PANKAJ MALVIYA RUCHIRA NASKAR Digital Forensic Technique for Double Compression based JPEG Forgery Detection PANKAJ MALVIYA RUCHIRA NASKAR Department of Computer Science and Engineering National Institute of Technology, Rourkela 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security Outline Introduction Digital Forensics JPEG Forgery Our Objectives Proposed Multi-compression based JPEG Forgery Detection Technique Introduction to JPEG Ghosts Proposed Algorithm Results Conclusion Future Work References 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security DIGITAL FORENSICS Digital forensics (sometimes known as digital forensic science) is a branch of forensic science encompassing the recovery and investigation of material found in digital devices, often in relation to computer crime. Digital Forensics is a branch of science and technology which deals with the detection of the cyber-crime and forgery by investigation of digital evidences. Pertains to legal evidence found in computers and digital storage media. The goal of computer forensics is to investigate digital media with the aim of identifying, preserving, recovering, analysing and presenting facts and opinions about the digital information Why DF? In present cyber world images and videos are the major sources of information exchange. The authenticity of digital images and videos is extremely crucial in the legal industry, media world and broad-cast industry. The present day easy availability of low-cost image processing software tools, having immense number of multimedia manipulating features, pose threat to the fidelity of digital multimedia data. 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security Digital Image Forgery Foreground is adjusted to background (by cutting, cropping, replacing etc…) Here, the background of the image is doubly compressed while the foreground (cat) is single compressed which destroys the original artifacts(JPEG) of image. Digital images can now be easily created, altered, and manipulated with no obvious traces of having been subjected to any of these operations. Common image processing operations such as cropping, splicing, blurring etc., made widely available by such software tools, compel us to question the trustworthiness of the digital images and videos. 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security Motivation of our Work While performing digital image forgery, it is a usual practice to combine multiple images (some region/regions of the one image is replaced with the other) for example, when compositing one person’s head onto another person’s body. If both of these images were originally of different JPEG compression quality, then the digital composite may contain a trace of the original compression qualities. If both the images are of different compression ratio (i.e., the one which is to be manipulated by using the other), what happens then?? 10th International Conference on Information Systems Security December 2014

Proposed Multi-compression based JPEG Forgery Detection In a JPEG image, whenever any kind of editing is carried out and it is written back to memory, the image undergoes re-compression We exploit this feature to detect any illegal modification or tampering in JPEG images We propose a forensic technique to identify JPEG forgeries with multiple degrees of compression within the same image The degree of compression varying from region to region 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security PROPOSED ALGORITHM 10th International Conference on Information Systems Security December 2014

PROPOSED ALGORITHM (Contd…) For forgery detection, we plot the vector of absolute differences (D2) against pixel positions (P). We investigate the variation of the elements of D2 over the entire 512×512 image matrix, from the D2 vs. P plot. Our key observation in our work is that, for forged JPEG images, for certain values of q’ belonging to [40, 90], the D2 vs. P plot demonstrates a sudden rise, which remains persistent over a range of P, corresponding to the area or region of image tampering. 10th International Conference on Information Systems Security December 2014

(Manually) Tampered Lena Image RESULTS (Manually) Tampered Lena Image (a) Original 512×512 image (b) Central 200×200 portion, re-saved at a different degree of compression (c) Forged image having its central portion modified 10th International Conference on Information Systems Security December 2014

IMAGE SQUARED-ERROR MATRICES RECOMPRESSED AT DIFFERENT FACTORS Squared-error matrices for test image Lena, at varying degrees of re-compression q’. Here, the optimal squared-error matrix, in which the modified image regions are most clear, is generated by q’ = 70. 10th International Conference on Information Systems Security December 2014

Absolute Squared-Error Pixel-Pair Difference Vector vs Position Vector D2 vs P Absolute Squared-Error Pixel-Pair Difference Vector vs Position Vector 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security INFERENCES The D2 vs. P shows a sudden rise in the plot, which is persistent for the range of pixels having undergone double-compression due to modification This feature of JPEG images, provides an evidence of JPEG image forgery, involving double-compression. Authentic JPEG images having no sub-part manipulated (hence doubly-compressed), demonstrate neither such a sudden rise of D2 values nor its persistence This is evident from the D2 vs. P characteristics of the authentic or original JPEG image 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security OTHER TEST IMAGES Lena Mandrill Barbara Goldhill Plane Sailboat 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security D2 vs P Plots 10th International Conference on Information Systems Security December 2014

