A comprehensive review of video steganalysis

IET Image ProcessingVolume 16, Issue 13 p. 3407-3425 REVIEWOpen Access A comprehensive review of video steganalysis Mourad Bouzegza, Corresponding Author Mourad Bouzegza mbouzegza@psu.edu.sa orcid.org/0000-0003-2451-5319 College of Computer and Information Sciences, Prince Sultan University, Riyadh, Saudi Arabia Department of Computer Science and Digital Technologies, Engineering and Environment, Northumbria University at Newcastle, UK Correspondence Mourad Bouzegza, College of Computer and Information Sciences, Prince Sultan University, P.O.Box No. 66833, Rafha Street, Riyadh 11586, Saudi Arabia. Email: mbouzegza@psu.edu.sa Contribution: Formal analysis, Funding acquisition, ​Investigation, Methodology, Resources, SoftwareSearch for more papers by this authorAmmar Belatreche, Ammar Belatreche ammar.belatreche@northumbria.ac.uk orcid.org/0000-0003-1927-9366 Department of Computer Science and Digital Technologies, Engineering and Environment, Northumbria University at Newcastle, UK Contribution: Project administration, Supervision, ValidationSearch for more papers by this authorAhmed Bouridane, Ahmed Bouridane abouridane@sharjah.ac.ae orcid.org/0000-0002-1474-2772 College of Computing and Informatics, Sharjah University, Sharjah, United Arab Emirates Contribution: Project administration, Supervision, ValidationSearch for more papers by this authorMohamed Tounsi, Mohamed Tounsi mtounsi@psu.edu.sa College of Computer and Information Sciences, Prince Sultan University, Riyadh, Saudi Arabia Contribution: ConceptualizationSearch for more papers by this author Mourad Bouzegza, Corresponding Author Mourad Bouzegza mbouzegza@psu.edu.sa orcid.org/0000-0003-2451-5319 College of Computer and Information Sciences, Prince Sultan University, Riyadh, Saudi Arabia Department of Computer Science and Digital Technologies, Engineering and Environment, Northumbria University at Newcastle, UK Correspondence Mourad Bouzegza, College of Computer and Information Sciences, Prince Sultan University, P.O.Box No. 66833, Rafha Street, Riyadh 11586, Saudi Arabia. Email: mbouzegza@psu.edu.sa Contribution: Formal analysis, Funding acquisition, ​Investigation, Methodology, Resources, SoftwareSearch for more papers by this authorAmmar Belatreche, Ammar Belatreche ammar.belatreche@northumbria.ac.uk orcid.org/0000-0003-1927-9366 Department of Computer Science and Digital Technologies, Engineering and Environment, Northumbria University at Newcastle, UK Contribution: Project administration, Supervision, ValidationSearch for more papers by this authorAhmed Bouridane, Ahmed Bouridane abouridane@sharjah.ac.ae orcid.org/0000-0002-1474-2772 College of Computing and Informatics, Sharjah University, Sharjah, United Arab Emirates Contribution: Project administration, Supervision, ValidationSearch for more papers by this authorMohamed Tounsi, Mohamed Tounsi mtounsi@psu.edu.sa College of Computer and Information Sciences, Prince Sultan University, Riyadh, Saudi Arabia Contribution: ConceptualizationSearch for more papers by this author First published: 05 July 2022 https://doi.org/10.1049/ipr2.12573AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract Steganography is the art of secret communication and steganalysis is the art of detecting the hidden messages embedded in digital media covers. One of the covers that is gaining interest in the field is video. Presently, the global IP video traffic forms the major part of all consumer Internet traffic. It is also gaining attention in the field of digital forensics and homeland security in which threats of covert communications hold serious consequences. Thus, steganography technicians will prefer video to other types of covers like audio files, still images, or texts. Moreover, video steganography will be of more interest because it provides more concealing capacity. Contrariwise, investigation in video steganalysis methods does not seem to follow the momentum even if law enforcement agencies and governments around the world support and encourage investigation in this field. In this paper, the authors review the most important methods used so far in video steganalysis and sketch the future trends. To the best of the authors' knowledge this is the most comprehensive review of video steganalysis produced so far. 1 INTRODUCTION As is well known in the field, steganography is the art of secret communication. It is the art and science of hiding information by embedding messages within a digital cover, which could be a text, an image, or a video. Many steganography methods exist in order to let the loaded messages remain seemingly harmless. As an obvious and a priori condition, the best carrier for secret messages must possess two features. Firstly, the carrier should be popular. Secondly, the steganogram insertion-related modifications of the carrier should not be 'visible' to the third party not aware of the steganographic procedure [1], whereas steganalysis is the art of detecting the hidden messages embedded in digital media covers by the means of steganography. The steganalysts are usually something of forensic statisticians, and must start by reducing the suspect set of data files to the subset most likely to have been altered [2]. In addition to the forensics and homeland security use [3], the steganalysis strategies are also beneficial in civilian applications by detecting all kinds of malware meant to harm the computers [4]. So far, images are probably the cover that received the biggest part of investigators effort in steganalysis. Nevertheless and as the digital video is overwhelming the Internet traffic [5], researchers start working on it in order to develop new methods because the ones developed for image steganalysis are not always easily adaptable to videos [6, 7]. Therefore, investigators should make an extra effort in order to adapt image algorithms or develop new ones that take into account the video characteristics like the temporal domain. This has to become a strong trend in the coming years, especially when we know that the capacity for hidden messages in video streams is enormous when compared with other steganographic mediums, and countless algorithms can be used to embed information in various domains of the video [8]. Unfortunately and despite the recent interest in the video cover by steganalysts, research in this field is still in its first steps when compared with image cover-related investigation. It is obvious that due to the huge amount of data to analyze in videos, the algorithm designers should put more effort in producing heuristic-based solutions in order to reduce the computation costs. We suggest, in Figure 1, a general framework for the video steganalysis approaches. FIGURE 1Open in figure viewerPowerPoint A suggested video steganalysis framework This paper contains a comprehensive review of steganalysis methods applied to videos. We are using a new taxonomy principally based on distinguishing whether the algorithms are built upon spatial, temporal, or spatial-temporal steganalysis. We then look at specific considerations for each of the above classes. Video steganalysis strategies use the spatial and temporal features obtained from intra- and inter-frames levels. The human visual system (HVS), naturally containing certain specific characteristics, can be deceived by covert data if a given embedding threshold is respected. This makes the temporal domain more privileged to fit larger amounts of hidden messages, through creating higher redundancy that gives steganalysts greater attack opportunities [6]. In this paper, the terms 'algorithm', 'approach', or 'technique' are used interchangeably. They mean the same. Also, the term 'cover' is used to refer to a media devoid of any hidden secret information and the term 'stego' is used to refer to a media that has hidden secret information. In the following, we will start, in Section 2, by comparing image to video when used as covers for hidden data. The objective is to determine how possible it is to extend the existing image steganalysis methods to video. Then, in Section 3, we will give general steganalysis rules and lessons extracted from the literature to the benefit of the new investigators or sometimes the experienced ones. In Section 4, we explain, in an acceptable detail, the differences between active and passive steganalysis. Further detail about the motion vectors-based methods is given. Another section addresses active video steganalysis principles and techniques. The paper then continues, in Section 5, by enumerating the chronological evolution of the video steganalysis features. The taxonomy we used in this paper in order to make it easily readable appears in Section 6. In Section 7, we gather, in two tables, the different characteristics of the surveyed video steganalysis methods. As datasets are essential for any experience, we decided to include a chapter about the most used and useful ones in the topic. In Section 9, we discuss the general findings of this research to conclude the paper, in Section 10, with the research directions and open problems that appear in the recent investigations to help the researchers push forward research in this very complex field. 2 IMAGE VERSUS VIDEO STEGANALYSIS From the steganalysts perspective, using videos as covers is interesting since the embedding capacity is high when compared to the other mediums such as images. Nevertheless, and as asserted in [9], there is a greater chance of message detection because of the statistical redundancy existence in the temporal domain. So far, images are probably the cover that received the biggest part of investigators effort in steganalysis. However, as the digital video is overwhelming the Internet traffic [5], researchers start working on it in order to develop new methods because the ones developed for image steganalysis are not always adaptable to videos [7]. Therefore, investigators should make an extra effort in order to adapt image algorithms or develop new ones that take into account the video characteristics like the temporal domain. This has to become a strong trend in the coming years, especially when we know that the capacity for hidden messages in video streams is enormous when compared to other steganographic mediums, and countless algorithms can be used to embed information in various domains of the video [8]. A quick comparison between image and video based on different criteria is given in Table 1. The advantages are represented by the sign (+) while the disadvantages are represented by the sign (−). TABLE 1. Advantages (+) and disadvantages (−) of image versus video as covers Image Video Ease of implementation + − Popularity + + Steganography capacity − + Options to embed message − + Maturity of research in steganalysis + − 3 GENERAL STEGANALYSIS RULES AND PRINCIPLES When we went through the video steganalysis literature, we found many lessons and rules worth extracting for the benefit of the new investigators or even more experienced ones who will need to complete their knowledge in order to extend the scope of their research. For example, slow-motion videos contain more exploitable information than high-motion ones. The reason for that is that slow-motion video successive frames present more common statistical and perceptual characteristics [10]. That is why the messages hidden in non-moving or having only translational motion in the video are easily detectable. Here is a list of those similar useful lessons in this very restrained topic of research The objective of steganalysis is to detect hidden messages with high probability and low complexity [9]. There exists a tradeoff between the visibility of the concealed message and its embedding rate in video sequences. In fact, below a given embedding rate, the message becomes statistically invisible leading to the used steganalysis method to fail. However, above that threshold, the message becomes robust to destruction caused by compression or other means while disturbing statistics that make the message visible to some steganalysis approaches [6, 11, 12]. Precisely, and in the temporal domain, the statistic visibility is tightly bound to the temporal correlation between the successive frame correlations. Farid et al. in [13] and [14] show that the embedding of a message disrupts the higher order statistical regularity within an image. The fact applies to the video spatial domain steganography too. So far, the majority of video steganalysis research work is oriented towards H.264-based videos. However, a few researchers start putting forward some investigation on the H.265 (HEVC) videos. In that perspective, we can cite, for example, Huang et al. in [15] and Shi et al. in [16]. A lot is yet to be done with this specific type of videos. In theory, it is argued that for a steganographic algorithm to be defeated, it is necessary for the steganography to be detected with more success than a random guess, that is, with a true positive rate greater than 50% and a false positive rate less than 50%. However, it is commonly agreed that the real performance of an efficient steganalysis should be far better. Based on the message embedding location in the processing chain of video compression, digital video steganography can be classified into two main categories [17]. Pre-compression steganography: The pre-compression steganography, the secret message is embedded into the cover video before compression [18, 19]. The primary advantage of pre-compression steganography is that the embedding technique is independent of the video compression standard. Robustness of the embedded message cannot be guaranteed in this case. In-compression steganography: In case of in-compression steganography, the message is embedded into the cover video during the compression process, for example, into the motion vectors [20] or quantized DCT coefficients [21] during video compression. These schemes, however, are sensitive to distortion introduced during transmission and are dependent on the video compression standard. Research on video steganalysis is developing slowly because video steganography and steganalysis require good backgrounds in video compression [22]. Noise level is proportional to embedding strength and different noise levels correspond to different detecting thresholds [22]. Compression has influence on mode detection results. The higher the bitrate, the less the embedding modes are destroyed and the easier the detection will be [22]. Because of the strong temporal correlation between adjacent frames, the frame difference signal of the cover video can be commonly approximated by a Laplacian distribution [22]. Active steganalysis is barely addressed by investigators because it is very greedy in processing time and often severely affects the cover media [8]. The video steganalysis algorithms that utilize the temporal redundancies at the frame level and inter-frame level have been observed to be more effective than algorithms based on spatial redundancies only. Nevertheless, some video steganalysis algorithms that simultaneously exploit both the temporal and spatial redundancies have also been proposed and shown to be effective [23]. Because video stream is first offered in a compressed format, steganography algorithms that are not applicable in compressed bit-stream would require complete or at least partial decompression, which is an unnecessary burden best avoided when the steganalysis method used is capable of attacking compressed videos. In the recent years, a good number of video steganography algorithms were designed for the compressed domain [24]. Motion vector (MV)-based steganography has been used for the last decade because the statistical characteristics of the spatial/frequency coefficients are indirectly affected and because the motion compensation technique is adopted by most advanced compression standards and the MVs are lossless coded, little degradation of the reconstructed visual quality would be introduced [25]. MV-based steganography embed messages during motion estimation within the compression process. The MV-based steganography is less detectable than those utilizing spatial/frequency coefficients directly [26]. Because the secret messages are embedded into MVs, the statistical characteristics of the spatial/frequency coefficients of video frames will not be changed aggressively [27]. The steganographic algorithms based on motion vectors may reduce the embedding rates, but produce little quality degradation of the reconstructed frames and little influence on the statistical characteristics of coefficients [28]. Data can be embedded in raw video [29, 30] or in compressed ones [20, 25, 31–35]. The techniques to do so range from extending the image steganography methods, which embeds data in DCT coefficients or intra-frame, as done in JPEG images, to hiding data in motions vectors during the encoding process. It is important to continue developing steganalysis techniques in order to deter the MV-based steganography as the approaches used in the image are not optimal [36]. The rich model steganography descriptors have been tested sometimes and showed their efficiency as done by Tasdemir in [37] and [7]. Automatic detection of object-based video forgery is still in its infancy [38]. When the descriptor (feature vector) is too large, it cannot be trained using an SVM classifier. Instead, an ensemble classifier should be used [7]. It is relatively difficult to distinguish between the double compressed video frames from the tampered ones [38]. The video sequences with fast and moderate movements exhibit stronger MV correlations than the slow moving video sequences, and this phenomenon has been explained in [7]. Low bitrate videos usually have shorter motion vectors and greater prediction residuals than their high bitrate versions. On the contrary, high bitrate videos usually have smaller prediction residuals than their low bitrate versions [39]. 4 TYPES OF VIDEO STEGANALYSIS In this section of the paper, we gather the different types of steganalysis along with the related used terminology found in the literature. The steganalysis approach can be passive, active, or even the combination of both. The researcher could also look at steganalysis from the spatial and temporal points of view. Thus, different assumptions could be done before introducing a new steganalysis approach. 4.1 Passive video steganalysis Passive steganalysis is based on a-priori knowledge of the steganography tool or embedding algorithm used to embed the secret message. It is also called specific or targeted steganalysis [8]. Kumar in [40] states that if the steganalysts know the embedding algorithm and its statistical signature then this type of steganalysis is very effective. This approach is similar to how anti-virus software works by looking for specific signatures that could be, for example, a statistical signature. As with anti-virus software, targeted steganalysis does not perform well with new or unknown embedding algorithms. Passive attacks are often very efficient at detecting stego messages as they are built against a specific subset of steganographic algorithms [41]. Thus, they are generally sufficient to defeat them. Otherwise, these types of steganalysis attacks do not need to alter the cover media to detect the presence of a hidden load [42]. However, despite these positive aspects of these technics, they present a set of disadvantages. We may point out that they are extremely difficult to generalize and can only be applied to a very specific type of steganographic algorithms. In addition, such strategies can easily be overcome by even a slight alteration of the steganographic algorithms. Consequently, we can state that these steganalysis passive attacks are very useful in a given limited interval of steganography methods. Beyond that, they present a large set of disadvantages like being rigid and inflexible. 4.2 Active video steganalysis The active steganalysis could be defined as the detection or extraction of a hidden message with little or no a priori information [10]. That is the blind attempt to detect the presence of covert data without knowing the particular steganographic algorithm used. For the first glance, this approach seems interesting. It would be impeccable if we reduce the complexity and do not loose in efficiency. Unfortunately, a very few active steganalysis attacks have been proposed [43] and [44] due to the broad range of existing steganography approaches and methods. Moreover, they are much fewer when the cover is a video. Thus, we do not consider this as an independent category in our taxonomy. Finally, each of these two approaches has its advantages and disadvantages. When enough a priori information is available, the passive attack is privileged and is more efficient but difficult to generalize to other steganography methods. Whereas, with no or little a priori information, it is better to use an active approach which needs a large dataset for training and test. In this case, the performance produced to attack a specific embedding algorithm is suboptimal. 4.3 Other definitions of active and passive steganalysis In [10, 45], the authors consider the role of passive steganalysis is only to detect the presence or absence of a hidden message, whereas the active steganalysis objective is to extract, destroy or alter it. The same definition is also adopted by Wu in [46]. The estimation of the hidden message 'length' can be sometimes part of the passive approach like in [45], or part of the active approach as stated by Trivedi in [47]. In addition to this, the above authors consider 'the location of the hidden load' to be part of the active approach. We may add to those pieces of information, 'the secret key used in the embedding process', some other parameters of the steganography algorithm used and eventually 'the message extraction' which is considered to be the ultimate objective when possible. It is also important to point out the difference between the active steganalysis as defined here and the active warden case where the steganalysts will destroy the message instead of making the effort to extract it. In some cases, the steganalysts may alter messages even if no trace of a hidden message is detected [48]. The amount of alteration made is subject to the model and the cover used. In this paper, we will consider the active and passive steganalysis as defined in Section 4.2. 4.4 Spatial, temporal and combined spatial-temporal video steganalysis In this paper, we define the spatial video steganalysis as the steganalysis method applied to video sequences based on features extracted from the spatial domain. Similarly, the temporal video steganalysis is the steganalysis method applied to video sequences based on features extracted from the temporal domain. Consequently, the combined spatial-temporal steganalysis is the steganalysis method applied to video sequences based on features extracted from both the spatial and temporal domains. It is important to point out that this is completely independent of whether the steganography method used to load the video is spatial, temporal or combines both the domains. 