Chapter 3 IMPLEMETATION

3.1. JPEG COMPRESSION USING MATLAB 7.10.0

3.1.1 Workflow

We successfully compressed a black & white photograph (source: Dresden Image Database) implementing JPEG algorithm in Matlab and compressed the images to 1/4th of the original image size. This was achieved by dividing the image in blocks of 8×8 pixels and applying a discrete cosine transform (DCT) on each partition of the images. The resulting coefficients were quantized and less significant coefficients are set to zero. In order to omit redundancy in our algorithm, we skipped the entropy encoding step, since it provides lossless compression and thus not useful for forensic of the image. This is shown in figure 3.1.

3.1.2 Block splitting
Normally, the width and height of the image are a multiple of 8 and that the image is either gray scale or RGB (red, green, blue). Each pixel is assigned a value between 0 and 255, or a triplet of RGB values.

Figure 3.1 Step of JPEG Compression

Thus, we split the image into 8×8 blocks. This is needed since the DCT has no locality information whatsoever. There is only frequency information available. We continued by shifting every block by −128, this made the values symmetric around zero with average close to zero.

3.1.3 Quantization
So far there had been no compression. We then proceeded by introducing zeros in the arrays by means of Quantization. Every DCT coefficient Xjk was divided by an integer Qjk and rounded to the nearest integer. The importance of the coefficients is dependent on the human visual system; the eye is much more sensitive to low frequencies. Measurements led to standard quantization tables listed below.

Q = [16, 11, 10, 16, 24, 40, 51, 61
12, 12, 14, 19, 26, 58, 60, 55
14, 13, 16, 24, 40, 57, 69, 56
14, 17, 22, 29, 51, 87, 80, 62
18, 22, 37, 56, 68, 109, 103, 77
24, 35, 55, 64, 81, 104, 113, 92
49, 64, 78, 87, 103, 121, 120, 101
72, 92, 95, 88, 112, 100, 103, 99]

The quantized DCT coefficients was computed with

Bj,k=roundX(j,k)Q(j,k) for j = 0,1,2,…..7; k = 0,1,2,….7 (3.1)

where X is the un-quantized DCT coefficients; Q is the quantization matrix mentioned above; and B is the quantized DCT coefficients. Using this quantization matrix with the DCT coefficient matrix from above resulted in:

Figure 3.2: Unquantized DCT coefficients

Figure 3.3: Quantized DCT coefficients

3.1.4 Decompression

As mention before, we skipped entropy encoding step, since it do not produce any finger print which can be used to develop a forensic technique. Thus, above mentioned were followed in bottom to up direction. An original image and its compressed version is shown in Fig.3.4 and Fig.3.5, respectively.

Figure 3.4 Comparison between (a) Original Image and (b) Image after implementing JPEG Compression with Quality factor of 50

3.2 ANTI FORENSIC FRAMEWORK TO HIDE JPEG COMPRESSION FINGERPRINTS

We have implemented the algorithm proposed by J. He, Z. Lin, L.Wang, and X. Tang in their research paper “Detecting doctored JPEG images via DCT coefficient analysis” to counter the forensic technique which uses localized evidence of double JPEG compression to identify image forgeries.

3.2.1 Framework
JPEG is a lossy image compression techniques which operate by applying a two-dimensional invertible transform, such as the DCT to an image as a whole, or to each set of pixels within an image that has been segmented into a series of disjoint sets. As a result, the image or set of pixels is mapped into multiple subbands of transform coefficients, where each transform coefficient is denoted X.
Once obtained, each transform coefficients must be mapped to a binary value both for storage and to achieve lossy compression. This is achieved through the process of quantization, in which the binary representation of the transform coefficient X is assigned the value x according to the equation

X= x if bk≤X≤b(k+1) (3.2)

where bk and bk+1 denote the boundaries of the quantization interval over which X maps to the value . Because some subbands of transform coefficients are less perceptually important than others, and thus can accommodate greater loss during the quantization process, the set of quantization interval boundaries is chosen differently for each subband. After each transform coefficient is given a binary representation, the binary values are reordered into a single bit stream which is often subjected to lossless compression.
When the image is decompressed, the binary bit stream is first rearranged into its original two-dimensional form. Each decompressed transform coefficient Y is assigned a value through dequantization. During this process, each binary value q is mapped to a quantized transform coefficient value belonging to the discrete set Q = {…, q-1,q0,q1,….}. Each dequantized transform coefficient value can be directly related to its corresponding original transform coefficient value by the equation

Y=qk if bk≤X≤b(k+1) (3.3)

After dequantization, the inverse transform is performed on the set of transform coefficients and the resulting values are projected back into the set of allowable pixel values P= {0,…,255}. If the image was segmented, this process is repeated for each segment and the decompressed segments are joined together to create the decompressed image; otherwise, this process reconstructs the decompressed image as a whole.
By performing image compression in this manner, a distinct fingerprint is introduced into the transform coefficients of an image. When examining an unaltered image’s transform coefficient values within a particular subband, they will likely be distributed according to a smooth, continuous distribution.

This is not the case for images which have undergone image compression, since the processes of quantization and dequantization force the transform coefficients of a compressed image to take values within the discrete set Q. In practice, the act of projecting the decompressed pixel values perturbs the transform coefficient values, though the transform coefficients of a previously compressed image still cluster tightly around elements of Q. These fingerprints, known as transform coefficient quantization artifacts, are used by the majority of compression artifact-based forensic techniques to identify single or double compression, determine an image’s origin, or identify image forgeries. They can be clearly seen in Fig.3.6 & Fig.3.7, which shows the histogram of one subband of DCT coefficients from an image before and after JPEG compression, respectively.

Figure .3.6Histogram of DCT coefficients Figure.3.7: Histogram of DCT coefficients from from an uncompressed image. same image after JPEG compression.

We have used the following generalized framework to remove transform coefficient quantization artifacts from a compressed.
First, we modeled the distribution of the transform coefficients for a given subband prior to quantization using a parametric model P(X=x) = f(x,θ) with parameter θ. Next, we estimated the value of θ from the quantized transform coefficients. We then anti-forensically modified each quantized transform coefficient by adding specially designed noise, which we refer to as anti-forensic dither, to its value according to the equation

Z = Y+D (3.4)

where D is the anti-forensic dither and Z is the anti-forensically modified coefficient.
The distribution of the anti-forensic dither is chosen so that it corresponds to a renormalized and recentered segment of the model distribution for that subband, where the segment is centered at the quantized coefficient value and the segment’s length is equal to the length of the quantization interval. Because the probability that the quantized coefficient value is q(k) is given by PY=qk=b(k)b(k+1)f(x,∅)dx (3.5)

the anti-forensic dither’s distribution is given by the formula

PD=d | Y=qk= f(qk+d,∅)b(k)b(k+1)f(x,∅)dx if bk≤qk+d≤b(k+1) (3.6)

Choosing the anti-forensic dither distribution in this manner yields two main benefits; the anti-forensically modified coefficient distribution will theoretically match the transform coefficient distribution before quantization and an upper bound can be placed on the distance between each unquantized transform coefficient and its anti-forensically modified counterpart. To prove the first property, we make use of the fact that

PZ=z | Y=qk= PD=z-q(k) | Y=qk (3.7)

We then use the law of total probability to write an expression for the anti-forensically modified coefficient distribution as

PZ=z=kPZ=zY=qkP(Y=qk)
PZ=z=kf(qk+d,∅)b(k)b(k+1)f(x,∅)dx*b(k)b(k+1)f(x,∅)dx if bk≤qk+d≤b(k+1)
= kf(z,∅) if bk≤qk+d≤b(k+1) (3.8)

This is important because it proves that forensic analysis of the transform coefficient distribution of an image should be unable to distinguish an unaltered image from an anti-forensically modified one, provided that the distribution of unmodified coefficients is modeled accurately and the parameter is correctly estimated. Assuming that each quantized value lies at the center of its corresponding quantization interval, this distance can be trivially bounded as follows: X-Y≤max|bk-b(k+1)|2 (3.9)

Because each anti-forensically modified coefficient value must lie within the quantization interval encompassing the modified quantized coefficient value, the bound placed on |X-Y| also holds for |Y-Z|.
As a result, the distance between an unquantized and anti-forensically modified transform coefficient value is upper bounded by

X-Y≤maxbk-bk+1 (3.10)

3.2.2 DCT Coefficient Quantization Fingerprint Removal
In accordance with the anti-forensic framework which is discussed earlier, we begin by modeling the distribution of coefficient values within a particular ac DCT subband using the Laplace distribution

PX=x=λ2e-λ|x| (3.11)

Though we use this model for each ac subband of the DCT, each subband will have its own unique value of. Using this model and the quantization rule described above, the coefficient values of an ac subband of DCT coefficients within a previously JPEG compressed image will be distributed according to the discrete Laplace distribution

PY=y = 1-e-λQi,j2 if y=0e-λ|y|sinhλQi,j2, if y=kQ(i,j)0 otherwise where k∈Z, k≠0 (3.12)

To anti-forensically modify a previously JPEG compressed image, we first perform the initial steps in JPEG compression (i.e., color space transformation, segmentation into blocks, DCT) to obtain a set of DCT coefficients from the image. Because the final stages of JPEG decompression involve projecting the decompressed pixel values back into, the DCT coefficient values obtained is Y=Q(i,j)roundYQ(i,j).
Next, we obtain a maximum likelihood estimate the model Parameter ʎ independently for each ac subband of DCT coefficients using the quantized coefficients. By doing this, we can use this model to obtain an estimate of each ac subband’s coefficient distribution before JPEG compression. We define N = N(0) + N(1) as the total number of observations of the current DCT subband N(0), as the number DCT subband of coefficients taking the value zero, N(1) as the number of nonzero valued coefficients, and S=k=1N|y(k)|. The model parameter estimate, which we denote λ , is calculated using the equation λ = -2Q(i,j)ln⁡(∂) (3.13)
Where
∂=-N0Q(i,j)2NQi,j+4S+N02Q(i,j)2-2N1Qi,j-4S(2NQi,j+4S)2NQ+4S

(3.14)

After λ has been estimated, we add anti-forensic dither to each DCT coefficient in an ac subband. Because we model the coefficient distribution before quantization using the Laplace distribution, the expression for the anti-forensic dither’s distribution given in eqn. (3.14) simplifies to one of two equations depending upon the magnitude of the quantized DCT coefficient value to which the dither is added. For zero-valued quantized coefficients, the anti-forensic dither distribution is chosen to be

P(D=d|Y=0)=1C0e-λ |d|, if –Q(i,j)2≥d≥Q(i,j)20, otherwise (3.15)

where C0=1-e-λQ(i,j)2 (3.16)

The distribution of the anti- forensic dither added to nonzero quantized DCT coefficients is P(D=d|Y=q(k))=1C1e-sgnqkλ(d+Q(i,j)/2), if –Q(i,j)2≥d≥Q(i,j)20, otherwise (3.17) where C1=1λ(1-e-λ Q(i,j)) (3.18)

The expected value was calculated using obtained probabilistic distribution

D= d*P(D=d|Y=q(k)) (3.19)

Expected value of dither was then added to DCT coefficients of the compressed images to obtain anti-forensically modified coefficients.

3.3 IDENTIFICATION OF DIGITAL CAMERA IMAGE ORIGIN USING PRNU EXTRACTION AND APPLYING ANTIFORENSICS OVER IT 3.3.1 Identification using PRNU extraction

Sensor noise is an inherent property of images captured with a digital camera. It consists of two main components: temporal and spatial noise. All images acquired with the same image input device contain a similar spatial noise pattern, which we assume to be unique for each sensor. Spatial noise consists of three components: Photo Response Non- Uniformity Noise (PRNU), Fixed Pattern Noise (FPN) and other irregularities resulting from local disturbances on the optical elements (scratches, dust, etc.).
To estimate the spatial noise for a device under investigation, we used MATLAB version 7.10.0. A Canon Ixus 50 Model was used to get a camera specific reference noise pattern called Fingerprint by averaging over 12-15 images of the same model and same size(1024*768). Then we take a test image that maybe from the same model or a different camera and extract noise pattern (PRNU) from the test image.
Further we calculate PCE (Peak to correlation energy) between the two set of noise patterns obtained each from the reference camera and the test image. If we get a high PCE value then the test image belongs to the reference camera otherwise not.
Like normalized correlation, Peak-to-Correlation Energy ratio (PCE) is a measure of similarity for two discrete signals. PCE is especially suitable for 2-dimensional camera fingerprints because presence of hidden periodic patterns (a latent source of false identification) decreases PCE.

RESULTS
JPEG Anti-Forensics
To demonstrate that anti-forensic DCT coefficient quantization fingerprint removal technique can be used on an image without significantly impacting its visual quality, we show a typical image before and after anti-forensic modification in Fig. 4.2 & Fig. 4.3, respectively. In Fig. 4.2, the image has undergone JPEG compression using a quality factor of 50 while the image in Fig.4.3 is the JPEG compressed image after anti-forensic dither has been added to its DCT coefficients. No noticeable difference between these images is apparent after visual inspection. This is reinforced by the fact that the PSNR between the two images is 29.26 dB. More importantly, the anti-forensically modified image contains no visual indicators of either previous compression or anti-forensic modification. Since a forensic examiner will not have access to either the unaltered or compressed version of an anti-forensically modified image, these cannot be compared against the anti-forensically modified image. Instead, what is necessary is that the anti-forensically modified image plausibly appear to have never been compressed.
Inspection of the DCT coefficient value distributions of the images shown in Fig. 4.1 and Fig.4.3 yields similar results. Fig. 4.4 shows a histogram of coefficient values in the (2,2) DCT subband in an uncompressed version of these images. The corresponding coefficient value histograms from the JPEG compressed and anti-forensically modified images are shown in figure 4.5 & 4.6, respectively. While DCT coefficient quantization fingerprints are present in the histograms taken from the JPEG compressed image, these fingerprints are absent in the coefficient value histograms corresponding to the uncompressed and anti-forensically modified images. Again, we note that in reality a forensic examiner will only have access to the anti-forensically modified image and will be unable to make note of minor differences between the coefficient histograms of the uncompressed and anti-forensically modified image. The fact that the DCT coefficient value histograms from the anti-forensically modified image both fit our coefficient distribution model and contain no compression fingerprints suggests that our proposed antiforensic technique is capable of producing images that can be passed off as never having undergone JPEG compression.

Figure 4.1 Original Image

Figure 4.2 JPEG compressed image with Quality Factor 50

Figure 4.3 Anti Forensically modified image

Figure 4.4 Histogram of coefficient values from the (2,2) DCT subband taken from an uncompressed version of the image shown in Fig. 4.1

Figure 4.5 Histogram of coefficient values from the (2,2) DCT subband taken from a compressed version of the image shown in Fig. 4.2 (left)

Figure 4.6 Histogram of coefficient values from the (2,2) DCT subband for an anti-forensically modified copy of the JPEG compressed image shown in 4.3 .

Appendix :

% input image o=imread ('C:\Users\abhishek\Desktop\sailing.bmp');
% covert image into black and white form e=rgb2gray(o); size(e); e_int=int16(e); sb=size(e_int); m_128=128*ones(sb); % shifting pixel values by 128 to left
G =e_int-int16(m_128);
Q =[16,11,10,16,24,40,51,61;12,12,14,19,26,58,60,55;14,13,16,24,40,57,69,56;14,17,22,29,51,87,80,62;18,22,37,56,68,109,103,77;24,35,55,64,81,104,113,92;49,64,78,87,103,121,120,101;72,92,95,88,112,100,103,99]; fun = @(block_struct) block_struct.data./Q; func = @(block_struct) dct2(block_struct.data);
% Unquantized DCT Coefficients
X = blockproc(G,[8 8],func);
% Quantized DCT Coefficients
I=blockproc(X,[8 8],fun);
% Round of Quantized DCT Coefficients
B=round(I);
% inverse of Quantization fun2 = @(block_struct) block_struct.data.*Q; inv_f=blockproc(B,[8 8],fun2); func2 = @(block_struct) idct2(block_struct.data); in_final2=blockproc(inv_f,[8 8],func2); inv_final=int16(in_final2)+int16(m_128); inv_final128=int16(inv_final)-int16(m_128); final22=blockproc(inv_final128,[8 8],func);

% Antiforensics
I2=blockproc(final22,[8 8],fun);
I2_r=round(I);
Y=blockproc(I2_r,[8 8],fun2); zero=find(Y==0); z=size(zero);
N0=z(1,1);
N=512*768;
N1=N-N0;
final2_mod=sum(abs(Y)); s=sum(final2_mod); l= N0*N0.*Q.*Q-(2*N1.*Q-4*s).*(2*N.*Q+4*s); gamma= (-1*N0.*Q +sqrt(l))./(2*N.*Q+4*s); lambda= size(Q); lambda = -1*2*log(gamma)./Q; c0 = 1- exp(-1.*lambda.*Q/2); c1 = (1-exp(-1.*lambda.*Q))./lambda; expt =size(Q); for i = 1:8 for j = 1:8 if (Y(i,j)==0) d = (-Q(i,j)/2):0.1:Q(i,j)/2; P = exp(-1*lambda(i,j)*abs(d))/c0(i,j); else d = (-Q(i,j)/2):0.1:Q(i,j)/2; P = exp(-1*sign(Q(i,j))*lambda(i,j)*(d+Q(i,j)/2))/c1(i,j); end %generating excepted value of dither expt(i,j) = sum(d.*P); end end Z = Y+D; in_fin=blockproc(Z,[8 8],func2); inv_finale=int16(in_fin)+int16(m_128); imshow(e),figure;imshow(inv_finale,[0 255])
%Plotting X,Y & Z histogram x = -20:0.1:20;figure(5),hist(Z,x); x = -20:0.1:20;figure(4), hist( X,x) x = -20:0.1:20;figure(3),hist(final22,x)