Statistical Tools forDigital Forensics

Multimedia Security

Henry Chang-Yu Lee

• One of the world’s foremost forensicscientists.

• Chief Emeritus for Scientific Servicesfor the State of Connecticut.

• Full professor of forensic science at the University of New Haven, where he has helped to set up the Henry C. Lee Forensic Institute.

Forensics

• Forensic science, the application of a broad spectrum of sciences to answer questions of interest to the legal system.

• Criminal investigations.• Other forensics disciplines:

– Forensic accounting.– Forensic economics.– Forensic engineering.– Forensic linguistics.– Forensic toxicology.– …

Digital Forensics

• Application of the scientific method to digital media in order to establish factual information for judicial review.

• What is digital forensics associate with DRM?– Authorized images have been tampered.– How to declare the image is neither authentic, nor authorized.

Image Tampering

• Tampering with images is neither new, nor recent.• Tampering of film photographs:

– Airbrushing.– Re-touching.– Dodging and burning.– Contrast and color adjustment.– …

• Outside the reach of the average user.

Image Tampering

• Digital Tampering:– Compositing.– Morphing.– Re-touching.– Enhancing.– Computer graphics.– Painted.

Image Tampering

• Tampering is not a well defined notion, and is often application dependent.

• Image manipulations may be legitimate in some cases, ex. use a composite image for a magazine cover.

• But illegitimate in others, ex. evidence in a court of law.

Watermarking-Based Forensics

• Digital watermarking has been proposed as a means by which a content can be authenticated.

• Exact authentication schemes:– Change even a single bit is unacceptable.– Fragile watermarks.

• Watermarks will be undetectable when the content is changed in any way.

– Embedded signatures.• Embed at the time of recording an authentication signature in

the content.– Erasable watermarks.

• aka invertible watermarks, are employed in applications that do not tolerate the slight content changes.

Watermarking-Based Forensics

• Selective authentication schemes:– Verify if a content has been modified by any illegitimate

distortions.– Semi-fragile watermarks.

• Watermark will survive only under legitimate distortion.– Tell-tale watermarks.

• Robust watermarks that survive tampering, but are distorted in the process.

• The major drawback is that a watermark must be inserted at the time of recording, which would limit this approach to specially equipped digital cameras.

Statistical Techniques for Detecting Traces

• Assumption:– Digital forgeries may be visually imperceptible, nevertheless,

they may alter the underlying statistics of an image.

• Techniques:– Copy-move forgery.– Duplicated image regions.– Re-sampled images.– Inconsistencies in lighting.– Chromatic Aberration.– Inconsistent sensor pattern noise.– Color filter array interpolation.– …

Detecting Inconsistencies in Lighting

•

•

• L: direction of the light source.• A: constant ambient light term.

Detecting InconsistentSensor Pattern Noise

• • • • p: series of images.• F: denoising filter.• n: noise residuals.

• Pc: camera reference pattern.

kkk pFpn pk

c NnP

Detecting InconsistentSensor Pattern Noise

• Calculate for regions Qk of the same size and shape coming from other cameras or different locations.

• • Decide R was tampered if p > th = 10-3 and not tapere

d otherwise.

RPQn ck ,

R

Detecting Color Filter Array Interpolation

• Most digital cameras have the CFA algorithm, by each pixel only detecting one color.

• Detecting image forgeries by determining the CFA matrix and calculating the correlation.

Reference

• H. Farid, “Exposing Digital Forgeries in Scientific Images,”in ACM MMSec, 2006

• J. Fridrich, D. Soukal, J. Lukas,“Detection of Copy-Move Forgery in Digital Images,”in Proceedings of Digital Forensic Research Workshop, Aug. 2003

• A. C. Popescu, H. Farid,“Exposing Digital Forgeries by Detecting Duplicated Image Regions,”in Technical Report, 2004

• A. C. Popescu, H. Farid,“Exposing Digital Forgeries by Detecting Traces of Resampling,” in IEEE TSP, vol.53, no.2, Feb. 2005

Reference

• M. K. Johnson, H. Farid,“Exposing Digital Forgeries by Detecting Inconsistencies in Lighting,”in ACM MMSec, 2005

• M. K. Johnson, H. Farid,“Exposing Digital Forgeries Through Chromatic Aberration,”in ACM MMSec, 2006

• J. Lukas, J. Fridrich, M. Goljan,“Detecting Digital Image Forgeries Using Sensor Pattern Noise,”in SPIE, Feb. 2006

• A. C. Popescu, H. Farid,“Exposing Digital Forgeries in Color Filter Array Interpolated Images,”in IEEE TSP, vol.53, no.10, Oct. 2005

Discussion

• The problem of detecting digital forgeries is a complex one with no universally applicable solution.

• Reliable forgery detection should be approached from multiple directions.

• Forensics is done in a fashion that adheres to the standards of evidence admissible in a court of law.

• Thus, digital forensics must be techno-legal in nature rather than purely technical or purely legal.

Exposing Digital Forgeries inScientific Images

Hany Farid,ACM Proceedings of the 8th Workshop on Multimedia and Security, Sep. 2006

Outline

• Introduction• Image Manipulation• Image Segmentation• Automatic Detection• Discussion

Introduction

• 南韓黃禹錫幹細胞研究造假– 2005/06/17 黃禹錫宣布成功的建立 11 個病人

身上體細胞所衍生的幹細胞株，論文並於國際知名的《科學》期刊發表。

– 2005/11/11 共同作者夏騰指控黃禹錫對他隱瞞卵子取得來源的事實，並認為其與黃禹錫所發表的論文數據有瑕疵。

– 2005/11/21 南韓首爾國立大學應黃禹錫自己要求也展開調查其實驗結果。

Introduction

• 南韓黃禹錫幹細胞研究造假– 2005/12/23 初步報告顯示，黃禹錫在 2005 年

發表在《科學》期刊的論文，數據絕大部份都是子虛烏有：由 11 個病人身上體細胞所衍生的幹細胞株，實際存在的只有兩個，這項結果也顯示黃禹錫的人為疏失並不是無意造成地，而是刻意欺騙。

– 2005/12/29 調查委員會再公佈所謂的實際存在的兩個病人幹細胞株其 DNA 也不符合原來的體細胞。

– 2006/1/13 《科學》期刊正式宣佈撤回黃禹錫在 2005 年和 2004 年的兩篇論文。

Outline

• Introduction• Image Manipulation• Image Segmentation• Automatic Detection• Discussion

Image Manipulation

• Action of each manipulation scheme:– Deletion, (a).

• A band was erased.– Healing, (b).

• Several bands were removing using Photoshop’s “healing brush.”

– Duplication, (c).• A band was copied and pasted

into a new location.

Image Manipulation

• Effect of each manipulation scheme:– Deletion.

• Remove small amounts of noise that are present through the dark background of the image.

– Healing.• Disturb the underlying spatial frequency (texture).

– Duplication.• Leave behind an obvious statistical pattern – two regions in

the image are identical.

• Formulate the problem of detecting each of these statistical patterns as an image segmentation problem.

Outline

• Introduction• Image Manipulation• Image Segmentation• Automatic Detection• Discussion

Image Segmentation:Graph Cut

• Consider a weighted graph G = (V, E).• A graph can be partitioned into A and B such that A ∩

B = φ and A B = V.∪•

• To remove the bias which is anatural tendency to cut a smallnumber of low-cost edges:

• •

Image Segmentation:Graph Cut

• Define W a n×n matrix such that Wi,j = w (i, j) is the weight between vertices i and j.

• Define D a n×n diagonal matrix whose ith element on the diagonal is .

• Solve the eigenvector problem with the secondsmallest eigenvalue λ.

• Let the sign of each component of define the membership of thevertex.

e

Image Segmentation: Intensity

• For deletion.

• • I ( ． ): gray value at a given pixel.

• Δi,j: Euclidean distance.

Image Segmentation: Intensity

• First Iteration:– Group into regions corresponding to the bands (gray pixels) and

the background.

• Second Iteration:– The background is grouped into two regions (black and white

pixels.)

Image Segmentation: Texture

• For healing.

•

• Ig ( ． ): the magnitude of the image gradient at a given pixel.

• • •

Image Segmentation: Texture

• s • d ( ． ): 1D deravative filte

r.– [0.0187 0.1253 0.1930 0.0 −0.

1930 −0.1253 −0.0187]

• p ( ． ): low-pass filter.– [0.0047 0.0693 0.2454 0.361

1 0.2454 0.0693 0.0047]

•

101

202

101

101

1

2

1

Image Segmentation: Texture

• First Iteration:– Using intensity-based segm

entation.– Group into regions correspo

nding to the bands (gray pixels) and the background.

• Second Iteration:– Using texture-based segmen

tation.– The background is grouped i

nto two regions (black and white pixels.)

Image Segmentation: Duplication

• For duplication.

• • • One iteration.

Outline

• Introduction• Image Manipulation• Image Segmentation• Automatic Detection• Discussion

Automatic Detection

• Denote the segmentation map as S (x, y).• Consider all pixels x, y with value S (x, y) = 0 such that

all 8 spatial neighbors also have value 0. The mean of all of the edge weights between such vertices is computed across the entire segmentation map.

• This process is repeated for all pixels x, y with value S (x, y) = 1.

• Values near 1 are indicative of tampering because of significant similarity in the underlying measures of intensity, texture, or duplication.

Automatic Detection

S0 = 0.19 S0 = 0.99 S0 = 0.30 S0 = 0.98 S0 = 0.50 S0 = 0.97

Outline

• Introduction• Image Manipulation• Image Segmentation• Automatic Detection• Discussion

Discussion

• These techniques are specifically designed for scientific images, and for common manipulations that may be applied to them.

• As usual, these techniques are vulnerable to a host of counter-measures that can hide traces of tampering.

• As continuing to develop new techniques, it will become increasingly difficult to evade all approaches.