A graph kernel based weakly supervised steganographer identification method and system for jpeg images

Abstract

The application discloses a weakly supervised steganographer identification method and system based on a graph kernel. The method first analyzes various JPEG domain steganalysis feature methods, selects and extracts image features suitable for steganographer identification of a graph structure. Then, the features are used in combination with the structural information between images to construct a user graph structure. Finally, a user graph data standardization representation method based on a graph kernel is designed, and a convolutional neural network is trained to learn the difference representation of the user. Experimental results show that for steganographers who embed secret information on images using mainstream JPEG steganography methods such as nsF5, UED, and J-UNIWARD, the proposed method achieves high recognition accuracy at various steganography embedding rates. When the DCTR3 feature of the image is extracted and the user graph structure is constructed based on the feature, the average recognition accuracy can be improved by nearly 20%, thereby verifying the effectiveness of the proposed method.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for weakly supervised JPEG image stegist identification based on graph kernels. Background Technology

[0002] Steganography is a technique that embeds secret information into digital carriers such as images, audio, and video to achieve covert communication. The development of steganography plays a crucial role in ensuring the communication security of special national departments and key personnel. However, while protecting communication security, if steganography is exploited by malicious organizations to carry out illegal covert communication, it will pose a serious threat to cyberspace security. How to effectively identify and monitor the covert communication activities of criminals has become an urgent need for security agencies in various countries.

[0003] Steganography identification is an effective steganalysis technique aimed at identifying potential image stegists on the internet and uncovering illegal covert communication activities and entities. Unlike steganalysis methods that typically focus on whether a single image contains secret information, stegography identification treats a batch of images as a whole to determine whether it contains secret information. This problem is considered one of the key issues that "brought steganalysis and steganography from the laboratory to the real world." Compared to single-image steganalysis methods, stegography identification methods need to address interference from steganalysis techniques and embedding rate mismatches; furthermore, it needs to address the interference of secret images mixed into a batch of carrier images on the accuracy of identification. All of these place higher demands on stegography identification technology, but precisely because of this, the development of stegography identification technology often better meets the needs of practical applications.

[0004] To address the challenges posed by algorithmic mismatches such as steganalysis techniques and embedding rates, Ker et al. first proposed a hierarchical clustering-based steganalysis paradigm in 2011 [Ker AD, and T. Pevny. A new paradigm for steganalysis via clustering [C] / / Proc of Media Watermarking, Security, and Forensics, Manchester: 2011, 312–324]. Clustering methods do not require knowledge of the steganalysis algorithm and embedding rate used by the steganalyst, and do not require training, thus exhibiting better robustness. However, clustering presupposes the existence of steganalysts, while in practice, steganalysis is uncertain whether steganalysts exist in the data to be examined. In this context, Ker et al. proposed a steganographer identification method based on local outliers [Ker AD, Pevny T. The steganographer is the outlier: realistic large-scale steganalysis[J].IEEE Transactions on Information Forensics and Security, 2014, 9(9): 1424–1435]. This method uses determined outliers to measure the degree of user anomalousness. Subsequently, steganographer identification methods based on different image features were proposed. Apart from differences in the recognizers, the performance of these methods mainly depends on the extracted image features. However, in general, to avoid being detected by steganalysis, only a small portion of the steganographer's images are often coded images, i.e., some coded images are mixed into a batch of carrier images to interfere with the steganographer recognizer. At this time, the image feature distribution of the steganographer will be very similar to that of ordinary users, making it extremely difficult to identify steganographers using only image features. In light of the significant breakthroughs achieved by deep learning in graph structure learning, in 2020, Zhang et al. [Zhang Zhi, Zheng Mingjie, Zhong Shenhua, et al. Steganographer detection via enhancement-aware graph convolutional network[C] / / Proc of IEEE International Conference on Multimedia and Expo, Piscataway, NJ:IEEE, 2020:1-6] proposed a stegwriter detection method based on graph convolutional neural networks. Specifically, after extracting image features, these features are further used to construct a graph structure of the user, and a trained multi-layer graph convolutional network is used to identify the stegwriter.

