dan deblasio and brad mundt university of central florida
DESCRIPTION
An Enhanced Steganographic Method for Data Hiding in Microsoft Word Documents by a Change Tracking Technique. Dan DeBlasio and Brad Mundt University of Central Florida [email protected], [email protected]. Steganography. What is Steg? - PowerPoint PPT PresentationTRANSCRIPT
An Enhanced Steganographic Method An Enhanced Steganographic Method for Data Hiding in for Data Hiding in
Microsoft Word Documents Microsoft Word Documents by a by a
Change Tracking TechniqueChange Tracking Technique
Dan DeBlasio and Brad MundtDan DeBlasio and Brad MundtUniversity of Central FloridaUniversity of Central Florida
[email protected], [email protected] [email protected], [email protected]
SteganographySteganography
What is Steg?What is Steg?
The word steganography is of Greek origin The word steganography is of Greek origin and means "covered, or hidden writing". and means "covered, or hidden writing".
Modern implementation is embedding secret Modern implementation is embedding secret information into something innocentinformation into something innocent
Pictures, audio, videoPictures, audio, video
Picture StegPicture Steg
By removing all but the last 2 bits of each color component, an almost completely black image results. Making the resulting image 85 times brighter results in the image to the right.
Image extracted from tree image.
Image of a tree.
Our selectionOur selection
A New Steganographic Method for Data Hiding in Microsoft Word Documents by a Change Tracking Technique by Tsung-Yuan Liu and Wen-Hsiang Tsai
A new steg method to hide information via MS Word A new steg method to hide information via MS Word change trackingchange tracking
Collaborative document with correctionsCollaborative document with corrections
Deleted words are struck through and new words are Deleted words are struck through and new words are underlinedunderlined
OverviewOverview
Transform a regular document to one with Transform a regular document to one with misspellings or mistakesmisspellings or mistakes
Make changes, allow word to track them.Make changes, allow word to track them.
Using a Huffman tree on the original words in Using a Huffman tree on the original words in the file, create a binary string of the embedded the file, create a binary string of the embedded messagemessage
Decode the binary string to get the secret Decode the binary string to get the secret messagemessage
The quick brown fox jumped over the lazy dog.
Original sentenceOriginal sentence
The quick borwn fox jumped oevr the lazy dag.
Sentences with MisspellingsSentences with Misspellings
The quick borwnbrown fox jumped oevrover the lazy dagdog.
Sentence with changes trackedSentence with changes tracked
Huffman TreeHuffman Tree
Created from the frequency of misspellings
WordWord HuffmanHuffman
tehteh 1111
qwikqwik 101101
borwnborwn 1001010010
brounbroun 00110011
jumppedjumpped 000010000010
oevroevr 00011100001110
orverorver 100010100010
dagdag 0101
The quick borwnbrown fox jumped oevrover the lazy dagdog.
How to DecodeHow to Decode
WordWord HuffmanHuffman
tehteh 1111
qwikqwik 101101
borwnborwn 1001010010
brounbroun 00110011
jumppedjumpped 000010000010
oevroevr 00011100001110
orverorver 100010100010
dagdag 0101
1001000 0111001
0x72 0x105
Hi
Our implementationOur implementation
Recreated the method from scratchRecreated the method from scratch
Made improvementsMade improvements
Modular code for easy improvementsModular code for easy improvements
Encryption, simple XOR pad with key in the Encryption, simple XOR pad with key in the author fieldauthor field
Example next,Example next,then a live demothen a live demo
A Word documentA Word documentBefore steg encodingBefore steg encoding
Encoding in ProgressEncoding in Progress
Encoding CompleteEncoding Complete
The Word documentThe Word documentAfter steg encodingAfter steg encoding
Decoding in ProgressDecoding in Progress
Decoding completeDecoding complete
Live DemoLive Demo
Statistical ResultsStatistical Results
Changes Bits b/change Words % changed
Sent. Changes/Sent
Document 1 40.4 93.8 2.321 475 8.5% 29 1.393
Document 2 43.2 99.8 2.310 551 7.8% 31 1.394
Document 3 65.6 129.6 1.976 641 10.2% 51 1.286
Document 4 124.4 224.8 1.968 1268 9.8% 89 1.398
Document 5 37.6 78 2.074 481 7.8% 27 1.392
ImprovementsImprovements
Due to the code being modular, improvements Due to the code being modular, improvements will be easywill be easy
More advanced or alternate encryption algorithmsMore advanced or alternate encryption algorithms
Implement a Markov model instead of a Huffman tree Implement a Markov model instead of a Huffman tree for statistical attacksfor statistical attacks
Use synonyms instead of misspellings or a Use synonyms instead of misspellings or a combination of bothcombination of both
That’s all for now folks!That’s all for now folks!