statistical tools for digital forensicsipr/mmsec2008/data/others/statistical tools... ·...

Statistical Tools forDigital Forensics

Multimedia Security

Henry Chang-Yu Lee

• One of the world’s foremost forensicscientists.

• Chief Emeritus for Scientific Servicesfor the State of Connecticut.

• Full professor of forensic science at the University of New Haven, where he has helped to set up the Henry C. Lee Forensic Institute.

Forensics

• Forensic science, the application of a broad spectrum of sciences to answer questions of interest to the legal system.

• Criminal investigations.• Other forensics disciplines:

– Forensic accounting.– Forensic economics.– Forensic engineering.– Forensic linguistics.– Forensic toxicology.– …

Digital Forensics

• Application of the scientific method to digital media in order to establish factual information for judicial review.

• What is digital forensics associate with DRM?– Authorized images have been tampered.– How to declare the image is neither authentic, nor authorized.

Image Tampering

• Tampering with images is neither new, nor recent.• Tampering of film photographs:

– Airbrushing.– Re-touching.– Dodging and burning.– Contrast and color adjustment.– …

• Outside the reach of the average user.

Image Tampering

• Digital Tampering:– Compositing.– Morphing.– Re-touching.– Enhancing.– Computer graphics.– Painted.

Image Tampering

• Tampering is not a well defined notion, and is often application dependent.

• Image manipulations may be legitimate in some cases, ex. use a composite image for a magazine cover.

• But illegitimate in others, ex. evidence in a court of law.

Watermarking-Based Forensics

• Digital watermarking has been proposed as a means by which a content can be authenticated.

• Exact authentication schemes:– Change even a single bit is unacceptable.– Fragile watermarks.

• Watermarks will be undetectable when the content is changed in any way.

– Embedded signatures.• Embed at the time of recording an authentication signature in

the content.– Erasable watermarks.

• aka invertible watermarks, are employed in applications that do not tolerate the slight content changes.

Watermarking-Based Forensics

• Selective authentication schemes:– Verify if a content has been modified by any illegitimate

distortions.– Semi-fragile watermarks.

• Watermark will survive only under legitimate distortion.– Tell-tale watermarks.

• Robust watermarks that survive tampering, but are distorted in the process.

• The major drawback is that a watermark must be inserted at the time of recording, which would limit this approach to specially equipped digital cameras.

Statistical Techniques for Detecting Traces

• Assumption:– Digital forgeries may be visually imperceptible, nevertheless,

they may alter the underlying statistics of an image.

• Techniques:– Copy-move forgery.– Duplicated image regions.– Re-sampled images.– Inconsistencies in lighting.– Chromatic Aberration.– Inconsistent sensor pattern noise.– Color filter array interpolation.– …

Detecting Inconsistencies in Lighting

•

•

• L: direction of the light source.• A: constant ambient light term.

Detecting InconsistentSensor Pattern Noise

•••• p: series of images.• F: denoising filter.• n: noise residuals.• Pc: camera reference pattern.

( ) ( ) ( )( )kkk pFpn −=( )( ) pkc NnP ∑=

Detecting InconsistentSensor Pattern Noise

• Calculate for regions Qk of the same size and shape coming from other cameras or different locations.

•• Decide R was tampered if p > th = 10-3 and not

tapered otherwise.

( ) ( )( )RPQn ck ,ρ

R

Detecting Color Filter Array Interpolation

• Most digital cameras have the CFA algorithm, by each pixel only detecting one color.

• Detecting image forgeries by determining the CFA matrix and calculating the correlation.

Reference• H. Farid,

“Exposing Digital Forgeries in Scientific Images,”in ACM MMSec, 2006

• J. Fridrich, D. Soukal, J. Lukas,“Detection of Copy-Move Forgery in Digital Images,”in Proceedings of Digital Forensic Research Workshop, Aug. 2003

• A. C. Popescu, H. Farid,“Exposing Digital Forgeries by Detecting Duplicated Image Regions,”in Technical Report, 2004

• A. C. Popescu, H. Farid,“Exposing Digital Forgeries by Detecting Traces of Resampling,”in IEEE TSP, vol.53, no.2, Feb. 2005

Reference• M. K. Johnson, H. Farid,

“Exposing Digital Forgeries by Detecting Inconsistencies in Lighting,”in ACM MMSec, 2005

• M. K. Johnson, H. Farid,“Exposing Digital Forgeries Through Chromatic Aberration,”in ACM MMSec, 2006

• J. Lukas, J. Fridrich, M. Goljan,“Detecting Digital Image Forgeries Using Sensor Pattern Noise,”in SPIE, Feb. 2006

• A. C. Popescu, H. Farid,“Exposing Digital Forgeries in Color Filter Array Interpolated Images,”in IEEE TSP, vol.53, no.10, Oct. 2005

Discussion

• The problem of detecting digital forgeries is a complex one with no universally applicable solution.

• Reliable forgery detection should be approached from multiple directions.

• Forensics is done in a fashion that adheres to the standards of evidence admissible in a court of law.

• Thus, digital forensics must be techno-legal in nature rather than purely technical or purely legal.

Exposing Digital Forgeries inScientific Images

Hany Farid,ACM Proceedings of the 8th Workshop on Multimedia and Security, Sep. 2006

Outline

• Introduction• Image Manipulation• Image Segmentation• Automatic Detection• Discussion

Introduction

• 南韓黃禹錫幹細胞研究造假– 2005/06/17 黃禹錫宣布成功的建立11個病人

身上體細胞所衍生的幹細胞株，論文並於國際知名的《科學》期刊發表。

– 2005/11/11 共同作者夏騰指控黃禹錫對他隱瞞卵子取得來源的事實，並認為其與黃禹錫所發表的論文數據有瑕疵。

– 2005/11/21南韓首爾國立大學應黃禹錫自己要求也展開調查其實驗結果。

Introduction

• 南韓黃禹錫幹細胞研究造假– 2005/12/23 初步報告顯示，黃禹錫在2005年

發表在《科學》期刊的論文，數據絕大部份都是子虛烏有：由11個病人身上體細胞所衍生的幹細胞株，實際存在的只有兩個，這項結果也顯示黃禹錫的人為疏失並不是無意造成地，而是刻意欺騙。

– 2005/12/29 調查委員會再公佈所謂的實際存在的兩個病人幹細胞株其DNA也不符合原來的體細胞。

– 2006/1/13 《科學》期刊正式宣佈撤回黃禹錫在2005年和2004年的兩篇論文。

Outline


Image Manipulation

• Action of each manipulation scheme:– Deletion, (a).

• A band was erased.– Healing, (b).

• Several bands were removing using Photoshop’s “healing brush.”

– Duplication, (c).• A band was copied and pasted

into a new location.

Image Manipulation

• Effect of each manipulation scheme:– Deletion.

• Remove small amounts of noise that are present through the dark background of the image.

– Healing.• Disturb the underlying spatial frequency (texture).

– Duplication.• Leave behind an obvious statistical pattern – two regions in

the image are identical.

• Formulate the problem of detecting each of these statistical patterns as an image segmentation problem.

Outline


Image Segmentation:Graph Cut

• Consider a weighted graph G = (V, E).• A graph can be partitioned into A and B such that A ∩

B = φ and A ∪ B = V.•

• To remove the bias which is anatural tendency to cut a smallnumber of low-cost edges:

••

Image Segmentation:Graph Cut

• Define W a n×n matrix such that Wi,j = w (i, j) is the weight between vertices i and j.

• Define D a n×n diagonal matrix whose ith element on the diagonal is .

• Solve the eigenvector problemwith the second

smallest eigenvalue λ.• Let the sign of each component of

define the membership of thevertex.

→

e

Image Segmentation: Intensity

• For deletion.

•• I (．): gray value at a given pixel.• Δi,j: Euclidean distance.

Image Segmentation: Intensity

• First Iteration:– Group into regions corresponding to the bands (gray pixels) and

the background.

• Second Iteration:– The background is grouped into two regions (black and white

pixels.)

Image Segmentation: Texture

• For healing.

•• Ig (．): the magnitude of

the image gradient at a given pixel.

•••


• s • d (．): 1D deravative filter.

– [0.0187 0.1253 0.1930 0.0 −0.1930 −0.1253 −0.0187]

• p (．): low-pass filter.– [0.0047 0.0693 0.2454

0.3611 0.2454 0.0693 0.0047]

• [ ]⎥⎥⎥

⎦

⎤

⎢⎢⎢

⎣

⎡

−−−

=−×⎥⎥⎥

⎦

⎤

⎢⎢⎢

⎣

⎡

101202101

101121


• First Iteration:– Using intensity-based

segmentation.– Group into regions

corresponding to the bands (gray pixels) and the background.

• Second Iteration:– Using texture-based

segmentation.– The background is grouped

into two regions (black and white pixels.)

Image Segmentation: Duplication

• For duplication.

••• One iteration.

Outline


Automatic Detection

• Denote the segmentation map as S (x, y).• Consider all pixels x, y with value S (x, y) = 0 such that

all 8 spatial neighbors also have value 0. The mean of all of the edge weights between such vertices is computed across the entire segmentation map.

• This process is repeated for all pixels x, y with value S (x, y) = 1.

• Values near 1 are indicative of tampering because of significant similarity in the underlying measures of intensity, texture, or duplication.

Automatic Detection

S0 = 0.19 S0 = 0.99 S0 = 0.30 S0 = 0.98 S0 = 0.50 S0 = 0.97

Outline


Discussion

• These techniques are specifically designed for scientific images, and for common manipulations that may be applied to them.

• As usual, these techniques are vulnerable to a host of counter-measures that can hide traces of tampering.

• As continuing to develop new techniques, it will become increasingly difficult to evade all approaches.

Statistical Tools for�Digital ForensicsHenry Chang-Yu LeeForensicsDigital ForensicsImage TamperingImage TamperingImage TamperingWatermarking-Based ForensicsWatermarking-Based ForensicsStatistical Techniques for Detecting TracesDetecting Inconsistencies in LightingDetecting Inconsistent�Sensor Pattern NoiseDetecting Inconsistent�Sensor Pattern NoiseDetecting Color Filter Array InterpolationReferenceReferenceDiscussionExposing Digital Forgeries in�Scientific Images� �Hany Farid,�ACM Proceedings of the 8th Workshop on Multimedia and Security, OutlineIntroductionIntroductionOutlineImage ManipulationImage ManipulationOutlineImage Segmentation:�Graph CutImage Segmentation:�Graph CutImage Segmentation: IntensityImage Segmentation: IntensityImage Segmentation: TextureImage Segmentation: TextureImage Segmentation: TextureImage Segmentation: DuplicationOutlineAutomatic DetectionAutomatic DetectionOutlineDiscussion

statistical tools for digital forensicsipr/mmsec2008/data/others/statistical tools... ·...

Documents