A HEVC Steganalysis Algorithm Based on Relationship of Adjacent 1 Intra Prediction Modes

9 Currently, many High Efficiency Video Coding (HEVC) video steganography algorithms based on Intra 10 Prediction Mode (IPM) have been proposed. However, the existing IPM-based video steganalysis 11 algorithms are almost designed for H.264/AVC videos, without considering the unique coding techniques 12 in HEVC, which is the latest video codec standard. Thus, it is of significant value to study IPM-based 13 steganalysis for HEVC videos. In this paper, the general process of IPM-based HEVC steganography is 14 modelled for the first time, and we find that the basic distortion existing in the change of the relationships 15 between each embedded IPM and the adjacent IPMs. By exploiting these weaknesses, we propose a 16 novel IPM steganalysis algorithm based on the Relationship of Adjacent IPMs (RoAIPM) feature. In 17 detail, the RoAIPM is extracted by generating different directional Gray-Level Co-occurrence Matrixes 18 (GLCMs) and texture characteristics of three refilled matrixes: MPM-IPM matrix, Left-IPM matrix and 19 Up-IPM matrix. Experimental results show that, the proposed RoAIPM feature is very sensitive to the 20 little change introduced by IPM-based steganography. Regardless of whether the feature is after 21

coding. Therefore, when detecting IPM-based HEVC steganography, the effect will be greatly reduced.  Vector Machine (SVM) to classify stego-videos and cover-videos. Experimental results demonstrate that 10 the RoAIPM is sensitive to the modification of IPMs, and the accuracy rates are higher than existing 11 other algorithms. Besides, the proposed algorithm has the lowest computational complexity compared 12 with other works, and thus it is easier to implement.

13
The rest of this paper is organized as follows: In Section 2, the HEVC intra prediction process is 14 introduced, and the general model of IPM-based HEVC steganography is analyzed. In Section 3, the 15 producing principle of the RoAIPM features is explained. The proposed steganalysis algorithm is 16 described in detail in Section 4. Next, Section 5 shows the experimental results and analysis. Finally, the 17 conclusions and future work are given in Section 6. In order to keep this paper more self-contained, the basics of intra prediction in HEVC are introduced 1 in Section 2.1. Then, the specific process of IPM-based HEVC steganography is analyzed and modeled 2 for the first time in Section 2.2. Transform Unit (TU). The flexibility of HEVC coding, such as transform and prediction, depends much 9 on these elements. A frame in HEVC is first spilt into several 64×64 nonoverlapping CTUs. Then every 10 CTU can either be directly used as CU or be further partitioned into multiple CUs with sizes of 32×32, 11 16×16 or 8×8. In the smooth region of a frame, the sizes of CUs are larger, and the smaller CUs are 12 selected in the edge or the area with complex texture, which is beneficial to improve coding efficiency.

13
CUs can be further split into PUs and TUs. An intra predicted CU may have one of the two types 14 of PU partitions modes: 2N×2N and N×N. The first type means that the CU is not split, and the second 15 type indicates that the CU is split into four equal-sized PUs. PUs are the blocks where Intra Prediction 16 Modes (IPMs) are established, and each PU has its own IPM. Intra-prediction aims to remove spatial 17 redundancies between the current block and its neighbors. Compared with H.264/AVC, the number of 18 IPMs increases from 9 to 35 in HEVC, including planar mode numbered 0, DC mode numbered 1 and 19 33 angular modes defined for luma information, as shown in Figure 1 [19]. 7 1 Figure 1: Angular intra-prediction modes numbered from 2 to 34 in HEVC.

2
In the process of intra prediction in HEVC. Firstly, HEVC uses Rough Mode Decision (RMD) to 3 choose several candidate modes from the 35 modes. The number of candidate modes is determined by 4 the size of the PU. RMD will refer to the Sum of Absolute Transformed Difference (SATD) and the 5 length of bits used for expressing the coding information of each mode. Secondly, three Most Probable 6 Modes (MPMs) will be added into above candidate set. If the current IPM is one of the three MPMs, 7 only its index in the MPMs needs to be encoded. Otherwise, its index in remaining 32 modes needs to 8 be encoded by using a code of 5-bit fixed length. The MPMs are decided by the IPMs of the upper and 9 left encoded luma PUs, and if the upper and left PUs are unavailable, they will be set DC mode for  al. [1]. Finally, Rate Distortion Optimization (RDO) technique is adopted to calculate the RD cost of 14 candidate modes. The mode with the minimum RD cost is selected as the optimal mode of the PU.    Firstly, compress the frames read from original video stream using HEVC encoder. Then, obtain 3 embedding blocks as well as theirs IPMs according to the cover selection rule. In HEVC, two number-4 adjacent blocks have similar prediction directions, and the principle of modifying IPMs is replacing them 5 with the modes that are similar in prediction direction. In different algorithms, one prediction mode has 6 one or several candidate IPMs that can replace it. In current IPM-based steganography, in order to reduce 1 the modes that yield the minimum cost for IPMs changing. IPM-based steganography may divide 35 2 modified IPMs into two groups. One represents secret data 0, and the other represents secret data 1.

