Forensics Characterization For physical devices

1
Forensics Characterization For physical devices

• Deng , Zhonghai

2
Part 1 Introduction

• 1 why we need the forensics method
• 2difference from watermarking
• 3 device signature

3
Objective

• For digital images
• Verify source camera
• Detect modification
• For Printer
• Identify a printer that was used to perform some
  illicit activity
• For RF device cell phone
• The radiation re-emitted

4
Framework
5
Part 2Characterization of digital cameras

• Problems to solve
• original image by a digital camera? Or a
  computer-generated image?
• Was the image originate from camera X? at time Y?
  at location Z?
• Has the image been modified?
• Was this image manipulated to embed a secret
  message? Stego-image?

6
techniques summarized
7
subpart 2.1 imaging pipeline

• 1 original scene
• 2 lens
• 3 filter
• 4 demosaicing, color correction, gamma
  correction
• 5 captured image

8
subpart 2.2 sensor noise

• Noise by array defects
• Noise by dark current and photo response
  nonuniformity noise (PRNU)
• Sensor dust characteristics
• Fixed pattern noise (FPN)

9
subpart 2.3 Sensor-based characterization (first
approach)

• Assumption pattern noise are different from
  camera to camera
• First way using the defective pixels, such as
  hot pixels and dead pixels.
• Improved way using sensor pattern noise
• Reference pattern noise
• Computer correlations or its variations

10
subpart 2.4 Feature vectors

• Using a set of contend independent features
  extracted from images
• Features from space domain
• Features from wavelet domain
• Features from their neighborhood
• Features from physical-motivated features
• Features from other frequency domain?

11
subpart 2.4 Color filter analysis (CFA)

• Camera using a single sensor in conjunction with
  a a color filter array
• One useful observation both the size of the
  interpolation kernel and the demosaicing
  algorithm vary from camera to camera
• Two major method
• Feature vector (assume it as nonlinear process )
• Nonlinear model for periodic correlation

12
Part 3 Forensics for printers
13
Why its important

• Printed materials is a direct accessory to many
  criminals and terrorist acts.

14
Method 1 Test pages with midtone gray level
patches

• Assumption different printers have different
  sets of banding frequencies that are dependent
  upon band and model
• To estimate the banding frequencies from the
  text, we need test pages with midtone gray level
  patches created using a particular pattern page
  containing all the band patterns.

15
Method 2 Intrinsic signatures

• Given a printed text, we could find the pattern
  vector for each character, like e.
• Someone use the SVM to do the classification.Since
  a majority vote is used to get the resulting
  classification from the SVM classifier.

16
Part 4 Forensics for RF devices

• RF Radio frequency
• Main problem by using the probe signal, reduce
  the problem into determining the properties of RF
  circuit by sending it a designed probe and
  examining the re-emitted RF signal from the
  device
• Method using the feature vector

17
two steps

• 1Probe signal
• using the two-toned signal to send to the device
  and receive the re-emitted signal.
• 2 Analyzing
• analyze their frequency and amplitude to do some
  process.

18
Features extraction

• In this papers experiments, four amplitude
  features are extracted from the signal and then
  do the classification using six different
  classification systems, as mentioned in the above
  graph.

19
Conclusion

• Forensics for devices is important in many
  situations today and will more important
  tomorrow.
• So, it is worthwhile to pay more attention to it.

20
Thanks!