Forensic Detection of Image Manipulation Using Statistical Intrinsic Fingerprints Fernando Barros Filipe Berti Gabriel Lopes Marcos Kobuchi

Forensic Detection of Image Manipulation Using Statistical Intrinsic

Fingerprints

Fernando BarrosFilipe Berti

Gabriel LopesMarcos Kobuchi

Seminar Series

MO447 - Digital Forensics

Prof. Dr. Anderson [email protected]

http://www.ic.unicamp.br/~rocha

mailto:[email protected]

http://www.ic.unicamp.br/~rocha

Outline

*2013 Seminar Series – Digital Forensics (MO447/MC919)

Outline‣ Introduction‣ System Model and Assumptions‣ Statistical Intrinsic Fingerprints of Pixel

Value Mappings‣ Detecting Contrast Enhancement‣ Detecting Additive Noise in Previously JPEG-

Compressed Images‣ Conclusion

Introduction


Nowadays...

‣ In recent years, digital images have become increasingly prevalent through society.


© Daily Stormers (www.dailystomers.com)

© R

aíz d

a V

ida (w

ww

.raizd

avid

a.co

m.b

r)

© http://topwalls.net/grand-canyon-united-states-2/

Real Pictures

© www.wallpea.com


© Fan Pop (www.fanpop.com)Digital Images

© johnnyslowhand.deviantart.com

© www.highqualitywallpapers.eu


Fake Pictures!

© www.epicfail.com

© www.hoax-slayer.com

©ig

ossip

.com

© fashmark.files.wordpress.com


© www.vidrado.com

Fake Pictures?

© Veja (http://veja.abril.com.br/)

© Telegraph (www.telegraph.co.uk)


Fake Pictures?© http://www.buzzfeed.com/tomphillips/22-viral-pictures-that-were-

actually-fake


Fake Pictures?

© http://10steps.sg/inspirations/photography/70-strange-photos-that-are-not-photoshopped/



Consequence

‣ At present, an image forger can easily alter a digital image in a visually realistic manner.

‣ As a result, the field of digital image forensics has been born.


State Of The Art

‣ Identification of images and image regions which have undergone some form of manipulation or alteration

‣ No universal method of detecting image forgeries exists

‣ Different techniques, with their own limitations


Some techniques

‣ Lighting Angle Inconsistencies

‣ Inconsistencies in chromatic aberration

‣ Absence of Color Filter Array (CFA) interpolation induced correlations

‣ Classifier based approaches


Fingerprints

‣ Most image altering operation leave behind distinct, traceable “fingerprints” in the form of image alteration artifacts

‣ Because these fingerprints are often unique to each operation, an individual test to catch each type of image manipulation must be designed


Some works with fingerprints

‣ Resampling

‣ Double JPEG compression

‣ Gamma correction


This work‣ Pixel value mapping leaves behind statistical

artifacts which are visible in an image’s pixel value histogram

‣ By observing the common properties of the histogram of unaltered images, it’s possible to build a model of an unaltered image’s histogram


‣ A number of operations are in essence pixel value mapping, it’s proposed a set of image forgery detection techniques which operate by detecting the intrinsic fingerprint of each operation

This work

System Model and

Assumptions


Digital image‣ In this work, digital images created by using an

electronic imaging device to capture a real world scene

‣ Each pixel is assigned a value by measuring the light intensity reflected from a real world scene

‣ Inherent in this process is the addition of some zero mean sensor noise which arises due to several phenomena (shot noise, dark current, etc)


‣ For color images, it is often the case that the light passes through a CFA so that only one color component is measured at each pixel location in this fashion

‣ In that case, the color component not observed at each pixel are determined through interpolation

‣ At the end of this process the pixel values are quantized, then stored as the unaltered image

Color image


‣ h(l) can be generated by creating L equally spaced bins which span the range of possible pixel values

‣ Tabulate the number of pixels whose value falls within the range of each bin

‣ Gray levels values in P = {0, … , 255}, Color values in P³

‣ Pixel value histogram uses 256 bins

Histogram


Histograms‣ None of the histograms contains sudden zeros

or impulsive peaks

‣ Do not differ greatly from the histogram’s envelope

‣ To unify these properties, pixel value are described as interpolatably connected


Interpolatably connected‣ Any histogram value h(l) can be aproximated

by ĥ(l)

‣ Each value of ĥ has been calculated by removing a particular value from h then interpolating this value using a cubic spline

‣ Little difference from h and ĥ


Fig. 1. Left: Histogram of a typical image. Right: Approximation of the histogram at left by sequentially removing then interpolating the value of each histogram entry.


System Model‣ To justify this model, a database of 341

unaltered images captured using a variety of digital cameras

‣ Obtained each image’s pixel value histogram h and its approximated histogram ĥ

‣ The mean squared error between both along with the signal power of h to obtain an SNR~30.67dB

Statistical Intrinsic

Fingerprints of Pixel Value Mappings


Pixel Value Mapping

‣ A number of image processing operations can be specified entirely by a pixel value mapping

‣ Leave behind distinct, forensically significant artifacts, which we will refer as intrinsic fingerprint


Intrinsic Fingerprint

‣ Intrinsic Fingerprint

‣ Original: x; Tampered: y


Discrete Fourier Transform


Example: Histogram

Synthesized Image

Real World Image


Example: DFT

Synthesized Image

Real World Image


Example: Frequency Domain

Synthesized Image

Real World Image


Example: Frequency Domain

Synthesized Image

Real World Image


‣ When examining a potentially altered image, if the histogram of unaltered pixel values is known, the tampering fingerprint can be obtained using

Intrinsic Fingerprints


‣ In most real scenarios, one has no a priori knowledge of an image’s pixel value histogram, thus the tampering fingerprint cannot be calculated

But...


‣ It’s possible to ascertain the presence of a tampering fingerprint by determining identifying features of a mapping’s intrinsic fingerprint

‣ Searching for their presence in the histogram of the image

However

Detecting Contrast

Enhancement


Overview

‣ Contrast Enhancement operations seek to increase the dynamic range of pixel values within images.


Detection of Globally Applied Contrast Enhancement‣ Usually nonlinear mappings

‣ Consider only monotonic pixel value mappings.

‣ Thereby, disconsidering simple reordering mappings.


Globally Applied Contrast

‣ Two significant mappings



‣ Euclidian norm increases!

‣ The energy of the DFT as well



‣ Therefore, all contrast enhancement mappings result in an increase in energy.

‣ This energy is related to the intrinsic fingerprint.


Globally Applied Contrast‣ Expected DFT’s to be strongly low-pass signal.

‣ Therefore, the presence of energy in the high frequency regions is indicative of contrast enhancement.

‣ Contrast enhancement will cause isolated peaks and gaps in the histogram.



Globally Applied Contrast‣ Saturation Case


http

://w

ww

.fun

nyju

nk.

com

/funn

y_p

ictu

res/

3306

291/

Ho

usto

n+w

e+

have

+a+

pro

ble

m/



‣ Solution


Globally Applied Contrast‣ Measuring the energy



‣ Defining the best c with 244 images e Np = 4

‣γ = 1.1



‣ Results



‣ Database of 341 unaltered images, taken in different resolutions and light conditions

‣ The green color layer created the grayscale images.

‣γ ranging from 0.5 to 2.0

‣ 4092 grayscale images





‣ Np = 4 e c = 112

‣ Pd of 99% at a Pfa approximately of 3% or less


Locally Applied Contrast

‣ Defined as applying a contrast mapping to a set of contiguous pixels within an image.

‣ Can identify cut-and-paste forgeries.



‣ To detect it, the image is divided in smaller blocks and the global technique is applied to the blocks.

‣ Who small(and big!?) are these blocks?



‣ Test the 341 unaltered images and use γ ranging from 0.5 to 0.9.

‣ Blocks of size 200x200, 100x100, 50x50, 25x25, and 20x20




‣ The contrast enhancement can be reliably detected using testing blocks sized 100x100 pixels with a Pd of at least 80% in every case at a Pfa of 5%.

‣ When γ ranged from 1.0 to 2.0, the Pd was of 95% at a Pfa of 5%



‣ In order to test the copy-and-paste, Photoshop was used to create the image (c).



‣ The image was divided in 100x100 pixel blocks and tested local contrast enhancement on the red(d), green(e) and blue(f) color layers.



‣ The image was divided in 50x50 pixel blocks and tested local contrast enhancement on the 3 the color layers.



‣ Applying a detection criteria.


Histogram Equalization

‣ Histogram equalization effectively increases the dynamic range of an image’s pixel values by subjecting them to a mapping such that the distribution of output pixel values is approximately uniform.



‣ In order to identify it, we calculate the “uniformity” of the histogram.

‣ The process will introduce zeros into an image’s pixel value histogram, so mean absolute differences and mean square differences won’t work.


[2]

http

://w

ww

.fun

nyju

nk.

com

/funn

y_p

ictu

res/

3306

291/

Ho

usto

n+w

e+

have

+a+

pro

ble

m/



‣ For histogram equalized saturated images, the location of the impulsive component is often shifted.

‣ Suppose that the number of pixels in the lowest bin is greater than 2N/255.



‣ If the lowest l such that h(l) > 0 is greater or equal to 1 and h(l) > 2N/255, the image is identified as saturated.



‣ Test the 341 unaltered images and the 341 histogram equalized images.





‣ Analyze the frequency domain.

‣α(k) is a weighting function used to deemphasize the

high frequency regions in H(k)



‣ Best conditions using α1 (k) was with r1 = 0.5, obtaining Pd of 99% with a Pfa of 0.5% and a Pd of 100% with a Pfa of 3%.



