Detection of Copy-Move Forgery in Images Using ... - Springer Link

Detection of Copy-Move Forgery in Images Using Segmentation and SURF V.T. Manu and B.M. Mehtre

Abstract In this era of multimedia and information explosion, due to the cheap availability of software and hardware, everyone can capture, edit, and publish images, without much difficulty. Image editing done with malicious intentions known as image tampering, may affect individuals, society, economy and so on. Copy-move forgery is one of the most common and easiest image tampering method which involves copying a patch of an image and pasting it within the same image. The purpose of this may be to conceal some objects in the image or conceal the artifacts of image editing. In this paper, we propose a new method to detect copy-move tampering in images, without prior image information, using an over complete segmentation and keypoint detection. It is evident from the experimental results obtained by testing it on standard datasets, that the proposed method is tolerant to postprocessing operations like blurring, JPEG compression, noise addition and so on. Also, our method is effective in detecting copy-move forgery where copied portions are subjected to various geometric transformations, like translation, rotation and scaling. Keywords Copy-move forgery · Image segmentation · SURF

1 Introduction Digital images finds a plethora of space on the internet from being photographs on social networking sites to critical financial documents. With most people using their V.T. Manu(B) · B.M. Mehtre Institute for Development and Research in Banking Technology (IDRBT), Hyderabad 500057, India e-mail: {vtmanu,bmmehtre}@idrbt.ac.in V.T. Manu School of Computer Science and Information Sciences(SCIS), University of Hyderabad, Hyderabad 500046, India © Springer International Publishing Switzerland 2016 S.M. Thampi et al. (eds.), Advances in Signal Processing and Intelligent Recognition Systems, Advances in Intelligent Systems and Computing 425, DOI: 10.1007/978-3-319-28658-7_55

645

646

V.T. Manu and B.M. Mehtre

smartphones and tablets than their desktop computers or laptops for their computing needs; capturing, posting and circulating images on social media platforms and photo sharing sites have increased tremendously. Along with this, a considerable number of powerful image manipulation programs and apps are in the market both free and open source and otherwise; simplifying the effort of a potential perpetrator to tamper images for the good or the bad. There are plenty of ways that an image can be forged or tampered, of which the most easiest for the manipulator and hardest for the detector is the copy-move forgery. Copy-move forgery involves copying a particular area of the image and pasting it on another area on the same image. As this happens within the same image it may be likely that most of the image parameters remains the same, say for example the illumination condition and the texture, making the task challenging for a detector. The intention of such an attack may be to hide a particular detail in the image while exploiting the aforementioned observation to its maximum benefit. A classical example of an copy-move forgery and its detection is presented in Fig. 1, related to a controversial photo of Iran’s so-called successful missile test that ran in newspapers and websites worldwide during July 2008. The photo shows four missiles launching into the sky, with the third missile appearing to be the copymove of the second missile. This was done to hide a launcher on the ground with an unfired missile. Image tampering detection methods are classified into two based upon the detector’s cognizance of the prior image information- active and blind. The former being informed and the latter being uninformed about the image information. Examples of active methods are steganography and watermarking, wherein, certain information required for proving the genuineness of the image are intentionally embedded into it. But this methods has a few limitations, like a dedicated hardware which may be expensive. Also, a forensic investigator may not expect to get an image which has been undergone an active method. Thus in most of the realistic situations, active methods cannot be depended upon. Blind or passive methods uses the information inherently present in a given image to find traces of tampering.

(a)

(b)

Fig. 1 Iran’s missile launch test. (a) The doctored image from the website of Sepah News, the media arm of the Iranian Revolutionary Guards. (b) The original version released on the online service of the Iranian daily, Jamejam Today.

Detection of Copy-Move Forgery in Images Using Segmentation and SURF

647

In this paper, we introduce a new blind method to detect copy-move forgery in an image by first segmenting the image into different regions and later looking for matches by finding interesting points within them.

2 Related Work In copy-move forgery detection algorithms, we search for visually similar regions in a given image. So the forgery detection problem is a matching problem [5]. The seminal works in image tampering detection started with [4] and [5]. There are two basic approaches to search for matching of such regions (Fig. 2). They are: • Key/interest point detection: Identify and select regions of high entropy. • Block tiling: Tile the image into overlapping blocks. The shapes of the blocks can be any geometrical structure, like a circle, square or a rectangle. Feature vectors are computed for every key-point in the former and for every overlapping blocks in the latter. Though there are large number of works on copy-move

Copy-Move Detection Algorithms

Key-Point Based

Block Matching Based

Fig. 2 Common workflow of copy-move detection algorithms

forgery detection in general and specifically based on keypoint based approaches, we were interested on the ones which used SURF(Speeded-Up Robust Features) as the keypoint descriptor. Bo et al. [8] proposed a work which detect copy-move regions by matching the SURF descriptors vectors using distance measure and calculating the ratio of the nearest neighbor and the second-nearest neighbor and grouping them if they are greater than a predefined threshold. The limitation of this work is that it is not able to automatically locate tampered regions and its boundary. In [9], the authors have extracted the SURF keypoints and represented using a data structure called k-d tree. k-d tree helps to efficiently search for nearest neighbors which represent areas of duplication. But it fails to localize small copy-moved areas. They performed the testing on some images from the dataset by [3] but have not presented the details of the results in terms of precision and recall. So it is not possible for us to make a comparison with their performance.

648


3 Background of the Proposed Copy-Move Detection Algorithm In our work, we adopt a keypoint based method to detect copy-move forgery using SURF [2] which is an improvised or rather time-efficient version of Scale Invariant Feature Transform (SIFT) [6]. Both does scale space analysis, for which SIFT approximates Laplacian of Gaussian (LoG) with Difference-of-Gaussian (DoG) whereas SURF approximates LoG with Box Filters. Convolution with box filter can be computed parallely for different scales with the help of integral images and also the use of Haar wavelets makes SURF faster than SIFT making it a better candidate for real-time applications, but compromising accuracy than SIFT. It is a well known fact that SURF is capable of giving better keypoints than SIFT when subjected to image quality degradation. Segmentation of images is done using the algorithm based on the concept of superpixels using a method called simple linear iterative clustering (SLIC) [1] which performs local clustering of pixels in the 5-D space defined by the L, a, b values of the CIELAB color space the x, y pixel coordinates.

4 Proposed Method The copy-move forgery detection algorithm that we propose takes an image as input and outputs the same image highlighting the regions of copy-moved areas. We employ two parallel approaches on the input image as mentioned below: 1. Key point generation using SURF [2] (“Key Points” block in Fig. 3). 2. Segmentation to generate the region map of the image for which we use the simple linear iterative clustering (SLIC) [1]. The resulting region label matrix (“Region Labels” block in Fig. 3) is stored and used in later stage of our method. As copy-move forgery involves copying a region of the image and pasting it at some other location within the same image, the SURF keypoints at these locations may have almost same features. So, in order to find if a particular keypoint occurs elsewhere in the image, we compute the correlation among the SURF features. The steps till here has been represented as a flowchart in Fig. 3. We make an assumption that the copy-pasted regions are separated by a distance which is proportional to the dimensions of the input image. For example, in an image whose dimensions are more than 400 × 400 sq. pixel units, the copy moved region may be approximately 100 to 120 pixel units apart. Based on this assumption, we compute the Euclidean distance between the keypoint locations and those keypoints having value above a particular threshold are considered for later analysis. These keypoints are analyzed for replication by computing the keypoint feature correlation among each other and those keypoints having value greater than a particular threshold are assigned a particular label. This is nothing but a clustering operation


649

input image

Segmentation

Key Point Extraction

Region Labels

Key Points Feature Correlation

Region Label Matrix

Labelled Matched Key Points Key Point Table

Copy-Move Candidate Selection

Fig. 3 Schematic Diagram of Proposed Method.

based on feature correlation. The resulting clusters are stored as a table which we call as the keypoint table, which contains each SURF keypoint and its corresponding label. For example, if i th keypoint matches with j th and k th keypoints, then i, j and k has the same label. The block named “Labelled Matched Key Points” in Fig. 3 summarizes the steps discussed in this paragraph. Now, we have to find the regions to which the corresponding keypoint belongs, for which we lookup the region label matrix which is obtained as the result of the segmentation algorithm as discussed earlier in this section. The block named “Copy-Move Candidate Selection” in Fig. 3 is been discussed below. We travese through the keypoints in the keypoint table in a particular fashion, so we have to keep track of the keypoints visited. For that, keep a vector V of size 1 × M, where M is the length of keypoint table. Each of the elements of this vector are initialised to zero. To indicate whether a keypoint is a candidate for copy-move forgery, keep a vector L having the same dimension of V , initialised to zero. For each keypoint i in the keypoint table, if V (i) = 0, find the region label from the region label matrix and make V (i) = 1. For each keypoint j in the keypoint table not having the same cluster label of i, which comes in the same region of i or closer to the region boundary of i are taken. Find its cluster label and check whether there are keypoints with the same cluster label of j in the same region or region boundary of keypoints having same cluster label of i. The keypoints thus obtained are saved for further processing. j th keypoint is pushed into a stack, keep j . Similarlly, keypoints satisfying the above mentioned property having cluster label j are kept in a stack, keep j j and that of i are kept in a

650


stack, keepii . Perform this for all the neighboring keypoints of i. Once the entire set of neighbors of i are processed, i has to be updated. So we pop an element from keep j , if the stack is not empty and update i with the popped element. If keep j is empty, update i with the first keypoint k from keypoint table where V (k) = 0. If keep j j and keepii are non-empty then L(i) and L( j) are assigned the value 1. Until keep j j is not empty, pop out an element to j j and make V ( j j) = 1 and L( j j) = 1. Similarlly, perform this operations for keepii . Perform these operations till V (i) = 1, ∀i. The keypoints having L(i) = 1 are candidate keypoints of copy-move forgery, hence display them in the input image.

5 Results and Discussions The proposed method is implemented in MATLAB R2013a(8.1.0.604), performed on Intel Core i5-3230M CPU @ 2.60GHz × 4. The threshold of correlation which is discussed in Sect.4 is experimentally taken as 0.975. As Fig. 4(a) is an example of real life copy-move forgery (discussed in Sect.1), it is given as input to our proposed system and the result obtained is shown in Fig. 4(b) where the region within the green circles indicate forgery. Also, a classic image (Fig. 5(a) & (b)) which appeared in the seminal work [5] depicting a canopy copymoved to conceal a truck, is tested and the result obtained is presented in Fig. 5(c). We tested our algorithm on the dataset used in [10] and the CoMoFoD dataset [7]. In the former, the copy-moved areas were subjected various affine transformations

(a)

(b)

Fig. 4 Iran’s missile launch test. (a) Doctored image (b) Result obtained using proposed method.

(a)

(b)

(c)

Fig. 5 “Jeep” image. (a) Original image with a truck visible (b) Copy-move forged image where truck is concealed using a portion of foliage (c) Result obtained using proposed method.


651

like translation, rotation and scaling. In the latter, the forged images were subjected to postprocessing methods like JPEG compression, noise adding, image blurring, brightness change, color reduction and contrast adjustments, after the copy-moved areas were subjected to different geometric transformations which include translation, rotation, scaling, distortion and combination of two or more transformation mentioned before. We carried out the testing on the dataset mentioned in [10] fully and the details are summarized in Table 1. To test the performance of our algorithm on images in which postprocessing is applied, we used the CoMofoD dataset. Therefore, we limited the testing only on translation copy-move forged images with various postprocessing techniques mentioned before. The result obtained using the proposed method on an image from the dataset used in [10], named “im9.bmp”(Fig. 6(a)) is presented in Fig. 6. The image in Fig. 6(b) is a forged image made from Fig. 6(a) by copy-move forgery by translation. Fig. 6(e) is a forged image created from Fig. 6(a) by copying, rotating by 270◦ and pasting. Similarly, the Fig. 6(e) made from Fig. 6(a) by copying, scaling by a factor 2 and pasting. The white regions in Fig. 6(c, f & i) represents the regions of forgery corresponding to the forged images in Fig. 6(b, e & h), provided by the developers of the dataset for reference . The green circles in Fig. 6(d, g & j) represents the regions of forgery corresponding to the forged images in Fig. 6(b, e & h) .

(a)

(b)

(c)

(d)

(e)

(f)

(g)

(h)

(i)

(j)

Fig. 6 Copy-move forgery detection on an image from the the dataset used in [10]. (a) Original image (b) Forged image (Translation) (e) Forged image (Rotation by 270◦ ) (h) Forged image (Scaling by a factor 2) (d,g,j)Result obtained using proposed method (regions of copy-move forgery shown in green circles ) (c,f,i) Region of copy-move (provided)

652


The result obtained using the proposed method on the image from the CoMoFoD dataset, named “035_F.png”(Fig. 7(b)) which is a forged version of “035_O.png” (Fig. 7(a)) is presented in Fig. 7. Fig. 7(c) is the copy-move mask provided by the developers of the dataset. Fig. 7(d)-(i) represents the postprocessed versions of “035_F.png”: Brightness Change, Contrast adjustments, Color reduction, Image blurring, JPEG compression and Noise adding.

(a)

(b)

(c)

(d)

(e)

(f)

(g)

(h)

(i)

(j)

(k)

(l)

(m)

(n)

(o)

Fig. 7 Copy-move forgery detection on an image from the CoMoFoD dataset [7]. (a) Original image (b) Copy-moved image (c) Regions of copy-move (d) Brightness Change, (lower bound, upper bound)= (0.01, 0.8) (e) Contrast adjustments, (lower bound, upper bound)= (0.01, 0.8) (f) Color reduction, intensity levels per each color channel = 128 (g) Image blurring, averaging filter = 5×5 (h) JPEG compression, factor = 100 (i) Noise adding, μ = 0, σ 2 = 0.009 (j-o) Copy-move detected output images of d to i respectively, with keypoints in the forged areas represented with green circles.

To evaluate the performance of the proposed scheme, we calculated the true positive (TP) which refers that a forged image is detected as fake and true negative (TN) which refers to that the authentic image is detected as original as shown below. TP T P + FP TP Recall = T P + FN TP +TN Accuracy = T P + FN + FP + T N Precision =

(1) (2) (3)

The values of True Positive(TP) Rate, True Negative (TN) Rate and Accuracy computed by testing our method on the dataset in [10] is given in Table 1. The


653

precision, recall and accuracy of our proposed method on this dataset are 99.4%, 91.64% and 91.56% respectively. The test results on the CoMoFoD are summarized in the Table 1. Since the dataset is very complex, 30 out of 40 translated copy-move forged images are detected. As given in the table, CoMoFoD uses compression factors ranging from 20 to 100 in steps of 10, noise addition with μ = 0 and σ 2 = (0.009, 0.005, 0.0005), image blurring using average filters, brightness change with specific lower bound and upper bounds, color reduction with particular intensity levels per color channel and contrast adjustment with specific lower bound and upper bound. Among the 30 detected images, our method is robust to compression, contrast adjustment, brightness change and color reduction. The algorithm is slightly sentsitive to blur and noise. Table 1 Performance Evaluation of the Proposed Method under various Transformation/Postprocessing categories

Dataset

[10]

[7]

Transformation/ Postprocessing Category Translation

Results Tamper TRUE FALSE Parameters Positives Negatives − 46 4 [-5◦ , 5◦ ] 212 8 Rotation 150 10 [-25◦ , 25◦ ] 211 9 [0◦ , 360◦ ] [0.25, 2] 131 29 Scaling [0.75, 1.25] 139 21 JPEG Compression [20, 100] 270 90 Noise Addition (0.009, 0.005, 0.0005) 80 40 Image Blur [3×3, 5×5, 7×7] 84 36 Brightness Change [(0.01, 0.95), (0.01, 0.9), 97 23 (0.01, 0.8)] Color Reduction [32, 64, 128] 95 25 Contrast Adjustments [(0.01, 0.95), (0.01, 0.9), 98 22 (0.01, 0.8)]

The performance of the proposed method is not compared with that in [10] and [7], as the former used a different approach for performance evaluation based on pixel level classification and the latter doesn’t provide complete information regarding their performance on postprocessed tampered images. Also, the performance of the former is better than ours, but they have not tested with postprocessing. SURF based works [8] and [9], that we discussed in 2 have not provided detection accuracies, hence it also cannot be compared.

654


6 Conclusions Copy-move forgery is the most common image tampering technique, which is done by copying a part of the image and pasting it within the same image to conceal a part of the image. We have presented examples of such forgeries in real world scenarios and developed an efficient algorithm that can detect them even if some postprocessing is done to counter the detection. We used a combination of segmentation and SURF keypoints for detection of copy-move forgeries in images by clustering the keypoints. We tested our method on two datasets- the datset used in [10] and CoMoFoD. The purpose of using the former was to test the performance on the basis of precision, recall and accuracy and the latter to verify its tolerance towards postprocessing operations after performing a copy-move forgery. The result on the former is found to be good as evident from the experimental results. But the results on the latter is not as much as the former considering the complexity of the images in it. Our future plan is to test and improve the accuracy of the algorithm on complex copy-move forged images.

References 1. Achanta, R., Shaji, A., Smith, K., Lucchi, A., Fua, P., Süsstrunk, S.: SLIC superpixels. Tech. rep. (2010) 2. Bay, H., Tuytelaars, T., Van Gool, L.: SURF: speeded up robust features. In: Computer Vision– ECCV 2006, pp. 404–417. Springer (2006) 3. Christlein, V., Riess, C., Jordan, J., Riess, C., Angelopoulou, E.: An evaluation of popular copy-move forgery detection approaches. IEEE Transactions on Information Forensics and Security 7(6), 1841–1854 (2012) 4. Farid, H.: Detecting digital forgeries using bispectral analysis (1999) 5. Fridrich, A.J., Soukal, B.D., Lukáš, A.J.: Detection of copy-move forgery in digital images. In: Proceedings of Digital Forensic Research Workshop (2003) 6. Lowe, D.G.: Distinctive image features from scale-invariant keypoints. International Journal of Computer Vision 60(2), 91–110 (2004) 7. Tralic, D., Zupancic, I., Grgic, S., Grgic, M.: CoMoFoD—new database for copy-move forgery detection. In: 2013 55th International Symposium on ELMAR, pp. 49–54. IEEE (2013) 8. Bo, X., Junwen, W., Guangjie, L., Yuewei, D.: Image copy-move forgery detection based on SURF. In: 2010 International Conference on Multimedia Information Networking and Security (MINES), pp. 889–892. IEEE (2010) 9. Shivakumar, B., Baboo, L.D.S.S.: Detection of region duplication forgery in digital images using SURF. IJCSI International Journal of Computer Science Issues 8(4) (2011) 10. Ardizzone, E., Bruno, A., Mazzola, G.: Copy-Move forgery detection by matching triangles of keypoints. IEEE Transactions on Information Forensics and Security 10(10), 2084–2094 (2015)