[0005] However, both the construction of the graph structure and the training of graph convolutions require the use of image features, which means that the effectiveness of graph-based steganalysis is largely constrained by the performance of the extracted image features. Furthermore, to learn classifiable user graph embeddings from the graph structure, graph convolutional neural networks often need to stack multiple layers of feature information, and the number of layers is usually difficult to determine. If the number of layers is set too high, it can lead to oversmoothing, making the embeddings of deep graph nodes very similar. The stacking of these similar node embeddings can cause a decline in graph classification performance. Summary of the Invention

[0006] Existing image stegwriter identification methods based on graph neural networks capture this difference by training multi-layer graph convolutions. On the one hand, due to the oversmoothing problem in graph neural networks, the learned representations are easily indistinguishable, leading to a decline in recognition performance. On the other hand, the performance of image features largely limits the effectiveness of the recognition method. To address these issues, this invention proposes a weakly supervised JPEG image stegwriter identification method and system based on graph kernels. First, an image feature extraction strategy suitable for graph structure stegwriter identification is designed. Under the guidance of this strategy, suitable image features are extracted and a user graph structure is constructed. Then, graph kernels that can maximally preserve structural information and global attributes are studied to obtain a low-dimensional standardized representation of the user graph structure based on the graph kernels. Finally, the user representation based on the graph kernels is fused with the constructed convolutional neural network to learn classification features that can capture user differences, thereby identifying stegwriters.

[0007] To achieve the above objectives, the present invention adopts the following technical solution:

[0008] This invention proposes a weakly supervised JPEG image stegologist identification method based on graph kernels, comprising:

[0009] Step 1: Analyze existing JPEG domain steganalysis detection features, select and extract JPEG image features suitable for graph structure steganalysis identification;

[0010] Step 2: Using the extracted JPEG image features and combining them with the structural information between JPEG images, construct the user as a graph structure;

[0011] Step 3: Use the graph kernel to map the graph structure data corresponding to the user to a low-dimensional space to obtain the low-dimensional embedded data of the graph;

[0012] Step 4: Input the low-dimensional embedding data of the graph into the constructed convolutional neural network to obtain the final graph feature embedding, and perform graph classification prediction based on the final graph feature embedding to identify JPEG image stegwriters.

[0013] Further, step 1 includes:

[0014] We simulate users embedding hidden information in JPEG images using steganography, and perform statistical analysis on the steganography detection features of JPEG images by utilizing the maximum mean difference among users.

[0015] Furthermore, the maximum mean difference between users is calculated as follows:

[0016]

[0017] Where MMD(X,Y) represents the maximum mean difference between user X and user Y, x i and y i Let X and Y be image samples, respectively, where n is the number of samples and k(x,y) is the kernel function.

[0018] Further, step 2 includes:

[0019] By using JPEG images as nodes and the similarity between JPEG images as edges, users are constructed as a graph structure.

[0020] Furthermore, in step 2, the similarity between JPEG images is calculated using a Gaussian kernel function:

[0021]

[0022] Where s(f) i,u ,f i,v ) represents user x i The similarity f between image nodes u and v in the corresponding graph structure i,u ,f i,v These are the eigenvectors of u and v, respectively, and σ represents the control coefficient of the Gaussian kernel function. 2 This represents the L2 norm.

[0023] Furthermore, in step 3, based on The method obtained The rows of Q are low-dimensional embeddings of the graph, N is the number of users, and p is the vector dimension. For graph G′, the mapping is calculated as follows:

[0024]

[0025] Where z′ represents the low-dimensional embedded data after mapping graph G′. yes The false rebellion, It contains the kernel value between G′ and other graphs in the dataset.

[0026] Furthermore, the graph classification prediction based on the final graph feature embedding includes:

[0027] Max pooling is applied to the graph feature embedding to retain only the maximum value in the graph feature embedding. This value is used as a signal related to the filter. Finally, two fully connected layers are connected and the Softmax function is used to complete the graph classification prediction.

