Adaptive Matching for Copy-Move Forgery Detection

Workshop on Information Forensics and Security 2014

Adaptive Matching for Copy-Move Forgery Detection Mohsen Zandi, Ahmad Mahmoudi-Aznaveh

Azadeh Mansouri

Faculty of electrical and computer engineering Shahid Beheshti University Tehran, Iran [email protected], [email protected]

Faculty of electrical and computer engineering Kharazmi University Tehran, Iran [email protected]

Abstract— The objective of copy-move forgery detection methods are to find copied regions within the same image. There are two main approaches to detect copy-move forgery: keypoint-based and block-based methods. Although the former is superior in terms of computational complexity, these methods neglect the smooth regions since they confine their search to salient points. On the other hand, while block-based methods consider smooth areas, they introduce a huge number of false matches. In this paper, it is proposed to employ an adaptive threshold in the matching phase in order to overcome this problem. The experimental results demonstrate that the proposed method can greatly reduce the number of false matches which results in improving both performance and computational cost. Index Terms – Copy-move forgery detection, adaptive threshold, duplicated region localization

I.

INTRODUCTION

Considering the widespread utilization of digital images along with powerful image editing tools, it is of utmost importance to determine whether an image is forged or not. The aim of digital image forensics is to analyze images to determine their authenticity. In contrast to active methods, such as digital watermarking, image forensics can analyze the creditability without resorting to any prior information. Consequently, it is of more practical significance. These techniques, defined as passive, can be employed to determine the acquisition device or to detect tampering [1]. The basic idea behind image forensics is to uncover the traces left during the image creation or other successive processing regarding different phases of image life cycle. The remained fingerprint may occur during acquisition, coding or editing phase. Any processing applied to digital images is referred to as editing. Based on the objective of editing, it can be categorized to innocent and malicious. In the earlier case, the semantic information is not altered. However, in the second one, the semantic content is changed by adding or concealing an object. Copy-move forgery, on which we focus in this paper, is occurred during editing phase [2]. In the recent decade, a lot of researches have been conducted to discover various forms of forgeries. One of the most studied forgery methods is copy-move attack in which a region of an image is copied and pasted in another location of

978-1-4799-7088-9/14/$31.00 ©2014 IEEE

the same image. The main copy-move intentions are to conceal an object or to repeat a region to exaggerate a concept. In copy-move forgery detection (CMFD), it is common to compare a similarity measure between two blocks with a constant threshold [3, 4]. Considering the high similarity between low entropy regions (smooth regions), a high threshold leads to a huge number of potential matches. Indeed, too many false matching will be occurred. This large number of candidate matches detracts the detection method from applicability, especially for images containing smooth regions. On the other hand, selecting a low threshold may miss duplicated regions especially in textured areas. Accordingly, assigning a proper threshold value affects the detection performance [5]. Thus, we propose to employ an adaptive threshold. The experimental results show the effectiveness of the proposed method. The rest of the presented paper is organized as follows. In section 2, we investigated the demands of CMFD methods in more details. A brief review on previous works is given in section 3. In section 4, the proposed method is explained. Experimental results are provided in section 5 in order to show the effectiveness of the proposed method. II.

CMFD FRAMEWORK

The result of copy-move manipulation is an image with almost duplicated regions. The forged regions are from the same image; thus, their basic components are the same as other regions. Therefore, it is not appropriate to employ forensics techniques performing based on statistical inconsistencies. In this case, proper methods for copy-move detection have been presented. Although, a considerable number of copy-move detection schemes have been presented, most of them follow a common framework as depicted in Fig. 1 [6]. The fundamental steps of copy-move forgery detection methods can be summarized as follows: Preprocessing: The main goal of this step can be summarized as efficiency improvement of the next stages. As a case in point, converting color images to gray.

1549


III.

Quantized DCT coefficients of each block are the features used in the first copy-move detection [11]. In [3], four features from DCT coefficients are extracted. In addition, PCA, KPCA and SVD are three feature extraction methods employed to represent the blocks [12-14]. It should be noted that the copied regions are exposed to some geometrical transformation before pasting. It is shown that the mentioned methods are mostly robust against jpeg compression and additive noise; however, they are not rotationally invariant [15].

