Multimedia Forensics for Detecting Forgeries - Springer Link

37

Multimedia Forensics for Detecting Forgeries Shiguo Lian and Yan Zhang

Contents 37.1 Some Examples of Multimedia Forgeries . . . . 810 37.2 Functionalities of Multimedia Forensics . . . . 812 37.2.1 Multimedia Origin/Source Identification . . . . . . . . . . . . . . . . . . . . . . . 813 37.2.2 Multimedia Forgery Detection . . . . . . . 814 37.3 General Schemes for Forgery Detection . . . . . 814 37.4 Forensic Methods for Forgery Detection . . . . 37.4.1 Correlation Based Detection . . . . . . . . . 37.4.2 Double Compression Detection . . . . . . 37.4.3 Light Property Based Detection . . . . . . . 37.4.4 Feature-Based Detection . . . . . . . . . . . . . 37.4.5 Duplication Detection . . . . . . . . . . . . . . . 37.4.6 Synthetic Image Detection . . . . . . . . . . . 37.4.7 Photomontage Detection . . . . . . . . . . . . 37.4.8 Performance Comparison . . . . . . . . . . . .

815 815 817 818 820 822 823 824 824

37.5 Unresolved Issues . . . . . . . . . . . . . . . . . . . . . . . . 825 37.6 Conclusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 826 The Authors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828

The first part of the chapter describes some examples of multimedia forgery. Here, multimedia data, including images, audio recordings or videos, etc., are forged by any of the following operations: data removal, replacement, replication, photomontage, or computer-aided media generation. The second part presents the concept of multimedia forensics and its corresponding functions. Multimedia forensics is carried out by extracting valuable information from multimedia content and using it to identify or authenticate the origin or

source of multimedia and, in the process, to detect forgeries. The third part reviews general forgery detection techniques and compares their performance. Here, existing forgery detection methods are classified into 3 groups: watermarking-based scheme, perceptual hash-based scheme, and multimedia forensic-based scheme. Each of these performs at different levels of efficiency and accuracy. The fourth part investigates multimedia forensicbased forgery detection schemes. These forensic methods are composed of special features (correlation, double compression, light, and media statistical); each performs unique functions such as duplication detection, photomontage detection and synthetic image detection. The fifth part addresses some topical and timely issues, focusing on detection accuracy, counter attacks, test bed, and video forgery, etc. The last section discusses future prospects and makes some conclusions. In the digital age, multimedia techniques are developing rapidly, increasing the ease with which multimedia content can be forged using popular software, e.g., Photoshop, WaveCN or FFmpeg. For example, there were reportedly 5 million registered users at www.worth1000.com in 2004 [37.1] who created and published photomontage images with image edition software in the hopes of receiving the most votes for a prize. The high quality of some images made it difficult to determine whether they were original or altered using the human eye [37.2]. Using editing software or methods in film making or special effects processing demonstrates their impressive capabilities. Some examples of these methods include adjusting the light in an original

Peter Stavroulakis, Mark Stamp (Eds.), Handbook of Information and Communication Security © Springer 2010

809

810

video scene to fit the background, combining people from different scenes into one scene, or substituting one audio sequence for another. All these edits or modifications aim to improve film quality, a worthy practice that should be encouraged. However, these types of operations also pose a tremendous threat. For example, in the aforementioned photo contest, some entrants forged photos, violating the principle of fair play. More seriously, an individual may replace a person’s face in a photo with another and post it on the Internet to the detriment of an individual’s privacy or reputation. Furthermore, the original image may be erased, eliminating evidence that can be problematic in court. Thus, it is critically important to ask “When is seeing believing?” [37.2]. In the case of using sensitive applications to prove a case in court or to protect privacy, it is essential to have access to techniques that can detect potential forgeries. These techniques detect malicious operations used to manipulate multimedia content or to produce forged copies. Some methods have recently been described to detect forgeries, e.g., digital watermarking [37.3, 4] and perceptual hash [37.5, 6]. Digital watermarking embeds authentic information into multimedia content at the time of content production. As one example, the watermark embedding process is one of the features built into a digital camera. Perceptual hash occurs when a hash value is computed from the multimedia content when it is first produced. Thus, both digital watermarking and perceptual hash need to be inserted into original multimedia content, or preprocessed. In practicality, preprocessing may be unavailable in some applications and it may also unacceptably degrade the multimedia content. Recently, the use of multimedia forensics [37.7, 8], a method featuring properties superior to those of digital watermarking and perceptual hash, has attracted a growing number of researchers. Multimedia forensics extracts some valuable information from multimedia content, and decides whether the extracted information has been altered. Therefore, unlike the previous two methods, multimedia forensics employs a more practical method that does not involve operating the original multimedia content to detect forgeries. This chapter introduces general schemes for detecting forgeries, reviews the latest research results in forgery detection based on multimedia forensics, and profiles some priority research topics and issues

37 Multimedia Forensics for Detecting Forgeries

that we believe are relevant to researchers, engineers or students working in this field.

37.1 Some Examples of Multimedia Forgeries Various operations can modify and or otherwise forge copies of multimedia data, e.g., images, audio recordings or videos. Generally, content-altering operations can be classified into the following groups: Removing This group is defined by operations that remove some parts from the multimedia content. The operations, including cutting and wiping, are often applied in either a spatial or temporal domain. Removing a moving car from a picture, cutting a segment from a voice sequence, and deleting a person from a frame in a video sequence represent examples of this practice. Generally, this operation is combined with others (filtering and noise removing) to obtain the desired quality or effect on the content. Replacement This group includes operations that replace some parts of multimedia content with parts borrowed from other content. Some examples are: replacing a person’s face in a photo with one from another photo, replacing a segment from an audio sequence with one from another sequence, and replacing a moving car in a video sequence with another. Generally, these replacements are achieved by combining several operations, such as wiping, pasting, smoothing, etc. Replication This group includes operations that increase the number of objects in the content by copying and pasting them from one location to another. For example, copying an image of an airplane and pasting it into other locations in the picture increases the number of airplanes. Generally, replication is achieved by combining several operations, such as copying, pasting, and smoothing, etc. Photomontage This group includes operations that combine several pictures, producing a new one of high quality that is typically a collage. Generally, photomontage is achieved by performing several additional operations such as cutting, splicing, pasting, and smoothing and filtering, etc. Computer-Generated Media This group includes media content generated by computers, e.g., computer graph, speech synthesis, and computer-aided drawing. Only the natural scene is simulated so the

37.1 Some Examples of Multimedia Forgeries

811

Fig. 37.1 The forged tiger picture (on http:// www.youth.cn/rdnews/ 200806/t20080629_ 744037.htm)

