CN111160364B - Multi-operation-chain evidence obtaining detection method based on residual characteristics under different domains - Google Patents
Multi-operation-chain evidence obtaining detection method based on residual characteristics under different domains Download PDFInfo
- Publication number
- CN111160364B CN111160364B CN201911236716.0A CN201911236716A CN111160364B CN 111160364 B CN111160364 B CN 111160364B CN 201911236716 A CN201911236716 A CN 201911236716A CN 111160364 B CN111160364 B CN 111160364B
- Authority
- CN
- China
- Prior art keywords
- image
- residual
- matrix
- dimensions
- dct
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06V—IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING
- G06V10/00—Arrangements for image or video recognition or understanding
- G06V10/40—Extraction of image or video features
- G06V10/46—Descriptors for shape, contour or point-related descriptors, e.g. scale invariant feature transform [SIFT] or bags of words [BoW]; Salient regional features
- G06V10/462—Salient features, e.g. scale invariant feature transforms [SIFT]
- G06V10/464—Salient features, e.g. scale invariant feature transforms [SIFT] using a plurality of salient features, e.g. bag-of-words [BoW] representations
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- G06T5/00—Image enhancement or restoration
- G06T5/10—Image enhancement or restoration by non-spatial domain filtering
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- G06T5/00—Image enhancement or restoration
- G06T5/20—Image enhancement or restoration by the use of local operators
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- G06T7/00—Image analysis
- G06T7/40—Analysis of texture
- G06T7/41—Analysis of texture based on statistical description of texture
- G06T7/45—Analysis of texture based on statistical description of texture using co-occurrence matrix computation
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- G06T2207/00—Indexing scheme for image analysis or image enhancement
- G06T2207/20—Special algorithmic details
- G06T2207/20024—Filtering details
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- G06T2207/00—Indexing scheme for image analysis or image enhancement
- G06T2207/20—Special algorithmic details
- G06T2207/20048—Transform domain processing
- G06T2207/20052—Discrete cosine transform [DCT]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06T—IMAGE DATA PROCESSING OR GENERATION, IN GENERAL
- G06T2207/00—Indexing scheme for image analysis or image enhancement
- G06T2207/20—Special algorithmic details
- G06T2207/20048—Transform domain processing
- G06T2207/20056—Discrete and fast Fourier transform, [DFT, FFT]
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
- Y02D10/00—Energy efficient computing, e.g. low power processors, power management or thermal management
Abstract
The invention discloses a multi-operation chain evidence obtaining detection method based on residual characteristics under different domains, which can realize type identification, sequence determination and parameter estimation of digital image tampering operation by analyzing the type of tampering trace left by a digital image and the mutual influence degree of the tamper trace, so as to attempt to reveal a complete tampering processing process, namely an image operation chain; the method can provide effective detection means and important technical support, the algorithm relates to the fields of image signal processing, signal detection and estimation, pattern recognition, criminal judicial and the like, and the algorithm promotes the cross fusion of multiple disciplines and has wide and deep scientific significance.
Description
Technical Field
The invention belongs to the field of digital image evidence collection, and particularly relates to a method for detecting evidence collection of multiple operation chains based on residual characteristics under different domains.
Background
Existing digital image forensics can be categorized into active and passive types. Active forensics prevent and verify possible image tampering by pre-embedding digital watermarks or generating perceptual hashes. Although active forensics can achieve excellent performance, the application range is severely limited due to the need to embed or generate auxiliary data in advance, and even the need for authentication by a third party. Passive evidence obtaining is also called blind evidence obtaining, can directly judge true and false according to the digital image, has better adaptability, and gradually becomes a hot spot for researching the technical field of image evidence obtaining in recent years. Currently, passive evidence collection surrounding image authenticity identification has achieved a stepwise progression. However, most of them are deployed around a particular editing operation of the digital image.
However, the actual image manipulation and forgery process may involve multiple processing operations at the same time, with a certain order of precedence between them. In order to fully reveal the editing process that a digital image may undergo, it is also necessary to determine which operations the image undergoes and the order of their sequencing, so-called chain of image operations, during forensics. Obviously, this is a deeper forensic target than the authenticity discrimination. For example, for judicial evidence collection, this would constitute a complete chain of evidence with better confidence.
Disclosure of Invention
The invention aims to provide a method for detecting evidence collection of various operation chains based on residual characteristics under different domains aiming at the defects of the prior art.
The method is formed by combining two parts of symbiotic matrix characteristics under a space domain and Markov characteristics under a discrete Fourier transform (DCT) domain.
