A REVIEW ON MODIFIED ANTI FORENSIC TECHNIQUE FOR REMOVING DETECTABLE

TRACES FORM DIGITAL IMAGES 1M.GOWTHAM RAJU. 2N.PUSHPALATHA, M.Tech (DECS) Student, Assistant professor

Department of ECE, AITS Department of ECE, AITS Annamacharya Institute of Technology and Sciences, Tirupati, India-517520

1mgr434@gmail.com 2pushpalatha_nainaru@rediffmail.com

Abstract: The increasing attractiveness and trust on digital photography has given rise to new acceptability issues in the field of image forensics. There are many advantages to using digital images. Digital cameras produce immediate images, allowing the photographer to outlook the images and immediately decide whether the photographs are sufficient without the postponement of waiting for the film and prints to be processed. It does not require external developing or reproduction. Furthermore, digital images are easily stored. No conventional "original image" is prepared here like traditional camera. Therefore when forensic researchers analyze the images they dont have access to the original image to compare. Fraud through conventional photograph is relatively difficult, requiring technical expertise. Whereas significant features of digital photography is the ease and the decreased cost in altering the image. Manipulation of digital images is simpler. With some fundamental software, digitally-recorded image can easily be edited. The most of the alterations include borrowing, cloning, removal and switching parts of a digital image. A number of techniques are available to verify the authenticity of images. But the fact is that number of image tampering is also increasing. The forensic researchers need to find new techniques to detect the tampering. For this purpose they have to find the new anti-forensic techniques and solutions for them. In this paper a new anti-forensic technique is considered, which is capable of removing the evidences of compression and filtering. It is done by adding a specially designed noise called tailored noise to the image after processing. This method can be used to cover the history of processing in addition to that it can be also used to remove the signature traces of filtering. Keywords: Digital forensic, jpeg compression, image coefficients, image history, filtering, Quantization, DCT coefficients.

Introduction Digital images become very popular for transferring visual information. And there are many advantages using these images instead of traditional camera film. The digital

cameras produce instant images which can be viewed without delay of waiting for film processing. it does not require external development they can be store easily. And there should not be taken any time delay. Images can be processed in different ways. They are processed as jpeg images, in some other cases they are processed in bit mat format. When they are used in bitmap format it does need to use without any information of past processing. to know about the past processing information it is desirable to know the artifacts of image. These techniques are capable of finding the earlier processing information. Therefore forensic researches need to examine the authenticity of images to find how much the trust can be put up on the techniques and this can also be used to find out the drawback of this techniques. Person with good knowledge in image processing can do undetectable manipulation. it is also desirable to find the draw backs of these techniques. For this purpose research has to develop both forensic and anti-forensic techniques to understand the weaknesses. Consider the situation that already tried to remove the artifacts of compression. The forensic experts can easily find out the existing techniques such as quantized estimation. It is useful when image processing unit receives compression details and quantization table used for processing and compression. Some of the existing techniques like detection of blocking signature estimation of quantization table this allow the mismatches and forgeries in jpeg blocks by finding the evidence of compression. To solve this problem of image forensic the research has to develop tools that are capable of fooling the existing methodologies. Even though the existing methods have advantages some limitations too. The main drawback of these techniquesis that they do not report for the risk that new technique may be design and used to conceal the traces ofmanipulations. As mention earlier it may possible for an image forger to generate undetectable compression and other image forgeries. This modified anti-forensic technique approach is presented which is capable of hiding the traces of earlier processing including both compression and filtering. This concept is that adding specially designed noise to the images blocks will help to hide the proof of tampering.

18

INTERNATIONAL CONFERENCE ON CURRENT INNOVATIONS IN ENGINEERING AND TECHNOLOGY

INTERNATIONAL ASSOCIATION OF ENGINEERING & TECHNOLOGY FOR SKILL DEVELOPMENT

ISBN: 378 - 26 - 138420 - 5

www.iaetsd.in

1. RELATED TO PROJECT WORK: 1.1. ANTI FORENSIC OF DIGITAL IMAGE COMPRESSION: As society has become increasingly reliant upon digital image to communicate visual information, a number of forensic techniques have developed. Among the most successful of these are techniques that make use of an images compression history and its associate compression finger prints. Anti-forensic techniques capable of fooling forensicAlgorithms this paper represents set of anti-forensic techniques designed to remove forensically significant indicators of compression of an image. in this technique first distributes the image transform coefficients before compression then adding anti-forensic transform coefficients of compressed image so that distribution matches estimation one. When we use these frame work of anti-forensic techniques specially targeted at erased finger prints left by both JPEG and wavelet based coders. 1.1.1. ANTI-FORENSIC FRAMEWORK: All image compression techniques are subbing band coders, which are themselves a subset of transform coders. Transform coders are mathematically applying to the signals of compressing the transforms coefficients. Sub band coders are transform coders that decompose the signal in to different frequency bands. By applying two dimensional invertible transform, such as DCT to as image as a whole that has been segmented into a series of disjoint sets. Each quantized transform coefficient value can be directly related to its corresponding original transform coefficient value by equation. = < + 1 (1) If the image was divided into segment during compression, another compression finger print may arise. Because of the loss