[0028] Another aspect of this invention proposes a weakly supervised JPEG image stegologist detection system based on graph kernels, comprising:

[0029] The image feature extraction unit is used to analyze existing JPEG domain steganalysis detection features, select and extract JPEG image features suitable for graph structure steganalysis identification;

[0030] The user graph construction unit is used to construct a graph structure of the user by utilizing the extracted JPEG image features and combining the structural information between JPEG images;

[0031] The user graph structure mapping unit is used to map the graph structure data corresponding to the user to a low-dimensional space using the graph kernel, so as to obtain the low-dimensional embedded data of the graph.

[0032] The user classification and recognition unit is used to input the low-dimensional embedding data of the graph into the constructed convolutional neural network to obtain the final graph feature embedding, and to perform graph classification prediction based on the final graph feature embedding, thereby identifying JPEG image stegwriters.

[0033] Compared with the prior art, the present invention has the following beneficial effects:

[0034] This invention first designs an image feature extraction strategy suitable for identifying graph-structured stegwriters. Under the guidance of this strategy, appropriate image features are extracted and user graph structures are constructed. Then, a graph kernel that can preserve structural information and global attributes to the greatest extent is studied to obtain a low-dimensional standardized representation of the user graph structure based on the graph kernel. Finally, the user representation based on the graph kernel and the constructed convolutional neural network are fused to learn classification features that can capture user differences, thereby identifying JPEG image stegwriters.

[0035] This invention analyzes and selects image features suitable for graph structure construction in JPEG image stegologist recognition. It delves into various JPEG image steganalysis feature design methods and selects image features more suitable for graph-based stegologist recognition tasks.

[0036] Given the advantage of graph kernels in preserving structural information in low-dimensional graph mappings, this invention introduces them into stegwriter identification to characterize users, proposing a weakly supervised JPEG image stegwriter identification method based on graph kernels. This avoids the user information loss problem caused by excessive smoothing during graph convolution in existing methods. Attached Figure Description

[0037] Figure 1This is a flowchart of a weakly supervised JPEG image stegist identification method based on graph kernels, according to an embodiment of the present invention.

[0038] Figure 2 This is a statistical chart for measuring user differences provided in an embodiment of the present invention;

[0039] Figure 3 The recognition results of different image feature representations provided in the embodiments of the present invention;

[0040] Figure 4 This is a schematic diagram of the architecture of a weakly supervised JPEG image stegologist recognition system based on graph kernels, according to an embodiment of the present invention. Detailed Implementation

[0041] The present invention will be further explained below with reference to the accompanying drawings and specific embodiments:

[0042] This invention constructs each user as a graph, transforming the stegwriter identification problem into a graph classification task. The graph consists of nodes and edges. In the constructed user graph structure, nodes correspond to the user's image, and edges describe the similarity relationships between images. Node embeddings are represented using image features, while edges are represented using the distance similarity between features. At a fundamental level, graph construction depends on the representation of image features. This means that, besides the design of the graph classification model, the performance of image features significantly limits the effectiveness and quality of graph-based stegwriter identification methods. Therefore, a suitable image feature is crucial for the model. Based on this, this invention, through in-depth analysis of various JPEG image steganalysis features, proposes an image feature selection strategy suitable for stegwriter identification, selects applicable image feature representations based on this strategy, and finally proposes a weakly supervised JPEG image stegwriter identification method based on graph kernels. Figure 1 As shown, the method includes:

[0043] Step 1: Analyze existing JPEG domain steganalysis detection features, select and extract JPEG image features suitable for graph structure steganalysis identification;

[0044] Step 2: Using the extracted JPEG image features and combining them with the structural information between JPEG images, construct the user as a graph structure;

[0045] Step 3: Use the graph kernel to map the graph structure data corresponding to the user to a low-dimensional space to obtain the low-dimensional embedded data of the graph;

[0046] Step 4: Input the low-dimensional embedding data of the graph into the constructed convolutional neural network to obtain the final graph feature embedding, and perform graph classification prediction based on the final graph feature embedding to identify JPEG image stegwriters.