Keypoint Detection Feature Extraction

Pre-Processing Block Tiling Post-Processing

Filtering

PREVIOUS WORK

Matching

Fig. 1 Common copy-move forgery detection framework [6] Localization: In general, there are two main approaches; in the first one, the image is divided into overlapping blocks while the second approach is based on salient points. The main drawback of keypoint-based methods is to restrict the search area into image salient points; as a result, smooth regions may be left out. Feature extraction: In this phase, a feature vector is computed either for each block or each keypoint. The main difference of algorithms is related to the selected features. In order to make the detection robust against some distortions it is needed to adopt appropriate features which are invariant to the respective distortions. Matching: It is assumed that the similar regions have similar features. Consequently, a search process should be performed to find similar feature vectors. Then, the distance between two feature vectors is computed. If the difference is less than a threshold, corresponding two parts will be considered as a potential copy. Most of block-based methods propose the use of lexicographic sorting in order to find similar feature vectors [6]. However, some recent methods [7, 8], employed the locality-sensitive hashing (LSH) which provides better matching. Filtering (error reduction): False matching may take place for non-duplicated regions with similar features. This undesirable effect is more noticeable in smooth regions. Resultant false positives matched blocks are pruned in this step for instance by removing small detected copy regions. Post processing: Finally, it can be considered that this optional processing tries to decrease the false results. For example, matches which are the result of copy-move attack should have similar amount of translation, scaling and rotation. In this step, the outlier matches are removed [9, 10]. It should be noted that to achieve effective performance, it is necessary to overcome the problem of computational complexity. In other words, methods with high computational complexity are not feasible for all cases.

A group of methods concentrating on detecting duplicated regions which are rotated. In doing so, it is necessary to utilize an appropriate rotation invariant transform. In [15], FourierMellin transformation is exploited. However, this method is reliable for rotation to small degrees. Local Binary pattern (LBP) is also utilized as a rotation invariant feature [16]. The main disadvantage of LBP is its sensitivity to interpolation error, and therefore, it is just rotationally invariant to some specific degrees. Two successful rotation invariant features used in CMFD are Zernike moments [4, 7] and polar cosine transform (PCT) [8]. These two features are analytically invariant to rotation. On the other hand, other CMFD techniques take advantages of salient point descriptors. SIFT is the mostly used algorithm in this approach [9, 10, 17]. Although these schemes provide robustness against scaling and rotation, the main drawback of these methods is that they neglect smooth regions. In keypoint-based approaches, a feature vector is computed for each salient point. Consequently, the number of extracted features, and therefore, computational cost of the succeeding steps is reduced. Hence, a wide range of algorithms for matching and filtering stages can be selected. However, it should be noted that the keypoint-based methods mainly extract their features from high entropy regions [6]. In block-based methods, on the contrary, the whole image, including smooth regions, is considered. It can be said that almost a feature vector is computed per each pixel. Since there exist a huge number of blocks, designing an appropriate matching algorithm is complicated. In that, the computational cost of the matching process is noticeable. Moreover, the number of potential copies that found in the matching phase may be of considerable size, especially when the input images involve highly smooth regions such as sky. If the numbers of potential matched pairs become very large, the runtime of filtering phase will drastically increase. Apart from this, another consequence of the large number of potential copies is a lot of false matches. This problem is very challenging and some CMFD methods ignore the smooth regions in order to prevent this effect [8, 18]. In this paper, we propose a new approach to overcome this challenging issue. The result of the proposed method is false positive reduction. The main idea is to apply an adaptive threshold in matching stage.

1550


IV.

τ ≥δ

PROPOSED METHOD

As it is mentioned, the duplicated region may be exposed to some distortions. These induced distortions may be the result of compression, blurring, rotation, interpolation and so on. The larger extent of the imposed distortion, the lower similarity will be. In addition of the level and type of distortions, the block content may also be effective in degradation amount. For example, high entropy blocks are more vulnerable to alternation in comparison to low entropy blocks in case of blurring. If a high threshold is utilized for matching, it will be likely to achieve more false positive results notably for smooth regions. On the other hand, employing a low threshold may lead to missing some copied regions. Therefore, using a constant threshold leads to false results. In this paper, it is proposed to employ an adaptive threshold to enhance the achieved results. In fact, in order to analyze the similarity between two copied blocks some factors should be taken into account: • • • •

The block content Selected features Degradation type and its degree And finally, similarity criteria

in which τ is the matching threshold and δ corresponds to distance similarity. Since the Euclidean distance is utilized as similarity measure, equation (1) can be rewritten as follows: τ ≥ B1 − B 2

