A Robust Multi-Watermarking Algorithm for Medical Images Based on DTCWT-DCT and Henon Map

To resolve the contradiction between existing watermarking methods—which are not compatible with the watermark’s ability to resist geometric attacks—and robustness, a robust multi-watermarking algorithm suitable for medical images is proposed. First, the visual feature vector of the medical image was obtained by dual-tree complex wavelet transform and discrete cosine transform (DTCWT-DCT) to perform multi-watermark embedding and extraction. Then, the multi-watermark was preprocessed using the henon map chaotic encryption technology to strengthen the security of watermark information, and combined with the concept of zero watermark to make the watermark able to resist both conventional and geometric attacks. Experimental results show that the proposed algorithm can effectively extract watermark information; it implements zero watermarking and blind extraction. Compared with existing watermark technology, it has good performance in terms of its robustness and resistance to geometric attacks and conventional attacks, especially in geometric attacks.


Introduction
Since the birth of medical imaging technology, medical images that, in the auxiliary diagnosis of the industry, play an increasingly important role in making accurate diagnoses for doctors, include computed tomography (CT) images, X-ray images, ultrasound images, magnetic resonance imaging (MRI) images, electrocardiograms, electroencephalograms, angiography images, radionuclide images etc. generated by medical imaging systems [1].Especially in recent years, due to the rapid development of life sciences, materials science, robotics engineering and information science, doctors can use imaging Appl.Sci.2019, 9, 700 3 of 23 functions embedded in multiple watermarks and a novel tracking key to restore original medical images; Lei et al. [17] inserted data and signature information into the original medical image via a recursive modulation algorithm after wavelet transform and singular value decomposition.In this method, the watermark strength is controlled by differential evolution.(3) The final category is based on classical conventional digital watermarking.In the literature [18][19][20][21][22], an algorithm of multiple watermarks for medical images is implemented.As Aditi Zear et al. [18] used SVD, DCT, DWT respectively for different type of watermarks, and back propagation neural networks (BPNN) to eliminate the impact of noise when extracting watermarks; they also enhanced its security by using Arnold transform; Rohit Thanki et al. [19] used fast discrete curvelet transform (FDCuT) for medical images to obtain the different frequency coefficients of the curve decomposition, and adopted DCT for high frequency coefficients.Then, the watermark is modified according to the medium frequency coefficient of a white gaussian noise (WGN) sequence image.During extraction, the same sequence of correlation is used to achieve blind recovery; Jinwei Wang et al. [20] proposed a new kind of multi-watermark which is controlled by secret key.The proposed hybrid decoder is optimal and locally optimal.It follows multiple multiplication rules and is based on the minimum risk of bayes.Their DWT coefficients are modeled as generalized gaussian distributions; Xiaochen Yuan et al. [21] proposed a local multi-watermark algorithm, which used the the robust and adaptive feature detector based on daisy descriptor (RAF3D) design adaptive detector to embed multiple watermarks into the orthogonal space of a feature extraction region at the same time.When extracting, the image can be extracted independently; Amit Kumar Singh et al. [22] proposed a spread spectrum watermarking algorithm, which used a haar wavelet to perform the binary sub-band decomposition, and then embedded different forms of watermark information in the intermediate frequency and second order selected frequency bands of the first order DWT respectively, according to the different contexts in which it was used.The three categories are shown in Figure 1.
Appl.Sci.2019, 9, x FOR PEER REVIEW 3 of 23 [16] proposed a reversible watermarking scheme using quantization functions embedded in multiple watermarks and a novel tracking key to restore original medical images; Lei et al. [17] inserted data and signature information into the original medical image via a recursive modulation algorithm after wavelet transform and singular value decomposition.In this method, the watermark strength is controlled by differential evolution.(3) The final category is based on classical conventional digital watermarking.In the literature [18,19,20,21,22], an algorithm of multiple watermarks for medical images is implemented.As Aditi Zear et al. [18] used SVD, DCT, DWT respectively for different type of watermarks, and back propagation neural networks (BPNN) to eliminate the impact of noise when extracting watermarks; they also enhanced its security by using Arnold transform; Rohit Thanki et al. [19] used fast discrete curvelet transform (FDCuT) for medical images to obtain the different frequency coefficients of the curve decomposition, and adopted DCT for high frequency coefficients.Then, the watermark is modified according to the medium frequency coefficient of a white gaussian noise (WGN) sequence image.During extraction, the same sequence of correlation is used to achieve blind recovery; Jinwei Wang et al. [20] proposed a new kind of multi-watermark which is controlled by secret key.The proposed hybrid decoder is optimal and locally optimal.It follows multiple multiplication rules and is based on the minimum risk of bayes.
Their DWT coefficients are modeled as generalized gaussian distributions; Xiaochen Yuan et al. [21] proposed a local multi-watermark algorithm, which used the the robust and adaptive feature detector based on daisy descriptor (RAF3D) design adaptive detector to embed multiple watermarks into the orthogonal space of a feature extraction region at the same time.When extracting, the image can be extracted independently; Amit Kumar Singh et al. [22] proposed a spread spectrum watermarking algorithm, which used a haar wavelet to perform the binary sub-band decomposition, and then embedded different forms of watermark information in the intermediate frequency and second order selected frequency bands of the first order DWT respectively, according to the different contexts in which it was used.The three categories are shown in Figure 1.For algorithms based on the first and third categories, the embedding of watermarks affects the images themselves, and these watermarking algorithms have poor anti-geometric attack capabilities; they cannot even resist the tiny geometric transformations [9,10,[22][23][24].For medical images, the particularity is that the embedded watermark cannot affect the diagnosis of doctors, and cannot obviously change the main content of medical images, especially for the region of interest of the image.The second category uses reversible digital watermarks.Although the watermark image can be restored to the original image without loss, the watermark is not robust.Therefore, finding a feature vector that can resist geometric attacks in medical images so that the algorithm can show good robustness without changing the original image is a problem that has long puzzled researchers [7,8,12,13,20,21].For algorithms based on the first and third categories, the embedding of watermarks affects the images themselves, and these watermarking algorithms have poor anti-geometric attack capabilities; they cannot even resist the tiny geometric transformations [9,10,[22][23][24].For medical images, the particularity is that the embedded watermark cannot affect the diagnosis of doctors, and cannot obviously change the main content of medical images, especially for the region of interest of the image.The second category uses reversible digital watermarks.Although the watermark image can be restored to the original image without loss, the watermark is not robust.Therefore, finding a feature vector that can resist geometric attacks in medical images so that the algorithm can show good robustness without changing the original image is a problem that has long puzzled researchers [7,8,12,13,20,21].
Consequently, this paper proposes a multi-watermark robust algorithm based on a dual-tree complex wavelet transform and discrete cosine transform (DTCWT-DCT) using perceptual hash and henon mapping.By selecting the low frequency coefficients of the medical images in the DTCWT-DCT transform domain and performing symbol transformation, the features of the medical image may be extracted.Then, using henon chaos and hash function properties, different initial values of the chaotic sequences and XOR operation are given to encrypt each watermark.Finally, based on common watermark technology, a set of secret keys are generated by combining the concepts of the "third party", chaotic encryption and cryptography technology to complete the embedding and extraction of the multi-watermark.
The main contribution of the present research is: (1) A new method is proposed to extract stable features of medical images according to human vision, which does not require any changes to the original images, and is highly resistant to geometric attacks.
(2) The encryption of watermarks uses a chaotic system and hash function properties, which are extremely sensitive to the initial value, to enhance the security of watermarks.
(3) The embedding of watermarks generates a set of secret keys that can be stored by a third party.The region of interest need not be selected, which can effectively protect the privacy of patients.
(4) The extraction of watermarks does not require the original image, i.e., zero watermark and blind extraction.
(5) It solves the problem that existing algorithms cannot simultaneously offer protection against geometric attacks and robustness.The proposed algorithm has good robustness and invisibility.