[0047] The method specifically includes:

[0048] 1 Image Feature Analysis and Extraction for Steganography Detection

[0049] Steganography detection utilizes image features to measure differences between users, typically using the maximum mean discrepancy (MMD) as a distance metric. Specifically, the MMD distance between users X and Y is...

[0050]

[0051] Where, x i and y i Let X and Y be image samples, respectively, and n be the number of samples. The kernel function k(x,y) maps the original variables to a higher-dimensional space. Commonly used kernel functions include linear kernels.

[0052] k(x,y)=x T y (2)

[0053] and Gaussian kernel

[0054] k(x,y)=exp(-γ||xy|| 2 (3)

[0055] Here, γ represents the width of the nucleus.

[0056] Based on this, in order to find image features suitable for steganography detection, this invention analyzes the existing typical JPEG domain steganalysis features. Specifically, firstly, a user is simulated to embed hidden information in their own image using steganography; this user is the steganalyst. Two steganography techniques were tested, including non-adaptive nsF5 steganography and adaptive J-UNIWARD (JPEG UNIversal WAVElet Relative Distortion) steganography. Then, the JPEG image steganalysis features were statistically analyzed using formula (1). It is worth noting that the purpose of the feature analysis here is to find image features that can reflect user differences; therefore, all images of the steganalyst are set to be steganographic images.

[0057] Unlike other image classification tasks, the design of image steganalysis features focuses on understanding small steganalytic noise or feature variations in an image, while suppressing the influence of image content. JPEG (joint photographic experts group) is a commonly used image format on the Internet, characterized by sufficient redundancy space and widespread application, making it a good carrier. The PEV-274 feature proposed by Pevny et al. [Pevny T, Fridrich J. Multiclass detector of current steganalytic methods for JPEG format [J]. IEEE Transactions on Information Forensics and Security, 2008, 3(4): 635-650] can reflect the influence caused by early non-adaptive JPEG image steganalysis embeddings while greatly reducing the interference of content on steganalysis, achieving good detection results. This feature has a total of 274 dimensions. CC-PEV features [Kodovsky J, Fridrich J. Calibration revisited [C] / / Procof the ACM Workshop on Multimedia and Security, New York: ACM: 2009: 63-74] are an improved version of PEV-274 that incorporates Cartesian calibration. Its dimensions are twice that of PEV-274, with 548 dimensions. With the emergence of STCs (syndrome-trellis codes), more advanced adaptive JPEG steganography was developed. Adaptive steganography embeddings mainly focus on complex regions that are difficult to model, making them more difficult to detect. For adaptive JPEG steganography, DCTR (DCT residual) features, as a groundbreaking work, opened up a new framework for JPEG phase-aware features. However, the dimension of DCTR features is also much higher than PEV-274 and CC-PEV, reaching an astonishing 8,000 dimensions. The recently developed DCTR... MThe (M=3,4,8) series of features [Xia Chao, Guan Qingxiao, Zhao Xianfeng, et al. Improved JPEG phase-aware steganalysis features using multiple filter sizes and difference images[J].IEEE Transactions on Circuits and Systems for Video Technology,2020,30(11):4100-4113], although also borrowing the design idea of ​​DCTR features, obtains residuals by setting different filter sizes (M represents the filter size), which can reduce the feature dimension while capturing local texture changes before and after adaptive JPEG steganography embedding. Among them, when M=3, the DCTR3 feature is 390-dimensional; when M=4, the DCTR4 feature is 1050-dimensional; when M=8, it is an 8000-dimensional DCTR feature, but due to the use of a feature symmetry method different from DCTR, the DCTR8 feature dimension is only 4100-dimensional, which is about 1 / 2 of the original DCTR feature dimension.

