Universal steganalysis detection method for airspace and JPEG (Joint Photographic Experts Group) domain

Abstract

The invention discloses a general steganalysis detection method for a spatial domain and a JPEG domain, which is characterized in that an SRM filtering kernel initialization branch and a randomly initialized convolution kernel branch are mutually fused through a well-designed bidirectional fusion module, the fused complementary information promotes the effective cooperation and learning of the two branches, the noise residual error extraction capability of the double branches is enhanced, and the noise residual error extraction efficiency is improved. Therefore, the signal-to-noise ratio of the preprocessing stage is improved. A multi-level feature fusion module is introduced in feature extraction, feature maps of different levels are weighted through a space attention mechanism, the feature maps of different levels are integrated by down-sampling to the same scale, and weak steganography features are reserved. In multi-scale attention pooling (MSAP) in a classifier, convolution kernels of different sizes are utilized to extract multi-scale features to enhance feature expression, then gated channel transformation (GCT) is utilized to control weight distribution among channels, and finally, style pooling of global standard deviation pooling and global average pooling is combined to perform global pooling on a feature map, so that the statistical magnitude is improved.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a universal steganalysis detection method for air domain and JPEG domain. Background Art

[0002] Image steganography can embed secret information into the carrier image to achieve covert transmission of information, ensuring that the hidden information is invisible to third parties without the key, and protecting the confidentiality of information transmission. The history of image steganography can be traced back to ancient times, but the development of its modern form is closely related to the progress of digital image processing technology. Digital images contain rich information content and have become ideal steganographic carriers. Modern digital image formats are diverse, such as PNG, BMP, TIFF, JPEG, WebP, etc. Each format has its own unique characteristics, which provide a broad application space for steganography. Image steganalysis, as an important branch in the field of information security, aims to detect and identify steganographic activities. Image steganography and image steganalysis compete with each other and make progress together, but also bring many problems and challenges.

[0003] In the early days of steganalysis, according to the different image carriers, two major categories were formed: spatial domain steganography and (joint photographic experts group, JPEG) domain steganography. Spatial domain steganography hides secret information by directly modifying the pixel values ​​of the image. These tiny changes are imperceptible to the human eye. The JPEG domain steganography algorithm utilizes the characteristics of the JPEG domain image compression algorithm to embed secret information into the compression domain of the image instead of directly modifying the pixel values. This method can reduce the impact on image quality and increase the steganographic capacity. Compared with spatial domain steganography, JPEG domain steganography is usually more complex because it needs to consider factors such as JPEG compression characteristics and quantization tables to ensure that the hidden information is not destroyed by the compression algorithm. With the development of technology, in order to improve the concealment of steganalysis, adaptive steganography has gradually become the mainstream. Adaptive steganography fully considers the properties of the image itself, selectively embeds secret information in the complex texture area of ​​the image and the edge area of ​​the image content, greatly improving the detection ability of anti-steganography analysis. Among them, the common steganographic algorithms in the spatial domain are WOW, HILL, MiPOD, etc., and those in the JPEG domain are UED, UERD, etc. UNIWARD is a dual-domain steganographic scheme, S-UNIWARD in the spatial domain and J-UNIWARD in the JPEG domain. The difference in steganographic algorithms led to the difference in early steganalysis detection methods in the spatial domain and the JPEG domain. In the spatial domain, steganalysis detects whether the image is embedded with secret information by analyzing the statistical characteristics of the digital image; in the JPEG domain, due to the existence of the Discrete Cosine Transform (DCT), the embedding process occurs in the quantized DCT coefficients, so it is necessary to detect by analyzing the statistical characteristics of these DCT coefficients.

[0004] The rapid development of deep learning has attracted the attention of researchers. Starting from TanNet, the steganalysis network based on deep learning has developed rapidly. In the spatial domain, Gaussian-Neuron CNN, XuNet, YeNet, YedroudjNet, CovpoolNet, ZhuNet, SigStegNet, LWENet, FPNet, and GFS-Net have appeared. In the JPEG domain, there are ZengNet, PNet&VNet. SRNet is the only network that can effectively detect both the spatial domain and the JPEG domain. The early research on steganalysis detectors based on deep learning more reflects the combination of prior knowledge and deep learning knowledge. In the spatial domain, GNCNN explores the significance of introducing Gaussian neurons as activation functions, and initializes the preprocessing layer with KV high-pass filter kernel to calculate the noise residual. XuNet considers the distribution characteristics of the steganalysis signal, and proposes to add an absolute value layer and introduce the (hyperbolictangent, TanH) activation function in the first layer, and introduce the (batch normalization, BN) layer to help the training stability of the neural network. YeNet's thinking is more in-depth. It proposes to use 30 high-pass filter kernels in (spatial rich model, SRM) as network preprocessing to greatly improve the signal-to-noise ratio, and proposes (truncated linear unit, TLU) activation function to adapt to the distribution of stego signals. In the JPEG field, ZengNet uses 25 DCT basic blocks for preprocessing. After quantization and truncation, it constructs 25 subnets with the same structure and extracts features from 25 residual maps. PNet&VNet proposed a steganalysis network based on JPEG phase information. Their preprocessing uses 4 different high-pass filters and a JPEG phase-aware module. In the JPEG phase-aware module, the image is divided into non-overlapping 8×8 blocks. The elements in the same position in each block form 64 phase separation matrices. A neural network is constructed for the phase separation matrix to separate the phase data of the image, effectively improving the detection accuracy of JPEG domain images. Later, with the rapid development of hardware, the computing resources for training neural networks have been alleviated, and neural networks with larger parameters and more complex network structures have been proposed. Researchers began to think about more complex steganalysis networks, such as SRNet, ZhuNet, and SigStegNet. SRNet uses a significantly expanded front part with multiple residual connections instead of traditional manually designed filters to learn noise residuals, thereby reducing the reliance on prior knowledge and effectively extracting noise residuals in the spatial domain and JPEG domain.ZhuNet divides the SRM filter kernel into 3×3 and 5×5 sizes in the preprocessing stage, and further refines the SRM filter kernel; in the feature extraction stage, two layers of depth-separable convolution are used instead of standard convolution to extract the correlation between the residual information space and the channel; spatial pyramid pooling (SPP) is introduced in the classifier to replace the global average pooling to compress the high-order feature map, retaining the local feature information. SigStegNet designs a twin architecture to extract the features of two sub-regions of an image respectively, and designs a contrast loss function to judge the distance between the two sub-regions. The network uses SRM plus 3 layers of residual blocks to enhance the signal-to-noise ratio of preprocessing; the classifier fuses the maximum, minimum, mean and variance statistics of the two image sub-regions for binary classification. However, a more complex network is not conducive to application, and lightweight is the demand of real scenarios. Lightweight steganalysis networks have become a hot topic of research, and CovpoolNet, LWENet, FPNet, and GFS-Net are all representatives of lightweight. CovpoolNet uses only 10 convolutional layers to reduce time complexity, and uses global covariance pooling instead of global average pooling in the classifier to improve detection performance. LWENet is a lightweight steganalysis network that uses SRM and 6-layer bottleneck blocks in the preprocessing stage to enhance the signal-to-noise ratio; uses depthwise separable convolution in the last layer of feature extraction to reduce the number of parameters; and adopts multi-view pooling to enhance global average pooling to improve the detection performance of the classifier. FPNet uses the feature enhancement transfer module to transfer steganographic features from shallow layers to deep layers, and uses the attention downsampling module to learn attention to full-resolution features. GFS-Net is a comprehensive steganalysis network that balances the number of parameters and time complexity. The model significantly improves the signal-to-noise ratio in the preprocessing stage through the joint strategy of SRM+(pointwise convolution, PWConv)+(gated channel transformation, GCT). FasterNetblocks composed of partial convolutions are used to extract features in the last two layers of feature extraction. The classifier uses style pooling (stylepooling) composed of global standard deviation pooling and global average pooling to enhance statistics to improve detection accuracy.

[0005] However, due to the difference in steganographic algorithms, there are great differences in the distribution of embedded noise between spatial domain and JPEG domain. The spatial domain steganographic algorithm directly modifies the pixel value adaptively, taking into account the differences in the content of different images. The embedded locations are all some areas with complex textures and edge areas of the image content. In contrast, the JPEG domain steganographic algorithm is completely different. Since the images in the JPEG domain are compressed, the steganographic algorithm modifies the quantized DCT coefficients. For JPEG domain steganalysis based on deep learning, usually only the changes in the stego signal after the JPEG domain image is decompressed are concerned. After the modification of a quantized DCT coefficient is subjected to the inverse discrete cosine transform (IDCT), its modification will be dispersed to all pixels in a block in the spatial domain of the image. This change becomes more complex in the spatial domain, and the range of pixel value changes may increase, thereby changing the statistical distribution characteristics of the pixels. In the preprocessing stage of spatial domain steganalysis, the high-pass filter kernel in SRM is used as prior knowledge to calculate the noise residual, mainly to extract high-frequency information in the image. In the preprocessing stage, JPEG domain steganalysis relies more on the DCT basic block in DCTR to calculate the noise residual and extract the steganographic features in the image. The effect of separate processing can effectively improve the signal-to-noise ratio in the preprocessing stage in both domains. However, SRNet does not consider the differences between the steganographic signals in the spatial domain and the JPEG domain. They believe that forcing the network to use the SRM filter or the DCT basic kernel is actually detrimental to the overall network performance, and the network should be allowed to actively analyze and learn the distribution of the steganographic signal. Therefore, they considered using randomly initialized convolution kernels to calculate the noise residual and using the network's back propagation to update the distribution of the actively learned features, thus balancing the differences between the two domains. SRNet also has shortcomings. The randomly initialized convolution kernel is too inefficient in the process of calculating the noise residual. Because the way of updating the convolution kernel using the network's back propagation results in a large cost in its solution space and training time, it is difficult to find the optimal solution. Summary of the invention

[0006] The purpose of the present invention is to provide a universal steganalysis detection method for spatial domain and JPEG domain, and to design a new universal steganalyzer ESNet that combines dual-branch preprocessing, multi-level feature fusion and multi-scale attention pooling modules, which is committed to enriching feature expression, thereby effectively adapting to steganalysis in spatial domain and JPEG domain.

[0007] The technical solution adopted by the present invention is:

[0008] A general steganalysis detection method for spatial domain and JPEG domain, comprising the following steps:

[0009] Step 1: Obtain the image to be processed and convert it into pixel values ​​for preprocessing. Extract features through the SRM filter kernel initialization branch and the randomly initialized convolution kernel branch respectively. The features extracted by the two branches are fused with each other through two bidirectional fusion modules to obtain fused features. The fused features contain complementary information of the two branches, which are then separated and transmitted to their respective branch trunks to continue calculating the noise residual. Finally, the residual maps extracted by the two branches are spliced, which enhances the ability of the two branches to extract noise residuals, thereby improving the signal-to-noise ratio in the preprocessing stage.

[0010] Step 2: In feature extraction, the residual block is used to extract the features of the residual map generated in the preprocessing stage, and the downsampling module is used for downsampling. The network generates feature maps of different levels. We introduce a multi-level feature fusion module to weight feature maps of different levels through a spatial attention mechanism, and then downsample them to the same scale to integrate feature maps of different levels to retain weak steganographic features;

[0011] Step 3. In the classifier, the multi-level feature map integrated by feature extraction is sent to the multi-scale attention pooling (MSAP). The multi-scale attention pooling (MSAP) uses convolution kernels of different sizes to extract multi-scale features and strengthen feature expression. Secondly, the gated channel transform (GCT) is used to control the weight distribution between channels to further enhance the features. Finally, the feature map is globally pooled by combining the global standard deviation pooling and the global average pooling style pooling to improve the statistics. Finally, the pooled information is sent to the fully connected layer for binary classification output.

