csisl / appa Goto Github PK

Abbreviations

I will refer to rgb values in the same way as in the readme.
[(r1,g1,b1),(r2,g2,b2),(r3,g3,b3)]

I will also refer to the LSBs (bit plane 0) of each color as follows:
r_lsb = percentage of red values with a 1 in the LSB
g_lsb = percentage of green values with a 1 in the LSB
b_lsb = percentage of blue values with a 1 in the LSB

Introduction

One method of steganalysis is to look at individual bit planes for each color. This algorithm only changes the LSB, so changes are only visible in bit plane 0 of each color (look at the figures below). For the original image of Appa, the cumulative percentage of 1's in bit plane 0 clings tightly to 50%. However, for the image of Appa with the encoded message, the cumulative percentage of 1's in bit plane 0 notably changes. While it is impossible to leave bit plane 0 completely intact and encode data, it is possible to reduce the number of changes made to bit plane 0 while still encoding the same amount of data. If only encoding lowercase ascii characters (excluding spaces and punctuation), the number of changes can be reduced from 9 to 6. Modifying the message end indicator to use an alternating pattern of 0s and 1s would have the effect of reducing the number of changes from 9 to 5. In the original image, 50% of values in the LSB are 0s and 50% are 1s, so an alternating pattern would have little to no effect.

Figures

The y-axis shows the cumulative percentage of 1s and the x-axis shows the number of bytes.

r1 can be left unchanged

All ascii characters start with 0. This means that there is no need to encode anything into r1. Leaving r1 intact will help decrease the change to r_lsb.

g1 and b1 can potentially be left unchanged

Lowercase ascii letters always start with '011'. This means that there is no need to encode anything into r1, g1, or b1. Leaving r1, g1, and b1 intact will help decrease the changes to r_lsb, g_lsb, and b_lsb. Unfortunately, leaving g1 and b1 untouched means that spaces, uppercase letters, or punctuation cannot be encoded into the image. If spaces are needed, either r1, g1, or b1 can use an alternating 0 and 1 pattern. A repeated bit of 0 or 1 would indicate an encoded space.

ex: 0 1 0 1 [1 space] 0 1 0 1 0 [0 space]

Message end indicator

b3 is used to indicate whether or not the encoded message has ended. If the encoded message has not ended, a 0 is encoded into b3. This means that large messages will significantly lower b_lsb. This can be addressed by alternating between 0 and 1. Once the last letter has been encoded, b3 should have the same value as the previous b3

ex: 0 1 0 1 0 1 [1 end] ...

ex: 0 1 0 [0 end] ...

Conclusion

The encoding algorithm should not affect bit planes 1 to 7, but it causes notable changes to bit plane 0. The changes to bit plane 0 are a result of 9 different bit flips: [(r1,g1,b1),(r2,g2,b2),(r3,g3,b3)]. The change to bit plane 0 can be reduced by reducing the number of bits flipped. If encoding ascii, r1 can be left unchanged, reducing the number of changes from 9 to 8. If only encoding lowercase ascii, g1 and b1 can be left unchanged. This reduces the number of bits changed to 6. If the message end indicator is changed to have an alternating pattern, the effect on b_lsb will negligible. A similar alternating technique could also be used in r1, g1, or b1 to encode spaces. This means that only 5 bits, [r2, g2, b2, r3, g3], will actually have an effect on bit plane 0. Since r1, g1, and b1 are left unchanged, they could potentially be used in a way that compensates for the changes made by the other bits.

TLDR

i) Ascii only uses 7 bits, so r1 can be left alone.
ii) Lowercase ascii always starts with '011', so r1, g1, and b1 can be left alone at the cost of no punctuation of spaces.
iii) The message end indicator can be switched to an alternating pattern, which should have little to no effect on bit plane 0.