[0058] Based on different image feature design methods, three low-dimensional steganalysis detection features, PEV, CC-PEV, and DCTR3, were analyzed. Specifically, based on the BOSSBase-1.01 image dataset commonly used in steganalysis and steganalysis, 10,000 JPEG images with a quality factor (QF) of 75 were generated as carrier images. Two steganalysis algorithms, nsF5 and J-UNIWARD, with an embedding rate of 0.5 bpnzAC (bits per nonzero AC DCT coefficient), were used to generate corresponding steganalysis images. A certain number of images were randomly selected from the carrier image set as normal user images, and the same number of images were randomly selected from the steganalysis image set to form the steganalyst's image. PEV, CC-PEV, and DCTR3 steganalysis detection features were extracted from all images, and formula (1) was used to measure the superiority of these three features in measuring differences between users. Experimental results are as follows: Figure 2 As shown, Figure 2 In the middle (a), the results of the stenographer's use of nsF5 steganography are measured. Figure 2 Table (b) shows the measurement results of the steganalyst using J-UNIWARD steganography. The horizontal axis represents the number of images for each user, and the vertical axis represents the MMD distance measurement results between users. This invention tested the number of images (from 10 to 100) for each user across 10 different specifications, with the MMD calculation repeated 100 times and the average value taken. Figure 2It can be seen that, when measuring differences between users, the DCTR3 feature provides a more significant measure of these differences compared to PEV and CC-PEV features across both steganography techniques. After analysis and selection of suitable image features, these features can be used for subsequent recognition tasks.

[0059] 2. Structure-Aware User Graph Construction

[0060] A structure-aware user graph is constructed using images as nodes and the similarity between images as edges. The similarity between images is calculated using a Gaussian kernel function. Specifically, given a user x containing multiple images... i x i The similarity between any two image nodes u and v is represented as:

[0061]

[0062] Where, f i,u ,f i,v These are the eigenvectors of u and v, respectively. σ controls the range of the Gaussian kernel function. ||·|| 2 The L2 norm is the Euclidean distance in the usual sense, i.e.

[0063]

[0064] Where d represents the dimension of the node feature.

[0065] User x i All image node features constitute the user's feature matrix. n is user x i The number of images is given by , where d is the dimension of the image features. Metric learning is performed on this feature matrix using formula (4) to obtain image similarity. As x i adjacency matrix Right now

[0066]

[0067] Where s(·) is the similarity function, f i,u ,f i,v These are the feature vectors of any two nodes u and v, respectively. It is an indicator function; its value is 1 when the condition is met, and 0 otherwise. The threshold τ∈[0,1] is a set hyperparameter, or the average distance between all nodes in the graph can be used as the threshold. This is used to obtain the feature matrix X. i and adjacency matrix A i Afterwards, user x i Represented as a graph structure, the user classification problem is transformed into a graph similarity problem.

[0068] 3 Steganography based on graph kernel

[0069] This invention uses a graph kernel to embed a user graph dataset into a low-dimensional space, so that the structural information and properties of the graph can still be preserved to the maximum extent in this low-dimensional space.

[0070] Let G = {G} i :i∈{1,2,...,N}} is the set of user graphs, and N is its cardinality. It is the kernel matrix constructed by G using the graph kernel K. The algorithm complexity of constructing the complete graph kernel matrix K and factoring it to obtain the low-dimensional embedding of the graph is O(N). 3 The computational cost is very high. The method is considered the most representative low-rank kernel matrix approximation method, based on The method obtained The resulting kernel matrix Its complexity is O(N) 3 ) dropped to O(p 2 N), where p << N. By using only a small subset of the p columns (or rows) of the kernel matrix, the computational cost of the kernel matrix is ​​reduced. In this case, the rows of Q are low-dimensional embeddings of the graph, which are used as standardized user graph vectors as input to train subsequent convolutional neural networks, with a vector dimension of p.

