Image steganalysis method based on hybrid deep learning framework

Abstract

An image steganography analysis method based on a hybrid deep learning framework combines the feature extraction advantage of a JPEG steganography rich model and the integratable advantage of a deep learning model to construct a multi-stage hybrid deep learning JPEG steganography analysis framework, and the framework has expandability and can be applied to image steganography analysis. The latest deep learning steganalysis network can be added to the framework. Meanwhile, the steganalysis problem under various complex scenes such as data source mismatching can also be adapted; a color image steganalysis CNN trunk model formed by three stages of preprocessing, feature extraction and feature classification is designed, and a space attention mechanism and a channel attention mechanism are added in a trunk stream, so that the detection accuracy is improved; a new algorithm optimization module is designed based on the framework, the network structure is adjusted, and the generalization ability, convergence performance, detection accuracy and robustness of the model are further improved.

Description

Technical Field

[0001] This invention relates to the field of image processing, and more specifically to an image steganalysis method based on a hybrid deep learning framework. Background Technology

[0002] Image steganography is a technique that hides secret information within a carrier image to achieve covert communication. Image steganalysis aims to analyze image steganography to determine whether an image carries classified information, thereby blocking the covert communication process achieved through image steganography. Therefore, it is essentially an image binary classification task. Image steganography analysis technology can not only promote the legal use of image steganography but also be applied to various practical scenarios, such as digital forensics, copyright protection, and network security monitoring. In digital forensics, steganalysis technology can help law enforcement agencies extract key evidence from suspects' electronic devices; in copyright protection, it can be used to detect and track pirated content; and in network security monitoring, it can monitor abnormal communications on the network and promptly identify potential security threats. Improvements in steganalysis technology are crucial for preventing hostile nations or terrorist organizations from transmitting sensitive information through steganography. It can effectively prevent information security problems such as the leakage of sensitive information caused by image steganography, which is of great significance for maintaining national security and social stability and is a key research focus.

[0003] Image steganalysis methods can be divided into two categories: traditional methods based on handcrafted features and deep learning-based methods. Traditional methods include early steganalysis algorithms (such as a series of methods for random LSB embedding), low-dimensional feature-based steganalysis algorithms (SPAM, CC-PEV, CDF, etc.), and rich model-based steganalysis algorithms (SRM, PSRM, DCTR, PHARM, GFR, etc.). Deep learning-based steganalysis algorithms include GNCNN, Xu-Net, Ye-Net, Xu-ResNet, SRNet, etc. Complex scenarios and massive amounts of data present many challenges for current image steganalysis methods. For example: 1. Real-world steganalysis scenarios require detection on a large number of JPEG images, but JPEG image steganalysis algorithms are always tested on small-scale databases with limited statistical characteristics, making it difficult to guarantee against overfitting. 2. Most image data in the real world is color, while most current deep learning-based steganalysis networks are designed for grayscale images, thus failing to effectively detect steganalysis in color images. Summary of the Invention

[0004] To address the problems existing in the aforementioned background technologies, this invention proposes an image steganalysis method based on a hybrid deep learning framework. This method is applicable to JPEG image steganalysis algorithms and color image steganalysis in real-world scenarios. It can effectively improve the detection accuracy of color steganalysis methods and enhance the generalization ability of the model, thus possessing significant theoretical and practical value.

[0005] An image steganalysis method based on a hybrid deep learning framework includes the following steps:

[0006] Step 1: Construct a hybrid JPEG steganalysis framework, which consists of three parts: feature extraction, deep convolutional neural network (CNN) backbone, and network optimization.

[0007] Step 2: For the feature extraction part in the hybrid JPEG steganalysis framework, based on the feature extraction mechanism in the JPEG steganalysis rich model, an integrated structure of multiple deep models is introduced, and the operation steps are optimized. By configuring different parameter combinations, diverse steganalysis residual maps are generated.

[0008] Step 3: For the deep convolutional neural network (CNN) backbone network part in the hybrid JPEG steganalysis framework, design a color image steganalysis model based on deep convolutional neural network, including a backbone with three stages: preprocessing, feature extraction and feature classification, and add spatial attention mechanism and channel attention enhancement module to each stage of the backbone.