[0012] Furthermore, in step 1, the bidirectional fusion module concatenates the feature maps generated by the two branches to obtain a merged feature map, and the merged feature map is fused and calculated in turn through the GCT module and the two-layer point convolution layer PWConv to obtain the fused feature; the fused feature is separated again and added to the trunk of each branch to continue calculating the noise residual; the BN layer and the Relu activation function layer are connected in series between the two-layer point convolution layer PWConv.

[0013] Furthermore, the bidirectional fusion module specifically performs the following steps:

[0014] Step 1-1, pass the feature map of branch 1 And the feature map of branch 2 The information is merged in the channel C dimension through the splicing operation to obtain the merged feature map:

[0015] F=Concat[X1,X2] (1)

[0016] in, It is the feature map after the two branches are merged;

[0017] Step 1-2, the merged feature map is fused and calculated by the GCT module and the 2-layer point convolution layer PWConv in turn to obtain the fused feature; specifically, the following steps are included:

[0018] Step 1-2-1, perform efficient context information modeling at the channel level based on the GCT attention mechanism, that is, aggregate the global context information in each channel through global context embedding operations;

[0019] Assumptions represents C1+C2 feature maps of size H×W, is the Cth channel in F, C∈{1,2,…,C1+C2}; the given embedding weights Then there is

[0020]

[0021] Among them, s c is the cth channel, i.e. F c The result of finding the L2 norm; α c is the embedding weight of channel c, which is a trainable parameter used to control the weight of each channel. Different channels should have different importance. In order to avoid the zero-point derivative problem, ε is a very small constant;

[0022] Step 1-2-2, perform normalization processing and establish dependencies between channels;

[0023]

[0024] in, It is the result of cross-channel normalization of s, and its dimension is consistent with s;

[0025] Step 1-2-3, perform gate control to adapt to the original features and obtain the feature map of GCT. The gate function is as follows:

[0026]

[0027] Among them, the gate weight γ c represents the gate weight of channel c; and gate bias β c represents the gate bias of channel c;

[0028] Specifically, the original channel F c The scale of will be adjusted by its corresponding gate. During the training process, α is initialized with 1, and r and β are initialized with 0.

[0029] Step 1-2-4, feature map after GCT The preliminary feature F′ is obtained by channel-level fusion through 2 layers of PWConv; the specific formula is as follows:

[0030]

[0031] Among them, δ is the Relu activation function,

[0032] Step 1-2-5, in order to increase the stability of the gradient, the preliminary feature F′ is added with the residual shortcut to obtain the fusion feature F″. The specific expression is as follows:

[0033] F″=F+F′ (6)

[0034] Step 1-3, separate the fused feature F″ again and add it to the trunk of each branch to continue calculating the noise residual. Specifically:

[0035] M1,M2=Split[F″] (7)

[0036] in, They are complementary information generated after fusion by the fusion module and are separated again.

[0037] Furthermore, step 2 specifically includes the following steps:

[0038] Step 2-1, feature maps X at different levels i Through the spatial attention mechanism, in the process of spatial attention weighting, different convolution kernels are used to extract features for feature maps of different scales (for example, large convolution kernels are used for feature maps of low-level semantic information, and small convolution kernels are used for feature maps of high-level semantic information). The feature map N after attention weighting i It is expressed as:

[0039] N i =X i ⊙(σ(Conv i ([Avg(X i ),Max(X i )]))),i∈{low,mid,high} (8)

[0040] Among them, ⊙ represents the Hadamard product, Avg and Max represent average pooling and maximum pooling, both of which are performed on the channel dimension. i Represents the convolution operation, for {Conv low ,Conv mid ,Conv high}Use convolution kernels of {7×7, 5×5, 3×3}; σ represents the sigmoid activation function;

[0041] Step 2-2: In order to aggregate feature maps of different levels to participate in the classification of the classifier, the low-level and mid-level feature maps are downsampled and adjusted to the same level as the high-level feature maps. Figure 1 The specific formula is as follows:

[0042] N i ′=Downsampling(N i ),i∈{low,mid} (9)

[0043] Downsampling(·) represents the bilinear interpolation algorithm. The low-mid-level feature maps after downsampling have the same size as the high-level feature maps.

[0044] Step 2-3, concatenate feature maps of different levels in the channel dimension:

[0045] Q = Concat[N low ′,N mid ′,N high ] (10)

[0046] Furthermore, the specific steps of step 3 are as follows:

[0047] Step 3-1, generate feature maps of different scales and cascade them. The specific generation formula is:

[0048] P i =Conv(k i ×k i )(Q),i={0,1,2,3} (11)

[0049] Among them, the size of the i-th convolution kernel is k i is 2i+1,i∈{0,1,2,3}, Conv(·) represents the convolution operation, Represents feature maps of different scales;

[0050] Step 3-2: Different scale feature maps are cascaded to obtain cascaded different scale feature maps. The cascade formula is as follows:

[0051] P=Concat([P0,P1,P2,P3]) (12)

[0052] Step 3-3, cascade feature maps of different scales The channels are rearranged through the channel shuffle operation, and then the gated weighting between channels of different scale features is completed through the GCT layer. The GCT calculation steps refer to the fusion module in the preprocessing. The specific expression is as follows:

[0053] P′=GCT(Shuffle(P)) (13)

[0054] Step 3-4, feature map after gating weighting Perform style pooling operation to compress the channel. The specific expression is as follows:

[0055] P″=Concat[GAP(P′),GSDP(P′)] (14)

[0056] Among them, GAP represents global average pooling, GSDP represents global standard deviation pooling, and style pooling

[0057] The present invention adopts the above technical scheme, and fuses the SRM filter kernel initialization branch and the randomly initialized convolution kernel branch through a carefully designed bidirectional fusion module. The complementary information after fusion promotes the effective cooperation and learning of the two branches, and enhances the ability of the two branches to extract noise residuals, thereby improving the signal-to-noise ratio in the preprocessing stage. In feature extraction, a multi-level feature fusion module is introduced, and feature maps of different levels are weighted by a spatial attention mechanism. Feature maps of different levels are integrated by downsampling to the same scale, and weak steganographic features are retained as much as possible. In the classifier, multi-scale attention pooling (MSAP) first uses convolution kernels of different sizes to extract multi-scale features and enhance feature expression. Secondly, the gated channel transform (GCT) is used to control the weight distribution between their channels, which further enhances the features. Finally, the style pooling using global standard deviation pooling and global average pooling is used to globally pool the feature map to improve the statistics.