[0071] When testing a new user graph, it is mapped to the feature space of the graphs in the training set. Specifically, given a new user graph G′, its mapping is calculated as follows:

[0072]

[0073] in, yes The false rebellion, This is the kernel value that includes G′ and other graphs in the training set. The dimension of the mapped vectors is consistent with the dimension of the normalized user graph vectors in the training set. After performing the above operations on all user subgraphs, these graphs are finally embedded into the input-convolutional neural network for downstream user classification tasks.

[0074] Assume z i For Figure G i The standardized embedding, and the features c after convolutional filtering. i for

[0075] c i =σ(w i z i +b i (8)

[0076] Where σ is the activation function, here ReLU is used, w i It refers to filtering learned by the network; any filter learned by the network. Both belong to the dot product of the graph kernel K to the regenerated Hilbert space H, i.e.

[0077] <z i ,z j >=k(G i G j )=<φ(G i ),φ(G j )> H (9)

[0078] Among them, z i ,z j For Figure G i and G j The standardized feature vector.

[0079] After normalizing and vectorizing all user graphs and performing multi-layer convolutions, the feature embeddings of G are obtained as shown in the figure below:

[0080] c = [c1, c2, ..., c N ] T (10)

[0081] In the final classification module of the network, max-pooling is applied to the user graph embedding. Max-pooling retains only the maximum value in the feature embedding (mapping) c, which serves as the signal associated with the filter w. Intuitively, max-pooling helps capture the feature representation of the class to which the graph belongs. Finally, two fully connected layers (FC) are connected, and the Softmax function is used to complete the user graph classification prediction, identifying JPEG image stegwriters.

[0082]

[0083] 4. Experiment

[0084] 4.1 Experimental Setup

[0085] The experiment was conducted on the BOSSBase-1.01 image database, a benchmark dataset commonly used in the fields of steganography and steganalysis. The BOSSBase-1.01 database contains 10,000 uncompressed 512×512 pixel grayscale natural images. Given that our research object is JPEG images, we first used MATLAB's "imwrite" function to compress the images into JPEG images with a quality factor QF = 75 as the experimental carrier images. Due to the widespread application of JPEG domain steganography algorithms nsF5, UED, and J-UNIWARD in the field of information hiding, this invention utilizes these three steganography techniques to construct steganography images with embedding rates of 0.2bpnzAC, 0.3bpnzAC, 0.4bpnzAC, and 0.5bpnzAC, respectively, on the carrier images.

[0086] Besides steganographic carriers, steganographic algorithms, and embedding rates, this invention focuses on users embedding hidden information across multiple images. This also involves a batch embedding strategy problem, namely, which strategy the steganologist chooses to embed M-bit hidden information into n available carriers (I1, I2, ..., I...). n In the experiments of this invention, a uniform embedding strategy is used, that is, the stegwriter embeds the hidden information uniformly into the carriers it can use, without considering the embedding capacity of a single carrier.

[0087] 4.2 Comparative Experiment Results Based on Different Image Features

[0088] The different image feature performances proposed in this experiment are mainly evaluated based on the same model under the condition that users share images of different quantities and sizes. These include four image steganalysis features: PEV, CC-PEV, DCTR, and DCTR3.

[0089] Specifically, firstly, two steganography techniques (nsF5 and J-UNIWARD) with a set embedding rate (here, a high embedding rate of 0.5bpnzAC is chosen) are used to generate corresponding coded images from the carrier images. The carrier images serve as the image dataset for normal users, while the coded images serve as the image dataset for steganalysts. Next, the carrier and coded images are used to simulate normal network users and steganalysts (the main entities in network image-based covert communication). Each user is set to share a certain number of images (including six specifications: 5, 10, 20, 30, 40, and 50 images). Each specification constructs 200 normal users and 200 steganalysts. For example, the first specification involves each user sharing 5 images, with a total of 400 users (200 normal users and 200 steganalysts), requiring 2000 images (including 1000 carrier images and 1000 coded images). The remaining rules are set accordingly. It should be noted that normal user images were randomly selected from the carrier image set, while steganographic images were randomly selected from the carrier images. In the experiment, 90% of the constructed user data was used as the training set for model testing, and the remaining 10% was used as the test set. The training set employed 10x10 fold cross-validation, which involved dividing the training dataset into 10 parts, using one part as the validation set each time, and using the remaining 9 parts as the training set, then averaging the results of these 10 iterations. The experimental results are as follows: Figure 3 As shown.