Fig1: anti forensic of digital image compression When the anti-forensically modify each quantized transform coefficient by adding specially designed noise,

which we refer to as anti-forensic dither, to it value according totheequation Z=Y+D The segment length is equal to the length of the quantization interval the probability that the quantized coefficient value is qk is given by. ( = ) (,) (2) The anti-forensic dithers distribution is given by the formula

P (D=d)= (,) (.) ( + < + 1)(3)

1.1.2. JPEG ANTI-FORENSICS: Brief over view of JPEG compression then present our anti-forensic technique designed to remove compression finger prints from JPEG compressed image DCT coefficients. For gray scale image, JPEG compression begins by segmenting an image into a series of non over lapping 8x8 pixel blocks then computing the two dimensional DCT of each block. Dividing each coefficient value by its corresponding entry in predetermined quantization matrix rounding the resulting value to the nearest integer. First image transformed from the RGB to the YCBCrcolorspace. After this can been performed, compression continues as if each color layer were an independent gray scale image. 1.1.3. DCT Coefficient Quantization Fingerprint Removal: Anti-forensic frame work which we outlined in section 2.we begins by modeling the distribution of coefficients values with in a particular ac sub band using the Laplace distribution. ( = ) =

x (4)

Using this model and the quantization rule described above the coefficient values of an ac sub band of DCT coefficients with in a JPEG compressed image will be distributed according to the discrete Laplace distribution.

P(Y=y)=1 , ify = 0

sin( 2 )0 if y=kQi,j (5)

19

INTERNATIONAL CONFERENCE ON CURRENT INNOVATIONS IN ENGINEERING AND TECHNOLOGY

INTERNATIONAL ASSOCIATION OF ENGINEERING & TECHNOLOGY FOR SKILL DEVELOPMENT

ISBN: 378 - 26 - 138420 - 5

www.iaetsd.in

Fig2: Histogram of perturbed DCT coefficient values from a DCT sub band in which all coefficients were quantized to zero during JPEG compression. Wavelet-Based Compression Overview: Through several wavelet-based image compression techniques exists such as SPIHT,EZW,and most popularly JPEG 2000.they all operate in a similar fashion and leave behind similar compression finger prints.JPEG 2000 begins compression by first segmenting an image into fixed sized non over lapping rectangular blocks known as tiles while other operate on the image as a whole. Two dimensional DWT of the image or each image tile is computed these sub bands of the wave let coefficient. Because of these sub bands corresponding to either high or low frequency DWT coefficients in each spatial dimension, the four sub bands are referred to using the notation LL, LH, HL, and HH. Image compression techniques achieve loss compression through different processes they each introduce DWT coefficient quantization finger prints into an image Quantization and dequantization process causes DWT coefficient in image compression in the multiples of their respective sub bands.

As a result only the n most significant bits of each DWT coefficients are retained. This is equivalent to applying the quantization rule. Where X is a DWT coefficient from an uncompressed imager y is the corresponding DWT coefficient in its SPIHT compressed counterpart.

Fig3: Top: Histogram of wavelet coefficient from an uncompressed image. Bottom: wavelet coefficient from same image after SPIHT compression.

Fig4: Top: peg compressed image using quality factor. Bottom: Anti forensically modified version of same image. 2. UNDETECTABLE IMAGE TAMPERING THROUGH JPEG COMPRESSION Number of digital image forensic techniques have been developed which are capable of identifying an images origin, tracing its processing history, and detecting image forgeries. Though these techniques are capable of identifying standard image manipulation, they do not address the possibility t be that anti forensic operations may be designed and used to hide evidence of image tampering .we propose anti-forensic operation capable of removing blocking artifacts from a previously JPEG compressed image. We can show that by help of this operation along another anti-forensic operation we are able to fool forensic