The Fundamental Theory
The fundamental theory involved in the algorithm is dual tree complex wavelet transform and henon mapping.

Dual-Tree Complex Wavelet Transform (DTCWT)
The dual complex wavelet transform (DTCWT) is a new transform method for improving the sensitivity of wavelet transform to translation operation and the inflexibility of direction selection [23].It has two trees: one stores the real numbers, and the other stores the imaginary numbers [24].When transforming, the two trees are played simultaneously.It can be selected in six directions and is stable for translation.The equation for the 2D DTCWT is as follows: where, ψ h and ψ g are orthogonal or biorthogonal real wavelets, respectively.The 2D discrete wavelet is shown in Figure 2a.The first two wavelets represent the vertical and horizontal two main directions, respectively; the third wavelet is the mixed diagonal direction with no main direction and serious chessboard artifacts.
The 2D discrete wavelet is shown in Figure 2a.The first two wavelets represent the vertical and horizontal two main directions, respectively; the third wavelet is the mixed diagonal direction with no main direction and serious chessboard artifacts.The 2D DTCWT is enforced by using four 2D DWTs which are synchronous for the image, whereby its row and column use different filter banks.The sum and difference of its sub-band diagrams yield 12 wavelets, as shown in Figure 2b.The first line is used as the real part (imaginary part) of the 6 complex-valued wavelets, the second line is the imaginary part (real part), and the third line represents the amplitude of the complex-valued wavelet.Figure 2c shows the ideal directional distribution of a two-dimensional complex wavelet.As shown in Figure 2, 2D DTCWT has 6 main directions and has better directional selectivity compared with 2D DWT.Meanwhile, 2D DWT checkerboard artifacts are eliminated.
In addition, 2D DTCWT can maintain good directional analysis capabilities while having translation invariance, as shown in Figure 3. Figure 3a is an input image.Figure 3b from left to right are the first to the fourth layer of the dual-tree complex wavelet coefficient reconstruction image and the fourth layer scale function coefficient map (to save space, the reconstructed image is only half displayed).The 2D DWT does not have translation invariance; therefore, it will produce many irregular edges and striped derivatives.While the 2D DTCWT performs the same processing on all directions of the input image, the processed image is smooth and continuous.The 2D DTCWT is enforced by using four 2D DWTs which are synchronous for the image, whereby its row and column use different filter banks.The sum and difference of its sub-band diagrams yield 12 wavelets, as shown in Figure 2b.The first line is used as the real part (imaginary part) of the 6 complex-valued wavelets, the second line is the imaginary part (real part), and the third line represents the amplitude of the complex-valued wavelet.Figure 2c shows the ideal directional distribution of a two-dimensional complex wavelet.As shown in Figure 2, 2D DTCWT has 6 main directions and has better directional selectivity compared with 2D DWT.Meanwhile, 2D DWT checkerboard artifacts are eliminated.
In addition, 2D DTCWT can maintain good directional analysis capabilities while having translation invariance, as shown in Figure 3. Figure 3a is an input image.Figure 3b from left to right are the first to the fourth layer of the dual-tree complex wavelet coefficient reconstruction image and the fourth layer scale function coefficient map (to save space, the reconstructed image is only half displayed).The 2D DWT does not have translation invariance; therefore, it will produce many irregular edges and striped derivatives.While the 2D DTCWT performs the same processing on all directions of the input image, the processed image is smooth and continuous.
are the first to the fourth layer of the dual-tree complex wavelet coefficient reconstruction image and the fourth layer scale function coefficient map (to save space, the reconstructed image is only half displayed).The 2D DWT does not have translation invariance; therefore, it will produce many irregular edges and striped derivatives.While the 2D DTCWT performs the same processing on all directions of the input image, the processed image is smooth and continuous.