[0090] Figure 3 The test accuracy of different image feature extraction methods in the constructed model is intuitively demonstrated. Figure 3 (a) shows the identification results of the stegwriter using the nsF5 steganalysis model. Figure 3 In (b), the stegologist uses the J-UNIWARD steganalysis model to identify the problem. Figure 3 In the graph, the horizontal axis represents the six image quantity specifications shared by the user: 5, 10, 20, 30, 40, and 50 images, while the vertical axis represents the model's recognition accuracy. From... Figure 2It is clear that different image features perform better in the stegwriter detection model. When users embed secret information into batches of images using different steganography techniques, the DCTR3 feature significantly outperforms other image features, especially when users use adaptive steganography, where its advantage is even more pronounced. Our analysis suggests this is mainly because, on the one hand, PEV and CC-PEV features have relatively limited ability to capture adaptive steganographic embeddings, resulting in less than ideal recognition performance when users use adaptive steganography; on the other hand, while the DCTR feature can capture adaptive steganographic embeddings, its high dimensionality leads to the failure of distance metrics, exhibiting the well-known curse of dimensionality problem, making its performance for stegwriter detection even worse than PEV and CC-PEV features. The DCTR3 feature, however, possesses both detection effectiveness and low feature dimensionality, resulting in superior performance in the model compared to other methods. This provides valuable insights for further research on stegwriter detection. Therefore, in our model and comparative experiments with other models, the DCTR3 feature is selected unless otherwise specified and necessary.

[0091] In summary, this invention proposes a weakly supervised JPEG image stegwriter identification method based on graph kernels. This method analyzes image feature extraction strategies suitable for graph-structured stegwriter identification and constructs a user graph structure using the DCTR3 features of the image under the guidance of this strategy. Then, the user graph embedding obtained based on the graph kernel is convolved with a one-dimensional convolutional neural network filter and passed to the neural network for training to complete graph classification, thereby identifying the stegwriter. A series of experiments were conducted on the commonly used BOSSbase-1.01 image database. Experimental results show that the image feature representation method proposed in this invention can effectively identify stegwriters using JPEG images for covert communication.

[0092] Based on the above embodiments, such as Figure 4 As shown, this invention also proposes a weakly supervised JPEG image stegologist identification system based on graph kernels, comprising:

[0093] The image feature extraction unit is used to analyze existing JPEG domain steganalysis detection features, select and extract JPEG image features suitable for graph structure steganalysis identification;

[0094] The user graph construction unit is used to construct a graph structure of the user by utilizing the extracted JPEG image features and combining the structural information between JPEG images;

[0095] The user graph structure mapping unit is used to map the graph structure data corresponding to the user to a low-dimensional space using the graph kernel, so as to obtain the low-dimensional embedded data of the graph.

[0096] The user classification and recognition unit is used to input the low-dimensional embedding data of the graph into the constructed convolutional neural network to obtain the final graph feature embedding, and to perform graph classification prediction based on the final graph feature embedding, thereby identifying JPEG image stegwriters.

[0097] In summary, this invention analyzes and selects image features suitable for graph structure construction in JPEG image stegologist recognition. It delves into various JPEG image steganalysis feature design methods and selects image features more suitable for graph-based stegologist recognition tasks. Given the advantage of graph kernels in preserving structural information in low-dimensional graph mappings, this invention introduces them into stegologist recognition to characterize users, proposing a weakly supervised JPEG image stegologist recognition method based on graph kernels. This avoids the user information loss problem caused by excessive smoothing during graph convolution in existing methods.