The extraction steps of the space domain lower symbiotic matrix feature are as follows:
1) Filtering the image by using high-pass filters with various different orders to obtain a residual image in a space domain, wherein the residual image is represented by R;
2) Quantizing the filtered residual image with an appropriate quantization parameter for each different filter, denoted F;
3) Using a threshold value T, limiting the quantized residual error value to a range from-T to +T, and representing the residual error value by V;
4) Calculating a third-order co-occurrence matrix C of each residual quantized and thresholded image (namely V);
5) And respectively calculating the third-order co-occurrence matrixes in the horizontal direction and the vertical direction, which are obtained under each different filter, wherein each co-occurrence matrix is characterized in that 27 is used for merging the values of all the calculated co-occurrence matrixes to obtain a 702-dimensional airspace co-occurrence matrix characteristic.
The Markov characteristic extraction step under the DCT domain comprises the following steps:
1) Performing 8-by-8 block DCT on the image to obtain DCT coefficients of the image;
2) Rounding DCT coefficients of an image and taking absolute values to represent the absolute values by A;
3) Making the DCT coefficients to be horizontal, vertical, a main diagonal and a secondary diagonal to be different; using a threshold T, defining the difference in the interval-T to +t; respectively calculating the characteristics of the third-order co-occurrence matrix in the horizontal direction and the vertical direction of each difference matrix to obtain a (2T+1) 3 Features with a multiplication of 8 equal to 1000 (i.e., 125 by 8) dimensions:
F1h(i,j)＝F(i,j)-F(i,j+1)
F1v(i,j)＝F(i,j)-F(i+1,j)
F1d(i,j)＝F(i,j)-F(i+1,j+1)
F1m(i,j)＝F(i+1,j)-F(i,j+1)
F2h(i,j)＝F(i,j-1)-2F(i,j)+F(i,j+1)
F2v(i,j)＝F(i-1,j)-2F(i,j)+F(i+1,j)
F2d(i,j)＝F(i-1,j-1)-2F(i,j)+F(i+1,j+1)
F2m(i,j)＝F(i+1,j-1)-2F(i,j)+F(i-1,j+1)。
preferably: in order to reduce the feature dimension, the features extracted from the two parts are prioritized by the SVM-RFE, the highest 600 dimensions are taken, and finally the feature dimension is compressed from 1702 dimensions to 600 dimensions.
Preferably: through the proposed features and the image dataset made by the boss-base, multiple classifications are trained and detection of multiple image tampering operation chains is achieved using multiple classifiers.
The beneficial technical effects of the invention are as follows:
1) The existing detection of single image tampering operation can only realize specific operation detection, and is ineffective for detecting whether the image is subjected to other operations.
2) Existing image manipulation chain detection generally only detects five manipulation chain hypotheses formed for two specific operations (there are five manipulation chain hypotheses that an image may experience at most for two single operations, a and B): NULL (without any tampering), A, B, AB, BA).
3) Also, the parameters of each operation used in existing image manipulation chain tampering are typically fixed values (e.g., the a operation is an image size scaling, then the scaling factor is fixed at 1.5: i.e. to make the image size 1.5 times the original).
Drawings
Fig. 1: algorithm identification flow chart;
fig. 2: residual image.
Examples
The algorithm feature is formed by combining two parts of a co-occurrence matrix feature under a space domain and a Markov feature under a discrete Fourier transform (DCT) domain.
1. Extracting the symbiotic matrix characteristics under the airspace:
1) Filtering the image by using high-pass filters with various different orders (13 first-order, second-order and third-order high-pass linear nonlinear filters in total, see fig. 2) to obtain a residual image (represented by R) in a spatial domain;
2) Quantizing (denoted by F) the filtered residual image for each different filter using an appropriate quantization parameter;
3) Using a threshold T (T is set to 1), defining the quantized residual value to a range from-T to +t (i.e., a range from-1 to 1) (denoted by V);
4) Calculating a third-order co-occurrence matrix C of each residual quantized and thresholded image (namely V);
5) And respectively calculating a third-order co-occurrence matrix (namely C) in the horizontal direction and the vertical direction, which are obtained under each different filter, wherein each co-occurrence matrix is characterized in that 27 combines the values of all the calculated co-occurrence matrices to obtain a space domain co-occurrence matrix characteristic of 702 dimensions (27 times 13 times 2).