Henon Map
A henon map is a two-dimensional nonlinear discrete chaotic map [25].It is sensitive to initial values, has unpredictability, and is ergodic, which is very similar to image encryption [26].Thus, it is often used in the study of image encryption algorithms.It is defined as follows: where, n represents the number of iterations, x, y represent the iteration values [27].a, b are two control parameters, a ∈ (0, 1.4), 0.2 < b ≤ 0.314.Under their control, the henon mapping system can be in a chaotic state, which a = 1.4,b = 0.3.Figures 4 and 5 show images of the non-attractive area and the two attractive domains displayed by the henon map under different parameters.In our proposed algorithm, we take the value of a as 1.399 and the value of b as 0.314.

Henon Map
A henon map is a two-dimensional nonlinear discrete chaotic map [25].It is sensitive to initial values, has unpredictability, and is ergodic, which is very similar to image encryption [26].Thus, it is often used in the study of image encryption algorithms.It is defined as follows: x ax y y bx where, n represents the number of iterations, , x y represent the iteration values [27].

The Proposed Algorithm
The proposed algorithm is based on DTCWT-DCT and a henon map.It is a multi-watermark scheme for medical images, which meets the requirements of zero watermark and blind extraction.It

The Proposed Algorithm
The proposed algorithm is based on DTCWT-DCT and a henon map.It is a multi-watermark scheme for medical images, which meets the requirements of zero watermark and blind extraction.It has strong resistance to geometric attacks and displays good robustness.The algorithm consists of five parts: feature extraction of the medical image, preprocessing of multi-watermark, embedding of the multi-watermark, extraction of the multi-watermark and recovery of the multi-watermark.In the feature extraction stage, based on human visual features, a new feature sequence based on perceptual hashing was found in the DTCWT-DCT domain to participate in the watermark operation.In the design of the algorithm, common watermark technology is organically combined with henon chaotic encryption, cryptography and the third-party concept, which not only allows the digital watermark to resist conventional and geometric attacks, but also makes the algorithm strong and robust.Meanwhile, the use of multiple watermarks also enhances the security of medical image transmissions, which can better protect the privacy of patients.
Figure 6 shows the working principle of the proposed algorithm.First, DTCWT-DCT transform was performed on an original medical image for a vector VF(j) conforming to human visual features found in the transformation domain.And binarization was performed on multiple watermarks to obtain multiple corresponding watermarks W n (i, j).Then, different initial values were taken for henon chaos to generate multiple different chaotic sequences X n (j).For these chaotic sequences, the symbol operation was applied to obtain the binary encryption matrixes C n (i, j), and the encrypted watermarks BW n (i, j) are obtained using C n (i, j) and W n (i, j), W = {w(i, j)|w(i, j) = 0, 1; 1 Next, logical operations are performed on BW n (i, j) and VF(j).According to the encrypted watermarks BW n (i, j) and the visual feature vector VF(j) of the image, binary logic sequences Key n (i, j) are generated through the Hash function.These binary logic sequences Key n (i, j) can be stored in a third-party platform.When testing, the same method was performed to the test medical image to extract the visual feature vector VF (j), and the watermarks BW n (i, j) contained in the image were extracted by VF (j) and the Key n (i, j) generated earlier.The chaotic sequences X n (j) and the encryption matrixes C n (i, j) were generated using the same henon initial value as the above method.Then, the restored watermarks W n (i, j) were obtained by hashing C n (i, j) and BW n (i, j).
A detailed algorithm description is shown in Figure 6.

Feature extraction
In order to find a visual feature applicable to medical images, a normal human brain image (128 pixels x 128 pixels) was randomly selected to carry out the DTCWT-DCT transformation, and this image was subjected to a variety of different types of attacks, as shown in Figure 7.By observing the coefficient data of the low-frequency part of the image after transformation, we found that although its numerical value changed significantly, its symbol remained basically the same.Table 1 lists the low frequency coefficients of the brain image under different attacks.In this paper, we selected 32 bits of low-frequency data for symbol transformation, and directly replaced data greater than or equal to 0 with 1, and all other data with 0. For the sake of explanation, we only list the first 10 data in the table; all data were in 1.0e+003 units.In this way, we obtained a set of DTCWT-DCT low-frequency coefficient symbol sequences of the original image, i.e., '1100010010'.As seen from Table 1, after transformation, the symbol sequences of all attacked images were consistent with the original image, and the NC values were all equal to 1.00.