‣ Test 2046 images.

‣ r2 = 4

‣ Pd of 100% with a Pfa of 1%.

Detecting Additive Noise in Previously

JPEG-Compressed

Images


Additive Noise‣ Additive noise can be used to mask previous

modifications to images.

‣ Previous techniques has dealt with detection of localized fluctuations of SNR in an image.

‣ Fail on detection of globally added noises.


Additive Noise‣ This technique applies a predefined mapping with a known fingerprint to a potentially altered image.

‣ If some noise was intentionally added, then an identifying feature of this fingerprint will be absent.

‣ We’ll be able to detect the presence of an additive noise if application of mapping does not introduce a fingerprint with this feature.


Scale and Round mapping‣ For additive noise detection it’ll be used scale

and round mapping:

‣ And the set


Scale and Round mapping‣ Cardinality of UC(v) is periodic in v with period

p.

‣ So, the intrinsic fingerprint of scale and round operation will contain a periodic component with period p.


Hypothesis Testing Scenario‣ JPEG compression/decompression schematics

© Compressed Examples by JISC Digital Media. All files © University of Bristol, 2009

http://soundcloud.com/jiscdigitalmedia/sets/compressed-examples

http://soundcloud.com/jiscdigitalmedia


Hypothesis Testing Scenario‣ So, if a monotonically increasing mapping is

applied to any color layer in the YCbCr color space, that mapping’s fingerprint will be introduced into the histogram of the color layer value.


Hypothesis Testing Scenario‣ Final stage of JPEG decompression: pixel

transformation from YCbCr to RGB, mathematically described by this equation:

‣ Values less than 0 is set to 0 and greater than 255 is set to 255.


Hypothesis Testing Scenario‣ Defining:

‣ Detection of additive noise can be formulated as an statistical hypothesis testing problem:


Hypothesis Testing Scenario‣ The fingerprint left by the mapping:

‣ helps to rewrite both hypothesis as:


Hypothesis Testing Scenario‣ Under hypothesis H0 , zi can be expressed as:

‣ The term round(cxi) dominates the behavior of zi and, so, the number of distinct xi values mapped to each zi value will occur in a fixed periodic pattern.


Hypothesis Testing Scenario‣ This will result in a periodic pattern discernible

in the histogram, which corresponds to the intrinsic scale and round mapping.


Hypothesis Testing Scenario‣ Under hypothesis H1 , zi has a different

behavior:


Hypothesis Testing Scenario‣ This hypothesis leads to 3 additional terms

containing scale and round mapping, each with their own scaling constant.

‣ If this constants and the original scaling has no common period, no periodic pattern will be introduced into the histogram, as can be observed in the figures.


Hypothesis Testing Scenario


Additive Noise Detection Images‣ Detection of the addition of noise to a

previously JPEG-compressed images is the same as detection of the periodic fingerprint within the normalized histogram.

‣ This detection is well suited for frequency domain and produces peaks with arbitrary location.


Additive Noise Detection Images‣ Applying DFT in the normalized and pinched-off

histogram we obtain Gzi, it is possible to measure the strength of the peak introduced into it:


Additive Noise Detection Images

‣ Then it is used the following decision rule to determine presence of additive noise:


‣ 227 unaltered images from 4 different digital cameras from unique manufacturers.

‣ Diversity of JPEG-compressed images using camera’s settings.

‣ Set of altered images created by decompression and addition of unit variance Gaussian noise to each pixel value.

Additive Noise Detection Images - 1st performance test


‣ All altered saved with original images resulting in a DB of 554 images.

‣ Pd = 80% @ Pfa = 0,4% (if Pfa <= 6,5% Pd goes to nearly 99%).





‣ 244 JPEG-compressed images at different quality. ratios.

‣ Q=90, 70, 50 and 30.

‣ Again, unit variance Gaussian noise added.

Additive Noise Detection Images – 2nd performance test


‣ For images with Q >= 50.

‣ Pd = 99% @ Pfa = 3,7%.




Conclusions


Conclusions‣ Statistical Intrinsic Fingerprints of Pixel

Value Mappings.

‣ Detecting Contrast Enhancement

‣ Detecting Additive Noise in Previously JPEG-Compressed Images

References


References1. A. Swaminathan, M.Wu, and K. J. R. Liu, “Digital image forensics via intrinsic fingerprints,” IEEE

Trans. Inf. Forensics Security, vol. 3, no. 1, pp. 101–117, Mar. 2008.

2. http://www.jiscdigitalmedia.ac.uk/guide/file-formats-and-compression/

http://www.jiscdigitalmedia.ac.uk/guide/file-formats-and-compression/

Thank You!Obrigado!

Documents

Forensic Detection of Image Manipulation Using Statistical Intrinsic Fingerprints Fernando Barros Filipe Berti Gabriel Lopes Marcos Kobuchi