Multimedia Forensics: Technologies For Imagery Investigation EVA Florence 2009 Roberto Caldelli, Irene Amerini, Francesco Picchioni and Vito Cappellini Florence 30.04.09
Outline • Scenario • Multimedia Forensic • State of the art • Methods and Results • Future Trends
Scenario Digital images every where ... as a result of a tremendous amount of growth in digital imaging technology • What technologies were employed? • Captured using a digital camera, cell phone camera, digital scanner, camcorder? • Generated by computer graphic? • Which camera brand took this picture? • Whatmodel? • Any post-processing? • Has it been tampered? manipulated? • Does it have any hidden info?
Scenario Problem: digital images or videos are not easily acceptable in a court because it is difficult to establish their integrity, origin, and authorship Solution: Digital Forensic (Multimedia Forensic) Use: assisting human investigator by giving instruments for the authentication and the analysis of a digital clue turning it in a evidence. Evidence
Multimedia Forensic • Can we trust the content of a digital media? • The goal of multimedia forensics is to • detect image forgeries, recover processing history • determine the source of an image (scan, computer graphics, digital camera, ...) • link the image with known device (digital camera) • Some Applications (silent witness in court): • child pornography - Was given image taken by this camera? • movie piracy - What camera or device was used to tape the movie in cinema?
Multimedia Forensic • Acquisition device identification • Kind of device • Brand • Specific device • Assessing image integrity • Copy-move • Splicing • Double JPEG compression
Source Identification- State of the Art • Dumb solution • metadata information but can be edited (EXIF JPEG format) • Active approach • watermark, digital signature but the commercial cameras don’t insert such content (Secure camera) • No external information at hand!!! • Passive approach • Only the digital content at disposal • Observation: acquisition process and post-processing operation leave a distinctive imprint on the data a digital fingerprint • Idea: fingerprint extraction and check intrinsic features present within the digital content
Source Identification- Acquisition Process Digital camera -CFA: Bayer pattern (GRGB) -sensor: CCD, CMOS -Digital Image Processor: interpolation, white balancing, gamma correction, noise reduction -JPEG compression • Fingerprint from: • Lens Aberration • Color Filter Array and Demosaicking • Sensor imperfections • Features (color, IQM, BSM, HOWS)
Sensor Imperfections • shot noise (random) • pattern noise (systematic) • Fixed Pattern Noise: dark current (exposure, temperature) suppressed subtracting dark frame from image. • Photo Response Non Uniformity: caused by imperfection in manufacturing process (flat fielding) • slightly varying pixel dimensions • inhomogeneities in silicon wafer. PRNU as Fingerprint embedded into every image.
Digital Camera Identification [Fridrich06] • Properties: • multiplicative noise • unique to every sensor [Fridrich06] M. Goljan J. Lukas, J. Fridrich, “Digital camera identification from sensor pattern noise“, 2006.
Digital Camera Identification- denoising filter Assumption: camera available or other N images taken by the camera Denoising filter:Low Pass Filter Mihçak Filter  Argenti-Alparone Filter  • DWT (Discrete Wavelet Transform)Daubechies – 4° decomposition level • Different denoising algorithm • Different noise model Fingerprint estimation from N images (no smooth images) Fingerprint detection: correlation; given an image we calculate the noise pattern and then correlated with the known reference pattern from a set of cameras. Decision: threshold, Neymann Pearson criterion FAR=10^-3  K. Ramchandran M. K. Mihcak, I. Kozintsev, “Spatially adaptive statistical model of wavelet image coefficients and its application to denoising”, 1999.  L. Alparone F. Argenti, G. Torricelli, “Mmse filtering of generalised signal-dependent noise in spatial and shift-invariant wavelet domain“, 2005.
Digital Camera Identification- fingerprint estimation
Digital Camera Identification- fingerprint detection
Result- denoising filter comparison Mihçak filter: 99.09% Argenti filter: 96.61% Low Pass filter: 84.44% • 10 digital camera • Data-set: training-set, test-set • Statistical analisys Amount of images not correctly detected with the different three filter
Result- Correlation values of residual noises Mihçak filter: 99.09% Argenti filter: 96.61% Low Pass filter: 84.44% The distributions of the correlation values cases are always well separated; in fact the higher values are those related to the correlation between the noise residual of the Olympus FE120 images and its fingerprint. Argenti Mihcak Correlation values for 20 images from a Olympus FE120 with 5 fingerprints
Future Trends • Extend analogous approach to video • Define new denoising filter • Suppression of image content • Different kind of sensor device • Use classification (SVM) to make a decision