Statistical Tools for Digital Forensics

1
Statistical Tools forDigital Forensics

• Multimedia Security

2
Henry Chang-Yu Lee

• One of the worlds foremost forensicscientists.
• Chief Emeritus for Scientific Servicesfor the
  State of Connecticut.
• Full professor of forensic science at the
  University of New Haven, where he has helped to
  set up the Henry C. Lee Forensic Institute.

3
Forensics

• Forensic science, the application of a broad
  spectrum of sciences to answer questions of
  interest to the legal system.
• Criminal investigations.
• Other forensics disciplines
• Forensic accounting.
• Forensic economics.
• Forensic engineering.
• Forensic linguistics.
• Forensic toxicology.

4
Digital Forensics

• Application of the scientific method to digital
  media in order to establish factual information
  for judicial review.
• What is digital forensics associate with DRM?
• Authorized images have been tampered.
• How to declare the image is neither authentic,
  nor authorized.

5
Image Tampering

• Tampering with images is neither new, nor recent.
• Tampering of film photographs
• Airbrushing.
• Re-touching.
• Dodging and burning.
• Contrast and color adjustment.
• Outside the reach of the average user.

6
Image Tampering

• Digital Tampering
• Compositing.
• Morphing.
• Re-touching.
• Enhancing.
• Computer graphics.
• Painted.

7
Image Tampering

• Tampering is not a well defined notion, and is
  often application dependent.
• Image manipulations may be legitimate in some
  cases, ex. use a composite image for a magazine
  cover.
• But illegitimate in others, ex. evidence in a
  court of law.

8
Watermarking-Based Forensics

• Digital watermarking has been proposed as a means
  by which a content can be authenticated.
• Exact authentication schemes
• Change even a single bit is unacceptable.
• Fragile watermarks.
• Watermarks will be undetectable when the content
  is changed in any way.
• Embedded signatures.
• Embed at the time of recording an authentication
  signature in the content.
• Erasable watermarks.
• aka invertible watermarks, are employed in
  applications that do not tolerate the slight
  content changes.

9
Watermarking-Based Forensics

• Selective authentication schemes
• Verify if a content has been modified by any
  illegitimate distortions.
• Semi-fragile watermarks.
• Watermark will survive only under legitimate
  distortion.
• Tell-tale watermarks.
• Robust watermarks that survive tampering, but are
  distorted in the process.
• The major drawback is that a watermark must be
  inserted at the time of recording, which would
  limit this approach to specially equipped digital
  cameras.

10
Statistical Techniques for Detecting Traces

• Assumption
• Digital forgeries may be visually imperceptible,
  nevertheless, they may alter the underlying
  statistics of an image.
• Techniques
• Copy-move forgery.
• Duplicated image regions.
• Re-sampled images.
• Inconsistencies in lighting.
• Chromatic Aberration.
• Inconsistent sensor pattern noise.
• Color filter array interpolation.

11
Detecting Inconsistencies in Lighting

• L direction of the light source.
• A constant ambient light term.

12
Detecting InconsistentSensor Pattern Noise

• p series of images.
• F denoising filter.
• n noise residuals.
• Pc camera reference pattern.

13
Detecting InconsistentSensor Pattern Noise

• Calculate for regions Qk of the
  same size and shape coming from other cameras or
  different locations.
• Decide R was tampered if p gt th 10-3 and not
  tapered otherwise.

R
14
Detecting Color Filter Array Interpolation

• Most digital cameras have the CFA algorithm, by
  each pixel only detecting one color.
• Detecting image forgeries by determining the CFA
  matrix and calculating the correlation.

15
Reference

• H. Farid, Exposing Digital Forgeries in
  Scientific Images,in ACM MMSec, 2006
• J. Fridrich, D. Soukal, J. Lukas,Detection of
  Copy-Move Forgery in Digital Images,in
  Proceedings of Digital Forensic Research
  Workshop, Aug. 2003
• A. C. Popescu, H. Farid,Exposing Digital
  Forgeries by Detecting Duplicated Image
  Regions,in Technical Report, 2004
• A. C. Popescu, H. Farid,Exposing Digital
  Forgeries by Detecting Traces of Resampling, in
  IEEE TSP, vol.53, no.2, Feb. 2005

16
Reference

• M. K. Johnson, H. Farid,Exposing Digital
  Forgeries by Detecting Inconsistencies in
  Lighting,in ACM MMSec, 2005
• M. K. Johnson, H. Farid,Exposing Digital
  Forgeries Through Chromatic Aberration,in ACM
  MMSec, 2006
• J. Lukas, J. Fridrich, M. Goljan,Detecting
  Digital Image Forgeries Using Sensor Pattern
  Noise,in SPIE, Feb. 2006
• A. C. Popescu, H. Farid,Exposing Digital
  Forgeries in Color Filter Array Interpolated
  Images,in IEEE TSP, vol.53, no.10, Oct. 2005

17
Discussion

• The problem of detecting digital forgeries is a
  complex one with no universally applicable
  solution.
• Reliable forgery detection should be approached
  from multiple directions.
• Forensics is done in a fashion that adheres to
  the standards of evidence admissible in a court
  of law.
• Thus, digital forensics must be techno-legal in
  nature rather than purely technical or purely
  legal.

18
Exposing Digital Forgeries inScientific Images
Hany Farid,ACM Proceedings of the 8th Workshop
on Multimedia and Security, Sep. 2006
19
Outline

• Introduction
• Image Manipulation
• Image Segmentation
• Automatic Detection
• Discussion

20
Introduction

• ????????????
• 2005/06/17 ??????????11????????????????,????????
  ????????
• 2005/11/11 ????????????????????????,????????????
  ????????
• 2005/11/21???????????????????????????

21
Introduction

• ????????????
• 2005/12/23 ??????,????2005???????????,????????
  ?????11????????????????,?????????,?????????????
  ??????????,???????
• 2005/12/29 ?????????????????????????DNA?????????
  ??
• 2006/1/13 ??????????????2005??2004???????

22
Outline

• Introduction
• Image Manipulation
• Image Segmentation
• Automatic Detection
• Discussion

23
Image Manipulation

• Action of each manipulation scheme
• Deletion, (a).
• A band was erased.
• Healing, (b).
• Several bands were removing using Photoshops
  healing brush.
• Duplication, (c).
• A band was copied and pasted into a new location.

24
Image Manipulation

• Effect of each manipulation scheme
• Deletion.
• Remove small amounts of noise that are present
  through the dark background of the image.
• Healing.
• Disturb the underlying spatial frequency
  (texture).
• Duplication.
• Leave behind an obvious statistical pattern two
  regions in the image are identical.
• Formulate the problem of detecting each of these
  statistical patterns as an image segmentation
  problem.

25
Outline

• Introduction
• Image Manipulation
• Image Segmentation
• Automatic Detection
• Discussion

26
Image SegmentationGraph Cut

• Consider a weighted graph G (V, E).
• A graph can be partitioned into A and B such that
  A n B f and A ? B V.
• To remove the bias which is anatural tendency to
  cut a smallnumber of low-cost edges

27
Image SegmentationGraph Cut

• Define W a nn matrix such that Wi,j w (i, j)
  is the weight between vertices i and j.
• Define D a nn diagonal matrix whose ith element
  on the diagonal is .
• Solve the eigenvector problem
  with the secondsmallest eigenvalue ?.
• Let the sign of each component of define the
  membership of thevertex.

28
Image Segmentation Intensity

• For deletion.
• I (.) gray value at a given pixel.
• ?i,j Euclidean distance.

29
Image Segmentation Intensity

• First Iteration
• Group into regions corresponding to the bands
  (gray pixels) and the background.
• Second Iteration
• The background is grouped into two regions (black
  and white pixels.)

30
Image Segmentation Texture

• For healing.
• Ig (.) the magnitude of the image gradient at a
  given pixel.

31
Image Segmentation Texture

• s
• d (.) 1D deravative filter.
• 0.0187 0.1253 0.1930 0.0 -0.1930 -0.1253
  -0.0187
• p (.) low-pass filter.
• 0.0047 0.0693 0.2454 0.3611 0.2454 0.0693
  0.0047

32
Image Segmentation Texture

• First Iteration
• Using intensity-based segmentation.
• Group into regions corresponding to the bands
  (gray pixels) and the background.
• Second Iteration
• Using texture-based segmentation.
• The background is grouped into two regions (black
  and white pixels.)

33
Image Segmentation Duplication

• For duplication.
• One iteration.

34
Outline

• Introduction
• Image Manipulation
• Image Segmentation
• Automatic Detection
• Discussion

35
Automatic Detection

• Denote the segmentation map as S (x, y).
• Consider all pixels x, y with value S (x, y) 0
  such that all 8 spatial neighbors also have value
  0. The mean of all of the edge weights between
  such vertices is computed across the entire
  segmentation map.
• This process is repeated for all pixels x, y with
  value S (x, y) 1.
• Values near 1 are indicative of tampering because
  of significant similarity in the underlying
  measures of intensity, texture, or duplication.

36
Automatic Detection
37
Outline

• Introduction
• Image Manipulation
• Image Segmentation
• Automatic Detection
• Discussion

38
Discussion

• These techniques are specifically designed for
  scientific images, and for common manipulations
  that may be applied to them.
• As usual, these techniques are vulnerable to a
  host of counter-measures that can hide traces of
  tampering.
• As continuing to develop new techniques, it will
  become increasingly difficult to evade all
  approaches.