Digital Investigation

(1)

Digital image forgery detection using passive techniques:

A survey

Gajanan K. Birajdar

^a^,^*

, Vijay H. Mankar

^b

aDepartment of Electronics & Communication, Priyadarshini Institute of Engineering & Technology, Nagpur 440019, Maharashtra, India

bDepartment of Electronics & Telecommunication, Government Polytechnic, Nagpur 440001, Maharashtra, India

a r t i c l e i n f o

Article history:

Received 11 December 2012 Received in revised form 7 April 2013 Accepted 29 April 2013

Keywords:

Passive/blind image forgery detection Image forensic

Image manipulation detection Image authentication Image tampering detection

a b s t r a c t

Today manipulation of digital images has become easy due to powerful computers, advanced photo-editing software packages and high resolution capturing devices. Veri- fying the integrity of images and detecting traces of tampering without requiring extra prior knowledge of the image content or any embedded watermarks is an important researchfield. An attempt is made to survey the recent developments in the field of digital image forgery detection and complete bibliography is presented on blind methods for forgery detection. Blind or passive methods do not need any explicit priori information about the image. First, various image forgery detection techniques are classified and then its generalized structure is developed. An overview of passive image authentication is presented and the existing blind forgery detection techniques are reviewed. The present status of image forgery detection technique is discussed along with a recommendation for future research.

1. Introduction to image forgery

The rapid growth of image processing softwares and the advancement in digital cameras has given rise to large amounts of doctored images with no obvious traces, generating a great demand for automatic forgery detection algorithms in order to determine the trustworthiness of a candidate image. A forgery detection algorithm should be passive, requiring no prior information about the image content or any protecting methods like watermarks.

According to the Wall Street Journal, 10% of all color photographs published in United States were actually digitally altered and retouched (Amsberry, 1989). The sci- entiﬁc community has also been subject to forgeries (Farid, 2006a;Pearson, 2005). The authenticity of photographs has an essential role as these photos are popularly used as supporting evidences and historical records in growing

number and wide range of applications from forensic investigation, journalistic photography, criminal investigation, law enforcement, insurance claims and medical imaging. Image forgery has a long history (Rocha et al., 2011). As shown in Fig. 1, in todays digital world it is possible to create, alter and modify the information rep- resented by an image very easily without leaving any obvious traces of these operations.

In recent years blind digital image forgery detection field has found significant interest from the scientific community. This is evident from theFig. 2which shows the number of papers related to digital image tampering detection that have been published in IEEE and Elsevier conferences and journals over the last 13 years. Due to the technological advancement in the recent years, law enforcement has needed to stay abreast of emerging technological advances and use these in the investigation of crime. The Scientific Working Group on Imaging Tech- nology (SWGIT) provide recommendations and guidelines to law enforcement agencies and others in the criminal justice system regarding the best practices for photography, videography, and video and image analysis (https://

* Corresponding author. Pillai HOC College of Engg. & Technology, Rasayani, Raigad 410207, India. Tel.:þ91 9224445046.

E-mail addresses: [email protected], gajanan123@rediffmail.

com(G.K. Birajdar),[email protected](V.H. Mankar).

Contents lists available atSciVerse ScienceDirect

Digital Investigation

j o u r n a l h o m e p a g e : w w w . e l s e v i e r . c o m / l o c a t e / d i i n

http://dx.doi.org/10.1016/j.diin.2013.04.007

(2)

www.swgit.org/documents, 2012). SWGIT provides information on the appropriate use of various imaging technologies for use by personnel in the criminal justice system through the release of documents such as the SWGIT best practices documents.

Different image forgery detection techniques are clas- siﬁed in1.1and then generalized structure of image forgery detection is presented in1.2. We then compared the performance of some typical image forgery detection algorithms. An overview of passive digital image authentication method is presented and the existing blind forgery detection techniques are reviewed. This papers focus is to classify various image forgery detection methods emphasizing on passive or blind techniques. We hope that this article

will serve as a guide and help the researchers from the image forgery detection area to ﬁnd new research problems.

1.1. Image forgery classiﬁcation

Image forgery detection aims to verify the authenticity of a digital image. Image authentication solution is classi- ﬁed into two types. (1) Active and (2) Blind or passive. An active forgery detection techniques, such as digital water- marking or digital signatures uses a known authentication code embedded into the image content before the images are sent through an unreliable public channel. By verifying the presence of such authentication code authentication Fig. 1. Recent image forgeries reported (a) Composite of Cher and Brad Pitt (Johnson and Farid, 2005) (b) Photomontage of John Kerry and Jane Fonda (Johnson and Farid, 2005) (c) Jeffrey Wong Su En receiving the award from Queen Elizabeth II (Redi et al., 2011) (d) Pakistan prime minister Yousaf Gilani (www.fourandsix.com, 2012) (e) Iranian montage of missiles (Irene et al., 2011) (f) Time covers reporting on the O.J. Simpson case (Redi et al., 2011).

Fig. 2. Number of publications over last 13 years. Results obtained by submitting query“Image tampering detection” from IEEE (http://ieeexplore.ieee.org) and Elsevier (http://www.sciencedirect.com) websites.

(3)

may be proved by comparing with the original inserted code. However, this method requires special hardware or software to insert the authentication code inside the image before the image is being distributed.

Passive or blind forgery detection technique uses the received image only for assessing its authenticity or integrity, without any signature or watermark of the original image from the sender. It is based on the assumption that although digital forgeries may leave no visual clues of having been tampered with, they may highly likely disturb the underlying statistics property or image consistency of a natural scene image which introduces new artifacts resulting in various forms of inconsistencies. These inconsistencies can be used to detect the forgery. This technique is popular as it does not need any prior information about the image. Existing techniques identify various traces of tampering and detect them separately with localization of tampered region.Fig. 3 shows classiﬁcation of image forgery detection techniques.

Several surveys have been published on image forgery detection:Rocha et al. (2011),Farid (2009a),Mahdian and Saic (2010), Lanh et al. (2007a), Luo et al. (2007a), Mahdian and Saic (2008a), Ng et al. (2006), Sencar and Memon (2008), Zhang et al. (2008a), Bayram et al.

(2008a) and Redi et al. (2011). Still most of the image forgery techniques are remained unidentiﬁed and this ar- ticles objective is to explore all the existing blind forgery techniques and recent updates in thisﬁeld.

1.2. Generalized structure of image forgery detection

Image forgery detection techniques are two-class classification techniques. Objective of blind or passive detection is to classify given images into two classes: original (or authentic) and forged images. Mostly existing blind image forgery detection approaches extract features from images first, then select a classifier and train the classifier using the features extracted from training image sets, and finally classify the features. Few such approaches are proposed in Luo et al. (2006),Mahdian and Saic (2007),Myna et al.

