Pitch and Fourier magnitude based steganography for hiding 2.4 kbps MELP bitstream

IET Signal ProcessingVolume 13, Issue 3 p. 396-407 Research ArticleFree Access Pitch and Fourier magnitude based steganography for hiding 2.4 kbps MELP bitstream Hamza Kheddar, Corresponding Author Hamza Kheddar hamza.kheddar@gmail.com Speech Communication and Signal Processing Laboratory, University of Sciences and Technology Houari Boumediene (USTHB), P.O. Box 32, El-Alia, Bab-Ezzouar, Algiers, 16111 AlgeriaSearch for more papers by this authorMerouane Bouzid, Merouane Bouzid Speech Communication and Signal Processing Laboratory, University of Sciences and Technology Houari Boumediene (USTHB), P.O. Box 32, El-Alia, Bab-Ezzouar, Algiers, 16111 AlgeriaSearch for more papers by this authorDavid Megías, David Megías Internet Interdisciplinary Institute (IN3), Universitat Oberta de Catalunya (UOC), CYBERCAT-Center for Cybersecurity Research of Catalaonia, Barcelona, SpainSearch for more papers by this author Hamza Kheddar, Corresponding Author Hamza Kheddar hamza.kheddar@gmail.com Speech Communication and Signal Processing Laboratory, University of Sciences and Technology Houari Boumediene (USTHB), P.O. Box 32, El-Alia, Bab-Ezzouar, Algiers, 16111 AlgeriaSearch for more papers by this authorMerouane Bouzid, Merouane Bouzid Speech Communication and Signal Processing Laboratory, University of Sciences and Technology Houari Boumediene (USTHB), P.O. Box 32, El-Alia, Bab-Ezzouar, Algiers, 16111 AlgeriaSearch for more papers by this authorDavid Megías, David Megías Internet Interdisciplinary Institute (IN3), Universitat Oberta de Catalunya (UOC), CYBERCAT-Center for Cybersecurity Research of Catalaonia, Barcelona, SpainSearch for more papers by this author First published: 01 May 2019 https://doi.org/10.1049/iet-spr.2018.5339Citations: 3AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract In this study, the authors present a new steganographic technique called random least significant bits of pitch and Fourier magnitude steganography (RLPFS). It is based on hiding a secret speech coded by mixed excitation linear prediction (MELP) speech coder in speech bitstream (cover signal), which is also encoded by MELP coder. First, the RLPFS leaks the hidden speech in the following modes: pitch-based steganography, Fourier magnitude-based steganography or both. These modes are selected randomly. Second, during transmission, the stego speech, the mode number, and the number of embedded bits would be transmitted either through a covert channel created in the transmission protocol or through the cover speech. In this work, the authors have dealt with the challenge of embedding a secret speech into a cover speech coded by a very low bit rate speech coder while maintaining a reasonable level of speech quality. They have shown that RLPFS was able to create hidden channels with maximum steganographic bandwidths up to 266.64 bit/s at the cost of a steganographic noise between 0.031 and 0.62 mean opinion score. Also, this study takes into account the security of the parameters, the synchronisation of the receiver to deal with a packet loss during transmission and the resistance of the proposed method against steganalysis. 1 Introduction A secure communication system is based on four main security concepts, namely authentication, confidentiality, integrity and the non-repudiation [1]. With the rise in demand of Internet applications, digital media needs to be transmitted in a secure manner. The exchange of data (audio, video etc.) through public channels is not secure because of illegal interception and improper manipulation by eavesdropper. Therefore, motivated by growing concern about the protection of data, the interest in steganography [2-4] and covert channels for data communications [5, 6] are receiving attention from the scientific community. Both of these methods violate the integrity of systems. Enabling and manipulating certain properties of the communication protocol in an unexpected or unconventional way can be a convenient approach to conceal a secret message within or with an ordinary message. Often it is considered that the use of encryption is sufficient to secure communication. However, encryption only prevents unauthorised parties from decoding the communication, whereas covert channel or steganography is intended to hide the existence of the communication. Hence, data hiding provides an economic and alternative approach to secure data besides encryption. Initially, covert channels were identified as a security threat to systems such as mainframes. Recently, focus has shifted towards transmission of information through covert channels in computer network protocols. Voice over IP (VoIP), or IP telephony, is one of the services of the IP world which is changing the entire telecommunications domain. Due to its popularity, it is becoming a target for steganography. In [6], steganophony is a proposed name to steganographic techniques applied to VoIP traffic. This term could address information hiding techniques in any layer of the TCP/IP protocol stack, including methods such as audio watermarking and techniques applied in speech coding techniques. In this paper, we present a new method for speech steganography called random least significant bits of pitch and Fourier magnitude steganography (RLPFS), which can be used on VoIP transmission to secretly send voice messages. This method belongs to packet modification category, specifically in the mixed sub-category, which involves both header and payload modification. The proposed method is based on applying the random least significant bit (R-LSB) method (described in Section 4) to hide the secret speech bitstream coded by a well-known 2.4 kbps mixed excitation linear prediction (MELP) coder [7] in the cover speech coded by the same coder. To the best of our knowledge, the bitstream of MELP coder is often used as secret speech similar to the scheme proposed by Wu et al. [8], due to the fact that it can encode a considerable amount of information in a few bits per frame, which provides the possibility of creating a covert channel that has small capacity to transmit secret information with good imperceptibility. However, it has never been used as cover speech, because the imperceptibility is hard to maintain even with small capacity of embedding, and may raise suspicions to attackers who are listening to the channel. In this work, we suggest using a MELP bitstream as a cover to embed secret speech on it by carefully choosing the coefficients that can hold stego speech with considerable embedding capacity while maintaining a good imperceptibility. The RLPFS method needs mode number (MN) and number of embedded bits (NEB) to correctly receive the stego speech. The values of MN can have multiple possibilities which are randomly selected. The stego bitstream containing cover speech and secret speech will be transmitted in the payload while MN and NEB will either be transmitted secretly in covert channel created on the transmission protocol or hidden in the cover speech bitstream. These two latter possibilities are complementary to each other: when the covert channel is erased by traffic normalisation that causes interruptions, the second configuration can be used to transmit stego speech, and when more imperceptibility is required, the first configuration can be used. The rest of the paper is organised as follows. In Section 2, background and related work are presented. Section 3 presents preliminaries about MELP coefficients generation and its final format. Section 4 presents in detail the proposed method. Implementation of the proposed method in different cases and results discussion of the experimental results are described in Section 5. Section 6 provides steganalysis of RLPFS method. Finally, Section 7 concludes our work. 2 Background on VoIP steganography and related work The literature of VoIP steganography has distinguished between three main groups of techniques used to hide data in VoIP traffic. Fig. 1 lists these groups. The first group, packet modification steganographic method, is classified into the following three sub-categories: methods that modify protocol fields, methods that modify message payload and mixed techniques. The next three sections overview these different approaches. Fig. 1Open in figure viewerPowerPoint Classification of VoIP steganography techniques. Techniques based on the modification of packets include payload modification (Section 2.2), protocol fields modification (Section 2.1) and mixed techniques (Section 2.3) 2.1 Methods that modify protocol fields These methods consist of hiding a secret message in the IP header's Identification (ID) field [9], transmitting a secret hidden message on covert channel created in TCP header's initial sequence number field [10], or embedding messages into the source address fields of IPv6 packets [11]. The advantage of this subcategory is ease of implementation. The high capacity of the covert channel and the speech quality of the original message (of the overt channel) are not affected. However, the steganalysis is easy and the reachability is limited. 2.2 Methods that modify message payload These methods modify packet's payload fields by modifying the content of the original message. It is divided into three sub-categories, namely, temporal domain stegenography, frequency/wavelet domain stegenography and code-based stegenography. Temporal domain stegenography: The dominant part of temporal domain methods utilises least significant bit (LSB) method, which is one of the principal techniques utilised for data concealing [2]. Generally, it is based on inserting each bit of the secret speech in the LSB of the cover speech deterministically. Thus, for an 8 kHz sampled audio, 8 kbps of information is covered up using LSB method. The LSB strategy permits high inserting capacity of information and is generally easy to implement and can be used in combination with other concealing systems. However, this method is characterised by low robustness to noise addition which decreases its security performance since it becomes vulnerable even to simple attacks. Another temporal domain method hides secret speech signal in silence intervals. In [12], a simple and effective embedding method is proposed to exploit silence intervals in cover speech signal. Initially, the silence intervals of the speech and their relevant lengths (the number of samples in a silence interval) are determined. These values are reduced by a value x where , and nbits is the number of bits needed to represent a value from the secret speech signal. In the extraction process, x is evaluated as . For instance, if we want to hide 5 in a silence interval with , we remove 6 samples from this interval which makes the new interval with samples. To extract the hidden data from this silent interval in the stego signal [2], we compute . Small silence intervals are left unchanged since they usually occur in continuous sentences and changing them might affect the quality of the speech. This method has a good perceptual transparency but obviously it is vulnerable to compression. Changes in length of silence intervals lead to false data extraction. Transform domain steganography: A certain characteristics of human auditory system (HAS) can be exploited for hiding information successfully. The masking effect phenomenon covers weaker frequencies next to stronger resonant ones [13]. Several transform-based hiding techniques have been proposed by the scientific community. To achieve the inaudibility, these strategies exploit the frequency masking effect of the HAS directly by explicitly modifying only masked regions [14] or indirectly [15] by slightly changing the samples of audio signals. Spread spectrum (SS) technique is a type of transform domain-based data hiding that spreads hidden data through the frequency spectrum. SS is a concept developed in data communications to ensure a proper recovery of a signal sent over a noisy channel by producing redundant copies of the data signal. Mainly, information is multiplied by an m sequence code known to both sender and receiver and then hidden in the cover audio. As a result, if noise corrupts some values, there will still be copies of each value left to recover the hidden message. Another technique that hides in transform domain is discrete wavelet transform (DWT). Audio steganography based on DWT is described in [16]. Data is hidden in the LSBs of the wavelet coefficients of the audio signals. To enhance the imperceptibility of embedded data, Delforouzi and Pooyan [14] employed a hearing threshold when embedding data in the integer wavelet coefficients, while Shirali-Shahreza and Manzuri-Shalmani [17] avoided data hiding in silent parts of the audio signal. Even though, data hiding in wavelet domain procures high embedding rate, data extraction at the receiver side might not be correct. Code-based stegenography: When passing through one of VoIP encoders, the transmitted audio signal is coded according to the encoder rate, and then decompressed at the decoder end. Thus, the data signal at the receiver side is not exactly the same as it was at the sender side, which affects the hidden data-retrieval correctness and therefore, makes these techniques very challenging. We distinguish two such techniques, namely, in-encoder and post-encoder techniques. One of the examples of steganography based post-coder is described in [3], where the secret message is embedded around the pitch of the speech signal during coding. Another scheme belonging to post-encoding is described in [18]. It is a communication system based on constellation shaping orthogonal frequency-division multiplexing modulation, where the secret message bits are always modulated into artificial noise superposed with the cover signal, which is then demodulated with the shared codebook at the receiver. Another famous steganographic method based on in-coder techniques is called quantisation index modulation (QIM) [4]. QIM embeds secret data bits by exploiting redundancy in codebook quantisation procedure of G.723.1 signal encoding. Later on, an improved and secured quantisation-index-modulation steganography in low bit rate speech streams was developed over G.723.1 coding in [19] that exploits the characteristics of codebook division diversity in the complementary neighbour vertices algorithm. The latter method uses a key-based codebook division strategy, which follows Kerckhoffs's principle [20] and provides a