Statistical Tools for Digital ForensicsHenry Chang-Yu Lee
• Chief Emeritus for Scientific Services for the State of Connecticut.
• Full professor of forensic science at the University of New Haven, where he has helped to set up the Henry C. Lee Forensic Institute.
Forensics
• Forensic science, the application of a broad spectrum of sciences to answer questions of interest to the legal system.
• Criminal investigations. • Other forensics disciplines:
– Forensic accounting. – Forensic economics. – Forensic engineering. – Forensic linguistics. – Forensic toxicology. – …
Digital Forensics
• Application of the scientific method to digital media in order to establish factual information for judicial review.
• What is digital forensics associate with DRM? – Authorized images have been tampered. – How to declare the image is neither authentic, nor authorized.
Image Tampering
• Tampering with images is neither new, nor recent. • Tampering of film photographs:
– Airbrushing. – Re-touching. – Dodging and burning. – Contrast and color adjustment. – …
• Outside the reach of the average user.
Image Tampering
Image Tampering
• Tampering is not a well defined notion, and is often application dependent.
• Image manipulations may be legitimate in some cases, ex. use a composite image for a magazine cover.
• But illegitimate in others, ex. evidence in a court of law.
Watermarking-Based Forensics
• Digital watermarking has been proposed as a means by which a content can be authenticated.
• Exact authentication schemes: – Change even a single bit is unacceptable. – Fragile watermarks.
• Watermarks will be undetectable when the content is changed in any way.
– Embedded signatures. • Embed at the time of recording an authentication signature in
the content. – Erasable watermarks.
• aka invertible watermarks, are employed in applications that do not tolerate the slight content changes.
Watermarking-Based Forensics
• Selective authentication schemes: – Verify if a content has been modified by any illegitimate
distortions. – Semi-fragile watermarks.
• Watermark will survive only under legitimate distortion. – Tell-tale watermarks.
• Robust watermarks that survive tampering, but are distorted in the process.
• The major drawback is that a watermark must be inserted at the time of recording, which would limit this approach to specially equipped digital cameras.
Statistical Techniques for Detecting Traces
• Assumption: – Digital forgeries may be visually imperceptible, nevertheless,
they may alter the underlying statistics of an image.
• Techniques: – Copy-move forgery. – Duplicated image regions. – Re-sampled images. – Inconsistencies in lighting. – Chromatic Aberration. – Inconsistent sensor pattern noise. – Color filter array interpolation. – …
Detecting Inconsistencies in Lighting
•
•
• L: direction of the light source. • A: constant ambient light term.
Detecting Inconsistent Sensor Pattern Noise
• • • • p: series of images. • F: denoising filter. • n: noise residuals. • Pc: camera reference pattern.
( ) ( ) ( )( )kkk pFpn −= ( )( ) p k
Detecting Inconsistent Sensor Pattern Noise
• Calculate for regions Qk of the same size and shape coming from other cameras or different locations.
• • Decide R was tampered if p > th = 10-3 and not
tapered otherwise.
Detecting Color Filter Array Interpolation
• Most digital cameras have the CFA algorithm, by each pixel only detecting one color.
• Detecting image forgeries by determining the CFA matrix and calculating the correlation.
Reference • H. Farid,
“Exposing Digital Forgeries in Scientific Images,” in ACM MMSec, 2006
• J. Fridrich, D. Soukal, J. Lukas, “Detection of Copy-Move Forgery in Digital Images,” in Proceedings of Digital Forensic Research Workshop, Aug. 2003
• A. C. Popescu, H. Farid, “Exposing Digital Forgeries by Detecting Duplicated Image Regions,” in Technical Report, 2004
• A. C. Popescu, H. Farid, “Exposing Digital Forgeries by Detecting Traces of Resampling,” in IEEE TSP, vol.53, no.2, Feb. 2005
Reference • M. K. Johnson, H. Farid,
“Exposing Digital Forgeries by Detecting Inconsistencies in Lighting,” in ACM MMSec, 2005
• M. K. Johnson, H. Farid, “Exposing Digital Forgeries Through Chromatic Aberration,” in ACM MMSec, 2006
• J. Lukas, J. Fridrich, M. Goljan, “Detecting Digital Image Forgeries Using Sensor Pattern Noise,” in SPIE, Feb. 2006
• A. C. Popescu, H. Farid, “Exposing Digital Forgeries in Color Filter Array Interpolated Images,” in IEEE TSP, vol.53, no.10, Oct. 2005
Discussion
• The problem of detecting digital forgeries is a complex one with no universally applicable solution.
