2013 European Modelling Symposium
Copy-Move Image Forgery Detection Using Local Binary Pattern and Neighborhood Clustering
1
Motasem AlSawadi, Ghulam Muhammad, Muhammad Hussain
George Bebis Department of Computer Science and Engineering University of Nevada at Reno Reno, Nevada, USA e-mail:
[email protected]
College of Computer and Information Sciences, King Saud University, Riyadh, Saudi Arabia National Center for Nano Technology Research, KASCT, Riyadh, Saudi Arabia email: eng.mt@hotmail,
[email protected]
of post-processing such as median filtering, adding noise, etc. can be applied to the pasted area. Image forgery detection methods can be classified into two major groups, active and passive or blind. In active method, the watermarking information is known and the extracted watermark is checked against the known watermark to validate the authenticity. On the other hand, in passive method, we do not have any information about the watermarking. In this paper, a passive method for copy-move image forgery detection is proposed. In the proposed method, the color components of a color image are exploited. First, three color components (red, green and blue) are extracted from the test input image. Each component is divided into overlapping blocks. Then, local binary patterns (LBP) histogram is obtained for each block. The distance between a block-pair is calculated, and the block-pairs are sorted in ascending order of distance. Only one-fourth of the blockpairs are retained and the rest are discarded. If these retained block-pairs are present in all the three color components, they are selected as primary candidates of copy-move forgery. These candidates are refined using 8-neighborhood clustering. Finally, the survived blocks are colored differently for visual purpose. The paper is organized as follows. Section II gives a brief discussion on previous related work; Section III introduces the proposed copy-move image forgery detection method; Section IV gives experimental results with discussion. Finally, Section V draws some conclusions.
Abstract— This paper introduces a copy-move image forgery detection method based on local binary patterns (LBP) and neighborhood clustering. In the proposed method, an image is first decomposed into three color components. LBP histograms are then calculated from overlapping blocks from each component. The histogram distance between the blocks is calculated and the block-pairs having the minimal distance are retained. If the retained block-pairs are present in all the three color components, they are selected as primary candidates. 8connected neighborhood clustering is then applied to refine the candidates. The proposed method shows significant improvement in reducing the false positive rates over some recent related methods. Keywords- image forgery detection; LBP; 8-connected neighborhood; copy-move forgery
I.
INTRODUCTION
Verifying the integrity of digital images and detecting the traces of tampering without any prior or pre-embedded information have become an important and hot research field in image processing. The popularity and the rapid growth of this field led to a lot of research on this topic, reflecting on a high number of research articles in recent years [1]. The trustworthiness of photographs has an essential role in many areas, including forensic investigation, criminal investigation, surveillance systems, intelligence services, medical imaging, and journalism. The availability of powerful, easy to use computer graphics editing software to end users makes the job of manipulating image easier than ever. Anyone with basic knowledge of digital image and the tools in a computer graphics editing software will be able to modify an image with ease. Due to the widespread popularity of digital images and availability of powerful image processing tools, it is important to authenticate digital images, identify their sources, and detect forgeries [2]. There are manly three types of image forgery, which are image retouching, image splicing, and copy-move. The topic in this paper is related to copy-move forgery. In a copy-move image forgery, a part of an image is copied and pasted to another part of the same image. The copied part may be rotated, scaled, or deformed before pasting to fit in the pasted area. To conceal the trace of forgery, some types 978-1-4799-2578-0/13 $31.00 © 2013 IEEE DOI 10.1109/EMS.2013.43
II.
SOME RELATED PREVIOUS WORK
There have been a lot of works in image forgery detection in recent years. Sun et al. [2] proposed an image compositing detection method based on a statistical model for natural image in the wavelet transform domain, assuming that image compositing operations affect the inherent statistics of the image. The generalized Gaussian model (GGD) is employed to describe the marginal distribution of wavelet coefficients of images, and the parameters of GGD are obtained using maximum-likelihood estimator. The statistical features include GGD parameters, prediction error,
236 249
mean, variance, skewness, and kurtosis at each wavelet detail subband. Then, these feature vectors are used to discriminate between natural images and composite images using support vector machine (SVM). Li et al. [3] proposed a blind forensics approach based on discrete wavelet transform (DWT) and singular value decomposition (SVD) to detect the specific artifact. This approach works well when the image is highly compressed or edge processed. Bravo-Solorio et al. [4] proposed a forensic method to detect duplicated regions, even when the copied portion has experienced geometrical distortions such as reflection, rotation or scaling. To achieve this, overlapping blocks of pixels were re-sampled into log-polar coordinates, and then summed along the angle axis, to obtain a one dimensional descriptor invariant to reflection and rotation. Christlein et al. [5] presented a common pipeline for copy-move forgery detection, performed a comparative study on 10 previously proposed methods and introduced a new benchmark database for copy-move forgery detection. Their experiments strongly support the use of kd-trees for the matching of similar blocks instead of lexicographic sorting. Also, Fourier-Mellin transform (FMT) features showed a very good overall performance. Under geometric transformations, principal component analysis (PCA) and discrete cosine transform (DCT) exhibited remarkably strong results when using same shift vectors as verification criterion. Peng et al. [6] proposed a passive image copy-move forensics scheme, where a color image was transformed into a grayscale one, and wavelet transform based de-noising filter was used to extract the sensor pattern noise. Then the variance of the pattern noise, the signal noise ratio between the de-noised image and the pattern noise, the information entropy and the average energy gradient of the original grayscale image are chosen as features. The tampered areas are detected by analyzing the correlation of the features between the blocks and the whole image. The biggest drawback of the scheme is that it cannot self-adaptively adjust the threshold. Multi-resolution LBP is used in a recently proposed image forgery detection method [7]. The LBPs are extracted using different neighborhoods and radii for the blocks of an image. Random sample consensus (RANSAC) algorithm is used for clustering to reduce the false matches. Shift invariant features transform (SIFT) based copy-move forgery detection and localization is proposed with J-Linkage clustering in [8]. The authors claimed that the method could accurately localize the forgery even if the pasted area was close to the copied area. Dyadic wavelet transform based image forgery detection method is proposed in [9], and found to have good performance in JPEG image with low compression quality factor. From the above discussion, we find that though there exists a number of copy-move forgery detection methods, almost none of them fully utilize different color information of an image to detect the forgery. In our proposed method, we utilize such information.
III.
PROPOSED METHOD
Fig. 1 shows a flow chart of the proposed copy-move image forgery detection method. First, an input image is decomposed into three color (red, green, and blue) components. The reason behind this decomposition is to utilize multiple information present in different color components. In most of the available methods, first the color image is converted into grayscale image. During this conversion, some approximated weights are used to the three color components to produce the grayscale. In this process, some weak but important traces of forgery may lose. Each component is divided into overlapping blocks. We tried with different sizes of blocks and overlapping, and finally fixed the block size to be 20 × 20 with 50% overlapping. It is assumed that the copied or the forged blocks are at least of the size of 40 × 40, which is quite reasonable in the context of image forgery. The next step of the proposed method is to extract LBP histograms for each block of each component. A. LBP LBP is a texture descriptor that labels each pixel in the image by thresholding the neighborhood pixels with the center pixel and considering the result as a binary number. Then, the texture can be described by the histogram of these label values [10]. A basic LBP operator is calculated in a rectangular window. LBP can also be extracted in a circular neighborhood (P, R), where P is the number of neighbors and R is the radius of the neighborhood. In this work, we have experimented both with the basic and circular LBP using P = 8 and R = 1. The results are reported with circular LBP only. The normalized LBP histogram is used as a feature vector for the corresponding block. The histogram has 256 bins corresponding to 256 gray values. The reason behind using LBP is that we are interested in texture, which remains similar in the copied and pasted area even some post-processing is applied after forgery. Therefore, the texture pattern can be a good indicator of forgery detection. Fig. 2 gives an example of LBP histograms of four blocks, three of which represent copy-move, and the other is not copy-move in