better security than the previous QIM approach. In [21], a novel approach of the steganographic technique also belonging to the in-coding family is introduced. It is based on embedding information using matrix embedding during the linear predictive coding (LPC) process for a low bit rate speech codec. In general, methods that modify payload message also employ same methods used in digital audio watermarking techniques. These methods tend to provide lower steganographic capacity than protocol field modifications methods; however, they are harder to implement and detect, hence the reachability is global. The main disadvantage of these methods is the fact that the modification of the message payload may decrease the speech quality. 2.3 Mixed techniques Mixed techniques offer high steganographic capacity, but the implementation is hard due to required low-level access to hardware. For the same reason, steganalysis is hard to perform, and the reachability is in a large scale. However, these techniques increase the frame error rate. The steganographic methods use modification of packets time relation to perform covert communication by changing the sequence of messages, or modifying inter-packet delays, or introducing intentional losses by skipping sequence numbers (SNs) at the sender's end [6, 22]. A recent communication-based model of IP covert timing channels (IPCTCs) has been introduced in [23]. This method utilises time variables attached to IP packets to hide information. The advantage of this method is that the IPCTC cannot be removed easily due to the fact that the time cannot be disrupted due to the redundancy bits among a packet's header. This IPCTC method can be used to resist monitoring and eavesdropping and, in addition, it can be utilised to watermark the packet flow. This category is easy to implement, however, it requires synchronisation between the sender and the receiver. Also, it provides a lower steganographic capacity than protocol field's modification techniques. Also, decreasing an inter-packet delay lower than a certain threshold results in increased transmission speed, reduced data detection and an increase in errors. Hence, resulting in a reduced voice quality and limited reachability. Hybrid steganographic methods modify both the packet as well as its scheduling. As a result, they combine the features of both systems. Lost Audio PaCKets Steganography method [6] is an example of hybrid steganographic method. Table 1 summarises the comparison between these techniques. Table 1. Comparison between steganographic techniques VoIP steganographic techniques Capacity Implementation Steganalysis Voice quality Reachability modification of protocol high easy easy not affected limited fields — — — — — modification of payload lower than fields difficult than fields difficult than fields reduced global stream modification modification modification — — modification of packets time lower than fields easy difficult than fields reduced limited relation modification modification — — — hybrid high difficult moderate moderate moderate 2.4 Related work Several steganographic methods were developed for the widely used G.711 codec, which is employed both in conventional and IP telephony. Its main advantage is its simplicity. The codec quantises each speech sample independently using a logarithmic quantiser. In 2003, Aoki and co-workers [24] proposed a packet loss concealment algorithm for G.711, which used the LSB technique to create an additional channel to carry the data needed for reconstruction of the packets that were lost during transmission. In 2006, Wu and Young [25] described another method for the same codec, in which they proposed an energy-based algorithm to choose the number of LSBs that could be used to transmit hidden data at a low steganographic cost, that is, with no or with only minor speech quality degradation. Xu and Yang [26] in their study in 2009 described an LSB-based technique for the G.723.1 codec. This codec is based on code-excited linear prediction (CELP), so it decomposes the speech signal into numerous parameters, such as linear prediction coefficients, pitch-related data and code vector indexes. The authors researched which parameters could be optimally used for steganographic purposes based on LSB. They proposed a solution that was able to create a hidden channel with a capacity of 133.3 bps. In 2015, Neal and ElAarag [27] described yet another method of working with the G.711 codec, which was able to handle packet losses. In 2014, Wei et al. [28] proposed a steganographic method called adaptive VoIP steganography, which was based on dynamic selection of multiple bits within the G.711 bitstream, in parallel with controlling embedding intervals to minimise detection risk. In 2011, Huang et al. [29] suggested that during G.723.1 transmission, the inactive