This full-text paper was peer-reviewed and accepted to be presented at the IEEE WiSPNET 2017 conference.
Copy–Move Forgery Detection Exploiting Statistical Image Features Rahul Dixit,1 Ruchira Naskar2 and Aditi Sahoo3 Department of Computer Science and Engineering National Institute of Technology, Rourkela Odisha-769008, India Email: 1
[email protected] 2
[email protected]
Abstract—Copy–move forgery is a form of forgery on digital images, where an area of an image is copied and pasted to a different position of the same image. Majority of the image forgery detection techniques try to find dissimilarities or variation in natural image statistics. However such techniques fail in case of region duplication forgery detection, since here the forged area originates from the image itself. In this paper, we introduce a technique to find duplicate regions in an image, which exploits statistical features of an image. We use mean and variance for this purpose here, by splitting the image into pixel blocks. Mean is used to find the contribution of each individual block with respect to pixel intensity of the entire image, and variance is used to find how each pixel varies from its neighbors in a block. We evaluate the presented algorithm and compare with others copy–move forgery detection methods. According to our experimental results it is clear that presented algorithms is better perform to the existing techniques. Index Terms—Copy–move forgery, Detection accuracy, Digital Forensics, Discrete Wavelet Transform, False positive rate, Image forgery, Mean, Variance.
(a) Original image
I. I NTRODUCTION In today’s digital world, multimedia act as the primary means of communication, and are regularly transmitted in large numbers over public channels such as the internet. In addition, multimedia act as the primary sources of clue regards any incident and largely influence judgments related to criminal investigations in the court of law. They are considered as the most valuable evidences to prove the veracity of any incidence. However, with the development of low-priced image and video editing tools, images and videos are losing their reliability and trustworthiness, very rapidly [1]. The broad adoption of cheap and easy-to-use image processing software is primarily responsible for the vast increase in image forgery rate in today’s cyber world. Due to the huge growth in the use of image editing tools like Microsoft Paint, picture manager etc., region duplication detection has now become a very trivial task. Hence assuring the integrity and correctness of digital images and videos poses to be a very crucial challenge today. This has gained several research activity among security and forensic researchers in the recent decade. Image forgery are of different forms such as image splicing [4], where image can be forged by combining multiple authentic images into one; image retouching [5], which is nothing but editing regions of an image to obscure significant information; etc. In this paper, we deal with copy–move [6] form of image forgery where a region of an image is copied and pasted onto itself, at a different location, with the
c 978-1-5090-4442-9/17/$31.00 2017 IEEE
(b) Region duplicated image Fig. 1. Example of copy move image forgery attack.
malicious intention to repeat or obscure significant objects in an image. An intelligent adversary, many times performs postprocessing actions on the forged image, such as noise addition, edge smoothening and filtering, so that the forged image looks natural. In the current times, a number of researchers have proposed different digital forensic techniques for region duplication forgery detection [6], [12–15]. Fig. 1 shows a typical example of region duplication forgery, where a car has been copied from the original image and pasted on to itself at a different location, to generate the tampered image. Traditional multimedia security techniques, such as Digital Watermarking, Steganography [2] and Digital Signatures [3], require data pre-processing in some form or the other. For example, computation of hash, watermarks etc., and embedding those into the cover. Such techniques are active.
2277
This full-text paper was peer-reviewed and accepted to be presented at the IEEE WiSPNET 2017 conference.
Such techniques require the devices to be equipped with specialized hardware chips and embedded software. However, for cyber-crime investigation we cannot assume such form of pre-computed information to be available always. Digital Forensics is the presently growing field of science which involves recovery and investigation of evidences left behind in digital devices and files, for detection of cyber-crimes and forgery. Digital Forensic methods are blind (passive) and are completely based on post-processing of data. Here, we present a region duplication forgery detection technique, which statistical features of an image, such as mean and variance. Initially, we decompose the possibly forged image into four sub-bands. The LL sub-band (having maximum information) is divided into fixed sized overlapping blocks. The mean of each block is computed and stored into a matrix. Similarities between blocks are computed based on their means, using Euclidean distance, and the most similar block pairs, decided using an empirically chosen threshold, are used to denote the duplicate image regions. The proposed scheme achieves an optimal false positives rate, by utilizing the variance of duplicate image block pairs. The remains paper is arranged as follows. A brief review of existing region duplication forgery detection techniques is provided in Section II. In Section III, we describe the presented mean and variance based forgery detection algorithm in detail. Our experimental results are given and talked about in Section IV. Also the proposed technique is analyzed across the existing methods in Section IV. Lastly, in Section V we wind up with future research work.
II. L ITERATURE S URVEY In the recent years, a number of forensic researchers have proposed different techniques for digital image region duplication detection, such as [6–10], [12–15]. Among these, the work in [6] is one of the most primary and significant researches in this direction, where the authors proposed four different principles for efficient copy–move forgery detection, viz., autocorrelation, exact block matching, robust matching, and exhaustive search. Farid and Popescu [12] proposed a region duplication identification scheme based on Principle Component Analysis (PCA). This technique is much less sensitive to lossy compression. The authors in [9], proposed a technique based on Discrete Cosine Transform (DCT) for copy–move forgery detection. This method is significantly efficient to detect multiple duplication forgeries in an image. Huang et al. [8] suggested a algorithm which is robust against Additive White Gaussian Noise as well as lossy JPEG compression. Zhang et al. [10] suggested a region duplication forgery algorithm based on Discrete Wavelet Transform (DWT). In this method the image is first divided into four fixed size regions and the similarity criterion is calculated among these regions, using the phase correlation principle. Qiao et al. [18] proposed a region duplication detection scheme based on curvelet transform. This scheme
is robust to rotation and re-scale attacks as well as computational complexity is low as comparison to other related methodologies. The Fourier Mellin Transform (FMT) based feature extraction method is presented by Bayram et al. [13], which is also capable of detecting copy-rotate-move (less than 10◦ ) and copy-scale-move forgeries in addition to plain copy–move forgery detection. Among the recent researches, In [14], the authors proposed a Double Quantization DCT based approach, which is robust towards Joint Photographic Experts Group (JPEG) compression. Another note-worthy region duplication detection technique, robust to JPEG compression was presented by Muhammad et al. in [16], which is based on undecimated dyadic wavelet transform (DyWT). III. P ROPOSED C OPY–M OVE F ORGERY D ETECTION T ECHNIQUE Here, we present the proposed technique for region duplication forgery detection, exploiting statistical image features, mean and variance, and based on DWT of an image. Fig. 2 displays the flowchart of the proposed technique. Below, we present the steps included in the presented copy–move forgery detection algorithm, including the detailed feature extraction, similarity calculation and thresholding procedures. (1) Initially we take the forged image of size W × H pixels (say) as an input. If the image is RGB format, we convert it into grayscale using to following Eqn.: I = 0.299 × Red intensity + 0.587 × Green intensity + 0.114 × Blue intensity. (1) (2) We are enforced the DWT on the forged image. Forged image attain into four sub-bands at scale 1. Out of these sub-band approximation sub-band (LL1) contains highest similarity as well as maximum information of an image. Hence, we selected LL1 sub-band for further processing. (3) Next, LL1 sub-band is split into overlapping blocks of size P × P pixels. (4) Hence, the total number of overlapping blocks is (W/2 − P + 1) × (H/2 − P + 1). The mean value sequence M1 , M2 . . . M((W/2−P +1)×(H/2−P +1)) is calculated from the corresponding blocks B1 , B2 , . . . B(W/2−P +1)×(H/2−P +1) , as: Mi =
P ×P 1 xij P × P j=0
(2)
where Mi is the mean of LL1 approximation coefficients (xij ) of block Bi . The M1 , M2 . . . M(W/2−P +1)×(H/2−P +1) values are stored into a (W/2 − P + 1) × (H/2 − P + 1) matrix, say A. The rows of matrix A are sorted. (5) For calculation of similarity between blocks, we measure the following Euclidean distance: ⎞1/2 ⎛ (H/2−P +1) . D (x, y) = ⎝ (Axi − Ayi )2 ⎠ (3)
2278
i=1
This full-text paper was peer-reviewed and accepted to be presented at the IEEE WiSPNET 2017 conference.
Fig. 2. Flow chart of the proposed method.
where D(x, y) is the Euclidean distance between a pair of rows of A, Ax and Ay , where Ax = (Ax1 , Ax2 , . . . Ax(H /2−P +1 ) and Ay = (Ay1 , Ay2 , . . . Ay(H/2 −P +1) ). (6) The block pairs for which D(x, y) < Ts , (where Ts is an empirically selected similarity threshold), are decided to be duplicates. In the next subsection, we present the algorithm for optimizing false matches resulting from the above procedure. A. Optimizing False Matches It was noted that the copy–move forgery detection scheme proposed above produces false block matches or false positives. Here we present a technique for optimization of false matches in the proposed method. For reduction of false matches we calculate variance of each block. Variance value is conventionally used to measure the degree of variance of a pixel in an image block, from its neighbors. This has been exploited here to minimize the false matches in the proposed techniques, as: (7) We consider the block pairs for which D(x, y) < Ts (as computed by steps 1–6 above), for false matches reduction. (8) The variance of each such block pair is calculated as: Vi =
P ×P 1 ·(xij − Mi )2 . P × P j=1
(4)
(9) Out of all block pairs considered in step 7, now the algorithm decides only those block pairs to be duplicates, which have identical variance values. That is, blocks Bi and Bk are decided to be duplicates if and only if Vi = Vk . In Fig. 3, we display the result of the presented approach for detection of copy–moved regions for two different images. We also show in Fig. 3(b), (e) that the proposed technique
Fig. 3. Output of the proposed algorithm. Detected copy–move regions are shown in white. The false matches are highlighted with yellow boxes.
