1 Introduction

As the old saying goes, a picture is worth a thousand words. Nonetheless, in ‘seeing is believing,’ one wonders the practicality of the proverb in our current situation [1–3]. At the present time, digital media plays a vibrant role in our daily life with the emergence of advance digital cameras [4–6]. Consequently, image tampering becomes a common phenomenon with the accessibility to powerful digital image editing software such as Photoshop [7–9]. Modification on digital forgeries images is made easier and expedient with the advancement of editing software without leaving any apparent suspicions [10, 11]. It is almost impossible for human to track the tampering of images with their naked eyes. Hence, authenticity verification of images has turned to be a perplexing task [12].

The swift upsurge of digitally manipulated counterfeits in media has resulted in the lack of integrity on digital images [13–16]. Thus, the dire needs to come up with methods to validate the authenticity and the integrity of image became vital, particularly the images presented as evidence or even document used in journalism, criminal, medical and others [17]. Image tampering is a digital art which needs one to comprehend the image properties. An image can be tampered by the usage of a variety of manipulation techniques such as blurring, resampling, filtering, scaling, rotation and cropping. The imitative region may not be the precise copy when pasted directly [18–22].

Various ways to tamper the image include blurring, addition of noise or even when the image is saved with a lower compression [23–26]. Apart from that, the copied region could be applied geometric transformation including rotating, scaling and others. Detection of image tampering deals with investigation on tampered images for possible correlations embedded owing to the tampering operations [27, 28]. Detecting forged image becomes a prominent research field in ensuring the integrity of images [29, 30]. Image forgery detection techniques are needed for copyright protection and forgery prevention. Copy-move attack which manipulates the image forgery by hiding some important information in the image is one of the prominent techniques in image forgery [31–33]. Copy-move manipulates an image by duplicating one portion of the image within the same image on a separate location. Nevertheless, copy move forgery is top  challenging falsifications since the region of copy-move attack belongs to the same image. Hence, it is tougher to detect the tampered region within the same image as compared with detecting the areas of some other image statistical methods such as image splicing [34, 35].

2 Related work

It is an inevitable fact that we are exposed to an extraordinary visual images in this innovative era. While we have pledge in the authentic of this digital image, the advent of technology has eroded this belief. There are numerous unscrupulous doctored images growth rate in our daily life until we could not grasp ranging from the advertisement in magazines for the scientific journals, mainstream media outlets or even fashion industry. The multimedia forensics which includes image tampering detection is to verify and authenticate a digital image. Manipulation of a digital image to hide the truth and altering the meaning of the image indicated in it can be misleading when used in a law court [31, 36, 37]. The misled evidence image may influence the verdict. This is similar to the influences that may inflict our interpretation based on the image. Therefore, we need to understand the underlying situation and comprehend what had exactly happened since the image has been manipulated. We need to identify if part of the image has been duplicated, an object has been covered, a combination of object or something has been copied and pasted from another image [38]. Image forensics is a field to detect and analyze images to verify the credibility and authenticity of the digital images. There are three main categories of forgeries in state-of-the-art digital image forensics namely image splicing, copy-move forgery and image retouching [39].

One of the most prevailing methods in image manipulation is by copying and pasting a part of the image once or numerous times elsewhere within the same image known as copy-move forgery. There is diversity of manipulation techniques in manipulating an image so as to have a perfect image without leaving any apparent suspicions. The main intention in copy-move image forgery detection is to detect tampered regions. Exhaustive search technique is an easy apparent approach to detect copy-move attack. The overlapped image and the circularly shifted version is used to look for closely undistinguishable image parts. Though exhaustive search method is relatively costly, it is simple and effective [40].

To resolve the problem of exhaustive approach, robust match detection method is engaged. Discrete Wavelet Transform (DWT) is used to identify forged image in robust match detection process. DWT method has lesser computational complexity as compared to the exhaustive search which only performed the lowest resolution image. Furthermore, this method works even for the images which has noise applied to it and when JPEG quality changes. Nevertheless, this method is not capable to detect the duplication image with geometrical transformation like rotation and scaling [41, 42].

Instead of exhaustive search approach, Discrete Cosine Transform (DCT) approach is used for the copy-move image forgery detection [43]. The detection process is initiated by scanning at upper left corner to lower right corner by sliding B × B block. Finally, DCT transform and quantized DCT coefficients are calculated for each block.

With the extensive use of powerful editing software currently, even an amateur can easily manipulate the image as they anticipated, hence resulting in the loss of the authenticity for the images. Human beings will not be able to tell apart between the real image and forged images due to the forged image which seems so real [44].

There exist two processing alternatives in copy-move image forgery detection: keypoint-based approach and block-based approach [45, 46]. For block-based techniques, the image is partitioned in a rectangular block depending on the block size such as 8 × 8 pixels. Then, we are to compute the feature vector and subsequently matched for the similar feature vectors for each block. In DCT, the discovery procedure starts from checking upper left corner to the lower right corner while sliding  a B × B block. For each block, the DCT is applied and the B 2 coefficients are quantized. The special characteristics of DCT are to detect tampered areas with a higher accuracy rate. However, the shortcomings of DCT are if there is a large number of block, extract feature vector’s size from the block will also be huge. However, smaller blocks will have smaller variability in DCT coefficients and this is due to high probability of false positive (FP). Since most of the study of DCT copy-move forgery detection only use 8 × 8 pixels block size, what will be the effect of different block size being used on DCT?

The issues need to be concerns when evaluating accuracy of detected tampered region in terms of precision and recall of detected forged areas number correctly (TP-True Positive), areas’ number that have been incorrectly detected as forged (FP-False Positive), and forged areas that are falsely missed (FN-False Negative). Therefore, precision (FP) and recall (FN) should be increased in order to achieve good accuracy rate. This research focuses on the investigation on the effect of block size on FP and FN by implementing the block-based copy-move image forgery detection approach using coefficients with various block sizes. Therefore, the main issue is:

  • What is the appropriate block size in order to achieve best accuracy (precision and recall)?

  • What is the effect of block size on false positive and false negative?

This research aims to implement the block-based copy-move image forgery detection approach using DCT coefficients with various block sizes in order to inspect the effect of block size on FP and FN.

3 Proposed methodology

In this research, copy-move image forgery detection using DCT coefficients has been carried out to investigate the effect of block size on performance of tampered region detection in terms of FP and FN by implementing the block-based detection approach with a variety of block size ranging from 4 × 4 to 8 × 8 pixels. Figure 1 presents the framework for this research.

Fig. 1
figure 1

Research framework

Full size image

3.1 RGB image convert to grayscale

To transform RGB image into grayscale, the image conversion technique is deployed[47]. The procedure to convert the RGB image to grayscale-indexed image is shown below.

Step 1 Converting color-indexed images

First, the color-indexed image is divided into its RGB components;

R = map (X2, 1); R = reshape (R, size (X2));

G = map (X2, 2); G = reshape (G, size (X2));

B = map (X2, 3); B = reshape (B, size (X2));

Eventually, the three color components, RGB, using the standard perceptual weightings, convert the matrices into a grayscale intensity image based on Eq. (1).

$$X_{\text{rgb }} = 0.2990\, \times \,{\text{R}} + 0.5870\, \times \,{\text{G}} + 0.1140\, \times \,{\text{B}};$$
(1)

3.2 Overlapping block

Following RGB image conversion to grayscale image, the image is partitioned into overlapping block to detect forged area by using block matching to find the duplicated or identical block.

Step 1 Assuming a n × n grayscale image I, is partitioned into overlapping blocks of m × n pixels, m = 4, 8. The neighboring blocks will only have one different column or row. Each block is indicated as \({\text{B}}_{ij}\), where i and j signifies the beginning point of the block’s row and column, respectively, [Eq. (2)]. Figure 2 shows the 4 × 4 overlapping block with different color block.

$${\text{B}}_{ij} \left( {x,y} \right) = f\left( {x + j,\quad y + i} \right)$$
(2)

where \(x,y \in \left\{ { 0, \ldots , {\text{B}} - 1} \right\},\quad i \in \left\{ {1, \ldots , {\text{M}} - {\text{B}} + 1} \right\}, \quad {\text{and}}\quad j \in \left\{ { 1, \ldots , {\text{N}} - {\text{B}} + 1} \right\}\)

Fig. 2
figure 2

Image M × N is divided into B × B overlapped blocks

Full size image

Hence, obtain \({\text{N}}_{\text{blocks}}\) of overlapped sub-blocks from suspicious image using Eq. (3).

$${\text{N}}_{\text{blocks}} = \left( {{\text{M}} - {\text{B}} + 1} \right)\, \times \,\left( {{\text{N}} - {\text{B}} + 1} \right)$$
(3)

Step 2 Let \({\text{N}}_{\text{blocks}} = \left( {{\text{M}} - {\text{B}} + 1} \right) \times \left( {{\text{N}} - {\text{B}} + 1} \right)\), DCT is applied for each block \({\text{B}}_{i} \left( {i = 1,2,3, \ldots ,{\text{N}}_{\text{blocks}} } \right)\). Then, exploit a DCT coefficients framework with an indistinguishable size from the block, which the comparing block could be represented [47]. Applied common quantization mask with same size as the DCT coefficients matrix and rounding to integers result as feature vector for each block.