4.5 Motion vector steganalysis The temporal domain is very characteristic of videos. Thus, it should be privileged by steganalysts to hide messages especially that it gives more space for that. Surprisingly, the techniques that have been proposed so far are in majority utilizing the spatial domain, which is common to other traditional covers like image or text. For example, the techniques described in [49] and [50] encode information within the frames of the video using image steganography. Thus, they look to the video as a set of images without considering the temporal video specific domain. Some other techniques, in contrary, described for example in [51], [24], [52], and [53] among others suggest algorithms which use motion vectors. Most of these techniques involve encoding information within motion vectors as calculated by motion estimation blocks of various compression algorithms [8]. Investigation in this matter goes on and more descriptors tend to be built using the inter-frame domain. More recently, a few works taking into account both the spatial and the temporal domains were presented. They are more complex but seem to be robust like in [7] or [54]. The work of Sadat et al. in [55] is original and proposes a new method for motion vector steganalysis. They use the statistical entropy value and combine it with the optimized motion vector features. In another high level view of steganalysis, it can be divided into different ways based on different criteria as follows: Original domain steganalysis and transform domain steganalysis according to its scope. Steganalysis based on the identification and steganalysis based on statistics. Specific steganalysis and universal steganalysis. The present studies of video steganalysis mainly aim at specific steganographic algorithm, but there are still no mature methods for universal steganalysis [56]. 5 CHRONOLOGICAL EVOLUTION OF VIDEO STEGANALYSIS FEATURES The video steganalysis features used in the surveyed papers can be split into three categories: spatial, temporal and the combination of both spatial and temporal (spatial-temporal) domains. In the following, they are dispatched into those classes with respect to their publication chronology since 2003, when, for the first time, a formal framework for video steganalysis was proposed by Chandramouli et al. [10] and 2004, when the first video steganalysis algorithm was proposed by Budhia et al. [9]. 5.1 Temporal In 2004, Budhia et al. [10] first suggested using inherent temporal redundant information in the form of Gaussian watermarks. They used the statistical values: kurtosis, entropy and the 25th percentile as a feature vector. In 2006, the same authors used the same features above but worked in [6] on generalizing, extending and providing thorough analytic justification and simulations to their previous method. In 2007, Jainsky et al. [45] exploited the high redundancy correlation between consecutive frames and used motion interpolation and non-classical asymptotic relative (ARE) memoryless detection to be implemented on networks involving multimedia sensor systems. In the same year, Pankajakhshan et al. [57] proposed a method that forms a 39-dimensional feature vector by concatenating the three moments of the histogram characteristic functions of the corresponding wavelet sub-bands as in [58]. In 2008, Su et al. introduced in [22] a new steganalysis algorithm, which uses correlation between adjacent frames and detects a special distribution mode across the frames to distinguish videos tampered by StegoVideo [59]. In the same year, Zhang et al. [60] were, to the best of our knowledge, the first to introduce a steganalysis technique to detect messages hidden in the motion vectors of compressed videos. They consider the motion vector first-order statistics alterations caused by the least significant bit (LSB) embedding. Almost simultaneously, Zhang and Su [61] used the aliasing effects (distortion) between adjacent frames that are generated by the embedded data in raw videos. More specifically, they used the probability mass function of the stego-video frame difference signal. It seems like the researchers, from this date on, preferred forming their descriptors from a combination of both spatial and temporal features. 5.2 Spatial In 2006, Pankajakshan et al. [62] suggested capturing the statistical changes introduced in the motion trajectories of the video. The features used are the local variance and the local mean taken from the motion-compensated prediction error frames (PEFs) of the video. In 2008, Rana et al. proposed a frame-by-frame blind video steganalysis method based on spatial average filtering of frames. They used the same features as in Budhia et al. [6]. Pankajakshan et al. [63] tried to detect, in 2009, whether a video stream contains any motion-incoherent component. Their method relies on some features extracted from the error frames after motion compensation, like the local variance. In 2013, Tasdemir et al. [64] introduced a steganalysis method that targets LSB-based motion vector steganography. They used a flatness measure that indicates the corruption in flat areas in order to detect the existence of a message embedded into MVs in the LSB fashion. In 2014, Chen et al. [65] proposed a passive forensics steganalysis approach to attack object-based forgery. They looked at some statistical features around the object boundaries. The same year, Wang et al. [66] presented another video steganalysis method called AoSO (add or subtract one) against MV-based steganography. Their method considers the influence of the stego message on the sum of absolute difference (SAD). In 2015, Wu [46] investigated the detection of hidden messages in H265-encoded videos using an LSB matching algorithm. Fan et al. [67] proposed in 2016 an approach targeting hash-based LSB steganography. They compared the correlation between two consecutive frames in the stego video and the correlation between the same frames in the reconstructive video. The same year, Zarmehi and Akhaee [68] pres