[0009] Step 4: For the network optimization part of the hybrid JPEG steganalysis framework, optimize the hybrid JPEG steganalysis framework from the perspective of optimizing the activation function.

[0010] Step 5: Put the hybrid JPEG steganography analysis framework processed in steps 2 to 4 into use, input the color JPEG image to be analyzed, and output the detection and analysis results.

[0011] The beneficial effects achieved by this invention are as follows:

[0012] (1) By combining the feature extraction advantages of rich JPEG steganalysis models with the ensemble advantages of deep learning models, a multi-stage hybrid deep learning JPEG steganalysis framework is constructed. This framework is scalable and can incorporate the latest deep learning steganalysis networks. Furthermore, it can adapt to steganalysis problems in various complex scenarios, such as data source mismatch.

[0013] (2) A CNN backbone model for color image steganalysis consisting of three stages, namely preprocessing, feature extraction and feature classification, was designed. Spatial attention mechanism and channel attention mechanism were added to the backbone to improve the detection accuracy.

[0014] (3) The design of the feature extraction part fully leverages the prior knowledge advantage of rich models in steganalytic feature enhancement, while utilizing the powerful feature learning capability of deep learning networks to form a hierarchical and closely connected hybrid analysis framework. It integrates the advantages of rich models in feature extraction and combines the learning capability of deep models, providing an effective technical solution for improving the performance of color image steganalysis.

[0015] (4) Innovative application of central difference convolution in CNN backbone network, central difference convolution is systematically introduced into steganalysis, and the ability to perceive subtle texture changes introduced by steganalysis is significantly enhanced through the coordinated processing of gradient and intensity information.

[0016] (5) Design a hierarchical attention mechanism in the CNN backbone network and construct a spatial and channel dual-dimensional attention system to enhance the representation ability of spatially significant regions and important feature channels at different stages of feature extraction.

[0017] (6) The entire CNN backbone network and the pre-built JPEG rich model form a unified tensor interface, supporting gradient backpropagation and end-to-end joint optimization training. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the image steganalysis method based on a hybrid deep learning framework in a specific embodiment of the present invention.

[0019] Figure 2 This is a flowchart of the hybrid JPEG steganography analysis framework in a specific embodiment of the present invention.

[0020] Figure 3 This is a schematic diagram of the feature extraction process in a specific embodiment of the present invention.

[0021] Figure 4 This is a schematic diagram of the CNN backbone network model in a specific embodiment of the present invention. Detailed Implementation

[0022] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings.

[0023] This embodiment mainly includes the following three parts: ① Hybrid deep learning JPEG steganalysis framework: Based on a large-scale dataset (Image Net dataset), a hybrid deep learning framework is designed. This framework is scalable and can incorporate the latest deep learning steganalysis networks. It can also adapt to steganalysis problems in various complex scenarios such as continuously expanding data scale and image source mismatch, while mitigating the overfitting problem caused by testing on small-scale databases. ② Feature extraction mechanism based on JPEG steganalysis rich models: First, the feature extraction mechanism in JPEG steganalysis rich models is borrowed, and its key operations are optimized. By configuring different parameter combinations, diverse steganalysis residual maps are generated, serving as an important component of the hybrid strategy. Furthermore, this framework introduces an integrated structure of multiple deep models to enhance detection performance. The final constructed hybrid deep learning JPEG steganalysis system combines the advantages of rich models in feature extraction with the learning capabilities of deep models. ③ A deep convolutional neural network (CNN) model for color image steganalysis: Convolutional layers with different hierarchical structures are designed in the three stages of image preprocessing, feature extraction, and image classification. Residual space attention and channel attention enhancement modules are introduced to improve the detection accuracy of the color steganalyzer. ④ Further network optimization of the CNN model: An optimized combination scheme based on the Swish function is adopted for the activation function. This scheme significantly improves model performance while maintaining training stability.

[0024] First, we construct the basic structure of a hybrid JPEG steganography analysis framework, referencing... Figure 2 The system comprises three parts: feature extraction, a deep convolutional neural network (CNN) backbone, and network optimization. Each part is then configured and designed separately. For the input image, the following terminology definitions are provided first:

[0025] Carrier: refers to the original overlay image that has not undergone any steganography and does not contain any secret information.