3.3 Rearrange the coefficient

The feature vector is rearranged into row vector using zig-zag scanning. Zig-zag scanning converts 2D matrix into a 1D array (row vectors). Figure 3 represents the direction of the way of zig-zag scanning arrangement.

Fig. 3
figure 3

Zig-zag scanning converting 2D matrix into 1D array

Full size image

3.4 Lexicographically sorting

The A is then sorted using lexicographically sorting and left corner's facilitates every block that is indicated by a circle block is recorded. The sorted set could be characterized as  \(\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{A}\) since each element of A is a vector. In lexicographic sorting, a matrix of feature vectors is developed and each feature vector appears as a row in the matrix. This matrix is further sorted in row-wise fashion and similar features in sequential rows are appeared. Figure 4 shows the feature vector in row before and after sorting.

Fig. 4
figure 4

a Exhibits feature vector in row before sorting and b exhibits feature vector in row after lexicographically sort

Full size image

3.5 Block matching

The block using quantized DCT coefficients is represented in robust match method. In calculating DCT coefficients, quantization process is involved decided by a user-specified parameter Q. Higher the values of Q factor means finer quantization so Q factor plays vital role in quantization steps for DCT transform coefficients. The blocks should match intently to recognize as comparable. However, more matching blocks are produced for the lower values of the Q factor and it will lead to false matches. Consequently, it may affect the accuracy of the final result. Based on \(\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{A}\) after the lexicographically sorting, calculated the Euclidean distance m_match \(\left( {\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{A}_{i} ,\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{A}_{i + j} } \right)\) between adjacent pairs of \(\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{A}\). Initialize a black map \(P\) with the size \({\text{M }} \times {\text{N}}\) and consider the looked blocks as a couple of possibility for the forgery,if the separation is littler than a preset limit \({\text{D}}_{\text{similar}}\).

$${\text{m}}\_{\text{match}}\left( {\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{A}_{i} ,\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{A}_{i + j} } \right) = \sqrt {\mathop \sum \limits_{k = 1}^{4} \left( {v_{i}^{k} - v_{i + j}^{k} } \right)^{2} } < {\text{D}}_{\text{similar}}$$
(4)

Moreover, due to the neighboring squares might have the comparative component vector, the real distance between two comparable pieces calculated using Eq. (5).

$${\text{m}}\_{\text{distance}}\left( {\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{A}_{i} ,\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{A}_{i + j} } \right) = \sqrt {\left( {x_{i} - x_{i + j} } \right)^{2} + \left( {y_{i} - y_{i + j} } \right)^{2} } {\text{N}}_{\text{d}}$$
(5)

as (x,y) is the circle center of the corresponding block, m_match and m_distance is used to determine the duplicated blocks.

In short, set two thresholds to make the detection: likeness threshold \({\text{D}}_{\text{similar}}\) and distance threshold \({\text{N}}_{\text{d}}\) where the amounts of neighboring feature vectors are controlled, only if the test satisfies the following condition [Eq. (6)].

$${\text{m}}\_{\text{match }}(V_{i} , V_{j} ) < {\text{D}}_{\text{similar}} \quad {\text{and}}\quad {\text{m}}\_{\text{distance}}(V_{i} , V_{j} ) > {\text{N}}_{\text{d}}$$
(6)

where \(j \in \left[ { i - {\text{N}}_{\text{number }} } \right]\), for the actual block, denotes a shading map and another guide for the copied block.

3.6 Forgery decision

Since most of the natural images would have many similar blocks, the method of block matching is insufficient to make the forgery decision. In the case, that there are more than a specific number of blocks that are linked to each other within a same distance, the forgery decision could be determined. Meanwhile, the distance between the two blocks those have the similar feature vectors, \(\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{A}_{i}\) and \(\overset{\lower0.5em\hbox{$\smash{\scriptscriptstyle\frown}$}}{A}_{j}\).