2. A Markov feature extraction step in the DCT domain:
performing 8-by-8 block DCT (discrete cosine transform) on the image to obtain the integer and absolute value (expressed by A) of DCT coefficients of the image;
making the DCT coefficients to be horizontal, vertical, the main diagonal and the secondary diagonal to be the difference (using the following formula);
using a threshold T (T is set to 2), the difference is limited to the interval-T to +t (i.e., the interval-2 to 2);
respectively calculating the characteristics of the third-order co-occurrence matrix in the horizontal direction and the vertical direction of each difference matrix to obtain a (2T+1) 3 Features with a multiplication of 8 equal to 1000 (i.e., 125 by 8) dimensions:
F1h(i,j)＝F(i,j)-F(i,j+1)
F1v(i,j)＝F(i,j)-F(i+1,j)
F1d(i,j)＝F(i,j)-F(i+1,j+1)
F1m(i,j)＝F(i+1,j)-F(i,j+1)
F2h(i,j)＝F(i,j-1)-2F(i,j)+F(i,j+1)
F2v(i,j)＝F(i-1,j)-2F(i,j)+F(i+1,j)
F2d(i,j)＝F(i-1,j-1)-2F(i,j)+F(i+1,j+1)
F2m(i,j)＝F(i+1,j-1)-2F(i,j)+F(i-1,j+1)。
3. in order to reduce the feature dimension, the features extracted from the two parts are prioritized by the SVM-RFE, the highest 600 dimensions are taken, and finally the feature dimension is compressed from 1702 dimensions to 600 dimensions. Through the proposed features and the image dataset made by the boss-base, multiple classifications are trained and detection of multiple image tampering operation chains is achieved using multiple classifiers.
4. The algorithm described above: 1) The proposed features have universality and can detect multiple image tampering operation chains simultaneously; 2) The application condition of the invention is closer to the actual image editing scene, and can be used for legal identification of image tampering; 3) The invention is a first research invention for realizing the higher-level and more general image tampering operation, is not a research for evidence collection of certain image operation, and is not a research for assumption detection of 5-step operation chains formed only for specific two operations like the prior image operation chain evidence collection.
Claims (2)
1. A multiple operation chain evidence obtaining detection method based on residual characteristics under different domains is characterized in that: the method is formed by combining two parts of symbiotic matrix characteristics under a space domain and Markov characteristics under a discrete Fourier transform (DCT) domain;
the extraction steps of the space domain lower symbiotic matrix feature are as follows:
1) Filtering the image by using high-pass filters with various different orders to obtain a residual image in a space domain, wherein the residual image is represented by R;
2) Quantizing the filtered residual image with an appropriate quantization parameter for each different filter, denoted F;
3) Using a threshold value T, limiting the quantized residual error value to a range from-T to +T, and representing the residual error value by V;
4) Calculating a third-order co-occurrence matrix C of each residual quantized and thresholded image V;
5) Respectively calculating the third-order co-occurrence matrixes in the horizontal direction and the vertical direction, which are obtained under each different filter, wherein each co-occurrence matrix is characterized in that 27 is used for combining the values of all the calculated co-occurrence matrixes to obtain a 702-dimensional airspace co-occurrence matrix characteristic;
the Markov characteristic extraction step under the DCT domain comprises the following steps:
1) Performing 8-by-8 block DCT on the image to obtain DCT coefficients of the image;
2) Rounding DCT coefficients of an image and taking absolute values to represent the absolute values by A;
3) Making the DCT coefficients to be horizontal, vertical, a main diagonal and a secondary diagonal to be different; using a threshold T, defining the difference in the interval-T to +t; respectively calculating the 3 characteristics of the third-order co-occurrence matrix in the horizontal direction and the vertical direction of each difference matrix to obtain a (2T+1) 3 Feature that 8 is equal to 1000, 125 by 8 dimensions:
F1h(i,j)＝F(i,j)-F(i,j+1)
F1v(i,j)＝F(i,j)-F(i+1,j)
F1d(i,j)＝F(i,j)-F(i+1,j+1)
F1m(i,j)＝F(i+1,j)-F(i,j+1)
F2h(i,j)＝F(i,j-1)-2F(i,j)+F(i,j+1)
F2v(i,j)＝F(i-1,j)-2F(i,j)+F(i+1,j)
F2d(i,j)＝F(i-1,j-1)-2F(i,j)+F(i+1,j+1)
F2m(i,j)＝F(i+1,j-1)-2F(i,j)+F(i-1,j+1)；
and training a multi-classifier through the extracted features and the image data set manufactured by the boss-base, and using the multi-classifier to realize detection of various image tampering operation chains.