PLOTS FOR ORIGINAL IMAGES 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security CONCLUSION In this work, we present a digital forensic technique for detection of JPEG image forgery. The proposed technique exploits the feature of double-compression, inherent in forged JPEG images. The proposed technique enables forgery detection as well as localization. The proposed technique is a blind one. 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security FUTURE WORK Automation of quality factor determination is a major future direction for this research. Reconstruction of forged JPEG regions will also be investigated in the future. 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security REFERENCES H. Farid, “Exposing digital forgeries from JPEG ghosts,” IEEE Transactions on Information Forensics and Security, vol. 4, no. 1, pp. 154–160, Mar. 2009. H. Farid, “A Survey of image forgery detection”, IEEE Signal Processing Magazine, vol. 26, no. 2, pp. 16-25, 2009. H.T. Sencar and N. Memon, (eds.), "Digital Image Forensics: There is More to a Picture than Meets the Eye", New York, NY, USA: Springer, 2013. G. Wallace, “The JPEG still picture compression standard", IEEE Transactions on Consumer Electronics, vol. 34, no. 4, pp. 30-44, 1991. D. Lowe, “Distinctive image features from scale-invariant key-points", International Journal of Computer Vision, vol. 60, no. 2, pp. 91-110, 2004. A. Srivastava, A.B. Lee, E.P. Simoncelli and S.C. Zhu, “On advances in statistical modeling of natural images", Journal of Mathematical Imaging, vol. 18, no. 1, pp.17-33, 2003. J. Redi, W. Taktak, and J.L. Dugelay, “Digital Image Forensics: A Booklet for Beginners", Multimedia Tools and Applications, vol. 51, no. 1, pp. 133 162, Jan. 2011. 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security REFERENCES J. Wu, M.V. Kamath, S. Poehlman, "Detecting dierences between photographs and computer generated images", Proceedings of the 24th IASTED International conference on Signal Processing, Pattern Recognition, and Applications, pp 268273,2006. B.S. Manjunath, J.R. Ohm, V.V. Vasudevan, and A. Yamada, "Color and Texture Descriptors", IEEE Trans. Circuits and Systems for Video Technology, vol. 11, no. 6, pp. 703-715, Jun. 2001. J.F. Lalonde and A.A. Efros, "Using color compatibility for assessing image realism", Proceedings of the International Conference on Computer Vision, 2007. N. Wang and W. Doube “How real is really a perceptually motivated system for quantifying visual realism in digital images", Proceedings of the IEEE International Conference on Multimedia and Signal processing, pp. 141-149, 2011. T.T. Ng and S.F. Chang, "Classifying photographic and photorealistic computer graphic images using natural image statistics", Technical report, ADVENT Technical Report, Columbia University, 2004. A.J. Fridrich , B.D. Soukal , A.J. Luk, "Detection of copy-move forgery in digital images", Proceedings of Digital Forensic Research Workshop, 2003. 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security REFERENCES H. Huang, W. Guo and Y. Zhang, “Detection of copy-move forgery in digital images using SIFT algorithm", IEEE Pacic-Asia Workshop on Computational Intelligence and Industrial Application, 2008. F. Zach, C. Riess and E. Angelopoulou, “Automated Image Forgery Detection through Classication of JPEG Ghosts", Proceedings of the German Association for Pattern Recognition (DAGM 2012), pp. 185-194, Aug. 2012. A.C. Popescu and H. Farid, “Exposing digital forgeries by detecting traces of re-sampling", IEEE Transactions on Signal Processing, vol. 53, no. 2, pp. 758-767, 2005. X. Pan and S. Lyu, “Detecting image duplication using SIFT features", Proceedings of IEEE ICASSP, 2010. 10th International Conference on Information Systems Security December 2014

10th International Conference on Information Systems Security THANK YOU 10th International Conference on Information Systems Security December 2014