(2)

Owing to the fact that in copy-move forgery the imposed distortions such as interpolation (mainly consequence of rotation) and blurring can be generally represented by a low pass filter, it can be stated that B2 is approximately the B1 filtered by a low pass filter, L. Therefore, we can conclude τ ∝ B1 − LB1 = HB1

(3)

where H is a high pass filter. A high pass filter may be approximated by a DC blocking filter. It can be easily shown that the energy of a signal which is filtered by a DC blocking filter is the same as its variance in the spatial domain; thus, we have: τ ∝ SD (b1 )

Most of presented methods make use of Euclidean distance to measure the similarity. The selected feature space and the distance criteria are predetermined for each CMFD method. As a result, we focused on block content and the imposed degradations. As it is expressed, a higher threshold should be selected for textured areas since the less false matches occurs in such regions. This is because more distinct features make block matching more reliable. On the contrary, a low threshold is more appropriate for smooth regions [7, 8]. The standard deviation (SD) estimates the energy of high frequency coefficients of the blocks. Thus, we propose to utilize the SD in order to adjust the employed threshold. On the other hand, the forger may exploit some image processing tools in order to hide or decrease the effect of tampering. These modifications mainly include rotation, blurring and jpeg compression. Therefore, the CMFD methods should be designed in such a way that they will be robust against these kinds of modifications. In the following, the relation between the SD and the induced distortion is investigated. Additive white Gaussian noise (AWGN) and linear blurring are investigated since they are basic attacks based on which complex manipulation can be expressed [19]. It is assumed that block b2 is the copy of b1 in the spatial domain, and B2 and B1 are considered as their corresponding frequency domain counterparts. It is obvious that in the matching phase the appropriate threshold should be greater than or equal to similarity distance of two copied blocks as illustrated in the following equation:

(1)

(4)

Therefore, it is reasonable to adjust the matching threshold proportional to standard deviation of the block’s intensity. As it is mentioned, the higher threshold value is adopted for textured blocks. Respect to the fact that human visual system is less sensitive to additive noise in textured areas, such blocks may be exposed to higher degree of noise addition. On the other hands, smooth blocks cannot accept the same level of noise. In other words, the acceptable noise level may be regarded proportional to the standard deviation of the blocks. Hence, in the case of noise addition, adjusting the threshold based on SD is sensible as well. Other distortions, such as interpolation and JPEG compression can be analyzed in term of blurring. It is well known that JPEG compression removes the details, similar to a low pass filter. It is worth noting that although both the original and copied blocks are compressed simultaneously, misalignment of copied blocks may be the source of difference. Based on the theoretical analysis, it can be concluded that it is appropriate to employ SD of each block to adjust the matching threshold. In order to achieve a relation between threshold and SD, an experiment is performed. In this experiment, based on equation(3), a low pass filter is applied on six randomly selected images. The energy of the differences related to the corresponding pair blocks with respect to their mean of SD is depicted in Fig. 2. It is obvious that there is almost a linear relationship between the paired blocks similarity distances and the average of their SDs. Therefore, we calculate the adaptive threshold based on equation(5).

1551


a

b

c

Fig. 3 a. Original Image b. Ground truth map c. Forged image

Fig. 2 The relation between the SD and imposed distortion

= τ α

SD (b1 ) + SD (b 2 ) 2

+β

(5)

where α and β are user-defined parameters which should be adjusted based on selected feature space and similarity distance measure. In addition, it is possible to regulate these parameter based on application demands. For instance, the sensitivity to smooth region can be controlled by β parameter. A greater value for β leads to reducing missed matches in smooth regions while increasing α will decrease negative false matches in high frequency areas. V.

EXPERIMENTAL RESULTS

In order to evaluate the efficiency of the algorithm, the proposed method should be tested by the variety of copy-move manipulated images. For a better judgment, various kinds of attacks such as rotation, AWGN, JPEG compression and blurring are performed on the copied regions. Regarding this issue, a dataset is created from 16 original images. This dataset is collected from personal images, dataset presented in [6] and the internet. In contrast to the other datasets, most of our selected images contain large portions of uniform areas. Copied regions are chosen both from textured and smooth areas. The dataset contains 240 forged images. All the mentioned attacks are considered in constructing the forged images. The details of the applied attacks are illustrated in Table 1. One sample of dataset images is illustrated in Fig. 3.

