st byte start, byte-by-byte inquiry, 1111 are followed successively by when retrieving continuous respective 8 bit of two bytes During 1111 and 1111 101*, the binary stream that the 1st byte in this continuous two byte is the MP3 audio files is determined In the byte that starts of the first frame, wherein, * represents binary number 0 or 1.
- A kind of 3. Stego-detection method for MP3Stegz according to claim 1 or 2, it is characterised in that the step It is rapid 6) in the process of next frame found out from the binary stream of the MP3 audio files be：According to the information in the frame head of present frame The length of present frame is calculated, since a byte after last byte of present frame, byte-by-byte inquiry, works as retrieval Meet successively to continuous respective 8 bit of three bytes：For 1,111 1111, be 111*****, high 4 be not all 1, it is determined that the 1st byte in this continuous three byte starts for the next frame in the binary stream of the MP3 audio files Byte, wherein, * represent binary number 0 or 1.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510228165.9A CN104821169B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
Applications Claiming Priority (2)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201510228165.9A CN104821169B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
| CN201310119750.6A CN103236265B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
Related Parent Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310119750.6A Division CN103236265B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104821169A CN104821169A (en) | 2015-08-05 |
| CN104821169B true CN104821169B (en) | 2018-04-17 |
Family
ID=48884301
Family Applications (2)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310119750.6A Expired - Fee Related CN103236265B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
| CN201510228165.9A Active CN104821169B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
Family Applications Before (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201310119750.6A Expired - Fee Related CN103236265B (en) | 2013-04-08 | 2013-04-08 | A kind of Stego-detection method for MP3Stegz |
Country Status (1)
| Country | Link |
|---|---|
| CN (2) | CN103236265B (en) |
Families Citing this family (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN104485109B (en) * | 2013-01-22 | 2017-09-29 | 宁波大学 | A kind of compressed domain audio digital extraction method based on index value |
| CN104282310B (en) * | 2014-09-26 | 2017-05-03 | 宁波大学 | Steganography detection method for audio subjected to MP3Stego steganography |
| CN104637484B (en) * | 2015-02-03 | 2017-09-29 | 宁波大学 | A kind of MP3 audio steganography detection methods based on Co-occurrence Matrix Analysis |
| CN105913856A (en) * | 2016-04-20 | 2016-08-31 | 深圳大学 | Audio tampering detection method and system based on amplitude co-occurrence vector characteristics |
| CN106228981B (en) * | 2016-08-03 | 2019-07-19 | 中山大学 | A kind of adaptive steganography method of MP3 based on compression domain |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101494051A (en) * | 2008-01-23 | 2009-07-29 | 武汉大学 | Detection method for time-domain audio LSB hidden write |
| CN101908203A (en) * | 2010-07-13 | 2010-12-08 | 中国科学院软件研究所 | Image and audio recoding-based steganography prevention method |
| CN102097098A (en) * | 2011-02-25 | 2011-06-15 | 宁波大学 | Digital steganography and digital extraction methods with compressed audio as masking carrier |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20030009670A1 (en) * | 2001-04-02 | 2003-01-09 | Digimarc Corporation | Background watermark processing |
| US6831991B2 (en) * | 2001-06-22 | 2004-12-14 | The Research Foundation Of Suny State University Plaza | Reliable detection of LSB steganography in color and grayscale images |
| JP3949029B2 (en) * | 2002-08-19 | 2007-07-25 | 沖電気工業株式会社 | Digital watermark detection apparatus and program |
| KR20070049748A (en) * | 2005-11-09 | 2007-05-14 | 임종인 | An apparutus and method for detecting steganography in digital data |
-
2013
- 2013-04-08 CN CN201310119750.6A patent/CN103236265B/en not_active Expired - Fee Related
- 2013-04-08 CN CN201510228165.9A patent/CN104821169B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101494051A (en) * | 2008-01-23 | 2009-07-29 | 武汉大学 | Detection method for time-domain audio LSB hidden write |
| CN101908203A (en) * | 2010-07-13 | 2010-12-08 | 中国科学院软件研究所 | Image and audio recoding-based steganography prevention method |
| CN102097098A (en) * | 2011-02-25 | 2011-06-15 | 宁波大学 | Digital steganography and digital extraction methods with compressed audio as masking carrier |
Non-Patent Citations (1)
| Title |
|---|
| 基于Hufman编码的大容量MP3隐写算法;严迪群等;《四川大学学报（自然科学版）》;20111130;第48卷(第6期);1281-1286 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104821169A (en) | 2015-08-05 |
| CN103236265B (en) | 2015-10-14 |
| CN103236265A (en) | 2013-08-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN104821169B (en) | A kind of Stego-detection method for MP3Stegz | |
| CN103853834B (en) | Text structure analysis-based Web document abstract generation method | |
| CN108536657B (en) | Method and system for processing similarity of artificially filled address texts | |
| CN102770856B (en) | The territory measured for precision waveform identifies and separates | |
| CN104282310B (en) | Steganography detection method for audio subjected to MP3Stego steganography | |
| JP2006351002A5 (en) | ||
| CN107993636B (en) | Recursive neural network-based music score modeling and generating method | |
| CN101963972A (en) | Method and system for extracting emotional keywords | |
| CN109067708B (en) | Method, device, equipment and storage medium for detecting webpage backdoor | |
| CN110019779A (en) | A kind of file classification method, model training method and device | |
| CN105490777A (en) | Satellite telemetry data outlier elimination pre-processing method | |
| CN101794378B (en) | Rubbish image filtering method based on image encoding | |
| CN110020190B (en) | Multi-instance learning-based suspicious threat index verification method and system | |
| CN113903361A (en) | Speech quality detection method, device, equipment and storage medium based on artificial intelligence | |
| CN110826062B (en) | Malicious software detection method and device | |
| CN105070297B (en) | A kind of MP3 audio compressions history detection method | |
| CN109240922B (en) | Method for extracting webshell software gene to carry out webshell detection based on RASP | |
| CN115438645A (en) | Text data enhancement method and system for sequence labeling task | |
| CN111785236A (en) | Automatic composition method based on motivational extraction model and neural network | |
| CN115169293A (en) | Text steganalysis method, system, device and storage medium | |
| CN115331703A (en) | Song voice detection method and device | |
| CN109273025B (en) | Chinese ethnic five-tone emotion recognition method and system | |
| CN103092854B (en) | Music data sorting method | |
| CN111930947A (en) | System and method for identifying authors of modern Chinese written works | |
| CN110782917A (en) | Poetry reciting style classification method and system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| EXSB | Decision made by sipo to initiate substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |