Method and device for carrying out steganography detection on compressed file based on Deflate algorithm
By extracting feature of compressed files based on Deflate algorithm and building a steganography detection model, the problem of detection of steganography information in the prior art is solved, and higher detection capabilities and lower error detection rates are achieved.
Patent Information
- Application Number
- CN202411946897.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-27
- Publication Date
- 2025-04-04
AI Technical Summary
When the prior art detects whether a compressed file based on the Deflate algorithm contains steganographic information, it is limited to detecting the matching position or length of the character string, and it is impossible to effectively identify more complex steganographic data distribution differences.
By extracting the compressed files to be detected, a steganography detection model can identify the difference in data distribution between steganography samples and non-steganography samples. The model consists of feature extraction module, regularization module and classification module, using a four-layer bidirectional GRU network and a Dropout layer to improve generalization capabilities.
Improve the detection capability of unknown steganography algorithms and reduce the error detection rate of non-steganography files compressed using normal compression tools.
Smart Images
Figure CN119766890A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of information security technology, and in particular to a method and device for performing steganographic detection on compressed files based on a Deflate algorithm. Background Art
[0002] The Deflate algorithm is a widely used lossless data compression algorithm that combines the LZ77 algorithm and Huffman Coding technology. This algorithm is widely used in ZIP files and other compression formats (such as PNG image format, gzip compression in HTTP transmission, etc.) due to its high compression ratio and relatively simple implementation.
[0003] Steganography refers to hiding information in files through certain methods. The information to be hidden is embedded in the carrier in a special way without damaging the expression of the original information of the carrier. It aims to protect the information to be hidden from being recognized by others. Steganography detection is the opposite of steganography. It aims to detect secret information hidden in public information. Steganography detection is of great significance to ensure network security and improve the security of steganography algorithms.
[0004] The existing steganographic technologies for compressed files based on the Deflate algorithm include steganography based on the parity of the string matching length or steganography based on the number of the longest matching strings. These two steganographic technologies will cause the matching position or matching length of the string to change, so usually the compression encoding is detected based on the matching position or matching length of the string to determine whether there is an abnormality, so as to determine whether the compressed file contains confidential information. However, the existing steganographic detection technology only focuses on whether the best matching string is selected for embedding during the compression process, and can only detect steganographic algorithms that change the matching string for embedding, which has certain limitations.
[0005] In view of this, the present invention is proposed. Summary of the invention
[0006] The purpose of the present invention is to address the limitation of existing steganalysis detection technology that can only detect whether a compressed file contains confidential information by detecting the matching position or matching length of a string, and to propose a method and device for steganalysis detection of compressed files based on the Deflate algorithm. The method of the present invention expands the features of the steganalysis data by extracting features of the compressed file to be detected, and at the same time constructs a steganalysis detection model that can identify the data distribution differences between steganalysis samples and non-steganography samples, so as to increase the generalization ability of steganalysis file detection.
[0007] In order to achieve the above-mentioned object of the invention, the present invention adopts the following technical scheme: In a first aspect, the present invention provides a method for performing steganographic detection on a compressed file based on a Deflate algorithm, comprising: S11. Preset the compressed file T based on the Deflate algorithm; S12. Decompress the compressed file T to obtain a file T1, compress the file T1 using a normal compression algorithm, but do not perform Huffman coding, obtain the offset Dis and length length of the compressed code in the data stream compressed normally by the LZ77 algorithm, record the position pos of the compressed code in the data stream compressed normally by the LZ77 algorithm, and obtain a triple sequence A [pos, Dis, length], wherein the triple sequence A does not carry steganographic information features; S13. According to the Huffman tree stored in the compressed file T structure, the encoded data in the compressed stream is parsed to obtain the offset Dis1 and length length1 of the compressed code in the data stream after Huffman decoding of the compressed file T, and the position pos1 of the compressed code in the data stream after normal compression by the LZ77 algorithm is recorded to obtain a triple sequence B [pos1, Dis1, length1], and the triple sequence B may carry steganographic information features; S14. Expand the triple sequence A and the triple sequence B into a one-dimensional sequence respectively to obtain a one-dimensional sequence A1 and a one-dimensional sequence B1, wherein the triple sequence A1 and the triple sequence B1 have the same length, specifically including: The sequence values of the initial one-dimensional sequence A1 are all 0, and the triple sequence A[pos, Dis, length] is represented in the one-dimensional sequence A1 in a preset manner, including: starting from the position indicated by the position pos component of the encoding, recording the values of the offset Dis of the length length; The sequence values of the initial one-dimensional sequence B1 are all 0, and the triple sequence B[pos1, Dis1, length1] is represented in the one-dimensional sequence B1 in a preset manner, including: starting from the position indicated by the position pos1 component of the encoding, recording the values of the offset Dis1 of the length length1 continuously; S15. Compare the one-dimensional sequence A1 with the one-dimensional sequence B1, delete the elements of the one-dimensional sequence A1 and the one-dimensional sequence B1 whose corresponding positions are both 0, respectively, to obtain a one-dimensional sequence A2 and a one-dimensional sequence B2, subtract the one-dimensional sequence B2 from the one-dimensional sequence A2 to obtain a one-dimensional sequence C, and retain the sequence length of the one-dimensional sequence C to a specific length by "truncating" or "adding 0"; S16. Input the one-dimensional sequence C into the steganalysis detection model D to obtain the classification probability vector of the compressed file T, wherein the steganalysis detection model D is composed of a feature extraction module, a regularization module and a classification module, specifically: The feature extraction module is composed of a four-layer bidirectional GRU network. When the one-dimensional sequence C is input into the feature extraction module, a high-dimensional feature representation q of the one-dimensional sequence C that integrates forward and backward information can be obtained; The regularization module is composed of a Dropout layer. When the high-dimensional feature representation q is input into the regularization module, a feature vector v can be obtained by randomly deactivating the high-dimensional feature representation q to prevent overfitting. The classification module is composed of a fully connected layer and a softmax function. The feature vector v is input into the fully connected layer to obtain the logical scores of the compressed file T belonging to each category. The logical scores of the compressed file T belonging to each category are then passed through the softmax function to obtain the classification probability vector of the compressed file T. S17. Determine whether the compressed file T contains confidential information based on the classification probability vector of the compressed file T.
[0008] Furthermore, the compressed file T is any file compressed based on the deflate algorithm, and is at least any one of a zip file, a gzip file, and a png file.
[0009] Furthermore, the sequence length of the one-dimensional sequence C in step S15 is related to the accuracy of the steganalysis detection model D, wherein the optimal value of the sequence length of the one-dimensional sequence C is 1024.
[0010] Furthermore, the embodiment of the present invention uses a zip file to perform model training on the steganalysis detection model D, including: S21. Prepare n zip file samples in advance, wherein the n zip file samples include steganographic samples and non-steganographic samples, wherein the steganographic samples are samples obtained by steganographically modifying normal zip files using 5 different steganographic algorithms, and the non-steganographic samples are zip files compressed using 3 common compression tools; S22. Divide the n zip file samples into a training set and a validation set in a ratio of 9:1; S23. Process the data in the training set and the validation set according to steps S12-S15 of claim 1 to obtain a one-dimensional sequence of the training set and a one-dimensional sequence of the validation set; S24. Input the one-dimensional sequence of the training set and the one-dimensional sequence of the verification set into the steganalysis detection model D respectively to obtain the classification probability vector of the training set and the classification probability vector of the verification set; S25. According to a preset model optimization goal, the steganalysis detection model D is trained until the accuracy of the steganalysis detection model D in predicting the data in the validation set reaches a preset threshold, wherein the preset model optimization goal is that the cross entropy loss function H is: Where N is the total number of samples, m is the number of categories in the classification problem, and y ij is the true label value of the i-th sample in the j-th category, is the model's predicted probability that the i-th sample belongs to the j-th class, w j is the weight for the jth class.
[0011] Furthermore, the w j It is related to the number of samples in each category. The weight of a large number is small, and the weight of a small number is large. Specifically: Among them, n j is the number of samples in the jth class, m is the number of categories in the classification problem, and the denominator is used to normalize the weights.
[0012] Furthermore, to train the steganalysis detection model D, the number of file samples n in S21 needs to be at least 100,000 samples, and a large difference in the ratio of positive and negative samples will directly affect the model effect.
[0013] In a second aspect, the present invention provides a system for performing steganalysis detection on a compressed file based on a Deflate algorithm, using a method for performing steganalysis detection on a compressed file based on a Deflate algorithm as described in the first aspect, comprising: Data acquisition module D31: acquires a preset compressed file T based on the Deflate algorithm; Recompression and comparison data stream generation module D32: decompress the compressed file T to obtain file T1, compress the file T1 using a normal compression algorithm, but do not perform Huffman coding, obtain the offset Dis and length length of the compressed code in the data stream compressed normally by the LZ77 algorithm, record the position pos of the compressed code in the data stream compressed normally by the LZ77 algorithm, and obtain a triple sequence A [pos, Dis, length], wherein the triple sequence A does not carry steganographic information features; Compressed data stream extraction module D33: according to the Huffman tree stored in the compressed file T structure, parse the encoded data in the compressed stream, obtain the offset Dis1 and length length1 of the compressed code in the data stream after Huffman decoding of the compressed file T, record the position pos1 of the compressed code in the data stream after normal compression by the LZ77 algorithm, and obtain the triple sequence B [pos1, Dis1, length1], the triple sequence B may carry the characteristics of steganographic information; Compression coding processing module D34: Expand the triple sequence A and the triple sequence B into a one-dimensional sequence respectively, and the initial sequence value is all 0, then the triple (position, offset, length) is represented as starting from the position indicated by the "position" component in the sequence, recording the values of "length" consecutive "offsets", and obtaining the one-dimensional sequence A1 and the one-dimensional sequence B1; The compressed data stream feature extraction module D35 compares the one-dimensional sequence A1 and the one-dimensional sequence B1, deletes the elements of the sequence A1 and the sequence B1 whose corresponding positions are both 0, obtains the one-dimensional sequence A2 and the one-dimensional sequence B2, subtracts the one-dimensional sequence A2 from the one-dimensional sequence B2, and retains the one-dimensional sequence C of a specific length by "truncating" or "adding 0"; Steganalysis detection module D36: input the one-dimensional sequence C into the steganalysis detection model D to obtain the classification probability vector of the compressed file T, wherein the steganalysis detection model D is composed of a feature extraction module, a regularization module and a classification module, specifically: The feature extraction module is composed of a four-layer bidirectional GRU network. When the one-dimensional sequence C is input into the feature extraction module, a high-dimensional feature representation q of the one-dimensional sequence C that integrates forward and backward information can be obtained; The regularization module is composed of a Dropout layer. When the high-dimensional feature representation q is input into the regularization module, a feature vector v can be obtained by randomly deactivating the high-dimensional feature representation q to prevent overfitting. The classification module is composed of a fully connected layer and a softmax function. The feature vector v is input into the fully connected layer to obtain the logical scores of the compressed file T belonging to each category. The logical scores of the compressed file T belonging to each category are then passed through the softmax function to obtain the classification probability vector of the compressed file T. Classification result judgment module D37: determines whether the compressed file T contains confidential information according to the classification probability vector of the compressed file T.
[0014] In a third aspect, the present invention proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a method for steganographic detection of compressed files based on the Deflate algorithm as described above is implemented.
[0015] In a fourth aspect, the present invention proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for performing steganographic detection on a compressed file based on the Deflate algorithm as described above.
[0016] Compared with the prior art, the present invention has the following beneficial effects: The method of the present invention can improve the detection capability of unknown steganographic algorithms and reduce the false detection rate of non-steganographic files compressed by normal compression tools. BRIEF DESCRIPTION OF THE DRAWINGS
[0017] The accompanying drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present invention, and together with the specification are used to explain the principles of the present invention. Obviously, the accompanying drawings described below are only some embodiments of the present invention, and for those of ordinary skill in the art, other accompanying drawings can be obtained based on these accompanying drawings without creative work.
[0018] Figure 1 It is a schematic diagram of a method for performing steganalysis detection on compressed files based on the Deflate algorithm proposed in the present invention.
[0019] Figure 2 It is a schematic diagram of examples of compressed data stream and triple sequence data obtained by processing compressed data in the present invention.
[0020] Figure 3 It is a structural schematic diagram of the steganalysis detection model D proposed in the present invention.
[0021] Figure 4 It is a schematic diagram of the system structure for performing steganalysis detection on compressed files based on the Deflate algorithm proposed by the present invention.
[0022] Explanation of reference numerals: D31 data acquisition module; D32 re-compression and comparison data generation module; D33 compressed data extraction module; D34 compression coding processing module; D35 compressed data feature extraction module; D36 steganalysis detection module; D37 classification result judgment module. DETAILED DESCRIPTION
[0023] In order to make the purpose, technical scheme and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.
[0024] The terms used in the embodiments of the present invention are only for the purpose of describing specific embodiments, and are not intended to limit the present invention. The singular forms "a", "said" and "the" used in the embodiments of the present invention and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings, and "multiple" generally includes at least two.
[0025] It should be understood that the term "and / or" used in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the associated objects before and after are in an "or" relationship.
[0026] As used herein, the words "if" and "if" may be interpreted as "at the time of" or "when" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrases "if it is determined" or "if (stated condition or event) is detected" may be interpreted as "when it is determined" or "in response to determining" or "when detecting (stated condition or event)" or "in response to detecting (stated condition or event)", depending on the context.
[0027] It should also be noted that the term "includes", "comprising" or any other variation thereof is intended to cover non-exclusive inclusion, so that a commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprising a ..." do not exclude the existence of other identical elements in the commodity or device including the elements.
[0028] The optional embodiments of the present invention are described in detail below with reference to the accompanying drawings.
[0029] First, as Figure 1 As shown, the present invention proposes a method for steganographic detection of compressed files based on the Deflate algorithm, comprising: S11. Preset the compressed file T based on the Deflate algorithm; S12. Decompress the compressed file T to obtain a file T1, compress the file T1 using a normal compression algorithm, but do not perform Huffman coding, obtain the offset Dis and length length of the compressed code in the data stream compressed normally by the LZ77 algorithm, record the position pos of the compressed code in the data stream compressed normally by the LZ77 algorithm, and obtain a triple sequence A [pos, Dis, length], wherein the triple sequence A does not carry steganographic information features; S13. According to the Huffman tree stored in the compressed file T structure, the encoded data in the compressed stream is parsed to obtain the offset Dis1 and length length1 of the compressed code in the data stream after Huffman decoding of the compressed file T, and the position pos1 of the compressed code in the data stream after normal compression by the LZ77 algorithm is recorded to obtain a triple sequence B [pos1, Dis1, length1], and the triple sequence B may carry steganographic information features; S14. Expand the triple sequence A and the triple sequence B into a one-dimensional sequence respectively to obtain a one-dimensional sequence A1 and a one-dimensional sequence B1, wherein the triple sequence A1 and the triple sequence B1 have the same length, specifically including: The sequence values of the initial one-dimensional sequence A1 are all 0, and the triple sequence A[pos, Dis, length] is represented in the one-dimensional sequence A1 in a preset manner, including: starting from the position indicated by the position pos component of the encoding, recording the values of the offset Dis of the length length; The sequence values of the initial one-dimensional sequence B1 are all 0, and the triple sequence B[pos1, Dis1, length1] is represented in the one-dimensional sequence B1 in a preset manner, including: starting from the position indicated by the position pos1 component of the encoding, recording the values of the offset Dis1 of the length length1 continuously; S15. Compare the one-dimensional sequence A1 with the one-dimensional sequence B1, delete the elements of the one-dimensional sequence A1 and the one-dimensional sequence B1 whose corresponding positions are both 0, respectively, to obtain a one-dimensional sequence A2 and a one-dimensional sequence B2, subtract the one-dimensional sequence B2 from the one-dimensional sequence A2 to obtain a one-dimensional sequence C, and retain the sequence length of the one-dimensional sequence C to a specific length by "truncating" or "adding 0"; S16. Input the one-dimensional sequence C into the steganalysis detection model D to obtain the classification probability vector of the compressed file T, wherein the steganalysis detection model D is composed of a feature extraction module, a regularization module and a classification module, specifically: The feature extraction module is composed of a four-layer bidirectional GRU network. When the one-dimensional sequence C is input into the feature extraction module, a high-dimensional feature representation q of the one-dimensional sequence C that integrates forward and backward information can be obtained; The regularization module is composed of a Dropout layer. When the high-dimensional feature representation q is input into the regularization module, a feature vector v can be obtained by randomly deactivating the high-dimensional feature representation q to prevent overfitting. The classification module is composed of a fully connected layer and a softmax function. The feature vector v is input into the fully connected layer to obtain the logical scores of the compressed file T belonging to each category. The logical scores of the compressed file T belonging to each category are then passed through the softmax function to obtain the classification probability vector of the compressed file T. S17. Determine whether the compressed file T contains confidential information based on the classification probability vector of the compressed file T.
[0030] The purpose of “removing zeros” and “reducing the difference” of the one-dimensional sequence A1 and the one-dimensional sequence B1 in S15 is to expand the information features of the steganographic coding of the triple sequence A.
[0031] In S15, the GRU network can effectively capture the association between the previous and next information between long sequences. The one-dimensional sequence C in S15 is a set of sequences carrying the compression algorithm features after the compressed file T is decoded. The one-dimensional sequence C can be further extracted features through the bidirectional GRU network, and the GRU network can alleviate the gradient disappearance or explosion phenomenon to a certain extent. The number of bidirectional GRU networks is related to the training effect of the steganalysis detection model D.
[0032] In S16, the regularization module is regularized by a Dropout layer, which forces the steganalysis detection model D not to rely on certain specific neurons by randomly dropping neurons during training, thereby improving the generalization ability of the steganalysis detection model D and reducing the risk of overfitting.
[0033] In S16, there are two types of the compressed file T, namely, the compressed file T contains secret information and the compressed file T does not contain secret information.
[0034] Furthermore, the compressed file T is any file compressed based on the deflate algorithm, and is at least any one of a zip file, a gzip file, and a png file.
[0035] Furthermore, the sequence length of the one-dimensional sequence C in step S15 is related to the accuracy of the steganalysis detection model D, wherein the optimal value of the sequence length of the one-dimensional sequence C is 1024.
[0036] like Figure 2As shown, the above steps S12 and S14 are illustrated by way of example to facilitate understanding of the process of performing data processing on the compressed file T to obtain the triple sequence A and the one-dimensional sequence A1.
[0037] S12. Decompress the compressed file T to obtain a file T1, wherein a data stream in the file TI is "tesseExamLLIExamytesk", The file T1 is compressed using a normal compression algorithm, but Huffman coding is not performed, and the data stream obtained after normal compression by the LZ77 algorithm is "tesseExamLLI(7,4)y(17,3)k", Extract the triple sequence A[12,7,4],[17,17,3] corresponding to the offset Dis, length length and encoding position pos of the compressed encoding of the data stream "tesseExamLLI(7,4)y(17,3)k", the triple sequence A[12,7,4],[17,17,3]; S14. Expand the triple sequence A[12, 7, 4], [17, 17, 3] into a one-dimensional sequence to obtain a one-dimensional sequence A1 “000000000000777701717170”; By performing the above steps simultaneously, a one-dimensional sequence B1 can be obtained, which will not be described in detail here.
[0038] Furthermore, if Figure 3 As shown, the embodiment of the present invention uses a zip file to perform model training on the steganalysis detection model D, including: S21. Prepare n zip file samples in advance, wherein the n zip file samples include steganographic samples and non-steganographic samples, wherein the steganographic samples are samples obtained by steganographically modifying normal zip files using 5 different steganographic algorithms, and the non-steganographic samples are zip files compressed using 3 common compression tools; S22. Divide the n zip file samples into a training set and a validation set in a ratio of 9:1; S23. Process the data in the training set and the validation set according to steps S12-S15 of claim 1 to obtain a one-dimensional sequence of the training set and a one-dimensional sequence of the validation set; S24. Input the one-dimensional sequence of the training set and the one-dimensional sequence of the verification set into the steganalysis detection model D respectively to obtain the classification probability vector of the training set and the classification probability vector of the verification set; S25. According to a preset model optimization goal, the steganalysis detection model D is trained until the accuracy of the steganalysis detection model D in predicting the data in the validation set reaches a preset threshold, wherein the preset model optimization goal is that the cross entropy loss function H is: Where N is the total number of samples, m is the number of categories in the classification problem, and y ij is the true label value of the i-th sample in the j-th category, is the model's predicted probability that the i-th sample belongs to the j-th class, w j is the weight for the jth class.
[0039] Furthermore, the w j It is related to the number of samples in each category. The weight of a large number is small, and the weight of a small number is large. Specifically: Among them, n j is the number of samples in the jth class, m is the number of categories in the classification problem, and the denominator is used to normalize the weights.
[0040] Furthermore, to train the steganalysis detection model D, the number of file samples n in S21 needs to be at least 100,000 samples, and a large difference in the ratio of positive and negative samples will directly affect the model effect.
[0041] The embodiment of the present invention selects to use zip files to train the steganography detection model D. When training the steganography detection model D, gzip files and png files are also selected to train the steganography detection model D. Because for any files compressed based on the deflate algorithm, the method for training the steganography detection model D is the same, so the embodiment of the present invention only describes one method.
[0042] Second, as Figure 4 As shown, the present invention proposes a system for performing steganalysis detection on a compressed file based on the Deflate algorithm, using a method for performing steganalysis detection on a compressed file based on the Deflate algorithm as described in the first aspect, comprising: Data acquisition module D31: acquires a preset compressed file T based on the Deflate algorithm; Recompression and comparison data stream generation module D32: decompress the compressed file T to obtain file T1, compress the file T1 using a normal compression algorithm, but do not perform Huffman coding, obtain the offset Dis and length length of the compressed code in the data stream compressed normally by the LZ77 algorithm, record the position pos of the compressed code in the data stream compressed normally by the LZ77 algorithm, and obtain a triple sequence A [pos, Dis, length], wherein the triple sequence A does not carry steganographic information features; Compressed data stream extraction module D33: according to the Huffman tree stored in the compressed file T structure, parse the encoded data in the compressed stream, obtain the offset Dis1 and length length1 of the compressed code in the data stream after Huffman decoding of the compressed file T, record the position pos1 of the compressed code in the data stream after normal compression by the LZ77 algorithm, and obtain the triple sequence B [pos1, Dis1, length1], the triple sequence B may carry the characteristics of steganographic information; Compression coding processing module D34: Expand the triple sequence A and the triple sequence B into a one-dimensional sequence respectively, and the initial sequence value is all 0, then the triple (position, offset, length) is represented as starting from the position indicated by the "position" component in the sequence, recording the values of "length" consecutive "offsets", and obtaining the one-dimensional sequence A1 and the one-dimensional sequence B1; The compressed data stream feature extraction module D35 compares the one-dimensional sequence A1 and the one-dimensional sequence B1, deletes the elements of the sequence A1 and the sequence B1 whose corresponding positions are both 0, obtains the one-dimensional sequence A2 and the one-dimensional sequence B2, subtracts the one-dimensional sequence A2 from the one-dimensional sequence B2, and retains the one-dimensional sequence C of a specific length by "truncating" or "adding 0"; Steganalysis detection module D36: input the one-dimensional sequence C into the steganalysis detection model D to obtain the classification probability vector of the compressed file T, wherein the steganalysis detection model D is composed of a feature extraction module, a regularization module and a classification module, specifically: The feature extraction module is composed of a four-layer bidirectional GRU network. When the one-dimensional sequence C is input into the feature extraction module, a high-dimensional feature representation q of the one-dimensional sequence C that integrates forward and backward information can be obtained; The regularization module is composed of a Dropout layer. When the high-dimensional feature representation q is input into the regularization module, a feature vector v can be obtained by randomly deactivating the high-dimensional feature representation q to prevent overfitting. The classification module is composed of a fully connected layer and a softmax function. The feature vector v is input into the fully connected layer to obtain the logical scores of the compressed file T belonging to each category. The logical scores of the compressed file T belonging to each category are then passed through the softmax function to obtain the classification probability vector of the compressed file T. Classification result judgment module D37: determines whether the compressed file T contains confidential information according to the classification probability vector of the compressed file T.
[0043] In a third aspect, the present invention proposes an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, a method for steganographic detection of compressed files based on the Deflate algorithm as described above is implemented.
[0044] In a fourth aspect, the present invention proposes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for performing steganographic detection on a compressed file based on the Deflate algorithm as described above.
[0045] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can be enabled to read and execute the program code stored in the storage medium.
[0046] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.
[0047] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RYM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer via a communication network.
[0048] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.
[0049] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or written to a memory provided in an expansion unit connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or the expansion unit is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.
[0050] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for steganographic detection of compressed files based on the Deflate algorithm, characterized in that: include: S11. Preset the compressed file T based on the Deflate algorithm; S12. Decompress the compressed file T to obtain a file T1, compress the file T1 using a normal compression algorithm, but do not perform Huffman coding, obtain the offset Dis and length length of the compressed code in the data stream compressed normally by the LZ77 algorithm, record the position pos of the compressed code in the data stream compressed normally by the LZ77 algorithm, and obtain a triple sequence A [pos, Dis, length], wherein the triple sequence A does not carry steganographic information features; S13. According to the Huffman tree stored in the compressed file T structure, the encoded data in the compressed stream is parsed to obtain the offset Dis1 and length length1 of the compressed code in the data stream after Huffman decoding of the compressed file T, and the position pos1 of the compressed code in the data stream after normal compression by the LZ77 algorithm is recorded to obtain a triple sequence B [pos1, Dis1, length1], and the triple sequence B may carry steganographic information features; S14. Expand the triple sequence A and the triple sequence B into a one-dimensional sequence respectively to obtain a one-dimensional sequence A1 and a one-dimensional sequence B1, wherein the triple sequence A1 and the triple sequence B1 have the same length, specifically including: The sequence values of the initial one-dimensional sequence A1 are all 0, and the triple sequence A[pos, Dis, length] is represented in the one-dimensional sequence A1 in a preset manner, including: starting from the position indicated by the position pos component of the encoding, recording the values of the offset Dis of the length length; The sequence values of the initial one-dimensional sequence B1 are all 0, and the triple sequence B[pos1, Dis1, length1] is represented in the one-dimensional sequence B1 in a preset manner, including: starting from the position indicated by the position pos1 component of the encoding, recording the values of the offset Dis1 of the length length1 continuously; S15. Compare the one-dimensional sequence A1 with the one-dimensional sequence B1, delete the elements of the one-dimensional sequence A1 and the one-dimensional sequence B1 whose corresponding positions are both 0, respectively, to obtain a one-dimensional sequence A2 and a one-dimensional sequence B2, subtract the one-dimensional sequence B2 from the one-dimensional sequence A2 to obtain a one-dimensional sequence C, and retain the sequence length of the one-dimensional sequence C to a specific length by "truncating" or "adding 0"; S16. Input the one-dimensional sequence C into the steganalysis detection model D to obtain the classification probability vector of the compressed file T, wherein the steganalysis detection model D is composed of a feature extraction module, a regularization module and a classification module, specifically: The feature extraction module is composed of a four-layer bidirectional GRU network. When the one-dimensional sequence C is input into the feature extraction module, a high-dimensional feature representation q of the one-dimensional sequence C that integrates forward and backward information can be obtained; The regularization module is composed of a Dropout layer. When the high-dimensional feature representation q is input into the regularization module, a feature vector v can be obtained by randomly deactivating the high-dimensional feature representation q to prevent overfitting. The classification module is composed of a fully connected layer and a softmax function. The feature vector v is input into the fully connected layer to obtain the logical scores of the compressed file T belonging to each category. The logical scores of the compressed file T belonging to each category are then passed through the softmax function to obtain the classification probability vector of the compressed file T. S17. Determine whether the compressed file T contains confidential information based on the classification probability vector of the compressed file T.
2. According to claim 1, a method for steganographic detection of compressed files based on the Deflate algorithm is characterized in that: The compressed file T is any file compressed based on the deflate algorithm, and is at least any one of a zip file, a gzip file, and a png file.
3. According to claim 1, a method for steganographic detection of compressed files based on the Deflate algorithm is characterized in that: The sequence length of the one-dimensional sequence C in step S15 is related to the accuracy of the steganalysis detection model D, wherein the optimal value of the sequence length of the one-dimensional sequence C is 1024.
4. The method for steganographic detection of compressed files based on the Deflate algorithm according to claim 1, characterized in that: The steganalysis detection model D is trained, including: S21. Prepare n zip file samples in advance, wherein the n zip file samples include steganographic samples and non-steganographic samples, wherein the steganographic samples are samples obtained by steganographically modifying normal zip files using 5 different steganographic algorithms, and the non-steganographic samples are zip files compressed using 3 common compression tools; S22. Divide the n zip file samples into a training set and a validation set in a ratio of 9:1; S23. Process the data in the training set and the validation set according to steps S12-S15 of claim 1 to obtain a one-dimensional sequence of the training set and a one-dimensional sequence of the validation set; S24. Input the one-dimensional sequence of the training set and the one-dimensional sequence of the verification set into the steganalysis detection model D respectively to obtain the classification probability vector of the training set and the classification probability vector of the verification set; S25. According to a preset model optimization goal, the steganalysis detection model D is trained until the accuracy of the steganalysis detection model D in predicting the data in the validation set reaches a preset threshold, wherein the preset model optimization goal is that the cross entropy loss function H is: Where N is the total number of samples, m is the number of categories in the classification problem, and y ij is the true label value of the i-th sample in the j-th category, is the model's predicted probability that the i-th sample belongs to the j-th class, w j is the weight for the jth class.
5. The method of training the steganalysis detection model D according to claim 4, wherein: The weight w for the jth class j It is related to the number of samples in each category, specifically: Among them, n j is the number of samples in the jth class, and m is the number of classes in the classification problem.
6. The method of training the steganalysis detection model D according to claim 4, wherein: The number of file samples n in S21 needs to be at least 100,000 samples.
7. A system for performing steganalysis detection on compressed files based on the Deflate algorithm, using the method for performing steganalysis detection on compressed files based on the Deflate algorithm as claimed in claim 1, characterized in that: include: Data acquisition module D31: acquires a preset compressed file T based on the Deflate algorithm; Recompression and comparison data stream generation module D32: decompress the compressed file T to obtain file T1, compress the file T1 using a normal compression algorithm, but do not perform Huffman coding, obtain the offset Dis and length length of the compressed code in the data stream compressed normally by the LZ77 algorithm, record the position pos of the compressed code in the data stream compressed normally by the LZ77 algorithm, and obtain a triple sequence A [pos, Dis, length], wherein the triple sequence A does not carry steganographic information features; Compressed data stream extraction module D33: according to the Huffman tree stored in the compressed file T structure, parse the encoded data in the compressed stream, obtain the offset Dis1 and length length1 of the compressed code in the data stream after Huffman decoding of the compressed file T, record the position pos1 of the compressed code in the data stream after normal compression by the LZ77 algorithm, and obtain the triple sequence B [pos1, Dis1, length1], the triple sequence B may carry the characteristics of steganographic information; The compression coding processing module D34: expands the triple sequence A and the triple sequence B into a one-dimensional sequence respectively to obtain a one-dimensional sequence A1 and a one-dimensional sequence B1, wherein the triple sequence A1 and the triple sequence B1 have the same length, specifically including: The sequence values of the initial one-dimensional sequence A1 are all 0, and the triple sequence A[pos, Dis, length] is represented in the one-dimensional sequence A1 in a preset manner, including: starting from the position indicated by the position pos component of the encoding, recording the values of the offset Dis of the length length; The sequence values of the initial one-dimensional sequence B1 are all 0, and the triple sequence B[pos1, Dis1, length1] is represented in the one-dimensional sequence B1 in a preset manner, including: starting from the position indicated by the position pos1 component of the encoding, recording the values of the offset Dis1 of the length length1 continuously; The compressed data stream feature extraction module D35: compares the one-dimensional sequence A1 with the one-dimensional sequence B1, deletes the elements of the one-dimensional sequence A1 and the one-dimensional sequence B1 whose corresponding positions are both 0, obtains the one-dimensional sequence A2 and the one-dimensional sequence B2, subtracts the one-dimensional sequence B2 from the one-dimensional sequence A2 to obtain the one-dimensional sequence C, and can retain the sequence length of the one-dimensional sequence C to a specific length by "truncating" or "filling 0"; Steganalysis detection module D36: input the one-dimensional sequence C into the steganalysis detection model D to obtain the classification probability vector of the compressed file T, wherein the steganalysis detection model D is composed of a feature extraction module, a regularization module and a classification module, specifically: The feature extraction module is composed of a four-layer bidirectional GRU network. When the one-dimensional sequence C is input into the feature extraction module, a high-dimensional feature representation q of the one-dimensional sequence C that integrates forward and backward information can be obtained; The regularization module is composed of a Dropout layer. When the high-dimensional feature representation q is input into the regularization module, a feature vector v can be obtained by randomly deactivating the high-dimensional feature representation q to prevent overfitting. The classification module is composed of a fully connected layer and a softmax function. The feature vector v is input into the fully connected layer to obtain the logical scores of the compressed file T belonging to each category. The logical scores of the compressed file T belonging to each category are then passed through the softmax function to obtain the classification probability vector of the compressed file T. Classification result judgment module D37: determines whether the compressed file T contains confidential information according to the classification probability vector of the compressed file T.
8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method for performing steganographic detection on a compressed file based on the Deflate algorithm as described in any one of claims 1 to 6 is implemented.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for performing steganographic detection on a compressed file based on the Deflate algorithm as described in any one of claims 1 to 6 is implemented.