(2007),Kirchner and Fridrich (2010),Cao et al. (2010a), Mahalakshmi et al. (2012)andGul et al. (2010). Here, we describe a generalized framework of blind image forgery detection approach tentatively, which consists of the following major steps:

(1) Image preprocessing: Before feature extraction process some operations are performed over the images under consideration, such as cropping, transforming RGB image into grayscale, DCT or DWT transformation to improve the classification performance. (2) Feature extraction: A set of features are extracted for each class that helps distinguish it from other classes, while remaining invariant to characteristic differences within the class from the input forged data. In particular, extract informative features and select feature that must be sensitive to image manipulation. One of the desirable characteristic of selected features and constructed feature vector should be with low dimension, which will reduce the computational complexity of training and classification. (3) Classifier selection and feature preprocessing: Based on the extracted set of features select or design appropriate classifiers and choose a large set of

images to train classifiers. Obtain some important parameters of classifiers, which can be utilized for the classification. Feature preprocessing is used to reduce the dimensionality of features without decreasing the machine learning based classification performance at the same time reduction in computational complexity (Sutthiwan et al., 2009b). (4) Classification: The purpose of classifier is to discriminate the given images and classify them into two categories: original and forged images. Various classifiers are used such as SVM inLint et al. (2005),Fu et al. (2006), Chen et al. (2007),Shi et al. (2007a),Hsu and Chang (2006), Wang et al. (2009),Zhenhua et al. (2009),Dirik et al. (2007), Chen et al. (2008a) andKhanna et al. (2008)and LDA in Fang et al. (2009a). (5) Postprocessing: In some of the forgeries like copy move and splicing, postprocessing operation involves localization of forged region as investigated in Fridrich et al. (2003), Sergio and Asoke (2011), Muhammad et al. (2011),Gopi et al. (2006)andGhorbani et al. (2011). According to the steps described above, the structure of blind image forgery detection is presented in Fig. 4.

2. Copy-move or region duplication forgery

Copy move is the most common image tampering technique used due to its simplicity and effectiveness, in which parts of the original image is copied, moved to a desired location and pasted. This is usually done in order to hide certain details or to duplicate certain aspects of an image. Textured regions are used as ideal parts for copy- move forgery, since textured areas have similar color and noise variation properties to that of the image which are unperceivable for human eye looking for inconsistencies in image statistical properties. Blurring is usually used along the border of the modiﬁed region to lessen the effect of irregularities between the original and pasted region.

First attempt in identifying tampered areas was investigated by Fridrich et al. (2003). The authors proposed a method of detecting copy-move forgery using discrete cosine transform (DCT) of overlapping blocks and their lexicographical representation to avoid the computational burden. Best balance between performance and complexity was obtained using block matching algorithm.Popescu and Farid (2004)presented a method using principal component analysis (PCA) for the representation of image segments i.e. overlapping square blocks. PCA-based detection results in reduction of the computational cost and the number of computations required are O(NtN log N), where N_tis the dimensionality of the truncated PCA representation and N the number of image pixels. Average detection accuracies obtained was 50% when JPEG quality¼ 95 with block size of 32 32 and 100% when JPEG quality ¼ 95 with block size of 160 160. Accuracy degrades for small block sizes and low JPEG qualities. To deal with computational complexity the use of k-dimensional tree was proposed by Langille and Gong (2006)in which a method searching for blocks with similar intensity patterns using matching techniques was used. The resulting algorithm has a complexity of O(NbNs), where Ns¼ neighborhood search size and Nb¼ the number of blocks (which is a function of input image with resolution MN). Zero-normalized cross

(4)

Fig.3.Digitalimageforgerydetectiontechniquesclassiﬁcation.

(5)

correlation (ZNCC) was used as a similarity measure and accurate detection results obtained through searching within at most 100 neighboring blocks in the sorted block array.

A copy-move forgery detection and localization method based on dividing an image into small overlapped blocks, then comparing the similarity of these blocks andﬁnally identifying possible duplicated regions using intensity- based characteristics features was introduced byLuo et al.

(2006). Illustrated algorithm has lower computational complexity and is more robust against stronger attacks and various types of after-copying manipulations, such as lossy compression, noise contamination, blurring and a combination of these operations resulting in accuracy of 0.9631 and false negative of 0.0966 in case of mixed operations. A method for detecting near-duplicated regions based on blur moment invariants, PCA and kd-tree was described by Mahdian and Saic (2007). To create the feature vector, algorithm uses 24 blur invariants up to the seventh order resulting in correct region duplication detection but major disadvantage of the method is its large computational time (Average run time is 30 min for 640 480 RGB image when block size of 24 and similarity threshold of 0.98).

Myna et al. (2007) developed a method using a log- polar coordinates and wavelet transforms to detect and localize copy-move forgery. Dimensionality reduction is obtained by applying wavelet transform to the input image and exhaustive search is performed to identify the similar blocks in the image by mapping them to log-polar coordinates and using phase correlation as the similarity criterion. Qiumin et al. (2011) employed log-polar fast Fourier transform (LPFFT) which is rotation and scale invariant with lower computational complexity of O(n²log n) where n is blocksize. A cloning detection method based on aﬁltering operation and nearest neighbor search was explored inDybala et al. (2007).Li et al. (2007)used singular value decomposition (SVD) for feature vector dimensionality reduction and wavelet transform for duplicated regions detection. Duplicated regions were localized by lexicographically sorting and neighborhood detecting for all blocks even when the image was highly compressed or edge processed.

JPEG image forensics approach is implemented to detect copy-paste forgery based on the check of block artifact grid (BAG) mismatch by Li et al. (2008b) even when a JPEG image is truncated or multi-compressed. Scale invariant features transform (SIFT) features which are stable with respect to changes in illumination, rotation and scaling applied byHuang et al. (2008)to detect the cloned regions in the image. A method has good accuracy on different kind of post image processing like JPEG compression, rotation, noise, scaling and is also robust to compound image processing. A novel methodology based on SIFT is evaluated to estimate the geometric transformation parameters (horizontal and vertical translation, scaling factors and rotation angle) with high reliability in addition to detect forged image byIrene et al. (2011). The proposed method achieves true positive rate (TPR) of around 100%. The technique also utilized for splicing detection.

A copy-move detection approach based on wavelet transforms and phase correlation was created to estimate

Fig.4.Generalizedstructureofimageforgerydetection.

(6)

the spatial offset between the copied region and the pasted region byZhang et al. (2008a). But the performance relies on the location of copy-move regions. The Fourier-Mellin transform (FMT) features, which are invariant to scale and rotation was extracted and lexicographic sorting is used to detect copy move forgery byBayram et al. (2009).

The method is robust against various manipulation types (JPEG compression, rotation and scaling) in addition to this authors also presented a detection scheme that make use of counting bloomfilters. Use of radix sort method was suggested byLin et al. (2009a) to reduce the computational complexity in forged area detection. The radix sort method is used for sorting the feature vectors of the divided sub- blocks instead of lexicographic sorting, which improves time efficiency significantly at a slight decrease in the robustness. Detection rates obtained were in the range of 94–98% in presence of various manipulations.

Liu et al. (2011a) designed an efficient and robust passive authentication method that uses the circle block and the Hu moments to detect and locate the duplicate regions with rotation. Features are extracted from thefirst four Hu moments of the circle blocks in low frequency part of Gaussian pyramid decomposition to reduce the computational complexity. To perform an efficient search, overlapping blocks of pixels are mapped to 1-D descriptors derived from log-polar map for automated detection and localization of duplicated regions affected by reflection, rotation and scaling in images is focused in Sergio and Asoke (2011). Out of total 20 non-tampered test images algorithm detected 3 false matches (The number of images mistakenly classified as forgeries). A blind copy move image forgery detection method obtained inMuhammad et al. (2011) using dyadic wavelet transform (DyWT) which is shift invariant utilizing both the LL1 and HH1 subbands tofind similarities and dissimilarities between the blocks of an image. Accuracy claimed is 95.9% with false positive of 4.54%.

Gopi et al. (2006)exploited auto regressive coefficients as the feature vector and artificial neural network (ANN) classifier to detect digital image forgery. 300 feature vectors from different images are used to train an ANN and the ANN is tested with another 300 feature vectors. Percentage of hit in identifying the digital forgery is 77.67% in experiment 1 in which manipulated images were used to train ANN and 94.83% in experiment 2 in which a database of forged images was used. An algorithm based on discrete wavelet transform (DWT) to reduce the dimension the image and DCT-quantization coefficients decomposition (DCT-QCD) to reduce the dimension of feature vector is illustrated by Ghorbani et al. (2011)to detect copy-move forgery.

Bashar et al. (2010) proposed a duplication detection approach that adopts two robust features based on DWT and kernel principal component analysis (KPCA). Multi- resolution wavelet coefﬁcients and KPCA-based projected vectors corresponding to image-blocks are arranged into a matrix for lexicographic sorting. ‘Translation – Flip’ and

‘Translation – Rotation’ duplications are also detected using global geometric transformation and the labeling technique to identify the forgeries. XiaoBing and ShengMin (2008) identiﬁed the location of copy-move image tampering by applying SVD which served to produce

algebraic and geometric invariant feature vectors. The proposed method has lower computational complexity, robust against retouching details and noise.Sutthiwan et al.

(2010)presented a method for passive-blind color image forgery detection which is a combination of image features extracted from image luminance by applying a rake – transform and from image chroma by using edge statistics.

The technique extracts multi-size block discrete cosine transform– Markov process (MBDCT-MP) features from Y- channel and support vector machine (SVM) with degree 2 polynomial kernel is employed for classiﬁcation purpose resulting in almost 99% of accuracy.

Xunyu and Siwei (2011)developed a region duplication method by estimating the transform between matched SIFT keypoints that is robust to distortions based on image feature matching. The algorithm results in average detection accuracy of 99.08% but one of the limitation of the method is smaller region duplication is hard to detect as it has fewer keypoints.Kakar and Sudha (2012)described a novel technique based on transform-invariant features for detecting copy-paste forgeries with possible postprocessing based on the MPEG-7 image signature tools. A feature matching process that utilizes the inherent constraints in matched feature pairs to improve the detection of cloned regions is used resulting in a feature matching accuracy in excess of 90% across postprocessing operations.

All the methods discussed above that are able to detect and locate detecting copy move forgery and near duplicates regions of the image, these are computationally expensive and a human interpretation of the results is necessary. Also, they introduce high false positives. Further, few techniques often fails to detect the forgery when the size of the forged area is much smaller than image dimensions.

3. Image splicing or image composites

Image splicing involves replacing of image fragments from one or more different images on to another image.

Image splicing is one of the simple and commonly used image tampering schemes. Image splicing detection is of the fundamental task in image forgery detection.

The method based on bispectral analysis was introduced byFarid (1999)to detect un-natural higher-order correlations introduced into the signal by the tampering process and is successfully used for detecting human-speech splicing. Bicoherence is a normalized bispectrum.Ng and Chang (2004) developed an image-splicing detection model based on the use of bicoherence magnitude and phase features. The results of detection accuracy was about 70%. Later same authors proposed a method for detecting the abrupt splicing discontinuity using bicoherence features (Ng et al., 2004). Inverse camera response functions were computed by analyzing the edges in different patches of the image and verifying their consistency byLint et al.

(2005). Fu et al. (2006) used Hilbert-Huang transform (HHT) to generate features for classiﬁcation and statistical natural image model based on moments of characteristic functions with wavelet decomposition was employed to distinguish the spliced images from the authentic images.

Chen et al. (2007) investigated a scheme that extracts image features from moments of wavelet characteristic

(7)

functions and 2-D phase congruency which is a sensitive measure of sharp transitions for image splicing detection.

Natural image model was constructed by Shi et al.

(2007a) to detect splicing which consists of statistical features extracted from the test image as well as 2-D arrays generated by applying to the test images multi-size block discrete cosine transform (MBDCT).Hsu and Chang (2006) proposed a method in which for a given image,first sus- picious splicing areas identified, and then computing the geometry invariants from the pixels within each region and the camera response function (CRF) is estimated from these geometry invariants. The cross-fitting errors are fed into an SVM classifier. Johnson and Farid (2007c) presented a method to detect compositing of two or more people into a single image based on estimating a cameras intrinsic parameters from the image of a persons eyes. Inconsistencies in the estimated principal point was used as evidence of tampering. The discontinuity of image pixel correlation and coherency caused by splicing in terms of image run-length representation and image edge statistics were used for image splicing detection in which SVM is used as the classifier byDong et al. (2008).

Zhang et al. (2008b) obtained a splicing detection method based on moment features extracted from the MBDCT and image quality metrics (IQMs) extracted from the given test image, which are sensitive to spliced image.

Ng and Tsui (2009)andNg T.T. (2009)described an idea of extracting the CRF signature from surfaces linear in image irradiance using linear geometric invariants from the single image. In second paper authors explored an edge-proﬁle- based method for extracting CRF signature from a single image. The proposed method requires straight edges and edges should be wide enough so that edge proﬁles can be reliably extracted. QingZhong and Andrew (2009) suggested a method based on extraction of neighboring joint

density features of the DCT coefﬁcients and then SVM is applied to the features for image splicing detection.Wang et al. (2009) implemented a color image splicing detection method based on gray level co-occurrence matrix (GLCM) of thresholded edge image of image chroma.

Zhenhua et al. (2009)illustrated splicing detection system consisting of an order statistic ﬁlters (OSF) based edge sharpness measure and a visual saliency guided feature extraction mechanism.Zhang et al. (2009c) constructed a method for detecting image composites based on estimated shadow geometry and photometry.

Fang et al. (2009b), evaluated consistency check of camera characteristics among different areas in an image for image splicing detection. Color sharpness and singular value difference are used for image authentication. CRF was used to detect splicing regions by (Yu-Feng and Shih-Fu, 2010). In this a test image was ﬁrst automatically segmented into distinct arbitrarily shaped regions. One CRF estimated from each region using geometric invariants from locally planar irradiance points (LPIPs).

Zhang et al. (2010)introduced a method based on the planar homography constraint to locate the fake region roughly and an automatic extraction method using graph cut with online feature/parameter selection to segment the fake object.Zhao et al. (2010)proposed a method based on chroma spaces. Four gray level run-length run-number (RLRN) vectors with different directions extracted from de- correlated chroma channels were employed as distinguishing features for image splicing detection and SVM as a classiﬁer. Liu et al. (2011b)investigated a technique based on photometric consistency of illumination in shadows by formulating color characteristics of shadows measured by the shadow matte value.

Table 1 shows comparison of various algorithms for image splicing. However all the above proposed techniques

Table 1

Comparison of image splicing or image composite detection algorithms.

Algorithm Extracted features Dimension

of feature vector

Classiﬁer Detection accuracy

Ng et al. (2004) Bicoherence features 768 segments SVM 71%

Lint et al. (2005) Inverse camera response function – SVM 100% (Using two

test images) Fu et al. (2006) Hilbert-Huang transform (HHT) & Moments of characteristics

function using wavelet decomposition based features

110 SVM 80.15%

Chen et al. (2007) Statistical moments of wavelet characteristic function and 2D phase congruency

120 SVM 82.32%

Shi et al. (2007a,b) Moments of characteristic functions of wavelet subbands and Markov transition probabilities of difference 2-D arrays

266 SVM 91.87%

Hsu and Chang (2006) Camera response function using geometry invariants 6 SVM 87%

Dong et al. (2008) Run length (RL) and edge detection (SP) based statistical moments 12 (RL)þ 49 (SP) ¼ 61 SVM 76.52%

Zhang et al. (2008a,b,c) Moment features extracted from multi-size block discrete cosine transform (MBDCT) and some image quality metrics (IQMs)

72 (IQMs)þ 168 (MBDCT)¼ 240

SVM 87.10%

QingZhong

and Andrew (2009)

Neighboring joint density of DCT coefﬁcients 169 SVM 89.2%

Wang et al. (2009) Gray level co-occurrence matrix (GLCM) of chroma components 324 SVM 90.5%

Zhenhua et al. (2009) Edge sharpness measure order statisticﬁlter (OSF) 10/9 SVM 96.33%

Fang et al. (2009a,b) Color sharpness, inter-channel singular value difference, and the difference between an estimate

of the demosaiced and tested image

20 LDA 90%

Yu-Feng

and Shih-Fu (2010)

CRF estimation using geometry invariants 20 SVM 70%

Zhao et al. (2010) Four gray level run-length run-number (RLRN) vectors extracted from chroma channels

60 SVM 94.7%

(8)

have few limitations. Image splicing detection fails when concealing measures, such as blur is applied after splicing when the edge sharpness cues are used for detection purpose. Also it requires straight edges and edges should be wide enough so that edge proﬁles can be reliably extracted.

Sometimes manual labeling of image regions makes a particular approach a semiautomatic one. Further, highly localized and minor tampering will most likely go unno- ticed and difﬁcult to detect. The compression artifacts make the localization of the forgery difﬁcult when the image being analyzed is compressed by a low quality factor.

4. Image forgery detection using JPEG compression properties

JPEG is most popular and commonly used compression standard which has been found in variety of applications.

Most digital cameras export JPEG ﬁle format. To identify whether an image in bitmap format has been previously JPEG compressed or not is an important issue for some image processing applications and plays very important role in image tampering detection.

Fan and Queiroz (2003) constructed a method deter- mining whether an image has been previously JPEG compressed and to estimate compression parameters. A method for the maximum likelihood estimation was devised to estimate what quantization table was used.

However, the original intention of the paper was not for tampering detection. A method for estimation of primary quantization matrix from a double compressed JPEG image presented in Fridrich and Lukas (2003). Three different approaches were presented from which the neural network classifier based one is the most effective reliable yielding less than 1% of errors. One of the limitation of proposed method is, sufficiently large images are required to obtain accurate results and is not possible to reliably estimate quantization steps for high-frequency coefficients due to insufficient statistics.

Popescu (2004)developed a technique for detecting if a JPEG image has been double compressed by examining the histograms of the DCT coefficients, as double JPEG compression amounts to double quantization of the block DCT coefficients which introduces specific artifacts visible in the histograms of these coefficients. But images that are compressedfirst with a high quality, then with a significantly lower quality are generally harder to detect.

Neelamani et al. (2003)implemented a method to estimate image JPEG compression history components including the color transformation, subsampling, and the quantization table employed during the previous JPEG operations based on DCT coefficient structure created by previous JPEG operation as JPEG-compressed images exhibit near- periodic behavior due to quantization. A statistical model based on Benford’s law for the probability distributions of the first digits of the block-DCT and quantized JPEG coefficients was obtained byFu et al. (2007). The generalized Benford’s law can be used in the detection of JPEG compression for images in bitmap format, the estimation of JPEG compression Q factor for JPEG compressed bitmap image, and the detection of double compressed JPEG image.

Tjoa et al. (2007a) explored a method to determine which transform was used during compression. The method is based on analyzing the histograms of coefficient subbands to determine the nature of the transform method. The three block transforms– DCT, Hadamard, and Slant and three wavelet transforms– 5/3, 9/7, and 17/11 were correctly determined using proposed method. Tjoa et al. (2007b) evaluated a method to estimate the block size in digital images in a blind manner without making any assumptions on the block size or the nature of any previous processing with a detection accuracy which correctly classifies an image as block-processed with a probability of 95.0% and the probability of false alarm at 7.4%. A passive approach to detect digital forgeries by checking image quality inconsistencies based on blocking artifact caused by JPEG compression was suggested byYe et al. (2007). The blocking artifacts introduced during JPEG compression could be used as a“natural authentication code”. A blocking artifact measure is proposed based on the estimated quantization table using the power spectrum of the DCT coefficient histogram.

Zhang et al. (2009a) illustrated a method to detect and locate for the tampered areas in tampered images based on double JPEG2000 compression. The technique exploits the fact that double JPEG2000 compression amounts to particular double quantization of the sub-band DWT coefficients, which introduces specific artifacts visible in the Fourier transforms of DWT coefficient histograms.Luo et al.

(2008)implemented a method for block size estimation based on morphological operation. The method is based on maximum-likelihood estimation resulted in 40% accuracy improvement compared with existing gradient-based method reported in Tjoa et al. (2007b). Fridrich and Penvy (2008)introduced a reliable method for detection of double compressed JPEG images and a maximum likelihood estimator of the primary quality factor with the accuracy better than 90%. It is based on classification using support vector machines with features derived from the first order statistics of individual DCT modes of low- frequency DCT coefficients. The algorithm not only detects cover images but also images processed using steg- anographic algorithms.

Qu et al. (2008) formulated the shifted double JPEG compression (SD-JPEG) as a noisy convolutive mixing model for identifying if a given JPEG image has ever been compressed twice with inconsistent block segmentation. A total of 13 features which represent the asymmetric characteristic of the independent value map then feed to an SVM classiﬁer resulting in detection accuracy of above 90%

at QF of 95. Chunhua et al. (2008) created a machine learning based scheme to distinguish between double and single JPEG compressed images with detection rate of 95%.

This scheme relies on the Markov process and transition probability matrix (TPM) applied to the difference JPEG 2-D arrays, which are of the second order statistics which detects the artifacts left with double JPEG compression.

Li et al. (2008a) utilized the probabilities of the first digits of quantized DCT coefficients from individual AC (alternate current) modes called as mode basedfirst digit features (MBFDF) to reveal the double JPEG compression history of a given JPEG image. Using the approach primary

(9)

QF identified correctly in most of the cases using fisher linear discriminant (FLD) classifier. Weihai et al. (2008) tested a blind approach to detect copy-paste forgery in a JPEG image to check whether a copied area came from the same image or not. The approach utilizes the mismatch information of BAG as a clue of copy-paste forgery. The complexity of this algorithm is quite high.Junfeng et al.

(2006)developed an approach by examining the double quantization effect hidden among the DCT coefﬁcients that can detect doctored JPEG images and locate the doctored parts. The approach has several advantages like the ability to detect doctored images by different kinds of synthesiz- ing methods (such as alpha matting and inpainting, besides simple image cut/paste), the ability to work without fully decompressing the JPEG images and the fast speed. How- ever, the method fails when the original image to contribute the undoctored part is not a JPEG image and in case of heavy compression after image forgery.

The artifacts introduced by lossy JPEG compression was employed as an inherent signature for compressed images byChen and Hsu (2008). The methodﬁrst estimates the blockiness for each pixel, model the linear dependency of the blockiness measure, andﬁnally analyze the different peak energy distributions to discriminate single compressed images from tampered images. However, detection of cropped-and-recompressed is feasible only when the original quality factor is smaller than the recompression quality factor. Farid (2009b) proposed a method for detecting image composites created by different JPEG compression quality on low quality images and can detect relatively small regions that have been altered. The technique detects if part of an image was initially compressed at a lower quality than the rest of the image. This technique is effective only when the tampered region is of lower quality than the image into which it was inserted.

Lin et al. (2009b) constructed a fast, fully automatic method for detecting tampered images by examining the double quantization effect hidden among the DCT co- efﬁcients using SVM classiﬁer. The technique was insensi- tive to different kinds of forgery methods such as alpha matting and inpainting, in addition to simple image cut/

paste. The method fails when the whole image is resized, rotated, or cropped. Detection method of double JPEG compressed image was proposed based on histograms of DCT coefﬁcients and SVM byMahdian and Saic (2009a).

The method exploits the fact that altering a JPEG image brings into the image speciﬁc artifacts like periodic zeros and double peaks. However, the method produces high false positive to natural images with “nonperfect histograms”.

Huang et al. (2010) presented a method which can detect double JPEG compression with the same quantization matrix. First a“proper” randomly perturbed ratio is obtained from the JPEG coefﬁcients of the recompressed test image and then this universal“proper” ratio generate a dynamically changed threshold, which can be utilized to distinguish between the singly and doubly compressed images. If the QF is no less than 90, theﬁnal detection accuracy rates are constantly higher than 90% for UCID, NRCS, and OurLab image dataset. The method can also be extended to detect the triple JPEG compression, four times

JPEG compression, and so on.Luo et al. (2010)evaluated a method for image tamper detection including identifying whether a bitmap image has previously been JPEG compressed, quantization steps estimation and detecting the quantization table of a JPEG image by analyzing the effects of quantization, rounding and truncation errors. The method achieves accuracy of around 90% even the image size decreases to 8 8 and the quality factor is as high as 95 while identifying JPEG images, average accuracy is 81.97%

for the images with size of 128 128 and with the quality factor 85 while estimating quantization steps, and the accuracy can achieve over 94.52% when the image size becomes larger than 64 64 while detecting quantization table.

Wang et al. (2010)implemented an algorithm which can locate the tampered region in a lossless compressed tampered image when its unchanged region is output of JPEG decompressor. PCA is employed to separate different spatial frequencies quantization noises, i.e. low, medium and high frequency quantization noise and extract high frequency quantization noise for tampered region localization. However, this methods fails to detect forgery if the tampered region of a forged image has little high frequency information or the source image is saved in JPEG format with higher quality than the quality tampered image.

Bianchi and Piva (2011) illustrated a reliable method to detect the presence of non-aligned double JPEG compression (NA-JPEG) based on a single feature which depends on the integer periodicity of the DCT coefﬁcients when the DCT is computed according to the grid of the previous JPEG compression. Additionally the method accurately estimates both the quantization step and the grid shift of the primary JPEG compression.

Chen and Hsu (2011)presented a technique to detect either block-aligned or misaligned recompression by formulating the periodic characteristics of JPEG images both in spatial and transform domains. The approach is limited if a global operation such as additive white Gaussian noise or blurring are applied with a large distortion level before recompression.Kee et al. (2011)described a technique which extracts camera signature (9163 camera configurations) from a JPEG image consisting of information about quantization tables, Huffman codes, thumbnails, and EXIF format to determine if an image has been modi- fied in any way.Bianchi et al. (2011)applied a statistical test to differentiate between original and forged regions in JPEG images by computing probability models for the DCT coefficients of singly and doubly compressed regions along with an estimation of the primary quantization factor in the case of double compression.Bianchi and Piva (2012)proposed a method to detect into a digital image the presence of non-aligned double JPEG compression based on the observation that the DCT coefficients exhibit an integer periodicity when the blockwise DCT is computed according to the grid of the primary JPEG compression.

5. Photographic images and photorealistic computer graphic (PRCG) images classiﬁcation

As computer graphics (CG) technologies rapidly develop, sophisticated computer graphics rendering

(10)

software can generate remarkably photorealistic images.

Photorealistic images can be created that are difﬁcult to distinguish visually from photographic images. As the rendering technology evolves, photorealistic images can be modeled and rendered easily. One of the challenging and immediate problem is to distinguish between photorealistic computer generated (PRCG) images from real (photographic) images.

Leykin and Cutzu (2003)investigated a technique based on properties of intensity and color edges to differentiate paintings from photographs of real scenes.Ng and Chang (2004b) constructed a detector which classifies photographic images (PIM) from PRCG using natural image statistics (NIS). Three types of NIS with different statistical order, i.e. NIS derived from the power spectrum, wavelet transform and local patch of images were studied.Lyu and Farid (2005) created a statistical model for photographic images consisting offirst and higher-order wavelet statistics using LDA and a non-linear SVM. However, the model don’t necessarily give any insight into how one might render more photorealistic images. Cutzu et al. (2005) computed the image classification system that discriminates paintings from photographs based on the evidence that that photographs differ from paintings in their color, edge, and texture properties.

Ng et al. (2005) proposed a method for classifying photographic images and photorealistic computer graphics based on a geometry-based image model motivated by the physical image generation process. The classification was based on the SVM classifier. FurtherNg and Chang (2006) deployed an online system for distinguishing photographic and computer graphic images in which users are able to submit any image from a local or an online source to the system and get classification results with confidence scores.Dehnie et al. (2006)developed a digital image forensics technique to distinguish images captured by a digital camera from computer generated images based on the properties of the residual image (pattern noise in case of digital camera images) extracted by a wavelet based denoisingfilter.

Rocha and Goldenstein (2006)described a new methodology to separate photographs and computer generated images using the progressive randomization (PR) technique that extracts the statistical properties of each one of photographs and computer generated image classes.Wang and Moulin (2006) implemented a method for differentiating digital photorealistic images from digital photographs using a wavelet based statistical model to extract features from the characteristic functions of wavelet coefﬁcient histograms.

Dirik et al. (2007)proposed the use of features based on the differences in the acquisition process of images to distinguish computer generated images from real images.

Traces of demosaicking and chromatic aberration are used to differentiate computer generated images from digital camera images. Shi et al. (2007b) introduced a novel approach to distinguish computer graphics from photographic images based on the statistical moments of characteristic function of the image wavelet subbands and their prediction-error features. Same authors explored the use of genetic algorithm to select an optimal feature set for

distinguishing computer graphics from digital photographic images using the same feature set but with reduced dimensions (Chen et al., 2008b).

Khanna et al. (2008) presented method for distinguishing between an image captured using a digital camera, a computer generated image and an image captured using a scanner based on sensor pattern noise features extracted from digital cameras and scanners.

Sankar et al. (2009)developed a technique for differentiating between computer graphics and real images based on an aggregate of existing features. In addition to this,ﬁlters were proposed to effectively detect attacks like creation of hybrid images and histogram manipulations. Sutthiwan et al. (2009a), employed statistical moments of 1-D and 2-D characteristic functions to derive image features which captures the statistical differences that can distinguish between computer graphics and photographic images.

Sutthiwan et al. (2009b)evaluated a method to differentiate between computer graphics and photographic images by applying Markov process (MP) to model difference JPEG 2-D arrays along horizontal and vertical directions to derive TPM which characterize the MP. Li et al. (2010) proposed a method for the discrimination between natural images and photorealistic computer graphics using second-order difference statistics and the Fisher linear discrimination analysis to construct a classiﬁer.Wu et al.

(2011)developed a method for discriminating computer generated graphics from photographic images based on several highest histogram bins of the difference images as features for the classiﬁcation.

Table 2describes comparison of various photographic images and computer graphics images algorithm. The techniques discussed above works well for uncompressed images or JPEG images with a high quality factor. Perfor- mance of various methods decreases with higher degrees of JPEG compression and down-sampling operation. Also from a rendering point of view, few methods don’t necessarily give any insight into how one might render more photorealistic images.

6. Lighting inconsistency

Different photographs are captured under different lighting conditions. When combining image fragments from different images, it is difﬁcult to match the lighting conditions from the individual photographs. Therefore, lighting inconsistency detection for different parts in an image can be employed to identify tampering.

Johnson and Farid (2005) described a technique for estimating the direction within one degree of freedom of an illuminating light source from only a single image to detect forgery. First the direction of the illuminated source is estimated for different objects/people in an image, inconsistencies in lighting can be used as evidence of digital tampering. Same authors illustrated a model based on inconsistencies in the lighting due to multiple light sources, diffuse lighting, directional lighting from a single image which is then used as evidence of tampering. It is illustrated by Johnson and Farid (2007a) that any arbitrary lighting environments can be modeled with a 9- dimensional model. Johnson and Farid (2007b)

(11)

constructed a technique to measure the 3-D direction to a light source from the position of the highlight on the eye.

Specular highlights that appear on the eye are a powerful cue as to the shape, color and location of the light source(s).

Inconsistencies in shape, color and location of the light source properties of the light can be used as evidence of forgery.

Zhang et al. (2009c) investigated a method to detect image composites by enforcing the geometric and photometric constraints from shadows. In particular, authors explored (i) the imaged shadow relations that are modeled by the planar homology and (ii) the color characteristics of the shadows measured by the shadow matte.Farid and Bravo (2010)described three computational methods that can be applied to detect the inconsistencies in shadows, reflections, and planar perspective distortions that seem to elude the human visual system.Yingda et al. (2011)proposed an improved blind image identification algorithm based on inconsistency in light source direction which is defined as “neighborhood method” as inconsistency in the light source direction can be considered as strong evidence of the image tampering. The neighborhood method was used to calculate surface normal matrix of image in the blind identification algorithm with detection rate of 87.33%.

Farid (2010)studied a 3-D photo forensic analysis of the historic and controversial Zapruderﬁlm on JFK. The analysis shows that the shadow is consistent with the 3-D geometry of the scene and position of the sun proving that the 8 mm originalﬁlm has not been altered.

Major advantage of these methods is that it is difﬁcult to hide the traces of inconsistencies in lighting conditions which is present due to digital tampering.

7. Projective geometry

Photographs with composited regions, it is often difﬁ- cult to keep the appearance of the image correct perspective. Hence, traces of tampering can be detected by applying the principles from projective geometry.

Johnson and Farid (2006b)proposed three techniques for estimating the transformation H of a plane imaged under perspective projection. With this transformation, a planar surface can be rectiﬁed to be fronto-parallel where each technique requires only a single image and exploits different geometric principles. Conotter et al. (2010)presented a technique for detecting text manipulation on sign or billboard using the evidence that text in an image fol- lows the expected perspective projection, deviations from which are used as evidence of tampering. It is difﬁcult to identify forgery if the inserted text is applied with correct homography.

An important advantage of this approach is that it is difﬁcult to conceal the traces of tampering. However, few techniques are semiautomatic.

8. Chromatic aberration

The imperfections in optical imaging systems results in different types of aberrations into the captured images.

Chromatic aberration is caused from imperfection in the lens to perfectly focus light different wavelengths in a digital camera which provokes a discrepancy in the location in which the sensor receives light of different wavelengths. There are two types of chromatic aberration:

longitudinal and lateral. Longitudinal aberration causes Table 2

Comparison of various photographic image and photo-realistic computer generated (PRCG) image classiﬁcation algorithms.

Algorithm Extracted features Dimension

of feature vector

Classiﬁer Classiﬁcation accuracy Ng and Chang (2004b) Natural image statistics (NIS) derived from the power

spectrum, wavelet transform and local patch of images

129 (NIS)

& 102 (CG)

SVM 83%

Lyu and Farid (2005) First- and higher-order wavelet statistics 216 LDA

& non-linear SVM

67%

Ng et al. (2005) Geometry-based features by means of the fractal geometry at theﬁnest scale and the differential geometry

at the intermediate scale

192 SVM 83.5%

Rocha

and Goldenstein (2006)

Statistical descriptors of the least signiﬁcant bit (LSB) occurrences using Progressive Randomization (PR) technique

96 SVM 90%

Wang and Moulin (2006) The characteristic functions of wavelet-coefficient histograms (High passfiltering and band pass filtering)

144 FLD 100%

Dirik et al. (2007) Colorﬁlter array demosaicking and chromatic aberration based features

72 SVM 90%

Shi et al. (2007a,b) Moments of wavelet subbands & prediction error image 234 SVM 82.1%

Khanna et al. (2008) Residual pattern noise (sensor pattern noise) 15 SVM 85.9%

Chen et al. (2008a,b) Moments of wavelet subbands & prediction error image 100 SVM 82.3%

Sankar et al. (2009) Moment-based method, texture interpolation method, color histogram and patch statistics based features

80 Two-class

classiﬁer 90%

Sutthiwan et al. (2009a) Image pixel 2D array and image JPEG 2-D array, 2D histogram features

780

(450 using BFS)

SVM 87.6%

(92.7%

using BFS) Sutthiwan et al. (2009b) Second order statistics transition probability matrices (TPM)

derived from Applying (Markov process) MP to model difference JPEG 2-D arrays

324

(150 using BFS)

SVM 94.0%

(94.2%

using BFS) Li et al. (2010) Features based on the variance and kurtosis of second-order difference

signals and theﬁrst four order statistics of predicting error signals

144 FLDA 95.5%

Wu et al. (2011) Histogram bins ofﬁrst-order and second-order difference images 112 FLD 95%

(12)

different wavelengths to focus at different distances from the lens while lateral aberration is attributed to different wavelengths focusing at different positions on the sensor.

Tampering of image causes the aberration across the image inconsistent. This reveals the presence of forgery.

Johnson and Farid (2006a) implemented a model for lateral chromatic aberration and automatic technique for estimating these model parameters that is based on maximizing the mutual information between color channel was derived. This approach for detecting tampering is effective when the manipulated region is relatively small.

Lanh et al. (2007b) estimated the parameters of lateral chromatic aberration by maximizing the mutual information between the corrected R and B channels with the G channel. The parameters extracted are then used as input features to an SVM classiﬁer for identifying source cell phone of images resulted in average accuracy rate of 92.22%.Gloe et al. (2010)obtained a new approach to estimate lateral chromatic aberration with low computational complexity and, for theﬁrst time, provide results on using lateral chromatic aberration in real-world scenarios based on the‘Dresden’ image database.Memon et al. (2011) employed a technique which is able to obtain a stable enough CA pattern distinguishing different copies of the same lens.

Most of the methods discussed above suffer heavily from image modiﬁcation attack and it is observed that the detection performs poorly on low quality images.

9. Colorﬁlter array (CFA) and inter pixel correlation

Many digital cameras are equipped with a single charge- coupled device (CCD) or complementary metal oxide semiconductor (CMOS) sensor which capture color images using CFA. The CFA consists of an array of color sensors, each of which captures the corresponding color scene at an appropriate pixel location where it is located and remaining colors are obtained by interpolating process. Image forgery can be detected by identifying correlation introduced by the interpolation process.

Popescu and Farid (2005a) introduced a method to detect and locate image tampering based on an expecta- tion/maximization (EM) algorithm and uses a linear model in lossless and lossy compressed images. The detection accuracies for eight different CFA interpolation algorithms are close to 100% for quality factors greater than 96, and that they decrease with decreasing quality factors.

Swaminathan et al. (2006a) investigated a technique for identifying the CFA pattern and the interpolation algorithm. The interpolation coefficients corresponding to the three color planes were estimated and an SVM was used for identifying the interpolation method. 100% classification accuracy in identifying the correct CFA interpolation algorithm with no false alarms was obtained. Cao and Kot (2009)presented a detection framework of image demosaicing regularity using partial derivative correlation models which detects both the cross and the intra-channel correlation caused by demosaicing. The test identification accuracies of 97.5% for 14 commercial DSCs of different models and 99.1% for 10 RAW-tools was obtained using the probabilistic SVM classifier.

Huang and Long (2008)proposed a decision mechanism using 3-layer feedforward back propagation neural net- works (BPN) and a majority-voting scheme is designed for demosaicking correlation recognition and digital photo authentication based on a quadratic pixel correlation model, in which such correlation is expressed in a quadratic form. Gallagher and Chen (2008) developed a technique which detects the presence of demosaicing in a digital image to detect and localizing tampering. Also an approach is described to distinguish between PIM and PRCG images.

Swaminathan et al. (2009) focused on the problem of component forensics and examined how the intrinsic ﬁngerprint traces left behind in the ﬁnal digital image by the different components of the imaging device can be used as evidence to estimate the component parameters.