three color components. In the image figure, lower left green object is copied and pasted into two different locations (upper side). For simplicity, blocks are drawn as non-overlapping. From the figure, we see that the copymoved blocks (block number 23, 28, and 63) have similar LBP histograms in a respective color component, while the histogram of block number 79 is totally dissimilar. B. Primary Candidate Selection After extracting LBP histograms of the blocks, the distance between every two blocks is calculated using some distance measure. In the proposed method, we use city block distance due to its simplicity and good performance in histograms. The block pairs are sorted according to ascending order of distance to produce a list. In this way, the closely resembled block pairs will appear at the top of the list. If there is total M number of blocks in an image, the number of block pairs will be M C . First one-fourth block 2
250 237
primary candidate list. The entries in this list are the candidates of copy-move, because the existing block pairs have similar texture in all the three color components. However, after this step, we may find some false positives (non-duplicated blocks are detected as duplicated blocks) due to homogeneity in the image content. In the next step, the primary candidates are refined using neighborhood clustering. C. Neighborhood Clustering First, we delete the block pairs, which are closely located, from the list. The copied and pasted blocks must be apart at least by two blocks in any direction. To accomplish this, the coordinates of top left corner of the blocks are utilized. After deleting the closely located block-pairs from the list, a new neighborhood clustering technique is applied to remove isolated block candidates. In the neighborhood clustering technique, the algorithm searches along 8neighborhood of a candidate block-pair. Suppose, a blockpair is in the candidate list. We find the 8-connected neighbors of Bi and Bj each, and check whether the neighbors of Bi and Bj are also in the list or not. For example, Bi_2 and Bj_5 are neighbors of Bi and Bj, respectively. Then we search for the block-pair in the list. If such T numbers of block-pairs are present in the list, we retain < Bi, Bj > in the list, otherwise we remove it from the list. In the experiments, we varied the number of T from 3 to 8 and found 4 to be the optimum. Fig. 3 shows two examples of neighborhood clustering where the value of T is 4. In Fig. 3 (a), the algorithm correctly classifies block pair as copy-move pair, while in Fig. 3 (b), it correctly removes block pair from the list, though this pair is present in the primary candidate list. The last step of the method is to fill the copy-move blocks with black color for visualization purpose. However, if the image contains a lot of black colors, visualization can be done with another color. IV.
EXPERIMENTS
The proposed copy-move image forgery detection method is evaluated using different types of original and forged images. The images are taken from mainly two sources. The first set of images is downloaded from http://faculty.ksu.edu.sa/ghulam/Pages/ImageForensics.aspx. The images are of size 200 × 200 and in JPEG format. Forged images are created by either single or multiple copymove operations. There are 10 original images and their at least one forged version each. The other set of images are taken from CASIA TIDE v2.0 database [11]. CASIA TIDE v2.0 dataset contains a total number of 12614 images. 7491 images are authentic and the remaining 5123 are forged images of which 3300 are copy-move and the remaining 1823 are spliced. In this paper, we consider only copy-move forgery. The image sizes vary from 240 × 160 to 900 × 600 pixels, and they are in JPEG, BMP or TIFF formats. In more than half of the forged images, copied part is rotated and/or scaled before pasting. A detailed counting of number of rotated and scaled images in CASIA TIDE v2.0 database is
Figure 1. Flow chart of the proposed copy-move image forgery detection method.
pairs in the sorted list are retained and the rest are discarded, because they are less likely to be copy-move pairs. The above procedure is repeated to all the three color components. The retained block pairs are checked across all the color channels. If a block pair is present in all these components, we put it in a separate list, which is called
251 238
Figure 2. Illustration of LBP histogram similarity between the copied and pasted blocks, and dissimilarity between non copy-move parts in three color components.
In the equations, TP represents true positives, FP refers to false positives, and FN corresponds to false negatives. These measures are calculated in blocks rather than pixels. If more than 50% area of a block is under copy-move attack, we consider that block as forged block.
given in [12]. To generate the ground truth, the original image is subtracted from the forged image. Fig. 4 shows one of the examples of ground truth. The performance of the proposed method is evaluated using precision-recall (PR) curves [14]. The equations of precision and recall are given in Eq. (1) and Eq. (2), respectively. TP TP + FP TP Recall = TP + FN
Precision =
A. Results The performance of the proposed method is compared with two other related methods that are described in [6] and [13]. In [6], the authors use compound statistics, while in [13], the authors utilize noise inconsistency to detect forgery. The performance comparison is reported in PR curves in four sets. In Fig. 5 (a), the results are shown when the pasted part did not have rotation or scaling. Fig. 5 (b), 5 (c), and 5 (d) show the results when the pasted part underwent rotation,
(1) (2)
252 239
Figure 3. Illustration of connected neighborhood clustering to remove false positives.
Figure 4. An example of (a) original image, (b) forged image, and (c) the ground truth image.
neighborhood clustering technique is also introduced to reduce the false positives. In the experiments, the proposed method outperforms two other contemporary methods in different types of forgery cases. In a future work, the work will be extended to detect forged images where various types of post-processing are applied on the pasted part.
scaling, and rotation plus scaling, respectively. From the figure, we see that the proposed method outperforms the methods in [13] and [6] in all the cases. When there is simple copy-move forgery without any rotation or scaling, the proposed method has more than 95% precision and recall at the same time. As expected, the performance of the methods degrades when the pasted parts undergo rotation and scaling both. However, the proposed method still performs far better than the two other methods. V.
ACKNOWLEDGMENT CONCLUSION
This work was supported by the National Plan for Science and Technology, King Saud University, Riyadh, Saudi Arabia under project number 10-INF1140-02.
An efficient detection method of copy-move image forgery is proposed. The proposed method utilizes three color components and LBP to find texture patterns. The
253 240
REFERENCES [1]
[2]
[3]
[4]
(a)
[5]
[6]
[7]
[8] (b) [9]
[10]
[11]
[12] (c) [13]
[14]
(d) Figure 5. Average PR curves of the three methods in four different forgery cases.
254 241
B. Mahdian and S. Saic,"Detecting Double Compressed JPEG Images", Proc. 3rd Int. Conf. Imaging for Crime Detection and Prevention, 2009. S.J. Sun, Q. Wu and G.H. Li, " Detection of image compositing based on a statistical model for natural images", Acta Automatica Sinica, Vol. 35, No. 12, pp. 1564-1568, 2009. G. Li, Q. Wu, D. Tu and S .Sun, " A sorted neighborhood approach for detecting duplicated regions in image forgeries based on DWT and SVD", International Conference on Multimedia and Expo (ICME) 2007, pp. 1750-1753. S. Bravo-Solorio and A. K. Nandi, "Passive forensic method for detecting duplicated regions affected by reflection, rotation and scaling", 17th European Signal Processing Conference (EUSIPCO 2009), pp.824-828. V. Christlein, C. Riess and E. Angelopoulou "A Study on Features for the Detection of Copy-Move Forgeries", Proc. Information Security Solution Europe (ISSE 2010), pp. 105-116. F. Peng, Y. Y. Nie and M. Long, "A complete passive blind image copy-move forensics scheme based on compound statistics features", Forensic Science International 212 (2011), pp. e21-e25. R. Davarzani, K. Yaghmaie, S. Mozaffari, and M. Tapak, “Copymove forgery detection using multiresolution local binary patterns”, Forensics Science International, vol. 231, pp. 61-72, 2013. I. Amerini, et al., “Copy-move forgery detection and localization by means of robust clustering with J-Linkage”, Signal Processing: Image Communication, DOI: 10.1016/j.image.2013.03.006, 2013. G. Muhammad, M. Hussain, G. Bebis, “Passive copy move image forgery detection using undecimated dyadic wavelet transform,” Digital Investigation, vol. 9 (1), pp. 49-57, 2012. T. Ahonen, A. Hadid, and M. Pietikainen, " Face Description with Local Binary Patterns: Application to Face Recognition", IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 28, no. 12, December 2006. J. Dong, W. Wang, “CASIA tampered image detection evaluation (TIDE) database, v1.0 and v2.0,” 2011. Downloadable at http://forensics.idealtest.org/. M. Jabery, G. Bebis, M. Hussain, and G. Muhammad, “Accurate and robust localization of duplicated region in copy-move image forgery,” Machine Vision and Applications, DOI: 10.1007/s00138-013-0522-0, 2013. B. Mahdian and S. Saic, “Using noise inconsistencies for blind image forensics,” Image and Vision Computing, vol. 27(10), pp. 1497–1503, 2009. D. M. W. Powers, “Evaluation: from precision, recall and f-factor to ROC, informedness, markedness & correlation,” J. Machine Learning Tech., vol. 2(1), pp. 37-63, 2011.
