JPEG image classification in digital forensic via DCT coefficient analysis

Information technology systems are attacked by offenders using digital devices and networks to facilitate their crimes and hide their identities, creating new challenges for digital investigators. Malicious programs that exploit vulnerabilities also serve as threats to digital investigators. Since digital devices such as computers and networks are used by organisations and digital investigators, malicious programs and risky practices that may contaminate the integrity of digital evidence can lead to loss of evidence. For some reasons, digital investigators face a major challenge in preserving the integrity of digital evidence. Not only is there no definitive comprehensive model of digital forensic investigation for ensuring the reliability of digital evidence, but there has to date been no intensive research into methods of doing so. To address the issue of preserving the integrity of digital evidence, this research improves upon other digital forensic investigation model by creating a Comprehensive Digital Forensic Investigation Model (CDFIM), a model that results in an improvement in the investigation process, as well as security mechanism and guidelines during investigation. The improvement is also effected by implementing Proxy Mobile Internet Protocol version 6 (PMIPv6) with improved buffering based on Open Air Interface PIMIPv6 (OAI PMIPv6) implementation to provide reliable services during handover in Mobile Node (MN) and improve performance measures to minimize loss of data which this research identified as a factor affecting the integrity of digital evidence. The advantage of this is to present that the integrity of digital evidence can be preserved if loss of data is prevented. This research supports the integration of security mechanism and intelligent software in digital forensic investigation which assist in preserving the integrity of digital evidence by conducting experiments which carried out two different attack experiment to test CDFIM. It found that when CDFIM used security mechanism and guidelines with the investigation process, it was able to identify the attack and also ensured that the integrity of the digital evidence was preserved. It was also found that the security mechanism and guidelines incorporated in the digital investigative process are useless when the security guidelines are ignored by digital investigators, thus posing a threat to the integrity of digital evidence.

Digital forensics is the digital equivalence of traditional crime investigations that leverages digital technologies to facilitate criminal investigations. The expertise and previous experience of an investigator or any security agent in traditional forensic investigations play an important role in the success, efficiency, and effectiveness of the investigation. Similarly employing the power of intelligence in the current computational resources in the digital investigation process will lead to more efficient and effective digital investigation results. This study builds on existing works in the literature to propose the use of clustering and classification machine learning algorithms on evolving database files to achieve intelligence in the digital investigation process and finally come up with a comprehensive block diagram as a general-purpose framework for intelligent forensic investigation.

Non-intrusive digital image forensics (NIDIF) aims at authenticating the validity of digital images utilizing their intrinsic characteristics when the active forensic methods, such as digital watermarking or digital signatures, fail or are not present. The NIDIF for lossy JPEG compressed images are of special importance due to its pervasively use in many applications. Recently, researchers showed that certain types of tampering manipulations can be revealed when JPEG re-compress artifacts (JRCA) is found in a suspicious JPEG image. Up to now, most existing works mainly focus on the detection of doubly JPEG compressed images without block shifting. However, they cannot identify another JRCA --- the shifted double JPEG (SD-JPEG) compression artifacts which are commonly present in composite JPEG images. In this paper, the SD-JPEG artifacts are modeled as a noisy 2-D convolutive mixing model. A symmetry verification based method and a first digit histogram based remedy method are proposed to form an integral identification framework. It can reliably detect the SD-JPEG artifacts when a critical state is not reached. The experimental results have shown the effectiveness of the proposed framework.

The advancement in information technology has changed our life significantly. No doubt, the Internet, smartphones, and social media have connected people and society. It has contributed to various aspects of our daily life. However, there is also a dark side of cyberspace, that is, cybercrime. It is becoming a global threat and needs technological solutions to combat. Whenever there is a crime, there is a law to curb the crime. The role of digital forensics is to understand the 'Who, What, Where and Why' of the incident. Digital forensics is a scientific process to collect, analyze, and present the evidence in a court of law. As it is used to link the person with criminal activities, it is crucial that the entire process of investigation be trustworthy. Managing the digital evidence and maintaining the chain of custody and integrity of digital evidence are utmost important. This chapter discusses the applications of blockchain technology to address the challenging issues faced by the digital investigation process and forensic readiness. The chapter also discusses the legal issues and admissibility of blockchain-based evidence in a court of law.