Fig. 37.2 The forged missile picture (on http:// news.xinhuanet.com/world/ 2008-07/11/content_ 8525967.htm)

resulting media content is different from the natural one. Cartoonization is one type of computer-aided drawing technique that converts natural digital images or videos into cartoons, or cartoonized media (also called animated digital media) [37.8]. In general, cartoonized media content is visually different from the original content. We describe below some real-world examples of image forgery. In 2007, the photo shown in Fig. 37.1 was altered by inserting a Huanan tiger into the picture of a forest. In actuality, the image was a forgery that had deceived many into believing Huanan tigers inhabited China’s Shanxi Province. In 2008, Iran publicly disclosed a picture of a missile test showing 4 launched missiles, as shown

in Fig. 37.2. Experts had doubts about its authenticity, suspecting that one missile has been copied to create several, as shown by the red circles, although no one has proved the image a forgery. In 2006, a picture showing antelope in the foreground and a train in the background, as seen in Fig. 37.3, received top prize in a photo contest held by CCTV (Chinese Central Television Station). Readers questioned its authenticity for several apparent reasons. First, one would expect the antelopes to scatter in reaction to the oncoming train, and not maintain an orderly line. Second, the stone in the bottom-right corner of the image is identical to one in a different published photo. The photographer later admitted the photo had been forged.

812


Fig. 37.3 The forged antelope picture (on http://www.ce.cn/culture/ today/200802/19/t20080219_ 14559809.shtml)

Fig. 37.4 The original and forged images (on http:// blogs.techrepublic.com.com/ security/?p=554)

Fig. 37.5 The original video and forged video (on http://www.webstrategist.com/blog/2007/ 01/19/social-media-createsmusic/)

In Fig. 37.4, the image was forged by removing the truck and replacing it with a copied tree from the same image. Without the original image for comparison, it is difficult to tell with the naked eye whether or not the image is authentic. In social media creation, the original video sequence may be modified by adding or removing frames in the spatial or temporal domain. As shown in Fig. 37.5, two videos are merged in the spatial domain.

37.2 Functionalities of Multimedia Forensics Multimedia Forensics [37.7, 8] extracts valuable information from multimedia content (image, audio, video, text, etc.) and uses it to identify and authenticate the content. Typical applications used for this purpose include media source (cell phone, digital camera, scanner, etc.) identification, forgery detection, etc. For example, the image forgery detection

37.2 Functionalities of Multimedia Forensics

technique makes use of distinct properties of images generally selected by statistical testing or training to detect unusual objects and tampered areas. Similarity between adjacent pixels, coherent light direction, flatness of background, etc., are some typical properties used. The performance of multimedia forensics and the rate of accurate detections depends on the distinct properties selected. The best methods will result in the highest rates of accurate detections. However, the diversity of natural images remains the largest challenge. In the following section, we describe in detail the functions of multimedia forensics.

37.2.1 Multimedia Origin/Source Identification Multimedia content is produced using various devices, e.g., computer, camera, scanner, recorder, cell phone, etc. In general, each device has different characteristics that affect the generated multimedia content. This is based on the assumption that all multimedia content generated by a device will contain certain characteristics that are intrinsic to the device itself e.g., unique hardware components. The origin of the multimedia content or source device can be identified by analyzing the characteristics of devices and the multimedia content they produce. Multimedia origin/source identification techniques are used to identify the characteristics of the devices that generate the multimedia content. In general, these identification techniques can be classified into two types, i.e., source class identification and individual source identification.

813

ner’s camera, or cell phone’s camera) can be classified. In the following section, various camera class identification methods will be reviewed. The standard digital camera is composed of several components, i.e., lens system, filters, color filter array, image senor, and digital image processor [37.9]; it is these components that define a camera’s characteristics. The light passes through the lenses and through a set of filters before it strikes the pixel array in the image sensor. The light is then converted to a digital signal, which is processed by the digital image processor. A camera class can be classified by analyzing component properties, a concept that applies to most of the other identification methods. The Lens System Method Each camera manufacturer uses a different lens system, which creates a unique distortion in every camera model. Choi et al. [37.10] describe a method to identify the source camera by making use of this property, or lens radial distortion. The parameters of the distortion are computed and used to design a classifier. Using this method in experiments on 3 camera models have demonstrated an accurate identification rate exceeding 90%.

Source Class Identification

The Image Sensor Method The image sensor method and its variations often produce certain sensitivity patterns that can be used in camera identification. The first variation [37.11] examines the defects of the charge-coupled device, obtaining the identifying features from these defects. The features are used to compare the image and the source camera. Another method [37.12] uses the image sensor’s sensitivity pattern to identify the camera; different pixels are sensitive to the light at varying levels, and the response of pixels is a function of the sensor itself. The sensitivity pattern can then be extracted and used for identification purposes.

Source class identification is the process of identifying the source of the multimedia content class. Here, the source class is denoted by device class, e.g., computer, camera, scanner, recorder, cell phone. Generally, only the multimedia content is available, and the source information is extracted by analyzing the content. Until recently, various research efforts have focused on camera identification whereby features are extracted from multimedia content to distinguish different camera models. Thus, the images or videos captured by different cameras (digital camera, scan-

The Color Filter Array Method The color filter arrays may vary by manufacturer. The filter array adds some color interoperation to the finished image that can then be used to identify the camera model. One variation of this identification method [37.13] uses the interpolation process to determine the correlation model in the color band, followed by matching the source correlation model with the one computed from the image to determine the source camera. The second method [37.14] computes the coefficient matrix from a quadratic correlation model within the adjacent pixels, using the matrix to iden-

814

tify camera models. Experiments on 4 cameras accurately identified the camera model more than 95% of the time. Another method [37.15] uses the binary similarity measures to identify source in cell-phone cameras by determining correlations across adjacent bit-planes of the interpolated. Experiments involving 3 groups of cameras attained an accuracy rate between 81% and 98%. The Image Features Method Some methods use image features to construct the classifier. For example, using one method [37.16] we extracted three groups of image features, i.e., color feature, image quality metric, and wavelet domain statistics. We then used 34 features to obtain 98% accuracy for two cameras for non-compressed images and attained 93% for compressed images (JPEG) with a quality factor of 75. The authors [37.17], using a similar method, attained a lower accuracy of 67% using camera sets with similar components. Individual Source Identification Individual source identification is the process by which the unique source that produced multimedia content is identified. In this case, the individual source is associated with a device that has a unique characteristic or signature, e.g., a camera with certain serial number, a scanner belonging to a specific brand, or a cell phone issued to one individual. Generally, the identification process requires use of the multimedia content and the device; the source information is then extracted from the content and matched to that of the source. The sensor’s properties are often adopted for digital camera and scanner identification. Considering that distortions are often introduced to the image sensor, the properties related to special distortions of a camera or scanner can be used as identifying information. For example, a series of steps can be taken to identify a digital camera: detecting fixed pattern noise [37.18], matching traces of defective pixels [37.19], extracting non-uniform noise in pixels [37.20, 21], and introducing pre-processing techniques before noise extraction [37.22]. In scanner identification, the sensor noise in one-dimensional linear array is extracted and used to design the classifier [37.23, 24], followed by an analysis of three aspects of the scanning noise [37.25]. Image dust characteristics can also be used. Removing the lens and opening the sensor area produces a unique dust pat-


tern below the surface of the sensor. A camera with a sensor that has been opened can be identified by studying the dust patterns [37.26].

37.2.2 Multimedia Forgery Detection Forgery detection, unlike multimedia origin/source identification, authenticates multimedia content by determining whether a forgery operation has occurred. In detecting forgery, only the multimedia content, and its extractable features, are available for analysis. In the following section, forgery detection methods will be investigated in detail.

37.3 General Schemes for Forgery Detection Several methods have been recently proposed to detect forgeries, i.e., watermarking-based schemes [37.3, 4], perceptual hash-based schemes [37.5, 6], and multimedia forensic-based schemes [37.7, 8]. In the first method, as shown in Fig. 37.6a, the watermark information, e.g., integrity flag or ownership identification, is embedded imperceptibly into multimedia content by slightly modifying the multimedia data. This embedding operation takes places when the multimedia content is generated, e.g., in the camera [37.3]. The embedded information is extracted from the operated multimedia content and compared with the original information. This comparison reveals whether or not the image has been forged, and even isolates the areas affecting by tampering. This method has two apparent disadvantages: 1) the embedding operation needed during media generation is often unavailable in practical applications; and 2) the information embedding operation degrades multimedia content quality not allowed by some applications. In the second method, as shown in Fig. 37.6b, the perceptual hash function is applied to multimedia content, generating a hash value composed of a certain-length string that is stored by the authenticator. A new hash value is computed from the operated multimedia content, and compared with the stored one to detect a forgery. The comparison reveals whether or not the content has been forged. Not unlike the watermarking method, the hash based-technique achieves the hash computing operation when multimedia content is created, e.g.,

37.4 Forensic Methods for Forgery Detection

815

Identification information

Marked media

Original media

Embed

a

Watermarking based forgery detection scheme Original media

Operation

Forgery detection

Forgery detection

Operation

Hash function

b

Hash based forgery detection scheme Original media

c

Operation

Forgery detection

Multimedia forensic based forgery detection scheme

in the camera. The difference is that the hash value does not change the multimedia content. Similarly, the fact that the hash computing operation executed during media generation is not always available in practical applications is a disadvantage. In the third method, as shown in Fig. 37.6c, the intrinsic features are extracted from the operated multimedia content, followed by an analysis and comparison of the feature properties with a common threshold; the comparison indicates whether or not the content has been forged. The extracted intrinsic features expose an apparent difference, revealed by the threshold, between the original and forged versions. Extracting the distinguishable features is at the core of this technique, although its use depends on the type of forgery operation and the different features identified for extraction. Apart from not altering media content quality, the forensic method differs from the other two in that this one can be performed in the absence of the original content.

Fig. 37.6 Various forgery detection schemes

media from the altered one. In the following section, we will analyze some forgery detection methods involving special features (correlation feature, double compression feature, light feature, and media statistical feature) and others with particular functions (duplication detection, photomontage detection and synthetic image detection).

37.4.1 Correlation Based Detection Some correlations that exist between adjacent temporal or spatial sample pixels are often introduced during multimedia content generation or content operations. From the standpoint of multimedia content, these correlations can be detected and used to identify forgeries. Typically, two kinds of operations are often considered, i.e., resample and color filter array interpolation. Resample Detection

37.4 Forensic Methods for Forgery Detection Under non-preprocessing conditions, only forensic methods can detect forgeries. These forensic methods extract the features that distinguish the original

Resample is often applied during multimedia content operation. It is necessary, for example, to modify multimedia content undergoing specific operations such as rotation, smoothing, and resampling to detect an image forgery. In this case, resampling is often composed of three steps, i.e., upsampling, inter-

816


Original media

Correlation mode detection

Conditional iteration

Correlation probability detection

Detected correlation mode Fig. 37.7 Resampling detection

polation and downsampling. Among these, interpolation adds correlations to the adjacent image pixels. Thus, detecting the presence of resampling will determine whether an image has been tampered. The typical resampling detection method has been described in [37.27]. As shown in Fig. 37.7, it is composed of two steps, i.e., correlation probability detection and correlation model detection. The former is used to detect the probability of an adjacent correlation, while the latter determines which correlation model it follows. Executing the two steps iteratively until the distortion is minimized produces the most accurate result. The probability map and magnitude of its Fourier transform can generally show the correlation model in a visual manner. The authors tested the detection accuracy for upsampling, down-sampling and rotation. For uncompressed images, perfect accuracy is obtained when the up-sampling rate is greater than 1% and when the rotation angle is bigger than 1. Conversely, detection accuracy decreases greatly when the downsampling rate is bigger than 30%. The authors tested the detection accuracy against such attacks as additive Gaussian noise, non-linear gamma correction, and image compression with JPEG, JPEG2000 and GIF. For example, against JPEG compression, the detection accuracy is not acceptable when the compression quality is smaller than 97. This method is used when it is assumed that the original media content is not resampled. Otherwise, it is difficult to distinguish between the original and forged content. Additionally, this method can tell

whether the image is a forgery, but it is unable to identify the forgery methods used or pinpoint the forged areas. Furthermore, there are doubts about the method’s robustness when the media content has been subject to various simultaneous alterations. Color Filter Array Interpolation Color filter array (CFA) is a component of digital cameras. At the time of digital image production, only one-third of the color image samples are typically captured by the camera, while the other twothirds are generated by interpolation of the color filter array. This interpolation adds certain correlations to the adjacent color image samples. During image forgery operations, these correlations may be destroyed. Thus, the authenticity of the region can be determined by detecting whether or not interpolation properties exist. It should be noted that interpolation detection has been used for resampling detection. The color filter array interpolation can also be detected using a similar method. However, resampling detection and CFA interpolation detection apparently differ in two respects [37.28]. First, CFA has different interpolation modes than resampling, and these modes have certain formulae, including bilinear and bicubic interpolation, smooth hue transition, median filter, gradient based interpolation, adaptive color plane, and a threshold based variable number of gradients. Thus, these modes can be used for correlation mode detection by making comparisons. Second, the forged areas can be detected by planing them alongside the whole image. As shown in Fig. 37.8, the original image is partitioned into different regions, and each area’s correlation mode is detected. An absence of correlations in an area indicates the area has been forged. If the opposite is true, then the area is authentic. Image forgery can be ascertained once all areas have been iteratively detected. The authors [37.28] tested 8 CFA interpolation methods on 100 images, and attained an average detection accuracy of 97%; a minimal accuracy of 87% was recorded for unprocessed images. Following JPEG compression, detection accuracy decreases gradually along with compression quality; accuracy is close to 100% if the compression quality remains above 96. This detection method attains lower accuracy under the influence of Gaussian noise attacks, i.e., about 76% for adaptive color plane and 86% for variable number of gradients.


Forged region

Media content

DCT coefficients of image blocks

Region partition

Compute histogram of coefficients

Correlation mode detection

Fourier transform

Y

Detected?

Iteration for regions

N

817

Authentic region

Periodicity of peak locations

Detected periodicity of distortions Fig. 37.9 Recompression detection

Detection result Fig. 37.8 Forgery detection based on CFA interpolation detection

Assuming that the images are first interpolated during image generation and then modified during image forgery, this forgery detection method can confirm authenticity in the image or an image area. Thus, forged images interpolated with the CFA interpolation methods, or re-interpolation attacks, reduce robustness. Fortunately, the CFA interpolation parameters are not public, and thus, the reinterpolation attack is not easily accessible to common users. However, the evolution of cameras may result in the skipping of CFA interpolation. Consequently, this method may not be able to detect the correlations in the captured images.

37.4.2 Double Compression Detection Some lossy compression methods are adopted to compact multimedia contents, such as MP3, JPEG and MPEG2 [37.29], to save storage space. In cases of multimedia content forgery, the edition software often stores the content in compression formats. Additionally, the multimedia source, e.g., digital camera, stores multimedia content as compression for-

mats, e.g., JPEG or MPEG2. Thus, the forged multimedia content may be recompressed. Intuitively, recompression introduces different distortions compared into content that had been compressed. The specific distortions can be used to detect whether the multimedia content is recompressed, allowing the other forgery detection methods to work, as shown in Fig. 37.9. As popular applications, JPEG and MPEG2 compressions are often affected and will be examined in the the following section. Double JPEG Compression In JPEG coding, the image is partitioned into blocks. Each block is transformed by DCT, with DCT coefficients quantized and subsequently encoded with entropy coding. The DCT coefficients will be double-quantized if the JPEG image is double-compressed. Image quality is controlled by the quantization step. Differences in the two quantization steps alter their related operations, causing distortions to the resulting image. The distortion caused by double quantization is different from the one caused by single quantization, which can be detected by the method proposed in [37.30]. According to this method, a histogram derived from the image blocks computes DCT coefficients that are then transformed by Fourier transform, leading to the detection of periodicity of the peak locations in the transformed histogram. This periodicity cor-

818

responds with the distortion periodicity of double quantization. Generally, the corresponding double quantization can be identified if periodicity is detected. The authors tested detection accuracy on more than 100 images. Complete accuracy was reportedly obtained in all but two cases. In the first case, the ratio of the second quantization step to the first one had an integer value. This reduces distortion caused by the second quantization. In the second case, the first quantization step was minor, while the second step was significant. Thus the first quantization is not apparent compared with the second one. In both cases, there was a decrease in distortion periodicity associated with double compression compared to single compression. This method can detect whether or not an image is recompressed, activating procedures for detecting instances of forgery. Thus, a recompressed image increases the probability of forgery. The disadvantage of this method is its vulnerability to attacks. For example, cropping a modified JPEG image before saving it in JPEG format makes it more difficult to detect the periodicity of distortion. Double MPEG Compression MPEG videos are compressed by adopting the spatial and temporal properties. In terms of general MPEG architecture, video frames are classified into 3 types, i.e., I frame, P frame and B frame. I frame is directly encoded with the JPEG method, P frame is encoded with reference to the previous I frame, and B frame is encoded with reference to both the I and P frames. Video forgery is often performed using video edition software, which modifies video frames in either the spatial or temporal domain. In the spatial domain, a video frame is altered by cutting, copying, pasting and smoothing; these are also applied to still images. In the temporal domain, the video frames are modified through frame deletion, frame insertion, frame average, etc. The well-known video forgery detection method [37.31] functions by dividing the detection task into two parts, i.e., static forgery detection and temporal forgery detection. The former detects double compression in I frame using the method for detecting JPEG double compression, whereas the latter uses the motion error caused by frame relocation to detect recompression. Periodic patterns


Compressed video

Compute motion error

Fourier transform

Periodic pattern of peak locations

Detected periodic pattern Fig. 37.10 Recompression detection based on motion error

arise in the motion error, making the periodic property suitable for detection. As shown in Fig. 37.10, the method begins with the compressed video stream, followed by motion error computing and transformation through the Fourier transform. The magnitude of the Fourier frequency influences the periodic pattern detected by studying the peaks in the middle frequency range. Recompression exists if periodicity is found. The authors attained positive detection accuracy in some experiments. However, as is the case with JPEG double compression detection, the video double compression detection method is also vulnerable to attacks. For example, video frames are inserted or deleted on a group by group basis, and therefore avoid frame re-location.

37.4.3 Light Property Based Detection Inconsistencies in Lighting In practice, the captured picture conforms to certain light directions. Suppose there is only a point light corresponding to the picture’s scene, then the estimated light directions for all the objects in the picture should intersect with that point. Conversely, tampering with an object in a picture will show that the estimated light direction of that object is inconsistent with the light directions of other objects in


819

the same picture. Thus, image forgery can be detected by understanding light directions. The general method for using light inconsistency in forgery detection is described in [37.32]. The authors first introduced some illuminant direction estimation methods reported in computer vision research. These include the estimation of infinite light source, local light source, or multiple light sources. Then, based on the estimation, they explained the forgery detection method, as shown in Fig. 37.11. The illuminant directions are estimated in relation to different objects in the image using this method; comparing illuminant directions exposes the forgery. Completely different light directions are indicative of a forged image. This method can determine the authenticity of the image itself or that of an object embedded within the image. Its computational complexity is a function of the adopted light direction estimation methods, and its ability to tolerate various attacks (noising, smoothing, filtering and recompression) depends on the robustness of the light estimation method.