frames could be used to hide data. Yet another method of hiding data in the speech payload, called StegVoIP, was proposed by Tian et al. in [30] for the G.729.A codec. Data hiding algorithms dedicated to specific codecs were also proposed, that is, in [31] for the G.721 codec, and in [8] by Wu et al., for G.729. A different approach to voice payload modification was proposed by Mazurczyk et al. [32] in 2014, and later improved by Janicki et al. [33]. This method, called transcoding steganography, consisted of replacing the original voice payload with the same speech data, but compressed at a higher compression ratio. The saved bits were used to carry a steganogram. Results of experiments for various pairs of overt/covert codecs, presented in [34], showed the high effectiveness of this method. The authors were able to create hidden channels with capacities over 30 kbps at a reduced quality between 0 and 1 mean opion score (MOS). 3 Overview of the MELP standard This section discusses the analysis algorithms of the MELP coefficients involved in the proposed scheme. The MELP standard belongs to parametric voice coders family [35]. It was developed by Texas Instruments and was proposed as a new military and federal standard for 2.4 kbps to replace the Federal Standard FS-1016 CELP[35]. The MELP coder produces a coded speech frame every 22.5 ms (44 frames/s) at a sampling rate of 8 kHz to get 54 bits per frame (as shown in Table 2) for the 2.4 kbps data rate [35]. MELP is basically an improvement with respect to LPC [35], where additional parameters are introduced to add naturalness, smoothness and adaptability to more diverse signal conditions. The MELP coder has achieved all these advantages without elevating the overall bit rate, which is mainly due to the inclusion of vector quantisation techniques. MELP parameter transmission order must be respected to produce a good quality at the decoding stage. The parameters involved to hide secret speech are described in Table 2. Table 2. MELP coder bit allocation Parameters Voiced Unvoiced LSF's 25 25 Fourier magnitudes 8 — gain 8 8 pitch 7 7 bandpass voicing 4 — aperiodic flag 1 — error protection — 13 synch. bit 1 1 total bits/22.5 ms 54 54 The next three sections provide detailed information about band-pass voicing, the Fourier magnitudes (FMs) and the pitch period. 3.1 Band-pass voicing Five bandpass voicing strengths (where ) determine how much the noisy and the periodic parts contribute in specific frequency bands to the linear prediction (LP) excitation, the flag's value of the periodic or aperiodic equals 1 for voiced parts and 0 for unvoiced parts. According to Algorithm 1 (see Fig. 2), when (unvoiced), the remaining voicing strengths, , , are quantised to 0. When , the remaining voicing strengths are quantised to 1 if their value exceeds 0.6, and quantised to 0 otherwise. There is one exception: if the quantised values of , are 0001, respectively, then is quantised to 0. Fig. 2Open in figure viewerPowerPoint Algorithm 1: band-pass voicing strength quantisation 3.2 FM calculation The purpose of Algorithm 2 (see Fig. 3) is to search in the neighbour surrounding the frequency values where, . These values correspond to the ten first harmonics associated with the pitch frequency. If the frequency value is above 255, that is, the harmonic is out of the evaluation range, the corresponding peak value, or FM, is set to SMALLEST_MAG, which is a constant. This latter case occurs when the pitch frequency is too high. If the frequency values are ≤255, the search for peaks is performed in the range ; this range can be adjusted accordingly depending on the desired accuracy. At the end of the routine, ten peak magnitudes are obtained: . These ten values are the sought-after FMs. Ten of these quantities are found to be sufficient for the present coding application. The FM sequence is normalised according to the following equation: (1)with Fig. 3Open in figure viewerPowerPoint Algorithm 2: FM calculation Ten magnitudes are quantised with an 8-bit vector quantiser. The codebook is searched using a perceptually weighted Euclidean distance, with fixed weights that emphasise low frequencies over higher frequencies. The weights are given by (2)where is the frequency in Hz that corresponds to the harmonic for a default pitch period of 60 samples. 3.3 Pitch period calculation and quantisation The input speech signal is first processed with a 1 kHz, sixth-order Butterworth low-pass filter. The integer pitch value, , is the value of for which the normalised autocorrelation function is maximised. This function is defined by (3)where (4)where represents truncation of an integer value. The final pitch and the low-band voicing strength are jointly quantised using 7 bits. If the low-band voicing strength is ≤0.6, then the frame is unvoiced and an all-zero code is sent. Otherwise, the log of the final pitch is quantised using a 99-level uniform quantiser ranging from log(20) to log(160). The resulting index is then mapped to a 7-bit codeword using a lookup table. 4 Proposed steganographic scheme In this section, we explain in detail the principle of our proposed method. First, the secret speech and the cover speech signals are coded with the 2.4 kbps MELP coder. In fact, the bitstream is made up of necessary and sufficient coefficients (54 bits per frame) taken from the output of the MELP coder. This is explained by the fact that the speech coding is a procedure to represent a digitised speech signal using as few bits as possible, maintaining at the same time a reasonable level of speech quality. Let be a sequence of scalar values (cover speech), where is encoded into M bits, and bits in MELP coding. Let be the data to be embedded (secret speech), where . Second, the strategy to hide secret speech into cover speech is done by putting into effect the R-LSB method (Fig. 4 a), which is an enhanced version of LSB. Fig. 4Open in figure viewerPowerPoint General scheme of hiding secret speech (a) Principle of LSB and R-LSB to hide secret data, (b) Principle of R-LSB method to embed data in pitch and FM Let be a bit-mask function that clears the LSB of x. If M is sufficiently large, we can expect that there is no large difference between x and . Therefore, we can use the LSB of as the payload for embedding information. Formally, , which represents the stego speech, can be written as follows: (5)As mentioned in [36] and detailed in [21], the stego speech can be modelled as additive white Gaussian noise, as mainly utilised in information theory to resemble the impact of random natural processes. The additive property comes from the fact that this model is added for any noise, which may be inherent for information systems. The white property represents its uniform power across the frequency band, while the Gaussian property represents its normal distribution with zero average value of time domain. From the statistics' point of view, our steganograms are random variables with the probability density function as follows: (6)i.e. our steganograms are random variables that fulfil the normal distribution with the expectation and the variance . For R-LSB version, if NEB = 1, if NEB = 2 or if NEB = 3. Then we can use the data as new data where the information is embedded. The embedded information can be recovered by (7)One problem of applying the simple LSB or R-LSB substitution method to MELP coded speech is that the distortion of the decoded speech depends on the magnitude of the input speech. When linear quantisation is applied, it is ensured that for any . On the other hand, a non-linear quantisation method such as multi-stage vector quantiser (MSVQ) used in MELP requires a non-linear transformation for restoring the speech. The formalism of non-linear distortion is given as follows: (8)In our scheme, the R-LSB method is applied on , which can be the pitch, the FM or both. At the sender side, the pitch and the FM of the cover speech (real values) are converted to binary, and, then, the LSBs of these two parameters are initialised to zeros using bitmask function . First, the secret message is converted to binary and then, it is split into groups of bits and (number of bits per group is fluctuated and depends on how many bit can be embedded at a time). The addition of these results (secret and cover signals) is called stego bitstream (). Fig. 4 b illustrates these steps. In the stego bitstream, the cover speech takes the higher significant bits while the secret speech occupies the LSBs of less importance. In our method, a switch is used to randomly choose MN; means embedding in the pitch, means embedding in the FM and, finally means embedding in both pitch and FM simultaneously for each transmitted frame. The strategy of changing mode of embedding increases the security level against an attacker or steganalysis process. Varying the MN and NEB multiple times in one stego speech file will prevent attackers to detect the hidden speech neither correctly nor permanently. The final frame structure before applying our scheme is as follows: (9)where stands for concatenation operation. After applying our scheme, the final structure of MELP frame will be as follows: (10)During transmission, there are following two possibilities for sending both MN and NEB: (i) Transmitting MN and NEB independent of bitstream: This kind of transmission can be done by transmitting the MN and the NEB in a covert channel created in the transmission protocol header field. Fig. 5 a shows the principle of this case. The overt channel represents the payload field where the stego signal is transmitted; such an approach resembles the so-called multi-level steganography. To create a covert cha