Feature extraction
In order to find a visual feature applicable to medical images, a normal human brain image (128 pixels × 128 pixels) was randomly selected to carry out the DTCWT-DCT transformation, and this image was subjected to a variety of different types of attacks, as shown in Figure 7.By observing the coefficient data of the low-frequency part of the image after transformation, we found that although its numerical value changed significantly, its symbol remained basically the same.Table 1 lists the low frequency coefficients of the brain image under different attacks.In this paper, we selected 32 bits of low-frequency data for symbol transformation, and directly replaced data greater than or equal to 0 with 1, and all other data with 0. For the sake of explanation, we only list the first 10 data in the table; all data were in 1.0e+003 units.In this way, we obtained a set of DTCWT-DCT low-frequency coefficient symbol sequences of the original image, i.e., '1100010010'.As seen from Table 1, after transformation, the symbol sequences of all attacked images were consistent with the original image, and the NC values were all equal to 1.00.Then, taking this conclusion as a reference, we conducted the same test on a large number of randomly selected medical images, and verified the value of the normalized correlation coefficient between the images using their respective 32-bit symbol vectors.Figure 8 and Table 2 show some of the medical images and the NC values between them.From the data, it can be concluded that the NC values of the different images obtained using the feature vector selected with the above method are all less than 0.5, and their own NC values are 1.00.These results are consistent with human visual features.Therefore, we can take the sequence of coefficient symbols in the low-frequency part of the medical image transformed by DTCWT-DCT as its effective visual feature vector, and correlate the watermarks with it to design the multi-watermarking algorithm.
Then, taking this conclusion as a reference, we conducted the same test on a large number of randomly selected medical images, and verified the value of the normalized correlation coefficient between the images using their respective 32-bit symbol vectors.Figure 8 and Table 2 show some of the medical images and the NC values between them.From the data, it can be concluded that the NC values of the different images obtained using the feature vector selected with the above method are all less than 0.5, and their own NC values are 1.00.These results are consistent with human visual features.Therefore, we can take the sequence of coefficient symbols in the low-frequency part of the medical image transformed by DTCWT-DCT as its effective visual feature vector, and correlate the watermarks with it to design the multi-watermarking algorithm.

Watermarks Pretreatment
Before embedding the watermark, henon chaos must be applied, and a preprocessing operation is carried out to obtain the watermark of chaotic encryption.Figure 9 shows the steps of watermarks pretreatment.


Step 1: Choose the initial values 0 1 2 , , x x x to create chaotic sequences ( ) n X j , and get binary encryption matrixes ( , ) n C i j via symbolic operations.Instead the values of ( ) n X j with '1' if they are bigger than the average, and instead with '0' if smaller.


Step 2: Obtain the encrypted watermarks ( ) , n BW i j by operating the binary watermarks ( ) and the binary encryption matrixes ( , ) n C i j through the hash function.

Watermarks Pretreatment
Before embedding the watermark, henon chaos must be applied, and a preprocessing operation is carried out to obtain the watermark of chaotic encryption.Figure 9 shows the steps of watermarks pretreatment.

•
Step 1: Choose the initial values x 0 , x 1 , x 2 to create chaotic sequences X n (j), and get binary encryption matrixes C n (i, j) via symbolic operations.Instead the values of X n (j) with '1' if they are bigger than the average, and instead with '0' if smaller.

•
Step 2: Obtain the encrypted watermarks BW n (i, j) by operating the binary watermarks W n (i, j) and the binary encryption matrixes C n (i, j) through the hash function.


Step 3: Extract the feature vector ( ) VF j using DTCWT-DCT transform on the original image ( , ) Oi i j , using the feature extraction method above.


Step 4: Generate binary henon sequences ( ) , n Key i j with the following operation: Figure 10 illustrates this process.


Step 5: Apply the same operation as step 3 to the tested image '( , ) O i i j to get a feature vector ( ) ' VF j .


Step 6: Extract the watermarks ( ) i j via the following operate: Figure 11 shows the extraction algorithm.

Watermarks Embedding
• Step 3: Extract the feature vector VF(j) using DTCWT-DCT transform on the original image Oi(i, j), using the feature extraction method above.

•
Step 4: Generate binary henon sequences Key n (i, j) with the following operation: Figure 10 illustrates this process.


Step 3: Extract the feature vector ( ) VF j using DTCWT-DCT transform on the original image ( , ) Oi i j , using the feature extraction method above.


Step 4: Generate binary henon sequences ( ) , n Key i j with the following operation: Figure 10 illustrates this process.


Step 5: Apply the same operation as step 3 to the tested image '( , ) O i i j to get a feature vector ( ) ' VF j .


Step 6: Extract the watermarks ( ) i j via the following operate: Figure 11 shows the extraction algorithm.

•
Step 5: Apply the same operation as step 3 to the tested image Oi (i, j) to get a feature vector VF (j).

•
Step 6: Extract the watermarks BW n (i, j) via the following operate: Figure 11 shows the extraction algorithm.

•
Step 7: The chaotic sequences X n (j) and binary encryption matrixes C n (i, j) are obtained according to the method of step 1.

