(2006); Xuan et al. (2006a); Fridrich et al. (2011); In the
MTPM feature-based steganalysis, the algorithms are pro-
posed for frequency domain in Shi et al. (2006); Pevný and
Fridrich (2008); Huang et al. (2011), while for spatial
domain in Pevný et al. (2010); Kodovský and Fridrich
(2011); Pevný et al. (2012).
Co-occurrence matrix
For JPEG images, there is strong dependence between
neighboring coefficients both in intra- and inter-block of
DCT domain (If not specified, the DCT block size of JPEG
image in this paper are all 88). Of which the inter-block
dependence refers to the dependence between co-
efficients at the same location of neighboring block along
horizontal, vertical and diagonal directions. The intra-block
dependence refers to the dependence between neigh-
boring coefficients in the same block along horizontal,
vertical and diagonal directions. Liu et al. (2011) take the
CMs extracted from neighboring DCT coefficients of inter-
and intra-block as steganalytic features. Suppose the size of
DCT coefficients matrix C of an image is MN, and denote
C
m,n
(k,l) as the coefficient value in location (k,l) of the m-th
row and n-th column block, 1 m M/8, 1 n N/8,
1 k,l 8. Then, the CMs F
C,1h
and F
C,2h
for horizontal
neighboring coefficients in intra- and inter-block extracted
by Liu et al. are calculated by Eqs. (1) and (2), respectively.
where, F
C,1h
(a,b) and F
C,2h
(a,b) denote the feature compo-
nents of F
C,1h
and F
C,2h
corresponding to coefficients pair
with values (b,a), respectively, i.e., the joint distribution
probabilities PðC
m;n
ðk; lÞ¼b; C
m;n
ðk; l þ 1Þ¼aÞ and
PðC
m;n
ðk; lÞ¼b; C
m;nþ1
ðk; lÞ¼aÞ. The integers a and b are
values to be counted for the CM.
d
(u,v) ¼ 1 if and only if
u ¼ v; otherwise,
d
(u,v) ¼ 0. The CMs for vertical and di-
agonal neighboring coefficients are defined analogically,
and the average value of the CMs extracted from three di-
rections is taken as the steganalytic feature by Liu et al.
(2011).
When the range of a and b is [L,R], i.e., L a,b R, the
number of elements in each CM F
C
is ( R L þ 1)
2
, which is
the number of the feature components. The matrix for-
mation is as Eq. (3):
F
C
¼
2
6
6
4
PðL; LÞ PðL; L þ 1Þ / PðL; RÞ
PðL þ 1; LÞ PðL þ 1; L þ 1Þ / PðL þ 1; RÞ
««1 «
PðR; LÞ PðR; L þ 1Þ / PðR; RÞ
3
7
7
5
(3)
It has been indicated in Liu et al. (2011) that, the CM
based on the dependence of neighboring DCT coefficients is
centre symmetric about (0,0), i.e., P(a,b)zP(a,b)
zP(a,b)zP(a,b)zP(b,a). Therefore, the CM of absolute
value of the coefficients can reflect the distribution prop-
erties well. In addition, as is indicated in Fridrich (2004)
that, because large majority of high-frequency DCT co-
efficients are 0, so, the CM usually has a sharp peek at (0,0)
and then quickly falls off. And the embedding changes are
essentially perturbations by some small value around (0,0).
It can be seen from Eq. (3) that, the dimensionality of the
features will increase by the second power of range (R L).
Thereby, in order to control the feature dimension, existing
detection algorithms usually extract features by setting a
coefficients statistical range, such as the coefficients range
in Liu et al. (2011) is set to [0,5]. In this case, there are
2 (5 þ 1)
2
¼ 72 dimensions of features extracted from
intra- and inter-block in all.
Markov transition probability matrix
Corresponding to the extraction of CM from DCT co-
efficients, the MTPM feature can also be extracted similarly.
In Co-occurrence Matrix, the feature CM extracted from the
DCT coefficients that are not processed with Zigzag scan-
ning, some researches such as Fu et al. (2006) also extract
MTPM feature from the coefficients after Zigzag scanning.
In Fu et al. (2006), the DCT coefficients are rearranged first,
and the scanning modes for intra- and inter-block co-
efficients are shown in Fig. 1 (The direct current (DC) co-
efficients are excluded in the final results, and the 63
columns correspond to all the alternating current (AC) co-
efficients.). When the size of the DCT coefficients matrix is
MN, the total number of DCT blocks is X ¼ (M/8)(N/8).
Denote the rearranged coefficients matrix as C
0
, and the
coefficients value in location (x,y)isC′(x,y), where 1 x X
and 1 y 63. The feature are calculated from absolute
value of the coefficients in [8], and the MTPMs F
M,intra
and
F
C;1h
a; b
¼ PðC
m;n
ðk; lÞ¼b; C
m;n
ðk; l þ 1Þ¼aÞ¼
X
M
=
8
m¼1
X
N
=
8
n¼1
X
8
k¼1
X
7
l¼1
dðb; C
m;n
ðk; lÞÞdða; C
m;n
ðk; l þ 1ÞÞ
56 ðM=8ÞðN=8Þ
(1)
F
C;2h
a; b
¼ PðC
m;n
ðk; lÞ¼b; C
m;nþ1
ðk; lÞ¼aÞ¼
X
M
=
8
m¼1
X
N
=
81
n¼1
X
8
k¼1
X
8
l¼1
dðb; C
m;n
ðk; lÞÞdða; C
m;nþ1
ðk; lÞÞ
64 ðM=8ÞðN=8 1Þ
(2)
J. Lu et al. / Digital Investigation 12 (2015) 1e14 3