2. The multiple operation chain evidence collection detection method according to claim 1, wherein: in order to reduce the feature dimension, the features extracted from the two parts are prioritized by the SVM-RFE, the highest 600 dimensions are taken, and finally the feature dimension is compressed from 1702 dimensions to 600 dimensions.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911236716.0A CN111160364B (en) | 2019-12-05 | 2019-12-05 | Multi-operation-chain evidence obtaining detection method based on residual characteristics under different domains |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911236716.0A CN111160364B (en) | 2019-12-05 | 2019-12-05 | Multi-operation-chain evidence obtaining detection method based on residual characteristics under different domains |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111160364A CN111160364A (en) | 2020-05-15 |
| CN111160364B true CN111160364B (en) | 2023-06-02 |
Family
ID=70556501
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911236716.0A Active CN111160364B (en) | 2019-12-05 | 2019-12-05 | Multi-operation-chain evidence obtaining detection method based on residual characteristics under different domains |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111160364B (en) |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2008157843A1 (en) * | 2007-06-21 | 2008-12-24 | Guardian Technologies International Inc. | System and method for the detection, characterization, visualization and classification of objects in image data |
| JP2013041563A (en) * | 2011-07-15 | 2013-02-28 | Nissan Motor Co Ltd | Evaluation device for image similarity and evaluation method for the same |
| CN110298280A (en) * | 2019-06-20 | 2019-10-01 | 上海海洋大学 | A kind of ocean eddy recognition methods based on MKL multiple features fusion |
Family Cites Families (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US8023747B2 (en) * | 2007-02-09 | 2011-09-20 | New Jersey Institute Of Technology | Method and apparatus for a natural image model based approach to image/splicing/tampering detection |
| JP2013126189A (en) * | 2011-12-15 | 2013-06-24 | Fujitsu Ltd | Image processor, alteration prevention method, and alteration detection method |
| CN103761799B (en) * | 2014-01-13 | 2016-03-30 | 李晓妮 | A kind of bill anti-counterfeit method based on texture image feature and device |
| CN103914839B (en) * | 2014-03-27 | 2017-02-15 | 中山大学 | Image stitching and tampering detection method and device based on steganalysis |
| CN105654089A (en) * | 2014-08-20 | 2016-06-08 | 江南大学 | Image re-sampling detection based on Markov process and Gabor filtering |
| CN107832800A (en) * | 2017-11-21 | 2018-03-23 | 中国人民武装警察部队工程大学 | A kind of method analyzed JPEG hidden images and its device |
| CN107977964A (en) * | 2017-12-01 | 2018-05-01 | 天津大学 | Slit cropping evidence collecting method based on LBP and extension Markov feature |
-
2019
- 2019-12-05 CN CN201911236716.0A patent/CN111160364B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| WO2008157843A1 (en) * | 2007-06-21 | 2008-12-24 | Guardian Technologies International Inc. | System and method for the detection, characterization, visualization and classification of objects in image data |
| JP2013041563A (en) * | 2011-07-15 | 2013-02-28 | Nissan Motor Co Ltd | Evaluation device for image similarity and evaluation method for the same |
| CN110298280A (en) * | 2019-06-20 | 2019-10-01 | 上海海洋大学 | A kind of ocean eddy recognition methods based on MKL multiple features fusion |
Also Published As
| Publication number | Publication date |
|---|---|
| CN111160364A (en) | 2020-05-15 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Park et al. | Double JPEG detection in mixed JPEG quality factors using deep convolutional neural network | |
| Goljan | Digital camera identification from images–estimating false acceptance probability | |
| Wu et al. | Anti-forensics of median filtering | |
| Milani et al. | An overview on video forensics | |
| Qiu et al. | A universal image forensic strategy based on steganalytic model | |
| CN106530200B (en) | Steganographic image detection method and system based on deep learning model | |
| Ravi et al. | Compression noise based video forgery detection | |
| Marra et al. | Evaluation of residual-based local features for camera model identification | |
| CN110210498B (en) | Digital image equipment evidence obtaining system based on residual learning convolution fusion network | |
| Wang et al. | Tampered region localization of digital color images based on jpeg compression noise | |
| Zeng et al. | Countering anti-forensics of median filtering | |
| Barni et al. | Higher-order, adversary-aware, double jpeg-detection via selected training on attacked samples | |
| Chen et al. | Detection of operation chain: JPEG-resampling-JPEG | |
| Hakimi et al. | Image-splicing forgery detection based on improved lbp and k-nearest neighbors algorithm | |
| Qadir et al. | Estimating JPEG2000 compression for image forensics using Benford's Law | |
| KR20090109012A (en) | Image Processing | |
| Korus et al. | Content authentication for neural imaging pipelines: End-to-end optimization of photo provenance in complex distribution channels | |
| Baracchi et al. | Facing image source attribution on iPhone X | |
| Berthet et al. | A review of data preprocessing modules in digital image forensics methods using deep learning | |
| Mehrish et al. | Joint spatial and discrete cosine transform domain-based counter forensics for adaptive contrast enhancement | |
| Chetty et al. | Nonintrusive image tamper detection based on fuzzy fusion | |
| CN111160364B (en) | Multi-operation-chain evidence obtaining detection method based on residual characteristics under different domains | |
| CN106851140A (en) | A kind of digital photo images source title method of use spatial domain smothing filtering | |
| Samaras et al. | Robustness in blind camera identification | |
| CN102592151B (en) | Blind detection method for median filter in digital image |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |