Multimedia Forensics: Technologies For Imagery Investigation

1. Multimedia Forensics: Technologies For Imagery Investigation EVA Florence 2009 Roberto Caldelli, Irene Amerini, Francesco Picchioni and Vito Cappellini Florence 30.04.09

2. Outline • Scenario • Multimedia Forensic • State of the art • Methods and Results • Future Trends

3. Scenario Digital images every where ... as a result of a tremendous amount of growth in digital imaging technology • What technologies were employed? • Captured using a digital camera, cell phone camera, digital scanner, camcorder? • Generated by computer graphic? • Which camera brand took this picture? • Whatmodel? • Any post-processing? • Has it been tampered? manipulated? • Does it have any hidden info?

4. Scenario Problem: digital images or videos are not easily acceptable in a court because it is difficult to establish their integrity, origin, and authorship Solution: Digital Forensic (Multimedia Forensic) Use: assisting human investigator by giving instruments for the authentication and the analysis of a digital clue turning it in a evidence. Evidence

5. Multimedia Forensic • Can we trust the content of a digital media? • The goal of multimedia forensics is to • detect image forgeries, recover processing history • determine the source of an image (scan, computer graphics, digital camera, ...) • link the image with known device (digital camera) • Some Applications (silent witness in court): • child pornography - Was given image taken by this camera? • movie piracy - What camera or device was used to tape the movie in cinema?

6. Multimedia Forensic • Acquisition device identification • Kind of device • Brand • Specific device • Assessing image integrity • Copy-move • Splicing • Double JPEG compression

7. Source Identification- State of the Art • Dumb solution • metadata information but can be edited (EXIF JPEG format)‏ • Active approach • watermark, digital signature but the commercial cameras don’t insert such content (Secure camera) • No external information at hand!!! • Passive approach • Only the digital content at disposal • Observation: acquisition process and post-processing operation leave a distinctive imprint on the data a digital fingerprint • Idea: fingerprint extraction and check intrinsic features present within the digital content

8. Source Identification- Acquisition Process Digital camera -CFA: Bayer pattern (GRGB) -sensor: CCD, CMOS -Digital Image Processor: interpolation, white balancing, gamma correction, noise reduction -JPEG compression • Fingerprint from: • Lens Aberration • Color Filter Array and Demosaicking • Sensor imperfections • Features (color, IQM, BSM, HOWS)

9. Sensor Imperfections • shot noise (random) • pattern noise (systematic) • Fixed Pattern Noise: dark current (exposure, temperature) suppressed subtracting dark frame from image. • Photo Response Non Uniformity: caused by imperfection in manufacturing process (flat fielding) • slightly varying pixel dimensions • inhomogeneities in silicon wafer. PRNU as Fingerprint embedded into every image.

10. Digital Camera Identification [Fridrich06] • Properties: • multiplicative noise • unique to every sensor [Fridrich06] M. Goljan J. Lukas, J. Fridrich, “Digital camera identification from sensor pattern noise“, 2006.

11. Digital Camera Identification- denoising filter Assumption: camera available or other N images taken by the camera Denoising filter:Low Pass Filter Mihçak Filter [1] Argenti-Alparone Filter [2] • DWT (Discrete Wavelet Transform)‏Daubechies – 4° decomposition level • Different denoising algorithm • Different noise model Fingerprint estimation from N images (no smooth images) Fingerprint detection: correlation; given an image we calculate the noise pattern and then correlated with the known reference pattern from a set of cameras. Decision: threshold, Neymann Pearson criterion FAR=10^-3 [1] K. Ramchandran M. K. Mihcak, I. Kozintsev, “Spatially adaptive statistical model of wavelet image coefficients and its application to denoising”, 1999. [2] L. Alparone F. Argenti, G. Torricelli, “Mmse filtering of generalised signal-dependent noise in spatial and shift-invariant wavelet domain“, 2005.

12. Digital Camera Identification- fingerprint estimation

13. Digital Camera Identification- fingerprint detection

14. Result- denoising filter comparison Mihçak filter: 99.09% Argenti filter: 96.61% Low Pass filter: 84.44% • 10 digital camera • Data-set: training-set, test-set • Statistical analisys Amount of images not correctly detected with the different three filter

15. Result- Correlation values of residual noises Mihçak filter: 99.09% Argenti filter: 96.61% Low Pass filter: 84.44% The distributions of the correlation values cases are always well separated; in fact the higher values are those related to the correlation between the noise residual of the Olympus FE120 images and its fingerprint. Argenti Mihcak Correlation values for 20 images from a Olympus FE120 with 5 fingerprints

16. Future Trends • Extend analogous approach to video • Define new denoising filter • Suppression of image content • Different kind of sensor device • Use classification (SVM) to make a decision

17. Thank you