20

INTERNATIONAL CONFERENCE ON CURRENT INNOVATIONS IN ENGINEERING AND TECHNOLOGY

INTERNATIONAL ASSOCIATION OF ENGINEERING & TECHNOLOGY FOR SKILL DEVELOPMENT

ISBN: 378 - 26 - 138420 - 5

www.iaetsd.in

methods designed to detect evidence of JPEG compression in decoded images, determine an images origin, detect double JPEG compression, and identify cut and paste image forgeries. A digital image forgery has resulted in an environment where the authenticity of digital images cannot be trusted. Many of these digital forensic techniques rely on detecting artifacts left in image by JPEG compression. Because most of the digital cameras make use of proprietary quantization tables, an image compression history can be used to help identify the camera used to capture it. These techniques are quite adept at detecting standard image manipulation, they do not account for the possibility that anti-forensic operation designed to hide traces of image manipulation may applied to an image. Recent work as shown such operations can be constructed to successfully fool existing image forensic techniques. Back Ground: When an image is subjected to JPEG compression, it is first segmented into 8X8 pixel blocks. The DCT of each block is computed and resulting set of DCT coefficients are quantized by dividing each coefficient by its corresponding entry in a quantization table then rounding the result to the nearest integer. The set of quantized coefficients read into a single bit stream and lossless encoded. so decompressed begins by bit stream of quantized DCT coefficients and reforming into a set of 8X8 pixel blocks. As a result two forensically significant artifacts are left in an image by JPEG compression. That is DCT coefficient quantization artifact sand blocking artifacts. Blocking artifacts are the discontinuities which occur across 8X8 pixel block boundaries because of JPEGs loss nature antiforensic technique capable of removing DCT coefficient artifacts from a previously compressed image.

2.1. ANTI-FORENSIC DEBLOCKING OPERATION

JPEGblocking artifacts must be removed from an image after anti-forensic dither has been applied to its DCT coefficients. Number of de blocking algorithms proposed since the introduction of JPEG compression, these are all suited for anti-forensic purposes. To be successful it must remove all visual and statistical traces of block anti-facts. We found that light smoothing an image followed by adding low-power white Gaussiannoise. Able to remove statistical traces of JPEG blocking artifacts without causing the image DCT coefficient distribution to deviate from the Laplace distribution. in the anti-forensically deblocked image according to the equation.

A measure of blocking artifacts strength is obtained by calculating the difference between the histograms of Z and Z values denoted by H1 and H2 respectively, using the equation.

K=|HI (Z= n) HII (Z= n)|. The values of K lying above a fixed detection threshold indicate the presence of blocking artifacts.

Fig5: Histogram of DCT coefficients from an image before compression (top left), after JPEG compression (top right), and after addition anti-forensic dither to the coefficients of the JPEG compressed image.

2.2. IMAGE TAMPERING THROUGH ANTI-FORENSIC:

We show that anti-forensic dither and our proposedanti-forensic deblocking operation can be used to deceive several existing image forensic algorithms that rely on detecting JPEG compression artifacts.

21

INTERNATIONAL CONFERENCE ON CURRENT INNOVATIONS IN ENGINEERING AND TECHNOLOGY

INTERNATIONAL ASSOCIATION OF ENGINEERING & TECHNOLOGY FOR SKILL DEVELOPMENT

ISBN: 378 - 26 - 138420 - 5

www.iaetsd.in

Fig 6:Result of the proposed anti-forensic deblocking algorithm applied to a typical image after it has been JPEG compression using a quality factor of 90 (far left), 70(center left), 30(center right),and 10 (far right) followed by the addition of anti-forensic dither to its DCT coefficients.

2.3. Hiding Traces of Double JPEG compression: An image forger may wish to remove evidence of corresponding a previously JPEG compressed image. Such image forger wishes to alter a previously compressed image, and then save the altered image as JPEG.Several methods have been proposed to detect recompression of JPEG compressed image commonly known as double JPEG compression. 2.4. Falsifying an Images Origin: In some scenarios, an image forger may wish to falsify the origin of digital image simply altering the Mata data tags associated with an images originating device is insufficient to accomplish this because several origin identifying features are intrinsically contained with a digital image.Anti-forensic dither of an images DCT coefficient, then re-compressing the image using quantization tables associated with another device. by doing an image in this manner, we are able to insert the quantization signature associated with a different camera into an image while preventing the occurrence of double JPEG compression artifacts that may alert forensic investigators of such a forgery.

Fig 7: Histogramof (3, 3) DCT coefficients from an image JPEG compressed once using a quality factor of 85(left),

image after being double JPEG compressed using a quality factor of 75 followed by 85(center),and the image after being JPEG compressed using a quality factor of 75,followed by the application of anti forensic dither, then recompressed using a quality factor of 85(right).

3. PROPOSED METHOD:

Tothe best knowledge increased in the field of anti-forensics. Most of the methods of this an forensics is to find out the process that which the image compression is takes places, such of that methods involves in like JPEG detection and quantization table estimation.in this method of anti-forensic the JPEG compression of an image history also produces the information of camera used to produce an image.