In order to evaluate the proposed approach, two recent block-based methods are selected. The first one is based on Zernike moments [7], while the other uses polar cosine transform (PCT) [8] for feature extraction. Both features are rotation invariant. In matching step, two mentioned methods utilize similar locality-sensitive hashing (LSH). LSH is employed for approximately finding the nearest neighbors. It is shown that the LSH based matching scheme is much more effective than the lexicographical sorting [8]. To assess the proposed adaptive threshold, the lexicographic sorting is employed instead of LSH. Applying adaptive threshold mainly affects the results of the matching process. Moreover, in the next steps such as filtering, the same algorithms can be employed for both approaches. Thus, the results of the matching processes are reported in order to assess the proposed method. It should be noted that a better results in the matching step would highly improve the overall performance. In order to implement the algorithm, the block size is considered as 24 and the minimum spatial distance between paired matches is selected as 50 for all the cases. Non-adaptive implementations employed LSH with quantization parameter 300 and 10 for Zernike moments and PCT respectively. In the proposed method, in order to calculate the adaptive threshold, α and β are set to 20 and 0 in Zernike moments and 6 and 2 for polar cosine transform. For similarity evaluation, each feature vector in lexicographic sorted matrix is compared with the next 50 vectors. The mean number of potential matches for both adaptive and non-adaptive (LSH) methods for both Zernike moments and PCT implementation is depicted in Table 2. It is shown that the number of found matches is drastically decreased by employing adaptive threshold. The decreasing ratios between proposed and PCT becomes 18, while this ratio rises up to 26 for proposed method and Zernike moments. Needless to say that reducing the number of potential matches provides better performance in filtering phase. Table 2: Mean of matches number

Table 1: Attacks and its parameters Attack Rotation Blurring Noise JPEG

Parameters Angle: 10, 30, 50, 70, 90 Filter radius: 0.5, 1.5, 2.5 Zero mean, Standard deviation: 0.001, 0.002, 0.003 Quality: 70, 80, 90, 100

Zernike PCT

1552

Adaptive 107955 54837

Non-adaptive (LSH) 2821909 911546

Ratio 26.14 18.682


Non-adaptive

TP-Zernike

80 70

Non-adaptive

FP-Zernike

50

Adaptive

Adaptive

40

60 50

30

40 20

30 20

10

10 0

JPEG

Rotation

Blurring

a

Non-adaptive

TP-PCT

80

0

Noise

Rotation

Blurring

b

Noise Non-adaptive

FP-PCT

50

Adaptive

70

JPEG

Adaptive

40

60 50

30

40 20

30 20

10

10 0

JPEG

Rotation

Blurring

c

0

Noise

JPEG

Rotation

Blurring

d

Noise

Fig. 4 The evaluation results: a. True positive of Zernike method b. False positive of Zernike method c. True positive of polar cosine transform d. False positive of polar cosine transform Two criteria are employed for results evaluation. The analysis is performed on pixel level. These are the ratio of correctly detected duplicated regions Tp (true positive) and erroneously matched blocks Fp (false positives). In the following equations, φd represents the detected regions, φf illustrates the forged regions, and φb corresponds to unchanged background.

Tp =

ϕ f ∩ ϕd ϕf

(6)

and Fp =

ϕ b ∩ ϕd ϕb

VI.

CONCLUSION

In this paper, an adaptive similarity threshold for CMFD algorithm is presented. This approach can be employed for most of the block-based copy-move forgery detection. We proposed that the matching threshold can be adjusted proportional to the standard deviation of the pair block’s intensity. It is illustrated that this relationship is almost linear. The effect of employing adaptive threshold is the higher performance in matching step, and therefore in the rest of the detection phases of the algorithm. In addition to reducing the potential matches, the presented approach outperforms the best recent LSH based methods in terms of true positive and false positive rates. References

(7) [1]

The detectability of the proposed method in terms of both true positive and false positive is reported too. Fig. 4 summarizes the performance of the proposed method in comparison with two non-adaptive (LSH) methods. As it is illustrated, applying adaptive threshold in matching step can improve the detection results in terms of both Tp and Fp.