Chromatic Aberration Chromatic aberration is an expansion or contraction of color channels caused by the optical imaging system. Chromatic aberrations are generally different among color pairs. For example, the aberration between red and green channels often differs from the one between blue and green channels. Thus, the images captured from a camera or the blocks in an image mimic the same aberration parameters. The image forgery can then be detected by comparing the chromatic aberrations. The typical method for using this feature in forgery detection is described in [37.33]. As shown in Fig. 37.12, the global estimation method is used to estimate the chromatic aberrations throughout the whole image. Detecting each block’s authenticity is achieved by partitioning the image into blocks, followed by using the block-based estimation method to estimate chromatic aberrations. The estimated result is then compared to the one derived from

Image

Image

Partition

Partition

...

Light estimation

Block-based estimation of chromatic aberration

Similar?

Y

Compare

Iteration for blocks

Light estimation

Global estimation of chromatic aberration

N N

Forged region

Similar?

Y

Authentic region

Fig. 37.11 Forgery detection based on light inconsistency

Forged region

Authentic region

Detection result Fig. 37.12 Forgery detection based on chromatic aberration

820


global estimation. Close agreement between both estimations confirms that the block is authentic and anything otherwise is a forgery. The image’s authenticity can be determined once each block has been detected. An absence of a block in the image means it is authentic; anything otherwise is a forgery. Global estimation and block-based estimation are similar to the issue of image registration [37.34]. This forgery detection method can detect the image’s authenticity or that of a block from the image. However, this method works assuming that only some blocks in an image are forged and that the forged blocks do not affect the global estimation. Additionally, its detection accuracy under various attacks (adding noise, filtering, smoothing, etc.) remains unresolved. Rectification-Based Detection Objects in the original image are often located in reasonable positions. In contrast, the relative distance among the objects may become unreasonable in the forged image. Thus, it is possible to identify forged objects by investigating their relative distance to each other. In practice, planar distortions, caused by the projection from three-dimensional space to two-

dimensional plane, are present in captured images. Removing distortions before forgery detection is preferred. To achieve this objective, the rectification technique in image analysis and computer vision is applied [37.35]. The authors explain the process of rectifying an image involving the use of special information, such as polygons, vanishing points, and circles. As shown in Fig. 37.13, the rectification process has three steps. First, the special information is identified, followed by estimation of the projective parameters and then finally the affected area is rectified. From the rectified region, the real distance between the objects can be computed to expose the forgery. This method can detect the image’s authenticity or that of an object inside the image. Its complexity is a function of the adopted rectification method, and its ability to withstand attacks depends on the forgery detection method applied.

37.4.4 Feature-Based Detection Some specific image features can exhibit differences in relation to the different processes used to produce a natural and forged image. High-Order Statistical Feature

Image

Detect special information

Projection estimation

Image rectification

Forgery detection based on distances

Detected result Fig. 37.13 Forgery detection based on image rectification

The natural signal is assumed to have weak higherorder statistical correlations within the frequency domain. Contrastingly, introducing the non-linear component may detect higher-order correlations. Considering that a forgery operation often creates non-linearity, the forgery may be detected by identifying the higher-order correlations. The method [37.36], based on bispectral analysis, is described in the detection of an audio forgery. As a 3-order correlation, the bicoherence spectrum is computed from the one dimensional signal. As shown in Fig. 37.14, the audio sequence is partitioned into segments, and then, the bicoherence spectrum is computed from each segment and averaged. The segment’s forgery can be determined from the magnitude and phase of the average bicoherence. This method can detect an audio segment forgery in all but two instances. First, the tampered region is very small, exacerbating detection of the nonlinearity. Second, the audio is subjected to some legitimate operations (non-linear filtering and record-


821

Image

Audio sequence

Partition Partition Compute segment sharpness/blurriness

Compute segment bicoherence spectrum

Averaged bicoherence spectrum

Forgery decision based on magnitude and phase

Decide the outliers or marginal deviations

Detected result Fig. 37.15 Forgery detection based on sharpness/blurriness

Detected result Fig. 37.14 Forgery detection based on higher-order features

Image

Construct the feature pool

ing) that will result in the false detection of otherwise unharmful non-linearity.

Optimal selection strategy Design the classifiers

Sharpness/Blurriness-Based Detection The sharpness/blurriness can be computed from the regularity properties of wavelet transform coefficients, which shows the decay of wavelet transform coefficients across scales. In general, different regions in the same image have similar levels of sharpness/blurriness; an area that differs in sharpness/blurriness indicates tampering. A forgery detection method based on this property,is described [37.37], as shown in Fig. 37.15. The image is first partitioned into segments, followed by computing the sharpness value from each segment. The presence of outliers or marginal deviations from the general distribution are then used to determine a forgery. This method confirms the presence or absence of a forgery in a given area within an image. Determining the outliers and marginal deviations influences the accuracy of detection.

Detected result Fig. 37.16 Forgery detection based on feature fusion

Feature Fusion and Classifier Fusion A general feature-based forgery detection method is described in [37.38–40]. As shown in Fig. 37.16, various features including the following are extracted from multimedia content: binary similarity measures between the bit planes, binary characteristics within the bit planes, image quality metrics applied to denoised image residuals, and the statistical features obtained from the wavelet decomposition. Various classifier methods are applied to make a determination. Thus, using multiple features and multiple classifiers obtains higher detection accuracy.

822


Image

Image

Partition

Partition

Partition

DCT

PCA

Sorting

Sorting

Sorting

Image

a

Detected result

b

Detected result

This method can detect a forgery in an image area. The challenge is designing an optimal strategy for selecting relevant features or classifiers.

37.4.5 Duplication Detection In multimedia forgery, duplication is one of the most frequently used tampering methods. As one example, image duplication is the process of copying one object in the image and pasting it into another location, creating two identical objects in the same image. Various duplication detection methods, which can be divided into two classes, i.e., direct detection and segmentation-based detection, have been in recent use. Direct Detection Direct detection is the process of detecting duplicated areas directly in the absence of information about these areas. This process can be classified into three kinds of duplication detection methods, i.e., spatial domain sorting [37.41], DCT domain sorting [37.42], and Principle Component Analysis (PCA)-based sorting [37.43]. As shown in Fig. 37.17a, whereby the spatial domain sorting method partitions the image into blocks, and lexicographically sorts all image blocks. The DCT domain sorting method is shown in Fig. 37.17b, whereby the image is partitioned into blocks, with each block transformed by DCT and lexicographic

c

Detected result

Fig. 37.17 Various duplication detection methods

sorting is applied to all DCT blocks. Unlike the previous two methods, the PCA-based sorting method, as shown in Fig. 37.17c, partitions the image into blocks, from which a robust feature is extracted, followed by applying feature-based sorting to the blocks. The first sorting method is time-intensive and does not tolerate acceptable operations such as noise or compression. The second method handles legitimate operations, but it too is time-intensive. The third extracts robust features and reduces the search parameters, making it not only time efficient but also capable of handling legitimate operations. Segmentation-Based Detection Segmentation-based detection is the process of detecting duplicated objects after segmentation. The typical method [37.44], as shown in Fig. 37.18, is composed of the following steps. The image is first segmented using the Normalized Cuts segmentation algorithm, or one like it. Then, similar objects are grouped by computing the minimum intensity difference. In the final step, the average edge weights are computed from the segmentation map and automatically used to identify the duplications. This method can detect the authenticity of an image object, including object deletion, healing or duplication. However, segmentation algorithms have limited abilities, so this method is more suitable for images with various specific objects (gels and micrographs).


