IMAGE FORENSICS BASED ON JPEG COMPRESSION ARTIFACTS

Abstract

Multimedia forensics has attracted strong attention from researchers in the field of image and video processing. The technological advancements have made digital cameras easily available and the increasing use of the Internet as a communication media made the digital images an easy way of conveying visual information. But the digital images can be manipulated easily with the help of photo-editing software, even by non-professional users. These manipulations are known as image forgery in which a part of a realistic image is tampered. These forgeries have made the authenticity of digital images doubtful or we can say that the old saying “to see is to believe”, might not be true in the case of digital images. In most of the cases, these forged images are not harmful, but the same may be used for malicious purposes such as evidence in the courtroom or as material for propaganda that may defame an individual or organization. The doctored images/videos may create a negative environment or influence the public opinion. Many forensic techniques that can detect forgeries have been proposed in recent years. These forensic techniques detect fingerprints of acquisition devices or the traces of signal processing operations associated with forgery. Among the forensic techniques, JPEG forensics have received considerable research attention. This is due to the fact that the JPEG is the most widely used image compression standard. It introduces blocking artifacts across the boundaries of 8 8 sub-image blocks in the spatial domain and DCT histogram artifacts in the form of clustering of DCT coefficient in the frequency domain. Furthermore, any forgery of a JPEG compressed image results in multiple compression artifacts in the forged image. Based on these artifacts, various forensic techniques have been proposed in the literature to detect doctored images. Most of the forensic techniques do not account for the possibility of anti-forensics. An adversary, familiar with the signal processing operations involved in the forgery, may develop an anti-forensic technique by removing the traces left by these operations. This results Abstract in an image forgery which can deceive forensic detectors. It is necessary for the forensic researchers to study any loopholes in the forensic techniques so that the image forgeries in presence of anti-forensic operations can be detected. The thesis first investigates a forensic approach for detecting horizontally-oriented overlay text in JPEG images. In this approach, the insertion of overlay text is considered as a forgery operation and the overlay text regions are treated as forged areas. It is based on the fact that the high-contrast edges in overlay text boundaries generate truncation error when subjected to JPEG compression. The regions containing high-contrast edges in a given test image are first identified using a Discrete Cosine Transform (DCT) domain technique and a binary truncation error map is generated. The overlay text regions in the truncation error map are generally clustered and the cluster corresponding to a text line appears in a connected form. The initial detection is refined using connected component-based processing. The next part of the thesis investigates the detection of anti-forensically modified images. JPEG anti-forensic operations aim to disguise existing forensic detectors by hiding blocking and quantization artifacts. A popular approach in JPEG anti-forensics is to add dither to remove quantization artifacts. We propose a re-dithering based approach for the detection of such JPEG anti-forensic techniques. It is based on the fact that when a JPEG anti-forensic operation is applied, the values of DCT coefficients are changed. This change decreases, especially in high-frequency subbands, if we apply the anti-forensic operation again. Based on this observation, we propose a normalized feature based on the difference of absolute values of DCT coefficients of the test image and its anti-forensically modified version. The thesis also proposes a method to differentiate between genuine and anti-forensically modified images based on the presence of JPEG blocking artifacts. The idea here is to exploit the correlation among DCT coefficients in spatially adjacent blocks of an image. Due to the presence of blocking artifacts, there is a difference between the inter-block correlation in DCT coefficients of an image and that of its cropped version. This difference in interblock correlation is captured by computing the average variation in the DCT subbands and is used to measure the blockiness. Although the JPEG anti-forensic operations suppress blocking artifacts, the proposed detector is able to expose anti-forensically modified images by detecting the traces of blockiness. The last part of the thesis proposes a pattern classification framework to classify variAbstract ous anti-forensic operations. Here, we consider two anti-forensic operations (anti-forensics to median filtering and contrast enhancement) in addition to JPEG anti-forensic operations which can affect the performance of different forensic detectors. In this method, a 64- dimensional feature vector in the DCT domain is used to train an SVM classifier. The feature vector consists of the mean of the absolute values of 64 DCT subband coefficients. The main advantage of the proposed technique is a significant reduction in the feature dimension as compared to the state-of-the-art techniques.