3
Steganography operation can be generally expressed as follows:  Above parameters are all integers. Besides, * ∈ {0, 1} determines whether block k is used to embed 8 information.

9
The main distortion caused by this steganography is the reduction in coding efficiency. The 10 distortion on visual quality is very weak when the video bit rate is sufficiently high, and thus it is not 11 feasible to detect the visual quality distortion caused by IPM-based steganography. Through analysis, we 12 can know that the steganography usually modifies IPMs with non-optimal selection rules. But even if 13 the modified IPM of each embedded block is very close to the original one, in consideration of the 14 similarity of adjacent IPMs in cover-videos, this type of embedding method will also break the IPM-15 similarity between adjacent blocks. Therefore, we focus more on the change of relationships between 16 adjacent blocks to detect steganography.

17
For each current 4×4 block k, the distortion in the distance between IPM-numbers of it and the the distance between current IPM and the adjacent left IPM is defined as following formula: 6 Furthermore, for each I-picture, the total distortion %&&"'+!"#$ can be presented as Equation (4),

7
where n indicates the total number of all PUs that are embedded secret message in one I-picture. (4)

9
Based on the above analysis, we can conclude that: (1) IPM-based HEVC steganography destroys 10 the IPM-similarity of each embedded block and its adjacent blocks.
(2) The probability that embedded 11 IPM is one of the MPMs is reduced. Taking advantage of these phenomenon, we establish the RoAIPM 12 features that can reflect the total distortion %&&"'+!"#$ and the violation of intra-modes coding in 13 accordance with three MPMs. It is worth mentioning that the distortion is weak and distributed, which

Proposed RoAIPM Features 19
In this part, we introduce the producing method of the proposed Relationship of Adjacent IPMs (RoAIPM) 20 feature, which is a kind of fusion feature. Obviously, these features are tiny and decentralized. If we can 12 present the IPMs distribution of adjacent blocks and the MPMs of every current block in the form of 1 matrix, and then indicate the relationships between the IPM of every embedded block and the IPMs of 2 its adjacent blocks as well as the MPMs, the RoAIPM is naturally fully obtained.

3
Firstly, the formation of texture is due to the repeated appearance of gray distribution in spatial 4 position, and GLCM is a common method to describe texture by studying the spatial correction of gray  GoAIPM is defined as the probability that the value of new IPM is . when leaving a fixed IPM 10 whose value is / with distance d and direction . ∈ {0°, 45°, 90°, 135°}. It can be formulated as:

12
where C is original IPM-matrix with grayscale 2 , and GoAIPM of size 2 × 2 represents the feature

5
For the matrix with similar IPM values, the value on the diagonal of GoAIPM will be larger.

6
Conversely, for the matrix with fast IPM change, the value deviating from the diagonal of GoAIPM will 7 be larger. Generally, some scalars can be used to characterize the textures of GoAIPM. Here we will 8 introduce three texture characteristics of GLCM: Angular Second Moment (ASM), correlation and 9 homogeneity.

10
ASM is the summation of squared elements in the GLCM. In our application, ASM of Adjacent 11 IPMs (ASMoAIPM) is formed as one kind of texture characteristics in Equation (6), Correlation is the statistical measure of how correlated a parameter value is to its neighbor over the whole 14 IPM-matrix, which reflects the consistency of texture, and Correlation of Adjacent IPMs (CORoAIPM) 15 is used as another kind of texture characteristics to enrich the RoAIPM features. It is calculated as: 16 17 2 456 " 3 Besides, homogeneity indicates the closeness of the distribution of elements in the GoAIPM to the 4 diagonal of GoAIPM, and it is 1 for a diagonal GoAIPM. Same as above, we also select the Homogeneity 5 of Adjacent IPMs (HOMoAIPM) characteristic to present texture changes introduced by IPM-based 6 steganography, which is formulated as Equation (12), Briefly, in view of the analysis that these texture characteristics can accurately capture the change 9 of energy after steganography and the relationship between adjacent IPMs, in the proposed steganalysis 10 algorithm, three novel texture characteristics are also proposed to present the RoAIPM features. In