Although it can be used to discover the forged areas along with in the picture.in case of image compression this technique is also developed to use as evidence of image manipulation.so in this anti forensic technique traces left by compression and other processing are discussed

4. CONCLUSION:

By the above two existing methods, one of the method of anti-forensic method of digital image compression it has increasingly up on digital images to communicate and this method is considered anti forensics method is fooling forensic algorithms. This technique is designed to remove forensically significant indicators of compression of an image. First developing frame work its design the anti-forensic techniques to remove compression finger prints from image transform coefficients. This anti forensic dither to the transform coefficient of compressed image distribution matches the estimated one. When we use this frame work it specifically targeted at erasing compression finger prints left by both JPEG and wavelet based coders. These techniques are capable of removing forensically detectable traces of image compression without significantly impacting an images visual quality. The second method of undetectable image tampering through JPEG compression anti forensics digital

22

INTERNATIONAL CONFERENCE ON CURRENT INNOVATIONS IN ENGINEERING AND TECHNOLOGY

INTERNATIONAL ASSOCIATION OF ENGINEERING & TECHNOLOGY FOR SKILL DEVELOPMENT

ISBN: 378 - 26 - 138420 - 5

www.iaetsd.in

forensics are developed which are capable of identifying an images origin. Thesetechniques are capable of identifying standard image manipulations. This anti forensic technique capable of removing blocking artifacts from previously JPEG compression image.in this method we are able to fool forensic methods to designed to detect evidence of JPEG compression in decoded images, determine an images origin. When comparing above two existing methods, the anti-forensic method of removing detectable traces from digital images has advanced technique increases attractive ness and more over trust in the digital images it has capable of removing evidences of compression and filtering of in digital images history processing.by adding tailored noise in the image processing we can find out the where the images is tampered and compressed, weather its fake or original this can be used in the medical department as well as in the police department cases. This method is to be used to cover history of processing and it can be also used to remove the signature traces of filtering. REFERENCES

[1]M.chen, J.fridrich, M.goljan and Lukas, Determining image origin and integrity using sensor noise IEEE trans.inf.forensic security, vol.3, no.1, pp.74-90, march.2008. [2]A.swaminathan,M.Wu,andK.R>Liu,Digital image forensics via intrinsic finger prints,IEEEtrans.inf.forensicssecurity, vol.3, no.1, pp.101-117, mar.2008. [3] M.Kirchner and R.Bohme,Hiding traces of resampling in digital images,IEEEtrans.inf.forensics security, vol.3, no.4, pp.582-592, Dec.2008. [4] I. Ascribes, S. Bayram, N.Memon, M. Ram Kumar, and B. Sankur, A classifier design for detecting image manipulations, in Proc. IEEE Int.Conf. Image Process. Oct. 2004, vol. 4, pp. 26452648. [5] M. C. Stamm and K. J. R. Liu, Forensic detection of image manipulation using statistical intrinsic fingerprints, IEEE Trans. Inf. ForensicsSecurity, vol. 5, no. 3, pp. 492506, Sep. 2010. [6] Z. Fan and R. de Queiroz, Identification of bitmap compression history: JPEG detection and quantizer estimation, IEEE Trans. ImageProcess. vol. 12, no. 2, pp. 230235, Feb. 2003. [7] M. C. Stamm and K. J. R. Liu, Wavelet-based image compressionanti-forensics, in Proc. IEEE Int. Conf. Image Process., Sept. 2010, pp. 17371740.

[8] W. S. Lin, S. K. Tajo, H. V. Zhao, and K. J. Ray Liu, Digital image source coder forensics via intrinsic fingerprints, IEEE Trans. InformationForensics and Security, vol. 4, no. 3, pp. 460475, Sept. 2009. [9] H. Farid, Digital image ballistics from JPEG quantization, Tech. Rep.TR2006-583, Dept. of Computer Science, Dartmouth College, 2006. [10] A.C. Popes cu and H. Farid, Statistical tools for digital forensics, in 6th International Workshop on Information Hiding, Toronto, Canada, 2004. [11] T. Pevny and J. Fridrich, Detection of double-compression in JPEG images for applications in steganography, IEEE Trans. InformationForensics and Security, vol. 3, no. 2, pp. 247258, June 2008. [12] M. Kirchner and R. Bohme, Hiding traces of resampling in digital images, IEEE Trans. Information Forensics and Security, vol. 3, no.4, pp. 582592, Dec. 2008.

23

INTERNATIONAL CONFERENCE ON CURRENT INNOVATIONS IN ENGINEERING AND TECHNOLOGY

INTERNATIONAL ASSOCIATION OF ENGINEERING & TECHNOLOGY FOR SKILL DEVELOPMENT

ISBN: 378 - 26 - 138420 - 5

www.iaetsd.in