Statistical and deterministic approaches for multimedia forensics

The increasing availability and pervasiveness of multimedia data in our society is before our very eyes. As a result of globalization and worldwide connectivity, people from all over the planet are exchanging constantly increasing amounts of images, videos, audio recordings on a daily basis. Coupled with the easy access to user-friendly editing software, this poses a number of problems related to the reliability and trustworthiness of such content, as well as its potential malevolent use. For this reason, the research field of multimedia forensics focuses on the development of forensic tools for verifying the authenticity of multimedia data. The hypothesis of pristine status of images, videos or audio tracks is called into question and can be rejected if traces of manipulation are detected with a certain degree of confidence. In this framework, studying traces left by any operation that could have been employed to process the data, either for malicious purposes or simply to improve their content or presentation, turns out to be of interest for a comprehensive forensic analysis. The goal of this doctoral study is to propose contributions to the forensic task of detecting certain processing operations in multimedia data, with particular attention to digital images. The general rationale behind our work is to leverage statistical and deterministic properties that are common to the kind of data under investigation. As it is shown in our results, this helps the forensic analysis in several directions, like assessing the confidence of a certain decision or avoiding preliminary training phases by exploiting closed-form theoretical derivations. With this respect, much work has been devoted to the study of JPEG compression traces in digital images, resulting in the development of several innovative approaches. Moreover, we have explored the possibility of defining and exploiting deterministic properties related to a certain processing operation in the forensic analysis, presenting a first approach targeted to the detection in one-dimensional data of a common data smoothing operation, the median filter. The main contributions of our work are detailed as follows: I Detection of JPEG compression traces in uncompressed format images. Intrinsic statistical properties of natural uncompressed images are used in image forensics for detecting traces of previous processing operations. The distribution of Benford-Fourier coefficients is derived theoretically both under the hypotheses of no compression and previous compression with a certain quality factor, allowing also for Correspondence to: [email protected] Recommended for acceptance by David Vázquez Bérmudez DOI http://dx.doi.org/10.5565/rev/elcvia.984 ELCVIA ISSN:1577-5097 Published by Computer Vision Center / Universitat Autònoma de Barcelona, Barcelona, Spain C. Pasquini et al. / Electronic Letters on Computer Vision and Image Analysis 15(2):16-18, 2016 17 the computation of the respective likelihood functions. Then, three novel classification tests based on different statistics are proposed [6, 4], relying on discriminative thresholds that can be determined automatically (without the need of any training phase) and proving to be suitable for images of different size and source camera. Experiments on real images and comparisons with state-of-art techniques show that the proposed approach outperforms existing ones and overcomes issues due to dataset-dependency. A pictorial example of the capability of the method is reported in Fig. 1 (blue case). II Detection of multiple JPEG compression traces in JPEG images. The analysis of Benford–Fourier coefficients is extended to the case of JPEG images, resulting in a forensic method for the identification of multiple aligned JPEG compressions and the estimation of the corresponding quality factors based on an hypothesis testing scheme [3]. In principle, the technique allows for the detection of an arbitrary number of compressions, depending on the pool of the tested alternative hypotheses. Experimental results show that the performance of the proposed technique is good also in the case of last compression heavier than the previous ones, where existing methods usually lead to high false negative rates. Moreover, the entire chain of JPEG compression is reconstructed also in case of triple compressed images (while existing methods generally estimate only one previous quality factor applied) and the effectiveness of the method is also explored in the challenging case of double high quality JPEG compression [7], for which specific improvements are adopted. A pictorial example of the capability of the method is reported in Fig. 1 (red case). III Counterforensics of JPEG images. Two counterforensic techniques are proposed for the reconstruction of statistical properties of natural and JPEG images. They both target the modification of the First Significant Digit (FSD) histogram of the DCT coefficients, in order to conceal traces of single and, in some cases, multiple compression. The first one operates in the FSD modular logarithmic domain, from which FSD and DCT coefficients distribution typical of uncompressed images are consequently reconstructed [1]. On the other hand, the second one directly targets the reconstruction of a given FSD histogram and can be seen as universal to detectors based on FSD first-order histogram [5]. Based on heuristic criteria, the technique provides a close-to-optimal solution for the problem of FSD histogram modification with minimal distortion in terms of Mean Square Error (MSE) distortion. Both methods are compared with a well-established existing anti-forensic attacks in terms of quality of the resulting image, showing generally superior performances. IV Deterministic detection of median filtering in data sequences. This work represents our first attempt to define and leverage properties that are deterministically related to a certain processing, in contrast with typical forensic methodologies based on statistical properties. We propose a forensic technique able to detect the application of a median filter to 1D data [2]. Relying on deterministic mathematical properties of the median filter, we identify specific order relationships among the sample values that cannot be found in filtered sequences. Hence, their presence in the analyzed 1D sequence allows excluding the application of the median filter. Due to its deterministic nature, the method ensures a null false negative rate and, although false positives (not filtered sequences classified as filtered) are theoretically possible, experimental results show that the false alarm rate is null for sufficiently long sequences. Besides, the proposed technique has the capability to locate with good precision a median filtered part of 1D data and provides a good estimate of the window size used. For each of the innovative contribution, experimental validation on benchmarking datasets has been carried out, thus identifying the pros and cons with respect to existing tools, as well as aspects leaving space of improvement. With this respect, we can observe that the proposed solutions have the positive features to be largely independent from the semantic content of the objects under investigation and to require none or very limited training phases on preliminary datasets. Thus, they can be considered as off-the-shelf tools to analyze data with diverse content and coming from diverse sources. 18 C. Pasquini et al. / Electronic Letters on Computer Vision and Image Analysis 15(2):16-18, 2016