There is an increasing number of crime cases involving computers and multimedia files such as child pornographic photos, recorded voices and CCTV videos. It is not uncommon that suspects can manage to erase the files or even destroy the whole file system before seized by the law enforcement officer. Reconstructing fragmented files is still a challenge in digital forensics for both damaged and integrity files, especially without the file system information.
\n
\nFirstly, this work focuses on JPEG files, one of the most popular photograph formats, and proposes techniques for recovering partially-damaged standalone JPEG fragments by reconstructing pseudo headers. The techniques deal with missing Huffman tables and sub-sampling factors, estimate the resolution of JPEG fragments, assess the image quality of JPEG files with incorrect quantization tables, and create quantization tables that are very close to the correct quantization tables in a reasonable amount of time. Extensive experiments with real camera pictures demonstrate that the techniques can recover standalone fragments accurately and efficiently.
\n
\nSecondly, this study focuses on JPEG file carving for, in particular, heavily fragmented JPEG files when file system information damaged. Due to the fact that, it is a critical challenge to identify encrypted or compressed unknown data streams without sufficient corresponding decoding information. To begin with, we propose a technology to display and identify the JPEG file fragmentation piece, which is a partial content of a file and consist of one or more physically consecutive data blocks, from unknown data streams. A new similarity matching metric (CED) is proposed to evaluate the difference between data blocks in large scale. By evaluating the pattern of similarity distribution in fragmented file, we can identify the occurrence of fragmentation point in advance. Then, a fragmentation piece-based _le carving methodology is presented to recover heavily fragmented JPEG files. By comparing with state-of-the-art photo recovery technical, the proposed techniques can automatically and successfully recover most of fragmented files from real case.
\n
\nMoreover, with the popularity of smart phone, voice chat of instant message (IM) applications are getting popular. However, huge amount of manpower is required to listen, analyze, and identify relevant chat files of IM apps during current forensic investigation tools and techniques. This study proposes a semi-automatic integrated framework to deal with audio forensic investigation for IM apps by applying modern technologies. The main objective is to reduce the amount of manpower in the investigation. This is the first work that applies speech to text technology in voice chat of IM apps forensic. Both text and audio features are extracted to reconstruct the dialog conversation. Experiments with real case data show that the framework is promising. And it is able to translate dialog into readable text and improve the efficiency during investigation with reconstructed conversation.

In today's era, efficiency of digital forensic investigation process is the biggest challenge for digital forensic community. The efficiency of investigation depends on the other various factors like storage capacity of digital media, proficiency of investigator and type of investigating case. Moreover, these storage devices do not store only investigating case related data but also stores accused personal and professional information which can lead a breach of privacy of accused. Very little attention has been given to make digital investigation process fully automated. In the Privacy Preserving Efficient Digital Forensic Investigation (PPEDFI) framework, we bridge the gap between efficiency and the privacy issue in digital forensic investigation process. The main contribution of the PPEDFI framework is to make the digital investigation process automated and shorten the turnaround time in evidence extraction process, thus saving the cost and time of digital investigation process. To evaluate the system, we conducted an investigation study namely: Digitized Document Fraud. The proposed framework was able to extract the evidence files and also rank them on the basis of their relevancy for being evidence.

Inpainting, originally designed in computer vision to reconstruct lost or deteriorated parts of images and videos, has been used for image tampering, including region filling and object removal to alter the truth. While several types of tampering including copy-move and seam carving forgery can now be successfully exposed in image forensics, there has been very little study to tackle inpainting forgery in JPEG images, the detection of which is extremely challenging due to the post-recompression attacks performed to cover or compromise original inpainting traces. To date, there is no effective way to detect inpainting image forgery under combined recompression attacks. To fill such a gap in image forensics and reveal inpainting forgery from the post-recompression attacks in JPEG images, we propose in this paper an approach that begins with large feature mining in discrete transform domain, ensemble learning is then applied to deal with the high feature dimensionality and to prevent the overfitting that generally happens to some regular classifiers under high feature dimensions. Our study shows the proposed approach effectively exposes inpainting forgery under post recompression attacks; especially, it noticeably improves the detection accuracy while the recompression quality is lower than the original JPEG image quality, and thus bridges a gap in image forgery detection.

Tampering detection has been increasingly attracting attention in the field of digital forensics. As a popular nonlinear smoothing filter, median filtering is often used as a post-processing operation after image forgeries such as copy-paste forgery (including copy-move and image splicing), which is of particular interest to researchers. To implement the blind detection of median filtering, this paper proposes a novel approach based on a frequency-domain feature coined the annular accumulated points (AAP). Experimental results obtained on widely used databases, which consists of various real-world photos, show that the proposed method achieves outstanding performance in distinguishing median-filtered images from original images or images that have undergone other types of manipulations, especially in the scenarios of low resolution and JPEG compression with a low quality factor. Moreover, our approach remains reliable even when the feature dimension decreases to 5, which is significant to save the computing time required for classification, demonstrating its great advantage to be applied in real-time processing of big multimedia data.

The increasing prevalence of digital technology brings great convenience to human life, while also shows us the problems and challenges. Relying on easy-to-use image editing tools, some malicious manipulations, such as image forgery, have already threatened the authenticity of information, especially the electronic evidence in the crimes. As a result, digital forensics attracts more and more attention of researchers. Since some general post-operations, like widely used smooth filtering, can affect the reliability of forensic methods in various ways, it is also significant to detect them. Furthermore, the determination of detailed filtering parameters assists to recover the tampering history of an image. To deal with this problem, we propose a new approach based on convolutional neural networks (CNNs). Through adding a transform layer, obtained distinguishable frequency-domain features are put into a conventional CNN model, to identify the template parameters of various types of spatial smooth filtering operations, such as average, Gaussian and median filtering. Experimental results on a composite database show that putting the images directly into the conventional CNN model without transformation can not work well, and our method achieves better performance than some other applicable related methods, especially in the scenarios of small size and JPEG compression.

Content-aware scaling is a method for image retargeting. It has been widely used in image manipulation including tampering. To improve the detection of the forgery in JPEG images, we propose to merge calibrated neighboring joint density and a rich models-based approach that was originally designed for steganalysis. A feature selection algorithm is utilized to reduce the feature dimensionality in the merged feature set. Experimental results show that the high-dimensional detector consisting of calibrated neighboring joint density and rich model features noticeably improves the detection accuracy; and the application of feature selection method to the high-dimensional detector can further improve the detection accuracy by using a much smaller and optimized feature set.

Digital data forensics, which gathers evidence of data composition, origin, and history, is crucial in our digital world. Although this new research field is still in its infancy stage, it has started to attract increasing attention from the multimedia-security research community. This lecture addresses the first digit law and its applications to digital forensics. First, the Benford and generalized Benford laws, referred to as first digit law, are introduced. Then, the application of first digit law to detection of JPEG compression history for a given BMP image and detection of double JPEG compressions are presented. Finally, applying first digit law to detection of double MPEG video compressions is discussed. It is expected that the first digit law may play an active role in other task of digital forensics. The lesson learned is that statistical models play an important role in digital forensics and for a specific forensic task different models may provide different performance.

Digital image forgery and its forensics have emerged as a significant research domain. Digital forensics is required to examine the questioned images and classify them as authentic or tampered. This paper aims at image tamper detection using a novel energy deviation measure (EDM). The EDM is a measure of deviation in pixel intensity with respect to its immediate and distant neighbourhood. It is extracted by measuring the inter pixel intensity difference across and inside the DCT block boundary of a JPEG image. Features from EDM have been used for the classification of the authentic and tampered images. Support vector machine is used for image classification. The experimental results have shown that the proposed method performs better with fewer dimensions as compared to other state of the art methods. It gives improved accuracy and area under curve while classifying images. It is robust to noise and JPEG image compression quality factor.

In recent years, there has been a dramatic increase in the number of images captured by users. This is due to the wide availability of digital cameras and mobile phones which are able to capture and transmit images. Simultaneously, image-editing applications have become more usable, and a casual user can easily improve the quality of an image or change its content. The most common type of image modification is cloning, or copy-move forgery CMF, which is easy to implement and difficult to detect. In most cases, it is hard to detect CMF with the naked eye and many possible manipulations attacks can be used to make the doctored image more realistic. In CMF, the forger copies parts of the image and pastes them back into the same image. One possible transformation is rotation, where an object is copied, rotated and pasted. Rotation-invariant features need to be used to detect Copy-Rotate-Move CRM forgery. In this paper we present three contributions. First, a new technique to detect CMF is developed, using Dense Scale-Invariant Feature Transform DSIFT. Second, a new improved DSIFT descriptor is implemented which is more robust to rotation than Zernike moments. Third, a new method to remove false matching is proposed. Extensive experiments have been conducted to train, evaluate and test the algorithms, the new feature vector and the suggested method to remove false matching. We show that the proposed method can detect forgery in images with blurring, brightness change, colour reduction, JPEG compression, variations in contrast and added noise.

In this paper, copy-move forgery in image is detected for single image with multiple manipulations such as blurring, noise addition, gray scale conversion, brightness modifications, rotation, Hu adjustment, color adjustment, contrast changes and JPEG Compression. However, traditional algorithms detect only copy-move attacks in image and never for different manipulation in single image. The proposed LLP (Laterally linked pixel) algorithm has two dimensional arrays and single layer is obtained through unit linking pulsed neural network for detection of copied region and kernel tricks is applied for detection of multiple manipulations in single forged image. LLP algorithm consists of two channels such as feeding component (F-Channel) and linking component (L channel) for linking pixels. LLP algorithm linking pixels detects image with multiple manipulation and copy-move forgery due to one-to-one correspondence between pixel and neuron, where each pixel’s intensity is taken as input for F channel of neuron and connected for forgery identification. Furthermore, neuron is connected with neighboring field of neuron by L channel for detecting forged images with multiple manipulations in the image along with copy-move, through kernel trick classifier (KTC). From experimental results, proposed LLP algorithm performs better than traditional algorithms for multiple manipulated copy and paste images. The accuracy obtained through LLP algorithm is about 90% and further forgery detection is improved based on optimized kernel selections in classification algorithm.

Image tampering/forgery can be accomplished easily using precise image editing software. However, different type of traces is introduced during image forgery process that may helpful in image forgery detection. This paper is an attempt to propose a robust blind image tampering detection technique in accordance with wavelet transform and texture descriptor. Image crucial details are highlighted using shift-invariant stationary wavelet transform. This transform provides more information about image internal statistics in comparison with DWT. Further to convert this information in terms of the feature vector, co-occurrence-based texture operator is used. The linear kernel SVM classifier is utilized to distinguish between pristine and forged images. The effectiveness of the proposed technique is proved on three image forgery evaluation databases, i.e., CASIA v1.0, Columbia and DSO-1.