• Reliable forgery detection should be approached from multiple directions.
• Forensics is done in a fashion that adheres to the standards of evidence admissible in a court of law.
• Thus, digital forensics must be techno-legal in nature rather than purely technical or purely legal.
Exposing Digital Forgeries in Scientific Images
Hany Farid, ACM Proceedings of the 8th Workshop on Multimedia and Security, Sep. 2006
Outline
Introduction
– 2005/11/21
– 2005/12/29 DNA
– 2006/1/13 20052004
Image Manipulation
• A band was erased. – Healing, (b).
• Several bands were removing using Photoshop’s “healing brush.”
– Duplication, (c). • A band was copied and pasted
into a new location.
• Effect of each manipulation scheme: – Deletion.
• Remove small amounts of noise that are present through the dark background of the image.
– Healing. • Disturb the underlying spatial frequency (texture).
– Duplication. • Leave behind an obvious statistical pattern – two regions in
the image are identical.
• Formulate the problem of detecting each of these statistical patterns as an image segmentation problem.
Outline
Image Segmentation: Graph Cut
• Consider a weighted graph G = (V, E). • A graph can be partitioned into A and B such that A ∩
B = φ and A ∪ B = V. •
• •
Image Segmentation: Graph Cut
• Define W a n×n matrix such that Wi,j = w (i, j) is the weight between vertices i and j.
• Define D a n×n diagonal matrix whose ith element on the diagonal is .
• Solve the eigenvector problem with the second
smallest eigenvalue λ. • Let the sign of each component of
define the membership of the vertex.
→
• • I (): gray value at a given pixel. • Δi,j: Euclidean distance.
Image Segmentation: Intensity
• First Iteration: – Group into regions corresponding to the bands (gray pixels) and
the background.
• Second Iteration: – The background is grouped into two regions (black and white
pixels.)
• • •
– [0.0187 0.1253 0.1930 0.0 −0.1930 −0.1253 −0.0187]
• p (): low-pass filter. – [0.0047 0.0693 0.2454
0.3611 0.2454 0.0693 0.0047]
• Second Iteration: – Using texture-based
into two regions (black and white pixels.)
Image Segmentation: Duplication
Automatic Detection
• Denote the segmentation map as S (x, y). • Consider all pixels x, y with value S (x, y) = 0 such that
all 8 spatial neighbors also have value 0. The mean of all of the edge weights between such vertices is computed across the entire segmentation map.
• This process is repeated for all pixels x, y with value S (x, y) = 1.
• Values near 1 are indicative of tampering because of significant similarity in the underlying measures of intensity, texture, or duplication.
Automatic Detection
S0 = 0.19 S0 = 0.99 S0 = 0.30 S0 = 0.98 S0 = 0.50 S0 = 0.97
Outline
Discussion
• These techniques are specifically designed for scientific images, and for common manipulations that may be applied to them.
• As usual, these techniques are vulnerable to a host of counter-measures that can hide traces of tampering.
• As continuing to develop new techniques, it will become increasingly difficult to evade all approaches.
Statistical Tools forDigital Forensics
Henry Chang-Yu Lee
Detecting Inconsistencies in Lighting
Reference
Reference
Discussion
Exposing Digital Forgeries inScientific Images Hany Farid,ACM Proceedings of the 8th Workshop on Multimedia and Security,
Outline
Introduction
Introduction
Outline