•
Step 8: Restore the extracted watermarks W n (i, j) through the following operation (as shown in Figure 12).
Then, the ownership of the image to be tested and the patient's personal information were determined according to the correlation degree of W n (i, j) and W n (i, j).


Step 7: The chaotic sequences ( ) n X j and binary encryption matrixes ( ) , n C i j are obtained according to the method of step 1.


Step 8: Restore the extracted watermarks '( , ) n W i j through the following operation (as shown in Figure 12).

( ) ( ) ( )
' , , ' , Then, the ownership of the image to be tested and the patient's personal information were determined according to the correlation degree of ( )

Experiment and Analysis
In the experiment, we used Matlab 2016a as the test platform, and took the randomly selected medical image 'brain' of Figure 8 as the original image, which is the tenth slice of a medical volume data.We also used three meaningful images as the original watermarks.Three groups of different initial values of henon chaos were selected to verify the robustness of the proposed algorithm and its ability to resist conventional and geometric attacks.Figure 13 shows the encrypted watermarks effect and the watermarked brain image.We observed that the brain image remained the same before and after embedding the watermark.It used the image feature vector associated with the watermarks to conduct the watermark embedding and extraction without any modifications to the original image, which strictly guaranteed the requirement of ROI sensitivity for medical images.However, the encrypted watermarks changed greatly, and could hardly be identified with the naked

Experiment and Analysis
In the experiment, we used Matlab 2016a as the test platform, and took the randomly selected medical image 'brain' of Figure 8 as the original image, which is the tenth slice of a medical volume data.We also used three meaningful images as the original watermarks.Three groups of different initial values of henon chaos were selected to verify the robustness of the proposed algorithm and its ability to resist conventional and geometric attacks.Figure 13 shows the encrypted watermarks effect and the watermarked brain image.We observed that the brain image remained the same before and after embedding the watermark.It used the image feature vector associated with the watermarks to conduct the watermark embedding and extraction without any modifications to the original image, which strictly guaranteed the requirement of ROI sensitivity for medical images.However, the encrypted watermarks changed greatly, and could hardly be identified with the naked eye, which improves security.Figure 14 shows the extracted watermarks.They can be extracted precisely without any attacks, and the NC values are all 1.00.The watermarked images under various attacks are discussed in detail below.For the convenience of illustration, although we used all the images in Figure 8 throughout the experiment, we only used the 'brain' image to illustrate the test results of the proposed algorithm.
eye, which improves security.Figure 14 shows the extracted watermarks.They can be extracted precisely without any attacks, and the NC values are all 1.00.The watermarked images under various attacks are discussed in detail below.For the convenience of illustration, although we used all the images in Figure 8 throughout the experiment, we only used the 'brain' image to illustrate the test results of the proposed algorithm.

Gaussian Noise Attacks
We add different degrees of noise to the watermarked image, as shown in Figure 15 and Table 3.When the intensity is below 15%, the average NC value of the extracted watermarks is 0.92.Even if the noise intensity is as high as 25% and the image is severely distorted, the average NC value of the watermarks extracted can also reach 0.85.eye, which improves security.Figure 14 shows the extracted watermarks.They can be extracted precisely without any attacks, and the NC values are all 1.00.The watermarked images under various attacks are discussed in detail below.For the convenience of illustration, although we used all the images in Figure 8 throughout the experiment, we only used the 'brain' image to illustrate the test results of the proposed algorithm.

Gaussian Noise Attacks
We add different degrees of noise to the watermarked image, as shown in Figure 15 and Table 3.When the intensity is below 15%, the average NC value of the extracted watermarks is 0.92.Even if the noise intensity is as high as 25% and the image is severely distorted, the average NC value of the watermarks extracted can also reach 0.85.

Gaussian Noise Attacks
We add different degrees of noise to the watermarked image, as shown in Figure 15 and Table 3.When the intensity is below 15%, the average NC value of the extracted watermarks is 0.92.Even if the noise intensity is as high as 25% and the image is severely distorted, the average NC value of the watermarks extracted can also reach 0.85.eye, which improves security.Figure 14 shows the extracted watermarks.They can be extracted precisely without any attacks, and the NC values are all 1.00.The watermarked images under various attacks are discussed in detail below.For the convenience of illustration, although we used all the images in Figure 8 throughout the experiment, we only used the 'brain' image to illustrate the test results of the proposed algorithm.

Gaussian Noise Attacks
We add different degrees of noise to the watermarked image, as shown in Figure 15 and Table 3.When the intensity is below 15%, the average NC value of the extracted watermarks is 0.92.Even if the noise intensity is as high as 25% and the image is severely distorted, the average NC value of the watermarks extracted can also reach 0.85.For medical images, compression mainly shows three indicators: first, the compression ratio should be large and the compression efficiency should be high; second, the calculation speed should be fast; third, the reliability of medical image must be ensured.As the currently international compression standard, JPEG compression is widely used in watermarking [1,2,[7][8][9].In the watermarking field, many scholars used JPEG attacks [8][9][10]13,14,18,19,21,22].High-intensity JPEG compression may be applied to watermarking images.As shown in Figure 16 and Table 4, the NC value remains at 1.00 when compressed to 40% of the original image.It had a strong patch effect when compressed to 4% of the original image, but the average NC was still as high as 0.78.For medical images, compression mainly shows three indicators: first, the compression ratio should be large and the compression efficiency should be high; second, the calculation speed should be fast; third, the reliability of medical image must be ensured.As the currently international compression standard, JPEG compression is widely used in watermarking [1,2,[7][8][9].In the watermarking field, many scholars used JPEG attacks [8][9][10]13,14,18,19,21,22].High-intensity JPEG compression may be applied to watermarking images.As shown in Figure 16 and Table 4, the NC value remains at 1.00 when compressed to 40% of the original image.It had a strong patch effect when compressed to 4% of the original image, but the average NC was still as high as 0.78.We applied median filtering attacks of [3,3], [5,5], [9,9] to our watermarked image 1, 10, and 20 times, as shown in Figure 17 and Table 5.With the increase of the intensity of the attack, the PSNR values gradually decreased, and the image was blurred and became indistinguishable.However, the median filter was 9 × 9, and after 20 repetitions, and the NC value remained above 0.68.

Median Filter Attacks
We applied median filtering attacks of [3,3], [5,5], [9,9] to our watermarked image 1, 10, and 20 times, as shown in Figure 17 and Table 5.With the increase of the intensity of the attack, the PSNR values gradually decreased, and the image was blurred and became indistinguishable.However, the median filter was 9 x 9, and after 20 repetitions, and the NC value remained above 0.68.Median Filter The watermarked image is rotated by 5 degrees each time.It can be seen from Figure 18 and Table 6 that the average NC value of extracted watermarks was very high.When rotating 45 degrees, it can still reach 0.64.Table 5.Data of Median Filter attacks.
Median Filter

Rotation Attacks
The watermarked image is rotated by 5 degrees each time.It can be seen from Figure 18 and Table 6 that the average NC value of extracted watermarks was very high.When rotating 45 degrees, it can still reach 0.64.Scale attacks were executed on the watermarked image with different scale factors.When the scaling factor was 0.5 and above 2.0, the NC value of the extracted watermarks were all 1.00.In the remaining cases, the NC values remained at 0.92.Even if the scaling factor was as low as 0.2, average NC values could still reach 0.64.Table 7 and Figure 19 show these data and part of the attack images.Scale attacks were executed on the watermarked image with different scale factors.When the scaling factor was 0.5 and above 2.0, the NC value of the extracted watermarks were all 1.00.In the remaining cases, the NC values remained at 0.92.Even if the scaling factor was as low as 0.2, average NC values could still reach 0.64.Table 7 and Figure 19 show these data and part of the attack images.The watermarked image is moved down and left.When moved down by 22%, where the lower half of the image is lost, the extracted watermarks are still legible, and average NC values are still as high as 0.60.The average left-moving NC was 0.84.When moving left by 11%, the NC value was

Translation Attacks
The watermarked image is moved down and left.When moved down by 22%, where the lower half of the image is lost, the extracted watermarks are still legible, and average NC values are still as high as 0.60.The average left-moving NC was 0.84.When moving left by 11%, the NC value was 0.69. Figure 20, Table 8, Figure 21 and Table 9 respectively show some test images and data moving down and left.0.69. Figure 20, Table 8, Figure 21 and Table 9 respectively show some test images and data moving down and left.20, Table 8, Figure 21 and Table 9 respectively show some test images and data moving down and left.In order to verify the robustness of the watermarked image to cropping attacks, we designed an operation for y-coordinate extraction, gradually increasing its movement from 2 percent to 37 percent.According to the data in Figure 22 and Table 10, when the image is cropped from 2% to 23%, its NC value is basically 1.00.When the image is cropped by about two-fifths, the average NC value of the extracted watermarks can still reach 0.59.The extracted watermarks can be identified by the naked eye.In order to verify the robustness of the watermarked image to cropping attacks, we designed an operation for y-coordinate extraction, gradually increasing its movement from 2 percent to 37 percent.According to the data in Figure 22 and Table 10, when the image is cropped from 2% to 23%, its NC value is basically 1.00.When the image is cropped by about two-fifths, the average NC value of the extracted watermarks can still reach 0.59.The extracted watermarks can be identified by the naked eye.

Algorithms Comparison
We compared the average NC values of the watermarks using our proposed algorithm under different attacks with Aditi Zear et al. [18], Rohit Thanki et al. [19], Xiaochen Yuan et al. [21] and Amit Kumar Singh et al. [22].It can be clearly seen from Figure 23 and Table 11 that under conventional attacks, the NC values of the proposed algorithm are significantly higher than the those of the other four algorithms.Figure 24 and Table 12 show the performance of the watermarks under geometric attacks.Observing these data, we can see that with the increase of the attack intensity, the NC values of all of them showed a downward trend.And under cropping attacks, left translation attacks and down translation attacks, our algorithm has obvious advantages over other algorithms in terms of NC values.Figure 24 illustrates that compared with the multi-watermarking scheme based on FDCuT-DCT proposed by Rohit Thanki et al. [19], the proposed algorithm performs slightly worse in rotation (clockwise) attacks.But their NC values are not much different and performance in other geometric attacks was significantly better than the latter.The watermark extraction effect under geometric attacks is generally better than that of Rohit Thanki et al. [19].When performing scaling attacks, as shown in the radar chart in Figure 24, Amit Kumar Singh et al.

Algorithms Comparison
We compared the average NC values of the watermarks using our proposed algorithm under different attacks with Aditi Zear et al. [18], Rohit Thanki et al. [19], Xiaochen Yuan et al. [21] and Amit Kumar Singh et al. [22].It can be clearly seen from Figure 23 and Table 11 that under conventional attacks, the NC values of the proposed algorithm are significantly higher than the those of the other four algorithms.Figure 24 and Table 12 show the performance of the watermarks under geometric attacks.Observing these data, we can see that with the increase of the attack intensity, the NC values of all of them showed a downward trend.And under cropping attacks, left translation attacks and down translation attacks, our algorithm has obvious advantages over other algorithms in terms of NC values.Figure 24 illustrates that compared with the multi-watermarking scheme based on FDCuT-DCT proposed by Rohit Thanki et al. [19], the proposed algorithm performs slightly worse in rotation (clockwise) attacks.But their NC values are not much different and performance in other geometric attacks was significantly better than the latter.The watermark extraction effect under geometric attacks is generally better than that of Rohit Thanki et al. [19].When performing scaling attacks, as shown in the radar chart in Figure 24, Amit Kumar Singh et al. [22] proposed the use of a spread spectrum multi-watermark in the wavelet transform domain.The NC values of this algorithm are basically equal to the NC values of our proposed algorithm under scaling attacks; they are only differ by 0.01.However, it is necessary to perform the spread spectrum operation on the wavelet transform, and the embedding of the watermark needs to select different transform layers according to different watermark types.Finally, multi-watermark embedding is achieved by the gain coefficient and the wavelet decomposition level.Compared with our algorithm, the operation of this algorithm is complex, and it does not perform as well as our algorithm in other geometric attacks.
operation on the wavelet transform, and the embedding of the watermark needs to select different transform layers according to different watermark types.Finally, multi-watermark embedding is achieved by the gain coefficient and the wavelet decomposition level.Compared with our algorithm, the operation of this algorithm is complex, and it does not perform as well as our algorithm in other geometric attacks.
Therefore, the algorithm presented in this paper is outstanding in all kinds of attack situations, especially so in solving the problem that existing algorithms cannot balance resistance to geometric attacks and robustness.It has strong resistance to geometric attacks and shows a good level of robustness.Therefore, the algorithm presented in this paper is outstanding in all kinds of attack situations, especially so in solving the problem that existing algorithms cannot balance resistance to geometric attacks and robustness.It has strong resistance to geometric attacks and shows a good level of robustness.

Figure 1 .
Figure 1.Category of watermarking algorithms for medical images.

Figure 1 .
Figure 1.Category of watermarking algorithms for medical images.

Figure 2 .
Figure 2. 2D discrete wavelet and 2D DT complex wavelet: (a) Two-dimensional discrete wavelet; (b) Two dimensional DT complex wavelet; (c) The ideal directional distribution of a two-dimensional complex wavelet.

Figure 2 .
Figure 2. 2D discrete wavelet and 2D DT complex wavelet: (a) Two-dimensional discrete wavelet; (b) Two dimensional DT complex wavelet; (c) The ideal directional distribution of a two-dimensional complex wavelet.

.
Under their control, the henon mapping system can be in a chaotic state, which a = 1.4,b = 0.3.Figures 4 and 5 show images of the non-attractive area and the two attractive domains displayed by the henon map under different parameters.In our proposed algorithm, we take the value of a as 1.399 and the value of b as 0.314.(a) (b)

Figure 4 .
Figure 4.The non-attractive region, color indicates the number of times the iteration has escaped.Figure 4. The non-attractive region, color indicates the number of times the iteration has escaped.

Figure 4 .
Figure 4.The non-attractive region, color indicates the number of times the iteration has escaped.Figure 4. The non-attractive region, color indicates the number of times the iteration has escaped.

Figure 4 .
Figure 4.The non-attractive region, color indicates the number of times the iteration has escaped.

Figure 5 .
Figure 5. Two domain of attraction.

Figure 5 .
Figure 5. Two domain of attraction.

Figure 6 .
Figure 6.The process of the proposed algorithm.

Figure 6 .
Figure 6.The process of the proposed algorithm.

Figure 15 .
Figure 15.Under Gaussian noise attacks: (a) Gaussian noise level of 1%; (b) the extracted watermark 1 with a Gaussian noise level of 1%; (c) the extracted watermark 2 with a Gaussian noise level of 1%; (d) the extracted watermark 3 with a Gaussian noise level of 1%; (e) Gaussian noise level of 25%; (f) the extracted watermark 1 with a Gaussian noise level of 25%; (g) watermark 2 with a Gaussian noise level of 25%; (h) watermark 3 with a Gaussian noise level of 25%.

Figure 15 .
Figure 15.Under Gaussian noise attacks: (a) Gaussian noise level of 1%; (b) the extracted watermark 1 with a Gaussian noise level of 1%; (c) the extracted watermark 2 with a Gaussian noise level of 1%; (d) the extracted watermark 3 with a Gaussian noise level of 1%; (e) Gaussian noise level of 25%; (f) the extracted watermark 1 with a Gaussian noise level of 25%; (g) watermark 2 with a Gaussian noise level of 25%; (h) watermark 3 with a Gaussian noise level of 25%.

Figure 16 .
Figure 16.Under JPEG attacks: (a) Compression quality set to 4%; (b) the extracted watermark 1 with compression quality set to 4%; (c) the extracted watermark 2 with compression quality set to 4%; (d) the extracted watermark 3 with compression quality set to 4%; (e) Compression quality set to 25%; (f) the extracted watermark 1 under compression quality set to 25%; (g) the extracted watermark 2 under compression quality set to 25%; (h) the extracted watermark 3 under compression quality set to 25%.

Figure 16 .
Figure 16.Under JPEG attacks: (a) Compression quality set to 4%; (b) the extracted watermark 1 with compression quality set to 4%; (c) the extracted watermark 2 with compression quality set to 4%; (d) the extracted watermark 3 with compression quality set to 4%; (e) Compression quality set to 25%; (f) the extracted watermark 1 under compression quality set to 25%; (g) the extracted watermark 2 under compression quality set to 25%; (h) the extracted watermark 3 under compression quality set to 25%.

Figure 20 .
Figure 20.Under down translation attacks: (a) Down distance 12%; (b) the extracted watermark 1 under down distance 12%; (c) the extracted watermark 2 under down distance 12%; (d) the extracted watermark 3 under a down distance of 12%; (e) Down distance 22%; (f) the extracted watermark 1 under a down distance of 22%; (g) the extracted watermark 2 under a down distance of 22%; (h) the extracted watermark 3 under a down distance of 22%.

Figure 21 .
Figure 21.Under left translation attacks: (a) Left distance 7%; (b) the extracted watermark 1 under left distance 7%; (c) the extracted watermark 2 under left distance 7%; (d) the extracted watermark 3 under a left distance of 7%; (e) Left distance 11%; (f) the extracted watermark 1 under a left distance of 11%; (g) the extracted watermark 2 under a left distance of 11%; (h) the extracted watermark 3 under a left distance of 11%.

Figure 20 .
Figure 20.Under down translation attacks: (a) Down distance 12%; (b) the extracted watermark 1 under down distance 12%; (c) the extracted watermark 2 under down distance 12%; (d) the extracted watermark 3 under a down distance of 12%; (e) Down distance 22%; (f) the extracted watermark 1 under a down distance of 22%; (g) the extracted watermark 2 under a down distance of 22%; (h) the extracted watermark 3 under a down distance of 22%.

Figure 20 .
Figure 20.Under down translation attacks: (a) Down distance 12%; (b) the extracted watermark 1 under down distance 12%; (c) the extracted watermark 2 under down distance 12%; (d) the extracted watermark 3 under a down distance of 12%; (e) Down distance 22%; (f) the extracted watermark 1 under a down distance of 22%; (g) the extracted watermark 2 under a down distance of 22%; (h) the extracted watermark 3 under a down distance of 22%.

Figure 21 .
Figure 21.Under left translation attacks: (a) Left distance 7%; (b) the extracted watermark 1 under left distance 7%; (c) the extracted watermark 2 under left distance 7%; (d) the extracted watermark 3 under a left distance of 7%; (e) Left distance 11%; (f) the extracted watermark 1 under a left distance of 11%; (g) the extracted watermark 2 under a left distance of 11%; (h) the extracted watermark 3 under a left distance of 11%.

Figure 21 .
Figure 21.Under left translation attacks: (a) Left distance 7%; (b) the extracted watermark 1 under left distance 7%; (c) the extracted watermark 2 under left distance 7%; (d) the extracted watermark 3 under a left distance of 7%; (e) Left distance 11%; (f) the extracted watermark 1 under a left distance of 11%; (g) the extracted watermark 2 under a left distance of 11%; (h) the extracted watermark 3 under a left distance of 11%.

Figure 23 .
Figure 23.Radar chart of different algorithms under conventional attacks.

Figure 23 .
Figure 23.Radar chart of different algorithms under conventional attacks.

Figure 24 .
Figure 24.Radar chart of different algorithms under geometric attacks.

Figure 24 .
Figure 24.Radar chart of different algorithms under geometric attacks.

Table 1 .
Changes of DTCWT-DCT coefficients under different attacks for the original image.

Table 2 .
Values of the correlation coefficients between different images (32 bit).

Table 2 .
Values of the correlation coefficients between different images (32 bit).

Table 3 .
Data of Gaussian noise attacks.

Table 3 .
Data of Gaussian noise attacks.

Table 4 .
Data of JPEG attacks.

Table 4 .
Data of JPEG attacks.

Table 5 .
Data of Median Filter attacks.

Table 6 .
Data of rotation attacks.

Table 6 .
Data of rotation attacks.

Table 6 .
Data of rotation attacks.

Table 7 .
Data of scaling attacks.

Table 7 .
Data of scaling attacks.

Table 8 .
Data of down translation attacks.

Table 9 .
Data of left translation attacks.

Table 8 .
Data of down translation attacks.

Table 8 .
Data of down translation attacks.

Table 9 .
Data of left translation attacks.

Table 9 .
Data of left translation attacks.

Table 10 .
Data of cropping attacks.

Table 10 .
Data of cropping attacks.

Table 11 .
Comparison values of different algorithms under conventional attacks.

Table 11 .
Comparison values of different algorithms under conventional attacks.

Table 12 .
Comparison values of different algorithms under geometric attacks.

Table 12 .
Comparison values of different algorithms under geometric attacks.