Welcome to Scribd, the world's digital library. Read, publish, and share books and documents. See more ➡
Download
Standard view
Full view
of .
Add note
Save to My Library
Sync to mobile
Look up keyword
Like this
1Activity
×
0 of .
Results for:
No results containing your search query
P. 1
Streamed Coefficients Approach for Quantization Table Estimation in JPEG Images

Streamed Coefficients Approach for Quantization Table Estimation in JPEG Images

Ratings: (0)|Views: 254|Likes:
Published by ijcsis
A forensic analyst is often confronted with low quality digital images, in terms of resolution and/or compression, raising the need for forensic tools specifically applicable to detecting tampering in low quality images. In this paper we propose a method for quantization table estimation for JPEG compressed images, based on streamed DCT coefficients. Reconstructed dequantized DCT coefficients are used with their corresponding compressed values to estimate quantization steps. Rounding errors and truncations errors are excluded to eliminate the need for statistical modeling and minimize estimation errors, respectively. Furthermore, the estimated values are then used with distortion measures in verifying the authenticity of test images and exposing forged parts if any. The method shows high average estimation accuracy of around 93.64% against MLE and power spectrum methods. Detection performance resulted in an average false negative rate of 6.64% and 1.69% for two distortion measures, respectively.
A forensic analyst is often confronted with low quality digital images, in terms of resolution and/or compression, raising the need for forensic tools specifically applicable to detecting tampering in low quality images. In this paper we propose a method for quantization table estimation for JPEG compressed images, based on streamed DCT coefficients. Reconstructed dequantized DCT coefficients are used with their corresponding compressed values to estimate quantization steps. Rounding errors and truncations errors are excluded to eliminate the need for statistical modeling and minimize estimation errors, respectively. Furthermore, the estimated values are then used with distortion measures in verifying the authenticity of test images and exposing forged parts if any. The method shows high average estimation accuracy of around 93.64% against MLE and power spectrum methods. Detection performance resulted in an average false negative rate of 6.64% and 1.69% for two distortion measures, respectively.

More info:

Published by: ijcsis on Oct 12, 2011
Copyright:Attribution Non-commercial

Availability:

Read on Scribd mobile: iPhone, iPad and Android.
download as PDF, TXT or read online from Scribd
See More
See less

10/12/2011

pdf

text

original

 
(IJCSIS) International Journal of Computer Science and Information Security,Vol. 9 No. 9, 2011
Streamed Coefficients Approach for QuantizationTable Estimation in JPEG Images
Salma Hamdy
Faculty of Computer and Information SciencesAin Shams UniversityCairo, Egypts.hamdy@cis.asu.edu.eg
 Abstract
 — 
A forensic analyst is often confronted with low qualitydigital images, in terms of resolution and/or compression, raisingthe need for forensic tools specifically applicable to detectingtampering in low quality images. In this paper we propose amethod for quantization table estimation for JPEG compressedimages, based on streamed DCT coefficients. Reconstructeddequantized DCT coefficients are used with their correspondingcompressed values to estimate quantization steps. Roundingerrors and truncations errors are excluded to eliminate the needfor statistical modeling and minimize estimation errors,respectively. Furthermore, the estimated values are then usedwith distortion measures in verifying the authenticity of testimages and exposing forged parts if any. The method shows highaverage estimation accuracy of around 93.64% against MLE andpower spectrum methods. Detection performance resulted in anaverage false negative rate of 6.64% and 1.69% for two distortionmeasures, respectively.
 Keywords: Digital image forensics; forgery detection; compression history; Quantization tables.
I.
 
I
NTRODUCTION
 Most digital image forgery detection techniques require thedoubtful image to be uncompressed and in high quality. Yet,currently most acquisition and manipulation tools use theJPEG standard for image compression. JPEG images are themost widely used image format, particularly in digitalcameras, due to its efficiency of compression and may requirespecial treatment in image forensics applications because of the effect of quantization and data loss. Usually JPEGcompression introduces blocking artifacts and hence one of thestandard approaches is to use inconsistencies in these blockingfingerprints as a reliable indicator of possible tampering [1].These can also be used to determine what method of forgerywas used. Moreover, a digital manipulation process usuallyends in saving the forgery also in JPEG format creating adouble compressed image. Mainly, two kinds of problems areaddressed in JPEG forensics; detecting double JPEGcompression, and estimating the quantization parameters forJPEG compressed images. Double compressed images containspecific artifacts that can be employed to distinguish themfrom single compressed images [2-4]. Note, however, thatdetecting double JPEG compression does not necessarilyprove malicious tampering: it is possible, for example, that auser may re-save high quality JPEG images with lower qualityto save storage space. The authenticity of a double JPEGcompressed image, however, is at least questionable andfurther analysis would be required. Generally, the JPEGartifacts can also be used to determine what method of forgerywas used. Many passive schemes have been developed basedon these fingerprints to detect re-sampling [5] and copy-paste[6-7]. Other methods try to identify bitmap compressionhistory using Maximum Likelihood Estimation (MLE) [8-9],or by modeling the distribution of quantized DCT coefficients,
like the use of Benford’s law [
10], or modeling acquisitiondevices [11]. Image acquisition devices (cameras, scanners,medical imaging devices) are configured differently in order tobalance compression and quality. As described in [12-13],these differences can be used to identify the source cameramodel of an image. Moreover, Farid [14] describes JPEG
ghosts
as an approach to detect parts of an image that werecompressed at lower qualities than the rest of the image anduses to detect composites. In [15], we proposed a methodbased on the maximum peak of the histogram of DCTcoefficients.Furthermore, due to the nature of digital media and theadvanced digital image processing techniques, digital imagesmay be altered and redistributed very easily forming a risingthreat in the public domain. Hence, ensuring that mediacontent is credible and has not been altered is becoming animportant issue governmental security and commercialapplications. As a result, research is being conducted fordeveloping authentication methods and tamper detectiontechniques.In this paper, we propose an approach for quantizationtable estimation for single compressed JPEG images based onstreamed DCT coefficients. We show the efficiency of thisapproach and how it recovers the weak performance of themethod in [15] for high quality factors.In section 2 we describe the approach used for estimatingquantization steps of JPEG images, and the two distortionmeasures we use in our forgery detection process.Experimental results are discussed in section 3. Section 4 isfor conclusions. A general model for forgery detection basedon quantization table estimation is depicted in Fig. 1.
36http://sites.google.com/site/ijcsis/ISSN 1947-5500
 
(IJCSIS) International Journal of Computer Science and Information Security,Vol. 9 No. 9, 2011
II.
 
S
TREAMED
C
OEFFICIENTS
A
PPROACH
 In [15] we proposed an approach for estimatingquantization tables for single compressed JPEG images basedon the absolute histogram of reconstructed DCT coefficients.Since we co
uld not use the “temporary” values of the
dequantized coefficients
 X 
q
to build the histograms, Wemanaged to reverse the process one step, i.e. to undo theIDCT, and reconstruct the coefficients by taking the block DCT of the decompressed image and compensate for errors(Fig. 2)
. This “re
-
compression” step produces an estimate
 X 
*
 that we used in our maximum peak method in [15].Now, if we continue one step further in reverse, that is,undo the dequantization, the normal case requires thequantization table to compress and reach the final version of the coefficients that are encoded and dumped to the file.However, the quantization table is unknown and it is our goalto estimate it. Yet, we have the result of the quantization; thecompressed coefficients, which we can retrieve from the file,as shown in Fig. 3. Hence, we can conclude a straightforwardrelation between the streamed compressed coefficients, andthe reconstructed dequantized DCT coefficient. If we refer tothe decompressed image as
 I 
, then we have:
)]([)(
sq
 DQ IDCT  X  IDCT  I 
(1)where
 DQ
is the dequantization process, and
 X 
s
resembles thecompressed coefficient dumped from the image file. As wepointed out above, the dequantized coefficient can beestimated (reconstructed) through applying the inverse of thisstep which is the discrete cosine transform. Hence:
)( )]]([[  )]([ )(
sqsq
 X  DQ X  X  DQ IDCT  DCT   X  IDCT  DCT  I  DCT 
 (2)Again,
 X 
q
is only temporary and is evaluated as itsreconstructed copy
*
 X 
taking into consideration the errorcaused by the cosine transforms. Hence, (2) becomes:
)(
*
s
 X  DQ E  X 
(3)where
 E 
is the error caused by the cosine transforms. Since acompressed coefficient is dequantized via multiplying it by thecorresponding quantization step we can write:
s
qX  E  X 
*
(4)Finally, solving for
q
gives: 
s
 X  E  X q
*
 (5)Again we suggest the neglect of round off errors; as we seetheir effect could be minimal and could be compensated forusing lookup tables if needed, also the exclusion of saturatedblocks to minimize the possibility of truncation errors. Hence,the estimated quantization step is computed as:
s
 X  X q
*
(6)Note that this is done for every frequency to produce the 64quantization steps. That is, for a certain frequency band, all
 X 
*
 from the image blocks are divided by their corresponding
 X 
s
toresult in a set of quantization steps that should be the same forthat single band. However, due to rounding errors, not all of the resulting steps are equal. We suggest determining the mostfrequent value among the resulting steps as the most probableone and assigning it to be the correct quantization step for thatfrequency band.Table I shows the sample results for the difference betweenthe estimated
Q
table and the original table for two quality
factors. The X’s mark undetermined coefficients.
The
TABLE I. D
IFFERENCE BETWEEN ESTIMATED AND ORIGINAL
Q
.
QF = 75 QF = 80
4 0 0 0 0 0 0 1 3 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 00 0 0 0 0 0 0 X 0 0 0 0 0 0 0 X0 0 0 0 0 0 X X 0 0 0 0 0 0 X X0 0 0 0 X X X X 0 0 0 0 X X X X
Figure 1.
A general model for forgery detection using quantization tables.
Figure 2.
 
 X 
q
is an intermediate result. Taking the DCT of a decompressedimage block does not reproduce
 X 
q
exactly, but an approximation to it;
 X 
*
.
Figure 3.
 
 X 
q
is an intermediate result. Taking the DCT of adecompressed image block does not reproduce
 X 
q
exactly, but anapproximation to it;
 X 
*
.
37http://sites.google.com/site/ijcsis/ISSN 1947-5500
 
(IJCSIS) International Journal of Computer Science and Information Security,Vol. 9 No. 9, 2011
estimation is slightly better than that of the maximum peak approach for AC coefficients in [15].The estimated table is then used to verify the authenticityof the image by computing a distortion measure and thencomparing it to a preset threshold, as was shown in Figure 1.In our experiments for forgery detection, we used twodistortion measures. An average distortion measure forclassifying test images can be calculated as a function of theremainders of DCT coefficients with respect to the original
Q
 matrix: 

81811
),(),,(mod
i j
 jiQ ji D B
 (7)where
 D(i,j)
and
Q(i,j)
are the DCT coefficient and thecorresponding quantization table entry at position (
i,j)
,respectively. Large values of this measure indicate that aparticular block of the image is very different from the onethat is expected and, hence is likely to belong to a forgedimage. Averaged over the entire image, this measure can beused for making a decision about authenticity of the image.Usually JPEG compression introduces blocking artifacts.Manufacturers of digital cameras and image processingsoftware typically use different JPEG quantization table tobalance compression ratio and image quality. Such differenceswill also cause different blocking artifacts in the imagesacquired. When creating a digital forgery, the resultedtampered image may inherit different kind of compressionartifacts from different sources. These inconsistencies, if detected, could be used to check image integrity. Besides,blocking artifacts of the affected blocks will change a lot bytampering operations such as image splicing, resampling, andlocal object operation such as skin optimization. Therefore, theblocking artifact inconsistencies found in a given image maytell the history that the image has been undergone. We use theBA measure proposed in [1] as the other distortion measurefor classifying test images:

    
81812
),(),( ),(),()(
i j
jiQ ji Dround  jiQ ji Dn B
(8)where
 B(n)
is the estimated blocking artifact for testing block 
n
,
 D(i,j)
and
Q(i,j)
are the same as in (7).Fig. 4 shows the results of applying these measures todetect possible composites. Normally dark parts of thedistortion image denote low distortion, whereas brighter partsindicate high distortion values. The highest consistent valuescorrespond to the pasted part and hence mark the forged area.For illustration purposes,
inverted 
images of the distortionmeasures for the composite images are shown in Figure 4(d)through (g). Hence, black (inverted white) parts indicate highdistortion values and mark the inserted parts. Apparently asquality factor increases, detection performance increases andfalse alarms decrease. This behavior as expected is similar tothat of maximum peak method in [15]. However, we observebetter clustering of the foreign part and less false alarms in themaximum peak method that in this method.III.
 
E
XPERIMENTAL
R
ESULTS AND
D
ISCUSSION
 
 A.
 
 Accuracy Estimation
We created a dataset of image to serve as our test data. Theset consisted of 550 uncompressed images collected fromdifferent sources (more than five camera models), in additionto some from the public domain Uncompressed Color ImageDatabase (UCID), which provides a benchmark for imageprocessing analysis [16]. For color images, only the luminanceplane is investigated at this stage. Each of these images wascompressed with different standard quality factors, [50, 55, 60,65, 70, 75, 80, 85, and 90]. This yielded 550×9 = 4,950
untouched 
images. For each quality factor group in theuntouched JPEG set, the luminance channel of each image wasdivided into 8×8 blocks and the block DCT was applied toreconstruct the dequantized coefficients. Then for eachfrequency band, all dequantized coefficients were collectedand stored in an array while on the other hand, theircompressed version were dumped from the image file andstored in a corresponding array. Zero entries were removedfrom both sets to avoid division by zeros. The next step was toapply (6) and divide the dequantized coefficients over theirdumped values. The resulting set of estimated quantizationstep was rounded and the most frequent value was selected asthe correct step for that frequency band. This was repeated forall 64 frequencies to construct the 8×8 luminance quantizationtable for the image. The resulting quantization table was
compared to the image’s known table and the percentage of 
correctly estimated coefficients was recorded. Also, theestimated table was used in equations (7) and (8) to determine
the image’s average distortion and blocking artifact measures,
respectively. These values were recorded and used later to seta threshold value for distinguishing forgeries from untouched.The above procedure was applied to all images in thedataset. Table II shows the numerical results where we canobserve the improvement in performance over the maximumpeak method especially for high frequencies. Notice that forQF = 95 and 100, the percentage of correct estimation was98% and 100% respectively, meaning that the method canestimate small quantization steps in oppose to the maximumpeak method.Maximum Likelihood methods for estimating
Q
tables [8-9], tend to search for all possible
Q(i,j)
for each DCTcoefficient over the whole image which can becomputationally exhaustive. Furthermore, they can only detectstandard compression factors since they re-compress theimage by a sequence of preset quality factors. This can also be
TABLE II. P
ERCENTAGE OF CORRECTLY ESTIMATED COEFFICIENTS FOR SEVERLA QFS
 
QF 50 55 60 65 70 75 80 85 90 95 100Max.Peak
66.9 69.2 72.0 74.2 76.9 79.4 82.3 85.5 88.2 66.33 52.71
StreamedCoeff.
87.94 89.16 90.37 91.37 92.36 93.24 94.11 95.66 97.21 98.61 100
38http://sites.google.com/site/ijcsis/ISSN 1947-5500

You're Reading a Free Preview

Download
/*********** DO NOT ALTER ANYTHING BELOW THIS LINE ! ************/ var s_code=s.t();if(s_code)document.write(s_code)//-->