[0098] The above description is only a preferred embodiment of the present invention. It should be noted that those skilled in the art can make several improvements and modifications without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A weakly supervised JPEG image stegwriter identification method based on graph kernels, characterized in that, include: Step 1: Analyze existing JPEG domain steganalysis detection features, select and extract JPEG image features suitable for graph structure steganalysis identification; Step 2: Using the extracted JPEG image features and combining them with the structural information between JPEG images, construct the user as a graph structure; Step 3: Use the graph kernel to map the graph structure data corresponding to the user to a low-dimensional space to obtain the low-dimensional embedded data of the graph; Step 4: Input the low-dimensional embedding data of the graph into the constructed convolutional neural network to obtain the final graph feature embedding, and perform graph classification prediction based on the final graph feature embedding to identify JPEG image stegwriters. Step 1 includes: Simulate users using steganography to embed hidden information in JPEG images, and perform statistical analysis on the steganography detection features of JPEG images by utilizing the maximum mean difference among users; The maximum difference in mean between users is calculated as follows: in x represents the maximum mean difference between user X and user Y. i and y i Let X and Y be image samples, respectively, where n is the number of samples and k(x, y) is the kernel function. In step 3, the result is obtained based on the Nyström method. Q's rows are low-dimensional embeddings of the graph, N is the number of users, and p is the vector dimension. The mapping calculation is as follows: in Representation diagram Mapped low-dimensional embedded data, yes The false rebellion, It includes Kernel values ​​between the kernel and other graphs in the dataset; The graph classification prediction based on the final graph feature embedding includes: Max pooling is applied to the graph feature embedding to retain only the maximum value in the graph feature embedding. This value is used as a signal related to the filter. Finally, two fully connected layers are connected and the Softmax function is used to complete the graph classification prediction.

2. The method for weakly supervised JPEG image stegwriter identification based on graph kernels according to claim 1, characterized in that, Step 2 includes: By using JPEG images as nodes and the similarity between JPEG images as edges, users are constructed as a graph structure.

3. The weakly supervised JPEG image stegologist identification method based on graph kernels according to claim 2, characterized in that, In step 2, the Gaussian kernel function is used to calculate the similarity between JPEG images: in User x i The similarity f between image nodes u and v in the corresponding graph structure i,u , f i,v These are the eigenvectors of u and v, respectively, and σ represents the control coefficient of the Gaussian kernel function. 2 This represents the L2 norm.

4. A weakly supervised JPEG image stegwriter identification system based on graph kernels, characterized in that, include: The image feature extraction unit is used to analyze existing JPEG domain steganalysis detection features, select and extract JPEG image features suitable for graph structure steganalysis identification; The user graph construction unit is used to construct a graph structure of the user by utilizing the extracted JPEG image features and combining the structural information between JPEG images; The user graph structure mapping unit is used to map the graph structure data corresponding to the user to a low-dimensional space using the graph kernel, so as to obtain the low-dimensional embedded data of the graph. The user classification and recognition unit is used to input the low-dimensional embedding data of the graph into the constructed convolutional neural network to obtain the final graph feature embedding, and to perform graph classification prediction based on the final graph feature embedding, thereby identifying JPEG image stegonists. The image feature extraction unit is specifically used for: Simulate users using steganography to embed hidden information in JPEG images, and perform statistical analysis on the steganography detection features of JPEG images by utilizing the maximum mean difference among users; The maximum difference in mean between users is calculated as follows: in x represents the maximum mean difference between user X and user Y. i and y i Let X and Y be image samples, respectively, where n is the number of samples and k(x, y) is the kernel function. In the user graph structure mapping unit, the Nyström method is used to obtain... Q's rows are low-dimensional embeddings of the graph, N is the number of users, and p is the vector dimension. The mapping calculation is as follows: in Representation diagram Mapped low-dimensional embedded data, yes The false rebellion, It includes Kernel values ​​between the kernel and other graphs in the dataset; The graph classification prediction based on the final graph feature embedding includes: Max pooling is applied to the graph feature embedding to retain only the maximum value in the graph feature embedding. This value is used as a signal related to the filter. Finally, two fully connected layers are connected and the Softmax function is used to complete the graph classification prediction.

Images