823

Image

Image

Segmentation

Segmentation

Duplicated object grouping

Duplicated object grouping

Automatic detection

Automatic detection

Detected result

Detected result

Fig. 37.18 Duplication detection based on segmentation

Fig. 37.19 Source discrimination based on source feature

37.4.6 Synthetic Image Detection

to the generated images. Detecting features from images can distinguish image sources. For example, the method [37.46] adopts the demosaicking and chromatic aberration to differentiate the camera from computer source (chromatic aberration is exclusive to the camera making it especially easy to tell apart). Another method [37.47] extracts the image source noise pattern from the image and compares it to the predefined noise pattern to identify the original source. The detection process, as shown in Fig. 37.19, has several steps. The image is first denoised using the denoising filter, followed by computing the noise pattern by subtracting the denoised image from the original image. The correlation between the computed noise pattern and the pre-computed reference error pattern is then associated with a source device. Finally, the source device is identified by comparing the correlation with a threshold. These methods work well when the computer and camera use different generation models. Conversely, detection accuracy decreases when similar models are used.

Today, distinguishing computer generated images from real images is becoming increasingly important. Additionally, the image may be a hybrid composed of both computer generated and original parts, further deceiving our eyes. To date, various methods have been presented to distinguish synthetic and authentic images. Imaging Model-Based Detection The first type of method adopts the theoretical image generation models. It works under the assumption that the computer generated image and real image are generated from different models. For example, the method presented in [37.45] constructs a new geometric-based image model to reveal certain physical differences between the two kinds of images. Gamma correction is the key parameter for analyzing the original image, while sharp structure is important for the computer-generated image. The authors attained a detection accuracy of 83.5%. However, modeling the natural image generation remains unresolved, due to the diversity of natural image sources. Source Feature-Based Detection Different image sources, e.g., camera and computer, have their own distinct features that are introduced

Image Feature-Based Detection Images contain features characteristic of the devices from which they were produced. Investigating differences in image features reveals their corresponding source devices. In general, this method follows the steps shown in Fig. 37.20. First, the image features are extracted, followed by classifying

824


Media Image Original Partition Media

Feature extraction

Classification

Classifiers

Detected source

Compute other features

Fig. 37.20 Source discrimination based on image feature

Conditional of regions

Compute bicoherence features

Region decision

the features in accordance with predetermined classifiers, resulting in only the detected image source. In general, classifiers are constructed by training large number of sample images. The extracted features determine the method’s performance. Features used most frequently are statistical regularities of natural images [37.48], the surface and object models [37.49], sub-band histogram in wavelet transform [37.50], and the image content’s artifacts [37.51]. The challenge associated with these methods is ensuring that the training of classifiers has already been performed.

Detected result Fig. 37.21 Photomontage detection

tures, and the edge percentage feature is performed. In the final step all the features are used to determined splicing operations. Each region can be detected iteratively based on the number of regions. Experiments show that a detection accuracy of 72% can be attained and can be improved by selecting or incorporating more suitable features.

37.4.7 Photomontage Detection Photomontage, a general operation used in image forgery, is essentially a collage containing several existing images. Image splicing is the most fundamental and essential technique used in photomontage. Thus, it is very important to understand the mechanics of image splicing to detect photomontage forgeries. Intuitively, the light inconsistence [37.32, 33] between different image parts can be used to detect splicing. Some researchers have described the image splicing model [37.52] based on the bipolar signal perturbation, discovering that the bicoherence features are suitable for splicing detection [37.53, 54]. The method, as shown in Fig. 37.21, is composed of the following steps. First, the image is partitioned into regions, followed by computing the bicoherence magnitude and phase for each region. Next, additional computing of other features such as the prediction residual for the plain magnitude, phase fea-

37.4.8 Performance Comparison As described in this chapter, various forgery detection methods and their associated functions and features have been studied. Their capabilities are compared and summarized in Table 37.1. The following three aspects of various methods are compared: suitability of media content, special forgery detection operations, and detection of the forged area. The first aspect characterizes the types of media, including image, audio, and video, for which forgery detection methods are most suitable. The second aspect characterizes special forgery operations, including standard forgery (removing, insertion, or replacement), duplication, photomontage, and synthesizer, to which different forgery detection methods can be applied. The third aspect characterizes forged areas, including the whole image or individual parts, i.e.,

37.5 Unresolved Issues

825

Table 37.1 Performance comparison of different forgery detection methods Forgery detection method

Suitability of media content Image Audio Video

Detected forgery operations G D P S

Method based on resample detection [37.27]

Method based on CFA interpolation [37.28]

Method based on double compression detection [37.30, 31]

Method based on light inconsistency [37.32]

Method based on chromatic aberration [37.33]

Method based on rectification [37.35]

High-order statistical feature [37.36]

Detected forgery area Whole Segment, image region, etc.

Sharpness/blurriness-based detection [37.37]

Feature fusion and Classifier fusion [37.38–40]

Direct duplication detection [37.41–43]

Segmentation-based detection [37.44]

Imaging model-based detection [37.45]

Source feature-based detection [37.46, 47]

Image feature-based detection [37.48–51]

Splicing detection-based on bicoherence [37.52–54]

G – general forgery, D – duplication, P – photomontage, S – synthesizer

segment, region or object, for which forgery detection methods can be used. The suitability of methods for certain applications can be selected from the list of methods depending on application specifications. These detection methods are still not fully developed so quantifying the performance of their features is not be possible at this stage. However, they are expected to improve and will become more effective when applied individually or in various combinations.

37.5 Unresolved Issues Our discussion of forensic methods for detecting multimedia forgery highlighted some challenges and issues that still need attention. Detection Accuracy Detection accuracy among the existing forgery detection methods remains, in practice, inadequate for applications. One important reason is that the diversity of natural media complicates efforts to design a fixed classifier or decision threshold.