[0026] Secret information carrier: refers to a carrier image that has been embedded with secret information through steganography algorithms, and is the corresponding concept of "carrier".

[0027] Original: Here it has the same meaning as "carrier", referring to a pure image that does not contain any secret information.

[0028] For the feature extraction part of the JPEG steganalysis framework, it borrows the feature extraction mechanism from the JPEG rich steganalysis model, optimizes its key operations, and generates diverse steganalysis residual maps by configuring different parameter combinations, which serve as an important component of the hybrid strategy. Furthermore, this framework introduces an integrated structure of multiple deep models to enhance detection performance. The final hybrid deep learning JPEG steganalysis system combines the advantages of rich models in feature extraction with the learning capabilities of deep models.

[0029] Figure 3 The feature extraction process in this embodiment is illustrated. For example... Figure 3 As shown, after decoding, the input JPEG image is simultaneously input into two parallel processing sub-modules, forming a dual-path feature extraction architecture. In sub-module one, the image undergoes convolution operations using a set of parameterized differential filtering kernels, including multi-scale Gabor filtering, Gaussian difference filtering, and SRM high-pass filtering. In sub-module two, a multi-level quantization reconstruction strategy is employed to repeatedly compress and decode the image at different compression qualities, generating multi-scale distortion features that effectively expose statistical anomalies and quantization inconsistencies caused by steganography. The outputs of the two sub-modules are then truncated using an adaptive truncation mechanism to effectively suppress image content noise interference and highlight subtle traces introduced by steganography. These outputs are then fused along the channel dimension, and after feature optimization and standardization using the SE attention mechanism, an 87-channel multi-dimensional residual feature map with a unified tensor format is generated. This feature map is directly used as input to the CNN backbone network.

[0030] This invention constructs a hybrid steganalysis framework that achieves a technological breakthrough through a meticulously designed dual-path feature extraction mechanism. In the feature extraction stage, a parallel architecture of differential filtering and quantization reconstruction is employed: Submodule one integrates 24 multi-scale Gabor filter kernels, 16 Gaussian difference filter kernels, and 30 SRM high-pass filter kernels, comprehensively covering texture, edge, and steganalytic noise features; Submodule two effectively exposes statistical anomalies through multi-level quantization reconstruction using 3 JPEG quality factors and 3 quantization steps. An innovative dual-threshold truncation mechanism is used, combining a fixed threshold of 3 and quantization thresholds [0.05, 0.95], to retain discriminative information while controlling the dynamic range of features. After optimization by the SE attention module (compression ratio 16), an 87-channel standardized feature map is generated and directly input into the CNN backbone network.

[0031] The CNN backbone network model of the JPEG steganalysis framework is as follows: Figure 4 As shown in the figure. The backbone network in this embodiment adopts a hierarchical structure design, which includes three core components: a preprocessing stage, a feature extraction stage, and a classification stage, forming a complete steganalysis pipeline.

[0032] The preprocessing stage, as the starting part of the backbone network, primarily functions to normalize the input features:

[0033] Channel separation and recombination module: Performs channel-dimensional recombination optimization on the multi-channel feature maps output by the rich model;

[0034] Feature map standardization module: Employs layer normalization technology to standardize feature maps, improving training stability;

[0035] Size unification adjustment unit: Ensures that the size of the output feature map meets the input requirements of subsequent network layers.

[0036] The preprocessing stage, through the above-described process, achieves format compatibility between rich model feature extraction and deep learning networks, laying the foundation for subsequent feature extraction.

[0037] The specific parameter configurations for each module during the preprocessing stage are shown in the table below:

[0038] Parameter Configuration Details

[0039]

[0040] The feature extraction stage is the core of the CNN backbone network, employing an innovative design that combines multi-level convolutional blocks with an attention mechanism:

[0041] A three-level convolutional block architecture is adopted, in which:

[0042] Convolutional Block 1: Dual-center difference convolutional layer combined with average pooling operation;

[0043] Convolutional Block 2: Channel-Expanded Central Difference Convolution Combination;

[0044] Convolutional Block 3: Single-center differential convolution and downsampling processing.

