Optimal Gabor Filters for Steganalysis of Content-Adaptive JPEG Steganography

( Xiaofeng Song ),( Fenlin Liu ),( Liju Chen ),( Chunfang Yang ),( Xiangyang Luo ) 한국인터넷정보학회 2017 KSII Transactions on Internet and Information Syst Vol.11 No.1

The existing steganalysis method based on 2D Gabor filters can achieve a competitive detection performance for content-adaptive JPEG steganography. However, the feature dimensionality is still high and the time-consuming of feature extraction is relatively large because the optimal selection is not performed for 2D Gabor filters. To solve this problem, a new steganalysis method is proposed for content-adaptive JPEG steganography by selecting the optimal 2D Gabor filters. For the proposed method, the 2D Gabor filters with different parameter settings are generated first. Then, the feature is extracted by each 2D Gabor filter and the corresponding detection accuracy is used as the measure for filter selection. Next, some 2D Gabor filters are selected by a greedy strategy and the steganalysis feature is extracted by the selected filters. Last, the ensemble classifier is used to assemble the proposed steganalysis feature as well as the final steganalyzer. The experimental results show that the steganalysis feature extracted by the selected optimal 2D Gabor filters also can achieve a competitive detection performance while the feature dimensionality is reduced greatly.

An SDN based hopping multicast communication against DoS attack

( Zheng Zhao ),( Fenlin Liu ),( Daofu Gong ) 한국인터넷정보학회 2017 KSII Transactions on Internet and Information Syst Vol.11 No.4

Multicast communication has been widely used in the Internet. However, multicast communication is vulnerable to DoS attack due to static router configuration. In this paper, HMC, a hopping multicast communication method based on SDN, is proposed to tackle this problem. HMC changes the multicast tree periodically and makes it difficult for the attackers to launch an accurate attack. It also decreases the probability of multicast communication being attacked by DoS and in the meanwhile, the QoS constrains are not violated. In this research, the routing problem of HMC is proven to be NP-complete and a heuristic algorithm is proposed to solve it. Experiments show that HMC has the ability to resist DoS attack on multicast route effectively. Theoretically, the multicast compromised probability can drop more than 0.6 when HMC is adopt. In addition, experiments demonstrate that HMC achieves shorter average multicast delay and better robustness compared with traditional method, and more importantly, it better defends DoS attack.

Steganalysis of adaptive JPEG steganography by selecting DCT coefficients according to embedding distortion

( Xiaofeng Song ),( Fenlin Liu ),( Chunfang Yang ),( Xiangyang Luo ),( Zhenyu Li ) 한국인터넷정보학회 2015 KSII Transactions on Internet and Information Syst Vol.9 No.12

According to the characteristics of adaptive JPEG steganography which determines the changed DCT coefficients based on embedding distortion, a new steganalysis method by selecting the DCT coefficients with small distortion values is proposed. Firstly, the principle of adaptive JPEG steganography through minimizing distortion is introduced. Secondly, the practicability of selecting the changed DCT coefficients according to distortion values is studied. Thirdly, the proposed steganalysis method is given and the embedding sensitivity of the steganalysis feature extracted from the selected DCT coefficients is analyzed. Lastly, the implement processes of the proposed method are presented and analyzed in details. In the experiments, PQt, PQe and J-UNIWARD steganography are used as examples to verify the effect of the proposed steganalysis method for adaptive JPEG steganography. A serial experimental results show the detection accuracy can be improved obviously, especially when the payload is relatively low.

Recognizing F5-like stego images from multi-class JPEG stego images

( Jicang Lu ),( Fenlin Liu ),( Xiangyang Luo ) 한국인터넷정보학회 2014 KSII Transactions on Internet and Information Syst Vol.8 No.11

To recognize F5-like (such as F5 and nsF5) steganographic algorithm from multi-class stego images, a recognition algorithm based on the identifiable statistical feature (IDSF) of F5-like steganography is proposed in this paper. First, this paper analyzes the special modification ways of F5-like steganography to image data, as well as the special changes of statistical properties of image data caused by the modifications. And then, by constructing appropriate feature extraction sources, the IDSF of F5-like steganography distinguished from others is extracted. Lastly, based on the extracted IDSFs and combined with the training of SVM (Support Vector Machine) classifier, a recognition algorithm is presented to recognize F5-like stego images from images set consisting of a large number of multi-class stego images. A series of experimental results based on the detection of five types of typical JPEG steganography (namely F5, nsF5, JSteg, Steghide and Outguess) indicate that, the proposed algorithm can distinguish F5-like stego images reliably from multi-class stego images generated by the steganography mentioned above. Furthermore, even if the types of some detected stego images are unknown, the proposed algorithm can still recognize F5-like stego images correctly with high accuracy.

A City-Level Boundary Nodes Identification Algorithm Based on Bidirectional Approaching

( Zhiyuan Tao ),( Fenlin Liu ),( Yan Liu ),( Xiangyang Luo ) 한국인터넷정보학회 2021 KSII Transactions on Internet and Information Syst Vol.15 No.8

Existing city-level boundary nodes identification methods need to locate all IP addresses on the path to differentiate which IP is the boundary node. However, these methods are susceptible to time-delay, the accuracy of location information and other factors, and the resource consumption of locating all IPes is tremendous. To improve the recognition rate and reduce the locating cost, this paper proposes an algorithm for city-level boundary node identification based on bidirectional approaching. Different from the existing methods based on time-delay information and location results, the proposed algorithm uses topological analysis to construct a set of candidate boundary nodes and then identifies the boundary nodes. The proposed algorithm can identify the boundary of the target city network without high-precision location information and dramatically reduces resource consumption compared with the traditional algorithm. Meanwhile, it can label some errors in the existing IP address database. Based on 45,182,326 measurement results from Zhengzhou, Chengdu and Hangzhou in China and New York, Los Angeles and Dallas in the United States, the experimental results show that: The algorithm can accurately identify the city boundary nodes using only 20.33% location resources, and more than 80.29% of the boundary nodes can be mined with a precision of more than 70.73%.

Microblog User Geolocation by Extracting Local Words Based on Word Clustering and Wrapper Feature Selection

( Hechan Tian ),( Fenlin Liu ),( Xiangyang Luo ),( Fan Zhang ),( Yaqiong Qiao ) 한국인터넷정보학회 2020 KSII Transactions on Internet and Information Syst Vol.14 No.10

Existing methods always rely on statistical features to extract local words for microblog user geolocation. There are many non-local words in extracted words, which makes geolocation accuracy lower. Considering the statistical and semantic features of local words, this paper proposes a microblog user geolocation method by extracting local words based on word clustering and wrapper feature selection. First, ordinary words without positional indications are initially filtered based on statistical features. Second, a word clustering algorithm based on word vectors is proposed. The remaining semantically similar words are clustered together based on the distance of word vectors with semantic meanings. Next, a wrapper feature selection algorithm based on sequential backward subset search is proposed. The cluster subset with the best geolocation effect is selected. Words in selected cluster subset are extracted as local words. Finally, the Naive Bayes classifier is trained based on local words to geolocate the microblog user. The proposed method is validated based on two different types of microblog data - Twitter and Weibo. The results show that the proposed method outperforms existing two typical methods based on statistical features in terms of accuracy, precision, recall, and F1-score.