leads to some false matches, which are eliminated by application of the false matches’ optimization technique (presented in Section III-A). The final optimized results are shown in Fig. 3(c), (f). Detailed experimental outputs are presented in Experimentation and Evaluation Section. Next, we present the performance evaluating parameters used in this paper. B. Performance Evaluation We figure out the effectiveness of the presented method with reference to two parameters, as defined next.
2279
This full-text paper was peer-reviewed and accepted to be presented at the IEEE WiSPNET 2017 conference. TABLE I DA AND FPR R ESULTS FOR THE P RESENTED M EAN -VARIANCE BASED T ECHNIQUE . Block size (pixels)
DA (%)
FPR1 (%)
FPR2 (%)
5×5 10 × 10 15 × 15 20 × 20 25 × 25 30 × 30 35 × 35
98.5186 98.4263 98.4092 98.4007 98.3770 98.3089 98.2972
6.2592 6.1293 6.1129 6.0382 6.0647 6.0184 5.9374
2.7709 2.3956 2.4251 2.8134 2.4074 2.4692 2.6008
Those are, Detection Accuracy (DA) and False Positive Rate (FPR). We also examine the effectiveness of the proposed algorithm with the existing methods in terms of these parameters. Our experimental outputs are presented in next Section. Detection Accuracy (DA) is the percentage of (actually) copy–moved pixels in an image, which are accurately detected by a particular region duplication detection method to be copy–moved. Higher efficiency implies higher detection accuracy. DA =
Fig. 4. Detection accuracy vs. P comparison results.
# Correctly detected copy-move pixels × 100%. # actually copy-moved pixels (5)
False Positive Rate (FPR) is described as the total number of actual image pixels, incorrectly detected to be forged, and formulated as: # incorrectly detected copy-move pixels FPR = × 100%. # actually copy-moved pixels (6)
Fig. 5. False positive rate vs. P comparison results.
IV. E XPERIMENTATION AND E VALUATION The presented mean-variance based methodology has been executed in MATLAB. Our test data consists of a set of 512 × 512 color as well as grayscale images, taken from the CoMoFoD [19] Database. For the sake of experimentation, we have selected test images with copy–move forgery induced into them. (Two such examples are displayed in Fig. 3(a) and (d), where the images have been manually forged to measure the capability of the presented algorithm.) The DA and FPR results of the presented technique (presented in Section III) are presented in Table I, columns DA and FPR1, respectively. Column FPR2 indicates the improvement in false positive rate obtained after application of the false positive optimization method (presented in Section III-A). DA and FPR values in Table I display that as block size varies from 5 × 5 to 35 × 35, the detection accuracy varies between 98.2972% and 98.5186% and the FPR varies between 5.94% and 6.26%. After optimizing the false matches, the false positive rate is minimized, which is now in the range of 2.3956%–2.8134%. All the results presented in Table I are averaged over all our test images. We compare the efficiency of the presented method with six different existing copy–move forgery detection techniques,
which are based on the following principles of operation: (a) Principle Component Analysis (PCA) [12] (b) DCT [6] (c) SVD [17] (d) Improved DCT [8]. (e) Discrete Wavelet Transform (DWT) [10], (f) Dyadic Wavelet Transform (DyWT) [16] and (g) Dyadic Wavelet Transform with Zernike moment [11]. The performance has been compared in terms of DA and FPR, in Figs. 4 and 5, respectively. Figs. 4 and 5 present the comparison results with reference to DA vs. block size, and FPR vs. block size plots. From Figs. 4 and 5, it is evident that the presented algorithm achieves lower false positive rate and higher detection accuracy as comparison to other existing techniques. V. C ONCLUSION AND F UTURE W ORK The proposed method operates by splitting an image into fixed size overlapping blocks, in its frequency domain, and considering statistical features, mean and variance, of each individual block. The proposed methodology performance is evaluated by using matrices DA and FPR. According to our experimental results it is observed that the presented method’s performances is raised. Our experimental results also prove
2280
This full-text paper was peer-reviewed and accepted to be presented at the IEEE WiSPNET 2017 conference.