[0045] In addition, a dual attention enhancement mechanism is introduced into the CNN backbone network, including:

[0046] Spatial attention module: introduced after convolution block 1, it highlights important feature regions through spatial weight map.

[0047] Spatial attention fusion module: fuses spatial attention with backbone features.

[0048] Channel attention fusion module: introduced after convolution block 2, it enhances discriminative features through inter-channel dependencies.

[0049] The specific parameter configurations for each module in the feature extraction stage are shown in the table below:

[0050] Parameter Configuration Details

[0051]

[0052] The classification stage is responsible for making the final judgment on the deep features obtained in the feature extraction stage, including:

[0053] Global pooling layer: Covariance pooling is used to capture higher-order statistical features;

[0054] Fully connected classifier: a dual fully connected layer structure with Dropout regularization embedded in the middle;

[0055] Binary output layer: Output images are classified as "dense / raw".

[0056] During the classification phase, the specific parameter configurations for each module are shown in the table below:

[0057] Parameter Configuration Details

[0058]

[0059] Wherein, CDC represents central difference convolution, the parameter θ controls the fusion ratio of gradient information and intensity information, and the optimal value has been verified to be 0.7; N is the number of channels output by the rich model feature extraction module, which can be adjusted according to specific configuration.

[0060] The Central Difference Convolution (CDC) used in this embodiment is an innovative convolution operation that leverages both intensity and gradient information from local regions to enhance feature representation. Unlike ordinary convolution, which only considers absolute intensity values, CDC effectively enhances the model's ability to perceive subtle texture changes by introducing the difference between the center pixel and its neighboring pixels.

[0061] The mathematical expression for central difference convolution is as follows:

[0062] Let the input feature map be x, the output feature map be y, the current computation position be p0, the local receptive field be R, and the weight parameter be w. Then the output of the central difference convolution can be expressed as:

[0063] y(p0)=θ·∑p n ∈Rw(p n )·(x(p0+p n )-x(p0))+(1-θ)·∑p n ∈Rw(p n )·x(p0+p n )

[0064] Where, p n The relative position within the local receptive field R is given by the parameter θ∈[0,1], which is used to balance the contribution ratio of the central difference information to the original intensity information. The above equation contains two key components:

[0065] Central difference term: ∑p n ∈Rw(p n )·(x(p0+p n )-x(p0)) calculates the difference between neighboring pixels and the center pixel to capture local gradient changes.

[0066] Intensity information item: ∑p n ∈Rw(p n )·x(p0+p n It retains the strength information extraction function of traditional convolution.

[0067] Experiments have shown that setting the parameter θ to 0.7 achieves optimal performance in steganalysis tasks, where the model prioritizes gradient information while retaining sufficient intensity information. This design makes central difference convolution particularly suitable for detecting weak signals introduced by steganalysis, as steganalysis modifications typically produce subtle gradient changes in areas of complex image texture, and the central difference operation can amplify these changes.

[0068] Compared with ordinary convolution, central difference convolution enhances the network's ability to capture detailed textures by introducing local gradient calculation, and shows significant advantages in color image steganalysis tasks.

[0069] For the network optimization part of the hybrid JPEG steganalysis framework, the framework is optimized by optimizing the activation function.

[0070] This embodiment employs an optimized combination scheme based on the Swish function for the activation function, which significantly improves model performance while maintaining training stability. Specifically, the optimized combination scheme based on the Swish function is applied to the CNN backbone network, and the combination form is as follows:

[0071] The Swish activation function is used in the network layers of the feature extraction stage of the CNN backbone network.

[0072] The dual attention mechanism of the CNN backbone network uses a Swish intermediate layer + Sigmoid output;

[0073] The fully connected classifier in the CNN backbone uses Swish hidden layers and a Softmax output. The formula for the Swish activation function is:

[0074] Swish(z) = x·σ(βz)

[0075] Here, z is the input variable, representing the input value flowing into the activation function. σ(βz) is the Sigmoid function, specifically in the form σ(βz) = 1 / (1 + e^(-βz)), which performs a nonlinear transformation on the input. β is a learnable parameter, which is a scalar or tensor, usually initialized to 1.0, and optimized during training using gradient descent.