Counter Attacks Occasionally, a single forgery operation can be easily detected. However, in practice, multiple forgery operations are often performed on the same content, increasing the amount of interference and potentially reducing detection accuracy. In addition, experienced attackers may execute a forgery by integrating sophisticated anti-detection features into the operation. These types of attacks are infrequently addressed by existing detection methods. Video Forgery The advent of video edition software has resulted in greater prevalence of video forgery, although this form of forgery has not received much attention. Video forgery, compared to image forgery, has an additional dimension, i.e., the temporal space, that is expected to lead to the development of new methods for detecting video forgery. Test Bed Until recently, public tests were not conducted for detecting forgeries due to a shortage of test beds, delaying their use in practice. Test beds are beneficial in that they contain a multimedia content database and are capable of evaluating various tasks,

826

Scene

a

Cameracapture

Original media

Operation

Forgery detection

The media content is forged after camera-capture

Scene

b


Operation

Cameracapture

Original media

Forgery detection Fig. 37.22 Different cases for media forgery

The media content is forged before camera-capture

including detection accuracy, robustness, and security.

References

Forgery Before Media Generation Solutions designed to detect forgery operations performed after media production have received priority over those executed before production. In the case of cameracapture, for example, media content can be forged after camera-capture, as shown in Fig. 37.22a, or before camera-capture, as shown in Fig. 37.22b. The scene may be forged before camera-capture, as seen in Fig. 37.1 into which the tiger has been inserted, generating an image that contains both the tiger and adjacent trees. The forged image is intended to substantiate the occurrence of Hunan tigers where they are not known to exist in the wild. Detecting a forgery executed before media production is more difficult than detecting one following production for reasons related to properties of light consistency, chromatic aberration and noise pattern. Therefore, new methods are needed to improve the detection of forgeries performed before media production.

37.1.

37.6 Conclusions

37.9.

This chapter reviewed the latest research on forensics techniques for detecting multimedia forgeries. Some typical forgery operations were introduced with examples, followed by a comparative discussion of three kinds of forgery detection methods and their components. Next, the latest in various forgery detection methods were classified, followed lastly by a discussion of high-priority and unresolved issues in the field. Researchers, engineers or students working or interested in this field will benefit from the information offered in this chapter.

37.10.

37.2. 37.3.

37.4.

37.5.

37.6.

37.7.

37.8.

37.11.

37.12.

37.13.

K. Hafner: The camera never lies, but the software can, New York Times (11 March 2004) W.J. Mitchell: When is seeing believing?, Sci. Am. 2(1), 44–49 (1994) I.J. Cox, M.L. Miller, J.A. Bloom: Digital Watermarking (Morgan Kaufmann, San Francisco, CA 2002) I.J. Cox, M.L. Miller, J.M.G. Linnartz, T. Kalker: A review of watermarking principles and practices. In: Digital Signal Processing for Multimedia Systems, ed. by K.K. Parhi, T. Nishitani (Marcel Dekker, New York, USA 1999) pp. 461–482 P. Blythe, J. Fridrich: Secure digital camera, Digital Forensic Research Workshop, Baltimore, Maryland (2004) C.-Y. Lin, S.-F. Chang: A robust image authentication algorithm surviving JPEG lossy compression, Proc. SPIE 3312, 296–307 (1998) A.C. Popescu, Statistical tools for digital image forensics, Technical Report TR2005-531, Dartmouth College (2005) H.T. Sencar, N. Memon: Overview of State-of-theArt in Digital Image Forensics, Statistical Science and Interdisciplinary Research (World Scientific Press, Singapore 2008) J. Adams, K. Parulski, K. Spaulding: Color processing in digital cameras, IEEE Micro 18(6), 20–31 (1998) K.S. Choi, E.Y. Lam, K.K.Y. Wong: Source camera identification using footprints from lens aberration, Proc. SPIE 6069, 172–179 (2006) Z.J. Geradts, J. Bijhold, M. Kieft, K. Kurosawa, K. Kuroki, N. Saitoh: Methods for identification of images acquired with digital camera, Proc. SPIE 4232, 502–512 (2001) J. Lukas, J. Fridrich, M. Goljan: Digital camera identification from sensor pattern noise, IEEE Trans. Inf. Forensics Secur. 1(2), 205–214 (2006) S. Bayram, H.T. Sencar, N. Memon, İ. Avcıbaş: Source camera identification based on CFA inter-

References

37.14.

37.15.

37.16.

37.17.

37.18.

37.19.

37.20.

37.21.

37.22.

37.23.

37.24.

37.25.

37.26.

37.27.

37.28.

37.29.

37.30.

polation, 2005 IEEE Int. Conference on Image Processing (ICIP) (2005) Y. Long, Y. Huang: Image based source camera identification using demosaicking, 2006 IEEE Int. Conference on Multimedia Siginal Processing (MMSP) (2006) O. Celiktutan, İ. Avcıbaş, B. Sankur, N. Memon: Source cell-phone identification, Proc. ADCOM (2005) M. Kharrazi, H.T. Sencar, N. Memon: Blind source camera identification, 2004 IEEE Int. Conference on Image Processing (ICIP) (2004) M.-J. Tsai, G.-H. Wu: Using image features to identify camera sources, 2006 IEEE Int. Conference on Acoustics, Speech, and Signal Processing (ICASSP) (2006) K. Kurosawa, K. Kuroki, N. Saitoh: CCD Fingerprint Method, Proc. 1999 IEEE Int. Conference on Image Processing (ICIP) (1999) S. Bayram, H.T. Sencar, N. Memon: Classification of digital camera-models based on demosaicing artifacts, Digit. Investig. 5(1/2), 49–59 (2008) J. Lukas, J. Fridrich, M. Goljan: Digital camera identification from sensor pattern noise, IEEE Trans. Inf. Forensics Secur. 1(2), 205–214 (2006) Y. Sutcu, S. Bayram, H.T. Sencar, N. Memon: Improvements on sensor noise based source camera identification, Proc. IEEE ICME (2007) M. Chen, J. Fridrich, M. Goljan: Digital imaging sensor identification (further study), Proc. SPIE 6505(1), 65050P (2007) N. Khanna, A.K. Mikkilineni, G.T.-C. Chiu, J.P. Allebach, E.J. Delp: Forensic classification of imaging sensor types, Proc. SPIE 6505, 65050U (2007) N. Khanna, A.K. Mikkilineni, G.T.-C. Chiu, J.P. Allebach, E.J. Delp: Scanner identification using sensor pattern noise, Proc. SPIE 6505, 65050K (2007) H. Gou, A. Swaminathan, M. Wu: Robust scanner identification based on noise features, Proc. SPIE 6505, 65050S (2007) E. Dirik, H.T. Sencar, N. Memon: Source camera identification based on sensor dust characteristics, Proc. IEEE SAFE (2007) A.C. Popescu, H. Farid: Exposing digital forgeries by detecting traces of re-sampling, IEEE Trans. Signal Process. 53(2), 758–767 (2005) A.C. Popescu, H. Farid: Exposing digital forgeries in color filter array interpolated images, IEEE Trans. Signal Process. 53(10), 3948–3959 (2005) T. Sikora: MPEG-1 and MPEG-2 digital video coding standards. In: Digital Consumer Electronics Handbook, ed. by R.K. Jurgen (McGraw-Hill, New York 1997) A. Popescu, H. Farid: Statistical tools for digital forensics, 6th Int. Workshop on Information Hiding, Toronto, Canada (2004)

827

37.31. W. Wang, H. Farid: Exposing digital forgeries in video by detecting double MPEG compression, MM&Sec’06, 26–27 September 2006, Geneva, Switzerland (2006) 37.32. M.K. Johnson, H. Farid: Exposing digital forgeries by detecting inconsistencies in lighting, Proc. ACM Multimedia Security Workshop (2005) 37.33. M.K. Johnson, H. Farid: Exposing digital forgeries through chromatic aberration, Proc. ACM Multimedia Security Workshop (2006) 37.34. T.E. Boult, G. Wolberg: Correcting chromatic aberrations using image warping, Proc. IEEE Conference on Computer Vision and Pattern Recognition (1992) pp. 684–687 37.35. M. K. Johnson, H. Farid: Metric measurements on a plane from a single image, Technical Report TR2006-579, Dartmouth College, Computer Science (2006) 37.36. H. Farid: Detecting digital forgeries using bispectral analysis, Technical Report AIM-1657, Massachusetts Institute of Technology (1999) 37.37. Y. Sutcu, B. Coskun, H.T. Sencar, N. Memon: Tamper detection based on regularity of wavelet transform coefficients, 2007 IEEE Int. Conference on Image Processing (ICIP) (2007) 37.38. B. Sankur, S. Bayram, İ. Avcıbaş, N. Memon: Image manipulation detection, J. Electron. Imaging 15(4), 041102 (2006) 37.39. S. Bayram, İ. Avcıbaş, B. Sankur, N. Memon: Image manipulation detection with binary similarity measures, EUSIPCO (2004) 37.40. İ. Avcıbaş, S. Bayram, N. Memon, M. Ramkumar, B. Sankur: A classifier design for detecting image manipulations, Proc. 2004 Int. Conference on Image Processing, Singapore (2004) 37.41. R. Duda, P. Hart: Pattern Classification and Scene Analysis (John Wiley and Sons, San Francisco 1973) 37.42. J. Fridrich, D. Soukal, J. Lukas: Detection of copymove forgery in digital images, Proc. 2003 Digital Forensic Research Workshop (2003) 37.43. A.C. Popescu, H. Faridy: Exposing digital forgeries by detecting duplicated image regions, Technical Report TR2004-515, Dartmouth College, Computer Science (2004) 37.44. H. Farid: Exposing digital forgeries in scientific images, ACM MM&Sec’06, 26–27 September 2006, Geneva, Switzerland (2006) 37.45. T.-T. Ng, S.-F. Chang, M.-P. Tsui: Physics-motivated features for distinguishing photographic images and computer graphics, ACM MM’05, Singapore (2005) 37.46. A.E. Dirik, S. Bayram, H.T. Sencar, N. Memon: New features to identify computer generated images, 2007 IEEE Int. Conference on Image Processing (ICIP) (2007) 37.47. S. Dehnie, T. Sencar, N. Memon: Digital image forensics for identifying computer generated and

828


digital camera images, 2006 IEEE Int. Conference on Image Processing (ICIP) (2006) 37.48. H. Farid, S. Lyu: Higher-order wavelet statistics and their application to digital forensics, 2003 Conference on Computer Vision and Pattern Recognition Workshop, Vol. 8 (2003) 37.49. N. Tian-Tsong, C. Shih-Fu, H. Yu-Feng, X. Lexing, T. Mao-Pei: Physics-motivated features for distinguishing photographic images and computer graphics, 2005 ACM Multimedia, Singapore (2005) 37.50. Y. Wang, P. Moulin: On discrimination between photorealistic and photographic images, 2006 IEEE Int. Conference on Acoustics, Speech and Signal Processing, IEEE, May 2006, Vol. 2 (2006) pp. II-161–II-164

37.51. S. Dehnie, H.T. Sencar, N. Memon: Identification of computer generated and digital camera images for digital image forensics, Proc. 2006 IEEE Int. Conference on Image Processing (ICIP) (2006) 37.52. T.-T. Ng, S.-F. Chang: A model for image splicing, 2004 IEEE Int. Conference on Image Processing (ICIP) (2004) 37.53. T.-T. Ng, S.-F. Chang, Q. Sun: Blind detection of photomontage using higher order statistics, 2004 IEEE Int. Conference on Circuits and Systems (ISCAS) (2004) 37.54. T.-T. Ng, S.-F. Chang: Blind detection of digital photomontage using higher order statistics, ADVENT Technical Report #201-2004-1, Columbia University (2004)

The Authors Dr. Shiguo Lian received his PhD in multimedia security from Nanjing University of Science and Technology, China, in July 2005. He was a research assistant at the City University of Hong Kong in 2004 and has been employed by France Telecom R&D (Orange Labs), Beijing since July 2005. He has (co-)authored more than 60 technical papers and book chapters and holds 16 patents. He is the author of the book Multimedia Content Encryption and co-editor of Handbook of Research on Secure Multimedia Distribution. His research interests include network and multimedia security, and intelligent services, i.e., lightweight cryptography, digital rights management (DRM), and intelligent multimedia services and security. Shiguo Lian France Telecom R&D (Orange Labs) Beijing 2 Science Institute South Road, Haidian District Beijing, 100080, China [email protected]

Yan Zhang received his BS in communication engineering from the Nanjing University of Post and Telecommunications, China; an MS in electrical engineering from the Beijing University of Aeronautics and Astronautics, China; and a PhD from the School of Electrical and Electronics Engineering, Nanyang Technological University, Singapore. Since August 2006 he has worked with the Simula Research Laboratory, Norway. His research interests include resource, mobility, spectrum, data, energy, and security management in wireless networks and mobile computing. He is a member of IEEE and IEEE Computer Society. Yan Zhang Simula Research Laboratory Martin Linges v 17, Fornebu P.O. Box 134 1325 Lysaker, Norway [email protected]