that the presented technique exceed the existing techniques with reference to detection accuracy and false positive rate. Future work of this research includes the association of copy-scale-move and copy-rotate-move duplicated image areas. R EFERENCES [1] J. A. Redi, W. Taktak, and J. Dugelay, “Digital image forensics: a booklet for beginners,” Multimedia Tools and Applications, vol. 51, no. 1, pp. 133–162, 2011. [2] I. J. Cox, M. L. Miller, J. A. Bloom, J. Fridrich, and T. Kalker Digital Watermarking and Steganography, Morgan Kaufmann Publishers, 2008. [3] L. Chun-Shien and H. Liao, “Structural digital signature for image authentication: an incidental distortion resistant scheme,” IEEE Transactions on Multimedia, vol. 5, no. 2, pp. 161–173, 2003. [4] J. A. Redi, W. Taktak, and J. Dugelay, “Image splicing detection using 2-d phase congruency and statistical moments of characteristic function,” in Society of Photo Optical Instrumentation Engineers (SPIE) Conference, 2007. [5] V. Savchenko, W. Kojekine, and N. Unno, “A practical image retouching method,” in Proceedings of First International Symposium on Cyber Worlds, pp. 480–487, 2002. [6] A. J. Fridrich, B. D. Soukal, and A. J. Luk, “Detection of copy–move forgery in digital images,” in Proceedings of Digital Forensic Research Workshop, 2003. [7] G. Muhammad, M. Hussain, and G. Bebisi, “Passive copy move image forgery detection using undecimated dyadic wavelet transform,” Digital Investigation, vol. 9, no. 1, pp. 49–57, 2012. [8] Y. Huang, W. Lu, W. Sun, and D. Long, “Improved DCT-based detection of copy–move forgery in images,” Forensic Science International, vol. 206, no. 1, pp. 178–184, Aug. 2011. [9] Y. Cao, T. Gao, L. Fan, and Q. Yang, “Arobust detection algorithm for copy–move forgery in digital images,” Forensic Science International, vol. 214, no. 1, pp. 297–309, 2012.
[10] J. Zhang, Z. Feng, and Y. Su, “A new approach for detecting copy–move forgery in digital images,” in Communication Systems, 2008. ICCS 2008. 11th IEEE Singapore International Conferenceon, pp. 362–366, 2008. [11] J. Yang, P. Ran, D. Xiao, and J. Tan, “Digital image forgery forensics by using undecimated dyadic wavelet transform and Zernike moments. Journal of Computational Infor mation Systems,” in 11th IEEE Singapore International Conference on Communication Systems (ICCS), vol. 9, no. 16, 2008. [12] A. P. Farid and A. C. Popescu, “Exposing digital forgeries by detecting duplicated image region,” [Technical Report], Hanover, Department of Computer Science, Dartmouth College. USA, 2004. [13] S. Bayram, H. T. Sencar, and T. N. Memon, “An efficient and robust method for detecting copy–move forgery,” in IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) 2009, pp. 1053–1056, 2009. [14] Z. Lin, J. He, X. Tang, and C. K. Tang, “Fast, automatic and fine–grained tampered JPEG image detection via DCT coefficient analysis,” Pattern Recognition, vol. 42, no. 11, pp. 2492–2501, 2009. [15] B. Mahdian and S. Saic, “Using noise inconsistencies for blind image forensics,” Image and Vision Computing, vol. 27, no. 10, pp. 1497–1503, 2009. [16] G. Muhammad, M. Hussain, and G. Bebisi, “Passive copy–move image forgery detection using undecimated dyadic wavelet transform,” Digital Investigation, vol. 9, no. 1, pp. 49–57, 2012. [17] X. Kang, M. Hussain, and S. Wei, “Identifying tampered regions using singular value decomposition in digital image forensics,” in International Conference on Computer Science and Software Engineering, 2008, vol. 3, no. 1, pp. 926–930, 2008. [18] M. Qiao, A. Sung, Q. Liu, and B. Ribeiro, “A Novel approach for detection of copy–move forgery,” in Proceedings of Fifth International Conference on Advanced Engineering Computing and Applications in Sciences (ADVCOMP 2011), 2011. [19] D. Tralic, I. Zupancic, S. Grgic, and M. Grgic, “CoMoFoD-New database for copy–move forgery detection,” in 55th IEEE International Symposium ELMAR 2013.
2281
