Statistical Tools for Digital ForensicsHenry Chang-Yu Lee
• Chief Emeritus for Scientific Services for the State of
Connecticut.
• Full professor of forensic science at the University of New
Haven, where he has helped to set up the Henry C. Lee Forensic
Institute.
Forensics
• Forensic science, the application of a broad spectrum of sciences
to answer questions of interest to the legal system.
• Criminal investigations. • Other forensics disciplines:
– Forensic accounting. – Forensic economics. – Forensic
engineering. – Forensic linguistics. – Forensic toxicology. –
…
Digital Forensics
• Application of the scientific method to digital media in order to
establish factual information for judicial review.
• What is digital forensics associate with DRM? – Authorized images
have been tampered. – How to declare the image is neither
authentic, nor authorized.
Image Tampering
• Tampering with images is neither new, nor recent. • Tampering of
film photographs:
– Airbrushing. – Re-touching. – Dodging and burning. – Contrast and
color adjustment. – …
• Outside the reach of the average user.
Image Tampering
Image Tampering
• Tampering is not a well defined notion, and is often application
dependent.
• Image manipulations may be legitimate in some cases, ex. use a
composite image for a magazine cover.
• But illegitimate in others, ex. evidence in a court of law.
Watermarking-Based Forensics
• Digital watermarking has been proposed as a means by which a
content can be authenticated.
• Exact authentication schemes: – Change even a single bit is
unacceptable. – Fragile watermarks.
• Watermarks will be undetectable when the content is changed in
any way.
– Embedded signatures. • Embed at the time of recording an
authentication signature in
the content. – Erasable watermarks.
• aka invertible watermarks, are employed in applications that do
not tolerate the slight content changes.
Watermarking-Based Forensics
• Selective authentication schemes: – Verify if a content has been
modified by any illegitimate
distortions. – Semi-fragile watermarks.
• Watermark will survive only under legitimate distortion. –
Tell-tale watermarks.
• Robust watermarks that survive tampering, but are distorted in
the process.
• The major drawback is that a watermark must be inserted at the
time of recording, which would limit this approach to specially
equipped digital cameras.
Statistical Techniques for Detecting Traces
• Assumption: – Digital forgeries may be visually imperceptible,
nevertheless,
they may alter the underlying statistics of an image.
• Techniques: – Copy-move forgery. – Duplicated image regions. –
Re-sampled images. – Inconsistencies in lighting. – Chromatic
Aberration. – Inconsistent sensor pattern noise. – Color filter
array interpolation. – …
Detecting Inconsistencies in Lighting
•
•
• L: direction of the light source. • A: constant ambient light
term.
Detecting Inconsistent Sensor Pattern Noise
• • • • p: series of images. • F: denoising filter. • n: noise
residuals. • Pc: camera reference pattern.
( ) ( ) ( )( )kkk pFpn −= ( )( ) p k
Detecting Inconsistent Sensor Pattern Noise
• Calculate for regions Qk of the same size and shape coming from
other cameras or different locations.
• • Decide R was tampered if p > th = 10-3 and not
tapered otherwise.
Detecting Color Filter Array Interpolation
• Most digital cameras have the CFA algorithm, by each pixel only
detecting one color.
• Detecting image forgeries by determining the CFA matrix and
calculating the correlation.
Reference • H. Farid,
“Exposing Digital Forgeries in Scientific Images,” in ACM MMSec,
2006
• J. Fridrich, D. Soukal, J. Lukas, “Detection of Copy-Move Forgery
in Digital Images,” in Proceedings of Digital Forensic Research
Workshop, Aug. 2003
• A. C. Popescu, H. Farid, “Exposing Digital Forgeries by Detecting
Duplicated Image Regions,” in Technical Report, 2004
• A. C. Popescu, H. Farid, “Exposing Digital Forgeries by Detecting
Traces of Resampling,” in IEEE TSP, vol.53, no.2, Feb. 2005
Reference • M. K. Johnson, H. Farid,
“Exposing Digital Forgeries by Detecting Inconsistencies in
Lighting,” in ACM MMSec, 2005
• M. K. Johnson, H. Farid, “Exposing Digital Forgeries Through
Chromatic Aberration,” in ACM MMSec, 2006
• J. Lukas, J. Fridrich, M. Goljan, “Detecting Digital Image
Forgeries Using Sensor Pattern Noise,” in SPIE, Feb. 2006
• A. C. Popescu, H. Farid, “Exposing Digital Forgeries in Color
Filter Array Interpolated Images,” in IEEE TSP, vol.53, no.10, Oct.
2005
Discussion
• The problem of detecting digital forgeries is a complex one with
no universally applicable solution.
• Reliable forgery detection should be approached from multiple
directions.
• Forensics is done in a fashion that adheres to the standards of
evidence admissible in a court of law.
• Thus, digital forensics must be techno-legal in nature rather
than purely technical or purely legal.
Exposing Digital Forgeries in Scientific Images
Hany Farid, ACM Proceedings of the 8th Workshop on Multimedia and
Security, Sep. 2006
Outline
Introduction
– 2005/11/21
– 2005/12/29 DNA
– 2006/1/13 20052004
Image Manipulation
• A band was erased. – Healing, (b).
• Several bands were removing using Photoshop’s “healing
brush.”
– Duplication, (c). • A band was copied and pasted
into a new location.
• Effect of each manipulation scheme: – Deletion.
• Remove small amounts of noise that are present through the dark
background of the image.
– Healing. • Disturb the underlying spatial frequency
(texture).
– Duplication. • Leave behind an obvious statistical pattern – two
regions in
the image are identical.
• Formulate the problem of detecting each of these statistical
patterns as an image segmentation problem.
Outline
Image Segmentation: Graph Cut
• Consider a weighted graph G = (V, E). • A graph can be
partitioned into A and B such that A ∩
B = φ and A ∪ B = V. •
• •
Image Segmentation: Graph Cut
• Define W a n×n matrix such that Wi,j = w (i, j) is the weight
between vertices i and j.
• Define D a n×n diagonal matrix whose ith element on the diagonal
is .
• Solve the eigenvector problem with the second
smallest eigenvalue λ. • Let the sign of each component of
define the membership of the vertex.
→
• • I (): gray value at a given pixel. • Δi,j: Euclidean
distance.
Image Segmentation: Intensity
• First Iteration: – Group into regions corresponding to the bands
(gray pixels) and
the background.
• Second Iteration: – The background is grouped into two regions
(black and white
pixels.)
• • •
– [0.0187 0.1253 0.1930 0.0 −0.1930 −0.1253 −0.0187]
• p (): low-pass filter. – [0.0047 0.0693 0.2454
0.3611 0.2454 0.0693 0.0047]
• Second Iteration: – Using texture-based
into two regions (black and white pixels.)
Image Segmentation: Duplication
Automatic Detection
• Denote the segmentation map as S (x, y). • Consider all pixels x,
y with value S (x, y) = 0 such that
all 8 spatial neighbors also have value 0. The mean of all of the
edge weights between such vertices is computed across the entire
segmentation map.
• This process is repeated for all pixels x, y with value S (x, y)
= 1.
• Values near 1 are indicative of tampering because of significant
similarity in the underlying measures of intensity, texture, or
duplication.
Automatic Detection
S0 = 0.19 S0 = 0.99 S0 = 0.30 S0 = 0.98 S0 = 0.50 S0 = 0.97
Outline
Discussion
• These techniques are specifically designed for scientific images,
and for common manipulations that may be applied to them.
• As usual, these techniques are vulnerable to a host of
counter-measures that can hide traces of tampering.
• As continuing to develop new techniques, it will become
increasingly difficult to evade all approaches.
Statistical Tools forDigital Forensics
Henry Chang-Yu Lee
Detecting Inconsistencies in Lighting
Reference
Reference
Discussion
Exposing Digital Forgeries inScientific Images Hany Farid,ACM
Proceedings of the 8th Workshop on Multimedia and Security,
Outline
Introduction
Introduction
Outline