[0076] The swish function is applied as an intermediate layer between spatial attention and channel attention. After application, the spatial attention process is as follows:

[0077] Input features → Convolutional layer 1 → Swish activation → Convolutional layer 2 → Swish activation → Average pooling + max pooling → Concatenation → Convolutional layer 3 → Sigmoid output.

[0078] The channel attention process is as follows:

[0079] Input features → Convolutional block → Swish activation → Channel matrix calculation → Reshaping operation → Sofimax normalization → Feature weighting → Sigmoid output.

[0080] This approach, which uniformly uses Swish as the intermediate layer activation function, maintains the structural consistency of the two attention mechanisms while fully leveraging Swish's advantages in feature transformation, providing a more accurate and stable attention weight generation mechanism for steganalysis tasks.

[0081] Furthermore, the fully connected classifier in the classification stage of the CNN backbone uses the Swish function, which, together with the Softmax of the output layer, completes the final classification decision.

[0082] The Swish function combines the advantages of linear and sigmoid functions. It maintains unboundedness in the positive interval to avoid gradient saturation and retains small negative values ​​in the negative interval to enhance gradient flow. This characteristic is particularly suitable for extracting complex texture features in steganalysis. In the dual attention mechanism, the intermediate layer uses the Swish function to ensure smooth gradient propagation, while the output layer uses the Sigmoid function to constrain the attention weights to the [0,1] range. The fully connected classifier in the classification stage also uses the Swish function, working in conjunction with the softmax function in the output layer to complete the final classification decision. This combined approach, validated through large-scale experiments at Google Brain, consistently outperforms ReLU on datasets such as ImageNet and CIFAR, with moderate computational complexity. In steganalysis tasks, the smoothness and non-zero negative response of the Swish function better capture the weak statistical anomalies introduced by steganalysis operations, while maintaining training stability and convergence speed comparable to ReLU, providing a high-performance and reliable activation function solution for steganalysis networks.

[0083] The above description is only a preferred embodiment of the present invention. The scope of protection of the present invention is not limited to the above embodiments. Any equivalent modifications or changes made by those skilled in the art based on the content disclosed in the present invention should be included within the scope of protection set forth in the claims.

Claims

1. An image steganalysis method based on a hybrid deep learning framework, characterized in that: The method includes the following steps: Step 1: Construct a hybrid JPEG steganalysis framework, which consists of three parts: feature extraction, deep convolutional neural network (CNN) backbone, and network optimization. Step 2: For the feature extraction part in the hybrid JPEG steganalysis framework, based on the feature extraction mechanism in the JPEG steganalysis rich model, an integrated structure of multiple deep models is introduced, and the operation steps are optimized. By configuring different parameter combinations, diverse steganalysis residual maps are generated. Step 3: For the deep convolutional neural network backbone network in the hybrid JPEG steganalysis framework, design a color image steganalysis model based on deep convolutional neural network, including a backbone with three stages: preprocessing, feature extraction and feature classification, and add spatial attention mechanism and channel attention enhancement module to the backbone. Step 4: For the network optimization part of the hybrid JPEG steganalysis framework, optimize the hybrid JPEG steganalysis framework from the perspective of optimizing the activation function. Step 5: Put the hybrid JPEG steganography analysis framework processed in steps 2 to 4 into use, input the color JPEG image to be analyzed, and output the detection and analysis results.

2. The image steganalysis method based on a hybrid deep learning framework according to claim 1, characterized in that: In step 2, the feature extraction process is as follows: After the input JPEG image is decoded, it is simultaneously input into two parallel processing sub-modules, including a parameterized differential filtering processing sub-module and a multi-level quantization reconstruction processing sub-module, forming a dual-path feature extraction architecture; In the parameterized differential filtering processing submodule, the image is convolved by a set of parameterized differential filtering kernels, including multi-scale Gabor filtering, Gaussian difference filtering and SRM high-pass filtering. In the multi-level quantization reconstruction processing submodule, a multi-level quantization reconstruction strategy is adopted to repeatedly compress and decode the image under different compression qualities, generate multi-scale distortion features, and expose statistical anomalies and quantization inconsistencies caused by steganography. The outputs of the two sub-modules enter the feature optimization processing module, which uses an adaptive double threshold truncation mechanism to suppress image content noise interference and highlight subtle traces introduced by steganography. Then, the features are fused according to the channel dimension, and then processed by the SE attention mechanism for feature optimization and standardization to generate an 87-channel multidimensional residual feature map with a unified tensor format. This feature map is used as the input of the CNN backbone network.

3. The image steganalysis method based on a hybrid deep learning framework according to claim 2, characterized in that: The parameterized differential filtering submodule contains 24 multi-scale Gabor filter kernels, 16 Gaussian differential filter kernels, and 30 SRM high-pass filter kernels to construct the differential filtering path.

4. The image steganalysis method based on a hybrid deep learning framework according to claim 2, characterized in that: The multi-level quantization reconstruction processing submodule contains a quantization reconstruction path based on three JPEG quality factors and three quantization steps.

5. The image steganalysis method based on a hybrid deep learning framework according to claim 1, characterized in that: The CNN backbone network in step 3 adopts a hierarchical structure design, which includes three core components: preprocessing stage, feature extraction stage and classification stage, forming a complete steganalysis pipeline.

6. The image steganalysis method based on a hybrid deep learning framework according to claim 5, characterized in that: The preprocessing stage of the CNN backbone, as the starting part of the backbone, normalizes the input features, specifically including: The multi-channel feature map output in step 2 is reorganized and optimized according to the channel dimensions; The feature maps are standardized using layer normalization techniques; Adjust the size of the uniform feature map to ensure that the size of the output feature map meets the input requirements of subsequent network layers; Through the above processing steps, format compatibility between the JPEG steganography rich model and deep learning networks was achieved.

7. The image steganalysis method based on a hybrid deep learning framework according to claim 6, characterized in that: The feature extraction stage of the CNN backbone network adopts an architecture combining multi-level convolutional blocks and attention mechanisms, which includes: Convolutional block 1 performs dual-center difference convolutional layers combined with average pooling on the feature map output from the preprocessing stage. The spatial attention module highlights important feature regions in the original input color JPEG image using a spatial weight map; The spatial attention fusion module fuses the output of convolutional block 1 with the output of the spatial attention module; Convolutional block 2, performing channel-expanded central difference convolution combination. The channel attention fusion module enhances the discriminative features of the output of convolutional block 2 through inter-channel dependencies; Convolutional block 3 undergoes single-center difference convolution and downsampling.

8. The image steganalysis method based on a hybrid deep learning framework according to claim 7, characterized in that: The classification decision stage of the CNN backbone network performs the final discrimination based on the deep features obtained in the feature extraction stage, which includes the following steps: The global pooling layer uses covariance pooling to capture higher-order statistical features; A fully connected classifier with a dual fully connected layer structure and Dropout regularization embedded in the middle; The binary output layer outputs the classification probability of the image.

9. The image steganalysis method based on a hybrid deep learning framework according to claim 1, characterized in that: In step 4, network optimization employs a Swish function-based optimization scheme applied to the backbone CNN network. Specifically, this includes using the Swish activation function in the feature extraction layers of the CNN backbone network, employing Swish intermediate layers and a Sigmoid output in the dual attention mechanism, and using Swish hidden layers and a Softmax output in the fully connected classifier. The formula for using the Swish activation function is: Swish(z) = x·σ(βz) Where z is the input variable, representing the input value flowing into the activation function; σ(βz) is the Sigmoid function, which has the specific form σ(βz)=1 / (1+e^(-βz)), and its function is to perform a nonlinear transformation on the input; β is a learnable parameter, which is a scalar or tensor, and is optimized through gradient descent during training; Based on the feature extraction stage of the CNN backbone network and the introduced dual attention mechanism, the swish function is applied in the intermediate layer between spatial attention and channel attention. The spatial attention process after application is as follows: Input features → Convolutional layer 1 → Swish activation → Convolutional layer 2 → Swish activation → Average pooling + max pooling → Concatenation → Convolutional layer 3 → Sigmoid output; The channel attention process after application is as follows: Input features → Convolutional block → Swish activation → Channel matrix calculation → Reshaping operation → Sofimax normalization → Feature weighting → Sigmoid output; In the classification stage of the CNN backbone network, the fully connected classifier uses the Swish function, which, together with the Softmax of the output layer, completes the final classification decision.

Images