Dirik and Memon (2009)constructed a tamper detection techniques based on artifacts created by CFA by computing features like CFA pattern number estimation and CFA based noise analysis andfinally classification is done by using a simple threshold based classifier. The technique is sensitive to strong JPEG re-compression and resizing and may also not work well if the tampered region area is too small.Fan et al. (2009)proposed a framework which is effective in recognizing the demosaicking algorithms for raw CFA images based on a generalized neural network framework to simulate the stylized computational rules in demosaicking through bias and weight value adjustment.Kirchner (2010) formulated an efficient method to determine the configuration of the CFA pattern in demosaiced digital images using only one linearfiltering operation per image which is used to assess the authenticity of digital images. However, JPEG compression severely reduces correct recognition rate of the CFA pattern configuration.

Takamatsu et al. (2010) described a method for estimating demosaicing algorithms from image noise variance based on the observation that the noise variance in interpolated pixels becomes smaller than that of directly observed pixels without interpolation. Estimation of the CFA pattern accuracy is 95.8% for multiple image and 98.4%

for single image when JPEG quality is set to 100. One limitation of the proposed method is that the accuracy decreases when the image is processed (e.g., image compression and other imageﬁltering) after demosaicing.

Major limitation of the methods discussed above is that strong post-processing and JPEG compression hamper a reliable accurate detection of tampering.

10. Image processing operations

When altering an image, to conceal traces of tampering often various image processing operations are applied to the images. Detection of these operations results in iden- tiﬁcation of forgeries.

Lukas (2000) implemented a technique to detect manipulation in digital images using the convolutional ﬁltering and spectral ﬁltering operations. Avcibas et al.

(2004) illustrated a method that discriminates between tampered image and its originals based on content- independent distortion measurements called as image quality measures used as features in the design of a linear regression classiﬁers.Bayram et al. (2005a) method based

(13)

on the neighbor bit planes of the image based on the basic idea that, the correlation between the bit planes as well the binary texture characteristics within the bit planes will differ between an original and a doctored image. These binary similarity measures are used as features in classiﬁer design.

Bayram et al. (2006) explored a technique to detect doctored and manipulated images using three features, the binary similarity measures between the bit planes, the image quality metrics applied to denoised image residuals, and the statistical features obtained from the wavelet decomposition of an image.Stamm and Liu (2008,2010) presented a method to detect globally and locally applied contrast enhancement and the use of histogram equalization by searching for the identifying features of each operations intrinsicfingerprint.Swaminathan et al. (2006b) exploited blind deconvolution to detect image tampering. The linear part of the tampering process is modeled as afilter and obtained its coefficients using blind deconvolution. Possible manipulations such asfiltering, compression, rotation etc.

are indentiﬁed using these estimated coefﬁcients.

Luo et al. (2007b) described a method based on the property of the blocking artifact characteristics matrix (BACM) for effectively detecting cropping and recompression operations in JPEG images. BACM exhibits a symmetrical shape for the original JPEG images and this symmetrical property will be altered by cropping and recompression operations. Kirchner and Bohme (2008) developed different form of image transformation operations which are undetectable by resampling detectors based on periodic variations in the residual signal of local linear predictors in the spatial domain. The detectability and the resulting image quality is benchmarked against conven- tional linear and bicubic interpolation and interpolation with a sinc kernel.Kirchner and Fridrich (2010)proposed a method which investigates the detection of medianﬁltering in digital image using streaking artifacts (for uncompressed images) and subtractive pixel adjacency matrix (SPAM for Compressed images) features and SVM classiﬁer.

Cao et al. (2010b) presented an algorithm to detect the medianﬁltering manipulation. Statistical characteristics of the median-ﬁltered signal is analyzed and measured by the probability of zero value on the difference map of textured pixels.Mahalakshmi et al. (2012)obtained a technique for image authentication that detects the basic image operations such as re-sampling (rotation, rescaling), contrast enhancement and histogram equalization in the digital images. The interpolation related spectral signature method is used for detecting rotation and rescaling and for estimating parameters such as rotation angle and rescale factors.Gul et al. (2010)employed SVD based features to model the correlation among the rows and columns using relative linear dependency to detect image manipulations such as rotation, scaling, brightness adjustment, etc.Table 3 shows comparison of various image processing operation detection algorithms.

11. Local noise

Authentic image contains an amount of noise that is uniformly distributed across an entire image. It is common

to add localized random noise to the forged image regions in order to conceal traces of tampering while creating forgeries. Detection of inconsistent local noise levels across the image resulted due to tampering can be utilized to perform forgery detection analysis.

Gou et al. (2007)introduced a novel approach for image tampering detection and steganalysis, using three sets of statistical noise features (60 features) based on denoising operations, wavelet analysis, and neighborhood prediction.

SVM is used for classifying the authentic images and the tampered images resulting detection probability 90% and above.

Mahdian and Saic (2008b) investigated a method to detect image forgeries which divides the investigated image into various segments of different noise levels and the local noise is estimated based on tiling the high pass diagonal wavelet coefficients. The proposed method is not able tofind the corrupted regions, when the noise degradation is very small. Also the detection performance radi- cally decreases to images corrupted by noise.Lee and Choi (2010)described a color laser printer identification method by estimating the invisible noises with the wiener-filter and then a GLCM is calculated to analyze the texture of the noise. These 60 GLCM statistical features are used as input to a support vector machine classifier for identifying the color laser printers.Nataraj et al. (2010)proposed a re- sampling detectors which reliably detect re-sampling in JPEG images at lower QFs (75–90) by adding a controlled amount of noise to the image before the re-sampling detection step.

Typically, in all the methods it is difﬁcult to ﬁnd the corrupted regions, when the noise degradation is very small.

12. Interpolation and geometric transformations

When creating image composites, to give the image a more uniform aspect geometric transformations are needed. These geometric transformations typically involve re-sampling (e.g., scaling or rotating) which in turn calls for interpolation (e.g., nearest neighbor, bilinear, bicubic).

Detecting the speciﬁc statistical changes due to interpolation step can be identiﬁed as possible image forgery.

Popescu and Farid (2005b) applied a technique to detect specific correlations into the image introduced by re- sampling operation using EM algorithm to estimate probability maps. The presence of these correlations can be used as evidence of digital tampering. This method performs well only on uncompressed TIFF, JPEG and GIF images with minimal compression.Gallagher (2005)presented an algorithm to detect the presence of interpolation in images by exploiting the property that the second derivative signal of the interpolated images contains a periodicity. The performance of the algorithm degrades for high order inter- polationfilters such as a windowed sinc interpolation filter and the interpolation detection algorithm fails in case of interpolation by a factor of 2.0.

Prasad and Ramakrishnan (2006)developed four techniques to detect the traces of re-sampling, two of the techniques are in pixel domain and two others in frequency domain. Spatial domain techniques are based on properties