[2] [3]

[4]

1553

H. Farid, "Image forgery detection," IEEE Signal Processing Magazine, vol. 26, pp. 16-25, 2009. A. Piva, "An Overview on Image Forensics," ISRN Signal Processing, vol. 2013, p. 22, 2013. Y. Cao, T. Gao, L. Fan, and Q. Yang, "A robust detection algorithm for copy-move forgery in digital images," Forensic science international, vol. 214, pp. 33-43, 2012. S.-J. Ryu, M.-J. Lee, and H.-K. Lee, "Detection of Copy-Rotate-Move Forgery Using Zernike


[5]

[6]

[7]

[8]

[9]

[10]

[11]

Moments," in Information Hiding. vol. 6387, R. Böhme, P. L. Fong, and R. Safavi-Naini, Eds., ed: Springer Berlin Heidelberg, 2010, pp. 51-65. H. Hailing, G. Weiqiang, and Z. Yu, "Detection of Copy-Move Forgery in Digital Images Using SIFT Algorithm," in Computational Intelligence and Industrial Application, 2008. PACIIA '08. PacificAsia Workshop on, 2008, pp. 272-276. V. Christlein, C. Riess, J. Jordan, C. Riess, and E. Angelopoulou, "An Evaluation of Popular CopyMove Forgery Detection Approaches," IEEE Transactions on Information Forensics and Security, vol. 7, pp. 1841-1854, 2012. S.-J. Ryu, M. Kirchner, M.-J. Lee, and H.-K. Lee, "Rotation Invariant Localization of Duplicated Image Regions Based on Zernike Moments," Information Forensics and Security, IEEE Transactions on, vol. 8, pp. 1355-1370, 2013. Y. Li, "Image copy-move forgery detection based on polar cosine transform and approximate nearest neighbor searching," Forensic science international, vol. 224, pp. 59-67, 2013. I. Amerini, L. Ballan, R. Caldelli, A. Del Bimbo, L. Del Tongo, and G. Serra, "Copy-move forgery detection and localization by means of robust clustering with J-Linkage," Signal Processing: Image Communication, vol. 28, pp. 659-669, 2013. I. Amerini, L. Ballan, R. Caldelli, A. Del Bimbo, and G. Serra, "A SIFT-Based Forensic Method for CopyMove Attack Detection and Transformation Recovery," Information Forensics and Security, IEEE Transactions on, vol. 6, pp. 1099-1110, 2011 2011. J. Fridrich, D. Soukal, and J. Lukas, "Detection of Copy Move Forgery in Digital Images," in Digital Forensic Research Workshop, Cleveland, OH, 2003.

[12] [13]

[14]

[15]

[16]

[17]

[18]

[19]

1554

A. C. Popescu and H. Farid. (2004). Exposing Digital Forgeries by Detecting Duplicated Image Regions. M. Bashar, K. Noda, N. Ohnishi, and K. Mori, "Exploring Duplicated Regions in Natural Images," Image Processing, IEEE Transactions on, vol. PP, pp. 1-1, 2010. L. Guohui, W. Qiong, D. Tu, and S. Shaojie, "A Sorted Neighborhood Approach for Detecting Duplicated Regions in Image Forgeries Based on DWT and SVD," in Multimedia and Expo, 2007 IEEE International Conference on, 2007, pp. 17501753. S. Bayram, H. T. Sencar, and N. Memon, "An efficient and robust method for detecting copy-move forgery," in Acoustics, Speech and Signal Processing, 2009. ICASSP 2009. IEEE International Conference on, 2009, pp. 1053-1056. S. L. Leida Li, Hancheng Zhu, "An Efficient Scheme for Detecting Copy-move Forged Images by Local Binary Patterns," Journal of Information Hiding and Multimedia Signal Processing, vol. 4, pp. 46-56, 2013. I. Amerini, L. Ballan, R. Caldelli, A. Del Bimbo, and G. Serra, "Geometric tampering estimation by means of a SIFT-based forensic analysis," in IEEE International Conference on Acoustics Speech and Signal Processing, 2010, pp. 1702-1705. V. Christlein, C. Riess, and E. Angelopoulou, "On rotation invariance in copy-move forgery detection," in Information Forensics and Security (WIFS), 2010 IEEE International Workshop on, 2010, pp. 1-6. R. Böhme and M. Kirchner, "Counter-Forensics: Attacking Image Forensics," in Digital Image Forensics, H. T. Sencar and N. Memon, Eds., ed: Springer New York, 2013, pp. 327-366.