[0058] The present invention proposes ESNet, which combines dual-branch preprocessing, multi-level feature fusion (MLFF) with multi-scale attention pooling (MSAP), a universal image steganalysis network for spatial and JPEG domains, aiming to enhance the expression of features from three stages: preprocessing, feature extraction and classifier. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments;

[0060] Figure 1 The overall network structure diagram of ESNet of the present invention is shown below;

[0061] Figure 2 This is a flow chart of using the ESNet model of the present invention;

[0062] Figure 3 (a) Schematic diagram of spatial domain image steganography traces;

[0063] Figure 3(b) is a schematic diagram of steganography traces in a JPEG domain image;

[0064] Figure 4 It is a schematic diagram of the signal-to-noise ratio detection results of the S-UNIWARD steganography algorithm at an embedding rate of 0.4bpp in the spatial domain;

[0065] Figure 5 It is a schematic diagram of the signal-to-noise ratio detection result of the J-UNIWARD steganography algorithm at 0.4bpnzac embedding rate in JPEG domain;

[0066] Figure 6 It is a schematic diagram of the overall architecture of the fusion module of the present invention;

[0067] Figure 7 Detailed structural diagram of the multi-level feature fusion module of the present invention;

[0068] Figure 8 This is a schematic diagram of the structure of the multi-scale attention pooling module of the present invention. Implementation

[0070] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0071] like Figures 1 to 8 As shown in one, the present invention discloses a universal steganalysis detection method for spatial domain and JPEG domain, which comprises the following steps:

[0072] Step 1: Obtain the image to be processed and convert it into pixel values ​​for preprocessing. Extract features through the SRM filter kernel initialization branch and the randomly initialized convolution kernel branch respectively. The features extracted by the two branches are fused with each other through two bidirectional fusion modules to obtain fused features. The fused features contain complementary information of the two branches, which are then separated and transmitted to their respective branch trunks to continue calculating the noise residual. Finally, the residual maps extracted by the two branches are spliced, which enhances the ability of the two branches to extract noise residuals, thereby improving the signal-to-noise ratio in the preprocessing stage.

[0073] Step 2: In feature extraction, the residual block is used to extract the features of the residual map generated in the preprocessing stage, and the downsampling module is used for downsampling. The network generates feature maps of different levels. We introduce a multi-level feature fusion module to weight feature maps of different levels through a spatial attention mechanism, and then downsample them to the same scale to integrate feature maps of different levels to retain weak steganographic features;

[0074] Step 3. In the classifier, the multi-level feature map integrated by feature extraction is sent to the multi-scale attention pooling (MSAP). The multi-scale attention pooling (MSAP) uses convolution kernels of different sizes to extract multi-scale features and strengthen feature expression. Secondly, the gated channel transform (GCT) is used to control the weight distribution between channels to further enhance the features. Finally, the feature map is globally pooled by combining the global standard deviation pooling and the global average pooling style pooling to improve the statistics. Finally, the pooled information is sent to the fully connected layer for binary classification output.

[0075] Furthermore, in step 1, the bidirectional fusion module concatenates the feature maps generated by the two branches to obtain a merged feature map, and the merged feature map is fused and calculated in turn through the GCT module and the two-layer point convolution layer PWConv to obtain the fused feature; the fused feature is separated again and added to the trunk of each branch to continue calculating the noise residual; the two-layer point convolution layer PWConv is connected in series with BN and Relu activation function layers.

[0076] Furthermore, the bidirectional fusion module specifically performs the following steps:

[0077] Step 1-1, pass the feature map of branch 1 And the feature map of branch 2 The information is merged in the channel C dimension through the splicing operation to obtain the merged feature map:

[0078] F=Concat[X1,X2] (1)

[0079] in, It is the feature map after the two branches are merged;

[0080] Step 1-2, the merged feature map is fused and calculated by the GCT module and the 2-layer point convolution layer PWConv in turn to obtain the fused feature; specifically, the following steps are included:

[0081] Step 1-2-1, perform efficient context information modeling at the channel level based on the GCT attention mechanism, that is, aggregate the global context information in each channel through global context embedding operations;

[0082] Assumptions represents C1+C2 feature maps of size H×W, is the Cth channel in F, C∈{1,2,…,C1+C2}; the given embedding weights Then there is

[0083]

[0084] s c is the cth channel, i.e. Fc Find the result of L2 norm. Among them, α c is the embedding weight of channel c, which is a trainable parameter used to control the weight of each channel. Different channels should have different importance. In order to avoid the zero-point derivative problem, ε is a very small constant;

[0085] Step 1-2-2, perform normalization processing and establish dependencies between channels;

[0086]

[0087] in, It is the result of cross-channel normalization of s, and its dimension is consistent with s;

[0088] Step 1-2-3, perform gate control to adapt to the original features and obtain the feature map of GCT. The gate function is as follows:

[0089]

[0090] Among them, the gate weight γ c represents the gate weight of channel c; and gate bias β c represents the gate bias of channel c;

[0091] Specifically, the original channel F c The scale of will be adjusted by its corresponding gate. During the training process, α is initialized with 1, and γ and β are initialized with 0.

[0092] Step 1-2-4, feature map after GCT The preliminary feature F′ is obtained by channel-level fusion through 2 layers of PWConv; the specific formula is as follows:

[0093]

[0094] Among them, δ is the Relu activation function,

[0095] Step 1-2-5, in order to increase the stability of the gradient, the preliminary feature F′ is added with the residual shortcut to obtain the fusion feature F″. The specific expression is as follows:

[0096] F″=F+F′ (6)

[0097] Step 1-3, separate the fused feature F″ again and add it to the trunk of each branch to continue calculating the noise residual. Specifically:

[0098] M1,M2=Split[F″] (7)

[0099] in, They are complementary information generated after fusion by the fusion module and are separated again.

[0100] Furthermore, step 2 specifically includes the following steps:

[0101] Step 2-1, feature maps X at different levels i Through the spatial attention mechanism, in the process of spatial attention weighting, different convolution kernels are used to extract features for feature maps of different scales (for example, large convolution kernels are used for feature maps of low-level semantic information, and small convolution kernels are used for feature maps of high-level semantic information). The feature map N after attention weighting i It is expressed as:

[0102] N i =X i ⊙(σ(Conv i ([Avg(X i ),Max(X i )]))),i∈{low,mid,high} (8)

[0103] Among them, ⊙ represents the Hadamard product, Avg and Max represent average pooling and maximum pooling, both of which are performed on the channel dimension. i Represents the convolution operation, for {Conv low ,Conv mid ,Conv high}Use convolution kernels of {7×7, 5×5, 3×3}; σ represents the sigmoid activation function;

[0104] Step 2-2: In order to aggregate feature maps of different levels to participate in the classification of the classifier, the low-level and mid-level feature maps are downsampled and adjusted to the same level as the high-level feature maps. Figure 1 The specific formula is as follows:

[0105] N i ′=Downsampling(N i ),i∈{low,mid} (9)

[0106] Downsampling(·) represents the bilinear interpolation algorithm. The low-mid-level feature maps after downsampling have the same size as the high-level feature maps.

[0107] Step 2-3, concatenate feature maps of different levels in the channel dimension:

[0108] Q = Concat[N low ′,N mid ′,N high ] (10)

[0109] Furthermore, the specific steps of step 3 are as follows:

[0110] Step 3-1, generate feature maps of different scales and cascade them. The specific generation formula is:

[0111] P i =Conv(k i ×k i )(Q),i={0,1,2,3} (11)

[0112] Among them, the size of the i-th convolution kernel is k i is 2i+1,i∈{0,1,2,3}, Conv(·) represents the convolution operation, Represents feature maps of different scales;

[0113] Step 3-2: Different scale feature maps are cascaded to obtain cascaded different scale feature maps. The cascade formula is as follows:

[0114] P=Concat([P0,P1,P2,P3]) (12)

[0115] Step 3-3, cascade feature maps of different scales The channels are rearranged through the channel shuffle operation, and then the gated weighting between channels of different scale features is completed through the GCT layer. The GCT calculation steps refer to the fusion module in the preprocessing. The specific expression is as follows:

[0116] P′=GCT(Shuffle(P)) (13)

[0117] Step 3-4, feature map after gating weighting Perform style pooling operation to compress the channel. The specific expression is as follows:

[0118] P″=Concat[GAP(P′),GSDP(P′)] (14)

[0119] Among them, GAP represents global average pooling, GSDP represents global standard deviation pooling, and style pooling

[0120] The working principle of the present invention is described in detail below:

[0121] Dual-branch preprocessing: As shown in Figure 3, because the steganographic signals in the spatial domain and the JPEG domain are very different, the common preprocessing methods in the spatial domain, such as the SRM filter kernel, are not completely applicable to the steganographic signals in the JPEG domain, and the prior knowledge in the JPEG domain cannot be applied in the spatial domain. In this regard, the present invention considers using two branches in the preprocessing stage. Branch 1 uses the SRM high-pass filter kernel in the prior knowledge. This branch mainly emphasizes high-frequency information (for example, image edges, texture information, etc.). Branch 2 is inspired by SRNet. The present invention uses a randomly initialized convolution kernel plus a 2-layer residual block. This branch mainly emphasizes that the distribution of the steganographic signal can be learned autonomously, which is very effective for extracting noise residuals in the spatial domain and the JPEG domain. However, the design of the dual branch also has problems. Simply using the Concatenation operation to splice the features of the two branches together according to the channel dimension cannot be effectively fused. Because the dual branches have great differences in the way of calculating the noise residual, the extracted features are very different. In this regard, a fusion module is designed to fuse the features of the two branches with each other. In order to ensure the effectiveness of dual-branch fusion, the present invention splits the 30 high-pass filter kernels in the SRM in branch 1 according to the weight size of 3×3 and 5×5 filter kernels, calculates the noise residual in series, and the weight of the convolution kernel does not participate in the back-propagation update. Finally, PWConv is used to upgrade the channel after SRM filtering to increase the diversity of features. Using each intermediate fusion block between the two branches, the features extracted from the two branches are fused in a channel manner, and the complementary information is passed to the original branch. With the assistance of each intermediate fusion block, branch 1 serves as a supplement to branch 2, helping branch 2 to pay attention to high-frequency noise during training and accelerate network convergence. In addition, branches 1 and 2 compensate each other to produce fused features, which contain the advantages of the two branches, resulting in an increase in the signal-to-noise ratio (SNR) in the preprocessing stage.

[0122] Fusion block: The design of the fusion block considers the GCT attention mechanism plus two layers of PWConv. In addition, a residual shortcut is added for connection. The main process is divided into three steps. The first step is to merge information, splicing the feature maps generated by the two branches together; the second step is fusion, the merged feature map is involved in the GCT and point convolution layer calculation; the third step is separation, separating the fused features and sending them back to each branch to continue extracting features. The detailed structure is as follows Figure 6 shown.

[0123] The first step: the present invention first branches and branches The information is merged in the channel C dimension through the Concatenation operation:

[0124] F=Concat[X1,X2] (1)

[0125] in, It is the feature after the two branches are merged;

[0126] Step 2: The merged features are fused. First, the GCT attention mechanism is used to efficiently model context information at the channel level. Specifically, the global context embedding operation in step 1 is used to aggregate the global context information in each channel. Assume represents C1+C2 feature maps of size H×W, is the Cth channel in F, C∈{1,2,…,C1+C2}. The given embedding weights Then there is

[0127]

[0128] α c It is a trainable parameter used to control the weight of each channel. Different channels should have different importance. In order to avoid the zero-point derivative problem, ε is a very small constant;

[0129] The second step is normalization, which establishes dependencies between channels.

[0130]

[0131] It is the result of cross-channel normalization of s, and its dimension is consistent with s;

[0132] Finally, gate control is used to adapt to the original features. By introducing the gating mechanism, the gate weight AND gate deviation The gating function is as follows:

[0133]

[0134] Original channel F c The scale of will be adjusted by its corresponding gate. During the training process, α is initialized with 1, and γ and β are initialized with 0;

[0135] Secondly, the feature map after GCT To perform channel-level fusion through 2 layers of PWConv, in order to reduce parameter overhead, the channel dimension is reduced by 2 times. The specific formula is as follows:

[0136]

[0137] Where δ is the Relu activation function,

[0138] In order to increase the stability of the gradient, a residual shortcut needs to be added. Specifically:

[0139] F″=F+F′ (6)

[0140] Step 3: The present invention needs to separate the fused features again and add them to the trunks of their respective branches to continue calculating the noise residual. Specifically:

[0141] M1,M2=Split[F″] (7)

[0142] In general, the features of the two branches are merged, GCT and PWConv are fused and separated, and these three parts interact to promote cooperation and learning between the two branches. The design of the fusion module improves the signal-to-noise ratio of the dual-branch preprocessing as follows Figure 4 , 5 shown.

[0143] Multi-level feature fusion (MLFF): The feature disappearance problem has attracted attention in FPNet. Weak steganographic features are weakened layer by layer through continuous stacking of convolutions and pooling. In the feature extraction stage, the deep learning steganalysis detector generates feature maps of different levels from top to bottom. For example, the low-level feature map contains many low-level features (image texture and contour). The low-level features play an important role in steganalysis, but gradually lose their influence after passing through the middle layer. These feature maps of different levels have not been effectively reused, resulting in waste. The feature fusion method can effectively help shallow information to be transmitted to deep layers, which is conducive to feature preservation and gradient back propagation.

[0144] Although simply downsampling to fuse low-medium-high-level features can transfer shallow features to deep layers, it is still difficult to find important areas that need attention (for example, image texture, edge information), which is not conducive to learning weak steganographic features. In addition, there is a receptive field mismatch problem in directly fusing feature maps of different levels by simple addition or concatenation operations. The information encoded in the shallow features is very different from the information encoded in the deep features because they have different receptive fields, and a single pixel in the deep features comes from an area in the shallow features. To address this problem, the present invention introduces a multi-level feature fusion module (MLFF). Its fusion method refers to the selective attention inspiration of the human visual system. According to the stimulation of different attention in the receptive fields of neurons at different levels, the specific structure is as follows: Figure 7 As shown in Figure 2, MLFF considers using convolution kernels of different sizes to calculate spatial attention weights for feature maps of different levels, highlighting important features in feature maps of different levels as much as possible, and then adjusting them to the same scale during downsampling, thereby effectively transferring and fusing low-medium-high-level features.

[0145] Specifically, the feature maps X at different levels iThrough the spatial attention mechanism, in the process of spatial attention weighting, different convolution kernels are used to extract features for feature maps of different scales (for example, large convolution kernels are used for feature maps of low-level semantic information, and small convolution kernels are used for feature maps of high-level semantic information). The feature map N after attention weighting i It is expressed as:

[0146] N i =X i ⊙(σ(Conv i ([Avg(X i ),Max(X i )]))),i∈{low,mid,high} (8)

[0147] Among them, ⊙ represents the Hadamard product, Avg and Max represent average pooling and maximum pooling, both of which are performed on the channel dimension. i Represents the convolution operation, for {Conv low ,Conv mid ,Conv high}Use convolution kernels of {7×7, 5×5, 3×3}; σ represents the sigmoid activation function.

[0148] In order to aggregate feature maps of different levels to participate in the classification of the classifier, it is necessary to downsample the low-level and mid-level feature maps and adjust them to the same level as the high-level feature maps. Figure 1 The specific formula is as follows:

[0149] N i ′=Downsampling(N i ),i∈{low,mid} (9)

[0150] Downsampling(·) represents the bilinear interpolation algorithm. The low-mid-level feature maps after downsampling have the same size as the high-level feature maps.

[0151] Finally, the feature maps of different levels are concatenated in the channel dimension:

[0152] Q = Concat[N low ′,N mid ′,N high ] (10)

[0153] Multi-scale Attention Pooling (MSAP): The pooling method in the classifier has always been the focus of steganalysis tasks. ZhuNet proposed the use of spatial pyramid pooling to average pool the feature maps through sliding windows of different scales to reduce the loss of local feature information; GFS-Net proposed the style pooling that combines global standard deviation pooling and global average pooling to compress high-order feature maps, enhance statistics, and further improve the detection accuracy of the classifier. The present invention analyzes the advantages and believes that it is necessary to combine their advantages at the same time. First, it is necessary to efficiently extract and utilize the spatial information of feature maps of different scales to enrich spatial features. Secondly, the attention mechanism is needed to further dynamically weight the channel information and strengthen the expression of features.

[0154] The present invention proposes a multi-scale attention pooling module (MSAP), which enhances detection performance through three key steps working together. First, 4 groups of convolution kernels of different sizes are used to obtain multi-scale feature maps. Secondly, in order to achieve cross-channel interaction between different groups of features, the present invention uses channel shuffling to shuffle 4 groups of feature maps of different scales, and then uses the GCT attention mechanism on the shuffled feature maps to control the weights of feature maps of different scales, thereby further enhancing multi-scale features. Finally, style pooling performs global information compression on the feature maps of different scales after channel weighting, and the addition of global standard deviation pooling enhances the statistics. The specific structure of MSAP is as follows: Figure 8 shown.

[0155] First, the formula for generating feature maps of different scales is:

[0156] P i =Conv(k i ×k i )(Q),i={0,1,2,3} (11)

[0157] Among them, the size of the i-th convolution kernel is k i is 2i+1,i∈{0,1,2,3}, Conv(·) represents the convolution operation, Represents feature maps of different scales. Feature maps of different scales can be obtained by cascading:

[0158] P=Concat([P0,P1,P2,P3]) (12)

[0159] Through the channel shuffle operation, the channels are rearranged and combined with the subsequent GCT layer to complete the gating weighting between feature channels of different scales:

[0160] P′=GCT(Shuffle(P)) (13)

[0161] The GCT calculation steps refer to the fusion module in the preprocessing, and the feature map after gating weights A style pooling operation is needed to compress the channels:

[0162] P″=Concat[GAP(P′),GSDP(P′)] (14)

[0163] GAP stands for global average pooling, and GSDP stands for global standard deviation pooling.

[0164] Technical effect: The detection performance of the present invention and the dual-domain steganalysis detector SRNet are compared in the JPEG domain, and the experimental results are shown in Tables 1 and 2. ESNet has achieved the best detection performance regardless of the quality factor and four embedding rates (0.1-0.4bpnzac), surpassing SRNet in all aspects. Among them, the quality factor of image compression in Table 1 is 75, and the quality factor of image compression in Table 2 is 95.

[0165] Table 1 Performance comparison between SRNet and ESNet

[0166]

[0167] Table 2 Detection performance comparison between SRNet and ESNet

[0168]

[0169] The detection performance of the present invention is compared with the most advanced steganalyzers in the spatial domain. As shown in Table 3, compared with the four most advanced steganalyzers SRNet, SiaStegNet, LWENet, GFS-Net, ESNet generally achieves the best detection performance in different embedding rates (0.1-0.4bpp) under different steganographic algorithms (WOW, S-UNIWARD, HILL and MiPOD), and is lower than GFS-Net in rare cases.

[0170] Table 3 Comparison of detection accuracy between ESNet and existing steganalyzers under different steganalysis algorithms and different embedding rates

[0171]

[0172]

[0173] In general, with the help of dual-branch preprocessing, multi-level feature fusion and multi-scale attention pooling, ESNet can better take into account the steganalysis signals in the spatial domain and JPEG domain, and secondly, it can effectively retain and identify weak steganalysis features, thereby improving the detection performance.

[0174] In summary, the fixed SRM filter kernel or DCT basic kernel in preprocessing cannot effectively and fully calculate the noise residual in two domains at the same time. The present invention fuses the SRM filter kernel initialization branch and the randomly initialized convolution kernel branch through a carefully designed bidirectional fusion module. The complementary information after fusion promotes the effective cooperation and learning of the two branches, enhances the ability of the two branches to extract noise residuals, and thus improves the signal-to-noise ratio in the preprocessing stage. Step 2, in feature extraction, it is very important to effectively utilize the different levels of feature maps generated by different layers of the network. For example, low-order feature maps contain a lot of image texture, edge and other information, which is indispensable for steganalysis. In this regard, the present invention introduces a multi-level feature fusion module, weights the feature maps of different levels through the spatial attention mechanism, and integrates the feature maps of different levels by downsampling to the same scale, retaining the weak steganalysis features as much as possible. Step 3, in the classifier, multi-scale attention pooling (MSAP) first uses convolution kernels of different sizes to extract multi-scale features and strengthen feature expression. Secondly, the gated channel transform (GCT) is used to control the weight distribution between their channels, further enhancing the features. Finally, the feature map is globally pooled by combining global standard deviation pooling and global average pooling style pooling to improve the statistics. The classification performance is enhanced by the effective combination of these three steps. Through the above three structures, a universal steganalysis detector ESNet is obtained. The experimental results also show that compared with the most advanced steganalysis detector, ESNet achieves higher detection accuracy in both the spatial domain and the JPEG domain.

[0175] The present invention proposes ESNet, which combines dual-branch preprocessing, multi-level feature fusion (MLFF) with multi-scale attention pooling (MSAP), a universal image steganalysis network for spatial and JPEG domains, aiming to enhance the expression of features from three stages: preprocessing, feature extraction and classifier.

[0176] Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians of the art without making creative work are within the scope of protection of the present application.

Claims

1. A general steganalysis detection method for spatial domain and JPEG domain, characterized by: The following steps are involved: Step 1: Obtain the image to be processed and convert it into pixel values ​​for preprocessing. Extract features through the SRM filter kernel initialization branch and the randomly initialized convolution kernel branch respectively. The features extracted by the two branches are fused with each other through two bidirectional fusion modules to obtain fused features. The fused features contain complementary information of the two branches, which are then separated and transmitted to their respective branch trunks to continue calculating the noise residual. Finally, the residual maps extracted by the two branches are spliced, which enhances the ability of the two branches to extract noise residuals, thereby improving the signal-to-noise ratio in the preprocessing stage. Step 2: In feature extraction, the residual block is used to extract the features of the residual map generated in the preprocessing stage, and the downsampling module is used for downsampling. The network generates feature maps of different levels. We introduce a multi-level feature fusion module to weight feature maps of different levels through a spatial attention mechanism, and then downsample them to the same scale to integrate feature maps of different levels to retain weak steganographic features; Step 3: In the classifier, the multi-level feature map extracted and integrated is sent to the multi-scale attention pooling. The multi-scale attention pooling uses convolution kernels of different sizes to extract multi-scale features and enhance feature expression. The weight distribution between control channels is controlled by gated channel transformation to further enhance the features; The feature map is globally pooled by combining global standard deviation pooling and global average pooling style pooling to improve the statistics; finally, the pooled information is sent to the fully connected layer for binary classification output.

2. According to claim 1, a universal steganalysis detection method for spatial domain and JPEG domain is characterized by: In step 1, the bidirectional fusion module concatenates the feature maps generated by the two branches to obtain a merged feature map, and the merged feature map is fused and calculated by the GCT module and the two-layer point convolution layer PWConv in turn to obtain the fused feature; The fused features are separated again and added to the trunk of each branch to continue calculating the noise residual; the two layers of point convolution layers PWConv are connected in series with a BN layer and a Relu activation function layer.

3. The universal steganalysis detection method for spatial domain and JPEG domain according to claim 1, characterized in that: The specific execution steps of the bidirectional fusion module are as follows: Step 1-1, pass the feature map of branch 1 And the feature map of branch 2 The information is merged in the channel C dimension through the splicing operation to obtain the merged feature map: F=Concat[X1,X2] (1) in, It is the feature map after the two branches are merged; Step 1-2, the merged feature map is fused and calculated by the GCT module and the two-layer point convolution layer PWConv to obtain the fused feature F″; Step 1-3, separate the fused feature F″ again and add it to the trunk of each branch to continue calculating the noise residual. Specifically: M1,M2=Split[F″] (7) in, They respectively indicate that the complementary information generated after fusion by the fusion module is separated again.

4. The universal steganalysis detection method for spatial domain and JPEG domain according to claim 3, characterized in that: Step 1-2 specifically includes the following steps: Step 1-2-1, perform efficient context information modeling at the channel level based on the GCT attention mechanism, that is, aggregate the global context information in each channel through global context embedding operations; Assumptions represents C1+C2 feature maps of size H×W, is the Cth channel in F, C∈{1,2,…,C1+C2}; the given embedding weights Then there is Among them, s c is the cth channel, i.e. F c The result of finding the L2 norm; α c is the embedding weight of channel c, which is a trainable parameter used to control the weight of each channel. ε is a constant to avoid the zero-point derivative problem. Step 1-2-2, perform normalization processing and establish dependencies between channels; in, It is the result of cross-channel normalization of s, and its dimension is consistent with s; Step 1-2-3, perform gate control to adapt to the original features and obtain the feature map of GCT. The gate function is as follows: Among them, the gate weight γ c represents the gate weight of channel c; and gate bias β c represents the gate bias of channel c; Step 1-2-4, feature map after GCT The preliminary feature F′ is obtained by channel-level fusion through 2 layers of PWConv; the specific formula is as follows: Among them, δ is the Relu activation function, Step 1-2-5, the preliminary feature F′ is added to the residual shortcut to obtain the fused feature F″. The specific expression is as follows: F″=F+F′ (6).

5. The universal steganalysis detection method for spatial domain and JPEG domain according to claim 4, characterized in that: During the training process, α is initialized with 1, and γ and β are initialized with 0.

6. The universal steganalysis detection method for spatial domain and JPEG domain according to claim 1, characterized in that: Step 2 specifically includes the following steps: Step 2-1, feature maps X at different levels i The spatial attention is weighted through the spatial attention mechanism, and different convolution kernels are used to extract features for feature maps of different scales. The feature map N after attention weighting i It is expressed as: N i =X i ⊙(σ(Conv i ([Avg(X i ),Max(X ii )]))),i∈{low,mid,high} (8) Among them, ⊙ represents the Hadamard product, Avg and Max represent average pooling and maximum pooling, Conv i Represents the convolution operation, for {Conv low ,Conv mid ,Conv high }Use convolution kernels of {7×7, 5×5, 3×3}; σ represents the sigmoid activation function; Step 2-2: In order to aggregate feature maps of different levels to participate in the classification of the classifier, the low-level and mid-level feature maps are downsampled and adjusted to the same size as the high-level feature maps. The specific formula is as follows: N i ′=Downsampling(N i ),i∈{low,mid} (9) Among them, Downsampling (·) represents the bilinear interpolation algorithm, and the low-mid-level feature map after downsampling has the same size as the high-level feature map; Step 2-3, concatenate feature maps of different levels in the channel dimension: Q=Concat[N low ′,N mid ′,N high ] (10)。 7. The universal steganalysis detection method for spatial domain and JPEG domain according to claim 6, characterized in that: In step 2-1, the convolution kernel size used in the feature map of low-level semantic information is larger than the convolution kernel size used in the feature map of high-level semantic information.

8. The universal steganalysis detection method for spatial domain and JPEG domain according to claim 1, characterized in that: The specific steps of step 3 are as follows: Step 3-1, generate feature maps of different scales and cascade them. The specific generation formula is: P i =Conv(k i ×k i )(Q),i={0,1,2,3} (11) Among them, the size of the i-th convolution kernel is k i is 2i+1,i∈{0,1,2,3}, Conv(·) represents the convolution operation, Represents feature maps of different scales; Step 3-2: Different scale feature maps are cascaded to obtain cascaded different scale feature maps. The cascade formula is as follows: P=Concat([P0,P1,P2,P3]) (12) Step 3-3, cascade feature maps of different scales The channels are rearranged through the channel shuffle operation, and then the gated weighting between channels of different scale features is completed through the GCT layer. The GCT calculation steps refer to the fusion module in the preprocessing. The specific expression is as follows: P′=GCT(Shuffle(P)) (13) Step 3-4, feature map after gating weighting Perform style pooling operation to compress the channel. The specific expression is as follows: P″=Concat[GAP(P′),GSDP(P′)] (14) Among them, GAP represents global average pooling, GSDP represents global standard deviation pooling, and style pooling

Images