Proposed Steganalysis Algorithm 18
In this section, based on the above introduction of the RoAIPM features, we will illustrate the flow of   introduced to strengthen the statistics of embedding impact. Next, the three refilled matrixes will be 1 derived from the IPM matrix: MPM-IPM matrix, Left-IPM matrix and Up-IPM matrix according to 2 Equation (4). In these refilled matrixes, if the size of current PU is 4×4 and the four 4×4 PUs in one 8×8

3
CU have different IPMs, which can be classified as non-uniform 4×4 PUs, these four IPMs remain 4 unchanged, or else the IPM of current PU will be reset according to three different matrix filling rules.

5
As depicted in Figure 6, a small square represents a 4×4 block, and also provides a matrix element.    14 Thirdly, the 4915 dimensional RoAIPM features obtained above can be directly sent into Support

15
Vector Machine (SVM) to classify stego-videos and cover-videos, outputting a detection accuracy.

16
Besides, to reduce the training time and storage space, the dimension of features can be reduced by using  In this section, experimental results will be presented to demonstrate the effectiveness and robustness of 7 the proposed steganalysis algorithm. Concrete experimental setup will be first introduced as follows:

8
(1) Video Database: Because HEVC is the state-of-art video codec standard, which is specially 9 designed for high definition videos to achieve higher coding efficiency, 22 YUV sequences (aspen, blue 10 sky, controlled burn, crowd run, ducks take off, factory, in to tree, life, old town cross, park joy, 11 pedestrian area, red kayak, riverbed, rush field cuts, rush hour, snow mint, speed bag, station, sunflower,

9
The SVM [23] is employed as classifier, and we choose polynomial kernel as the kernel function. 13 respectively, on a common dataset to illustrate the advantage of ours. In all experiments, the proposed 14 features have been tested both before and after PCA dimension reduction. We adopt accuracy rate to 15 evaluate detection performance. Accuracy rate is defined as the ratio of predicted value, which is same 16 as actual value, to all predicted results. Table 2, Table 3 and   It's remarkable that the accuracy rates of the proposed steganalysis against Tar1 are all above 99% while 6 the features without PCA dimension reduction. Thus, the detection effect is stable 7 in various coding conditions. Furthermore, according to research, PUs with size of 4×4 are selected as 8 cover in Tar1 [14], and results demonstrate a strong effect of the proposed features captured only from 9 4×4 PUs. In addition, because the lower the dimension of features is, the less information is retained, 10 and the training accuracy will be reduced. Together with the linearity of the model may be not high, and

11
PCA can only deal with typical linear models. Therefore, the accuracy rates turn lower while the      change of capacity has little influence on the performance of our algorithm. In addition, the higher the 3 QP is, the coarser the quantization is, and some details are lost, which leads to the enhancement of video 4 distortion and the degradation of video quality. And the embedding distortion on the relationship between 5 the IPM and its adjacent IPMs as well as the MPMs will be more obvious. Consequently, the performance 6 results of the proposed steganalysis may be better as QP increases.

7
To summarize, the experimental results show that, regardless of whether the feature after dimension 8 reduction or the 4915 dimensional feature is provided for classifier, the proposed steganalysis algorithm 9 can both present a considerable detection accuracy when attacking several latest IPM-based HEVC 10 steganography. Under any QP, the accuracy rates are almost all above 90% and even approach 100% 11 while detecting the three steganography methods. Consequently, the proposed RoAIPM features are 12 effective, performing better than existing other works.

14
In addition to the accuracy rate, the computational complexity is also a main index to consider. In order  Table 5, where s is 19 the short for second (a unit for measuring time). The optimal experimental results are displayed in bold. As presented in Table 5, when QP is higher, the feature extraction time is less. This is because

Conclusion 9
In this paper, a novel IPM steganalysis algorithm for HEVC videos has been proposed. Since the previous 10 literatures mainly focus on detecting H.264/AVC steganography, this paper first models the general 11 process of IPM-based HEVC steganography methods, concluding that IPM-based HEVC steganography 12 can destroy the IPM-similarity of each embedded block and its adjacent blocks. In addition, the 13 relationships of embedded IPM and the MPMs also will be influenced. Accordingly, we adopt GLCM 14 as well as its texture properties to generate the proposed RoAIPM features.