Let \(\left( {i_{1} , i_{2} } \right)\) and \(\left( {j_{1} , j_{2} } \right)\) represents matching blocks location. In next step, we calculate shift vector between two blocks to be compared. Refer to Eq. (7).

$$s = \left( {s_{1} , s_{2} } \right) = \left( {i_{{1 - j_{1} }} , i_{2} - j_{2} } \right)$$
(7)

Due to the shift vectors −s and s correspond to the same shift, if necessary, normalize the shift vectors s by multiplying by −1 so that s1 ≥ 0. Increase the standardized move vector counter C by one for each coordinating pair of blocks using Eq. (8).

$$C\left( {s_{1} , s_{2} } \right) = C\left( {s_{1} , s_{2} } \right) + 1$$
(8)

At the beginning, initialize the values of C to zero. At least one of the values of \(C\left( {s_{1} , s_{2} } \right)\) should be more than a threshold value, if there are many blocks which give the similar feature values within the same separation. In the event that these blocks are associated with each other, then the forgery decision can be made.

3.7 Performance measurement

The performance measurement only focuses on the accuracy of the evaluation, which was described as following.

3.7.1 Accuracy evaluation

Appropriate measures are required in order to gauge the performance of the method in a copy-move forgery. The accuracy in the performance of the implemented method with various block sizes in detecting the forged region is being considered in this research.

The accuracy in the performance of the implemented method is evaluated regarding exactness and review as shown in Fig. 5. Precision signifies the probability correct forgery of the detected blocks as forgery, whereas recall determines the probability of forged blocks in the image that are detected. True positive (TP) represents the number of appropriately detected forged areas, false positive (FP) represents the number of regions that have been wrongly distinguished as produced, and false negative (FN) represents the falsely missed forged areas based on Eqs. (9) and (10).

$${\text{Precision}} = {\text{TP}}/\left( {{\text{TP}} + {\text{FP}}} \right)$$
(9)
$${\text{Recall}} = {\text{TP}}/\left( {{\text{TP}} + {\text{FN}}} \right)$$
(10)
Fig. 5
figure 5

a Forged image, b forged region, c detected region and d \(\left( {{\text{Forged Region }} \cap {\text{Detected Region}}} \right)\)

Full size image

It could be conclude that low FP rates lead to high precision values, whereas low FN rates will result in high recall values based on the equation to predict the precision and recall equation. As shown in Fig. 5, there is a difference between forged area and detected region when calculating accuracy performance.

The precision in percentage term is computed as below [Eqs. (11 and 12)] [48].

$${\text{Precision}} = \left( {\left( {{\text{Forged}}\,{\text{Region}} \cap {\text{Detected}}\,{\text{Region}}} \right) } \right)/\left( {\text{Detected Region}} \right) \, \times \,100$$
(11)

In contrast, recall in percentage is computed as below [48]:

$${\text{Recall}} = \left( {\left( {{\text{Forged Region }} \cap {\text{Detected Region}}} \right)} \right)/\left( {\text{Forged Region}} \right) \times 100\,\%$$
(12)

4 Implementation

In this section, experimental result of the proposed approach has been exhibited to verify its performance. The implemented method is evaluated by utilizing the images from the CoMoFoD dataset. The algorithm has been implemented using MATLAB and C++.

4.1 CoMoFoD dataset

CoMoFoD is a standard dataset for benchmarking the detection of image tampering artifacts [49]. This dataset comprises of 200 images: 100 original images and 100 tampered images. The standard image size has been set as 512 × 512. In this research, 10 images will be chosen as experimental images. Each of the images will implement the block-based copy-move image forgery detection approaches using DCT coefficients with 4 × 4 and 8 × 8 pixel block sizes. Figure 6 shows the sample of datasets used as input images.

Fig. 6
figure 6

Input images used in this experiment

Full size image

4.2 Experimental results

This research implemented the block-based copy-move image forgery detection approach using DCT coefficients with 4 × 4 and 8 × 8 overlying block and evaluated performance of forgery detection in terms of precision and recall.

Figure 7a–c presents the forgery detection for 4 × 4 and 8 × 8 overlying block. Detected forged area is displayed in white color block. Threshold Dsimilar and distance threshold Nd where the amounts of neighboring feature vectors are control. Threshold Dsimilar = 0.1 and distance threshold Nd = 100 are used to examine the effect of different block size on performance of the forgery detection in terms of precision and recall. Obviously, the forgery detection for 8 × 8 overlapping block is more accurate as compared to the 4 × 4 overlapping block. 4 × 4 overlapping block increased the number of areas that have been erroneously detected as forged (FP-False Positive). Therefore, the number of false positive value influenced the precision of the forgery detection.

Fig. 7
figure 7figure 7

a Forgery detection for 4 × 4 and 8 × 8 overlapping block. b Forgery detection for 4 × 4 and 8 × 8 overlapping block. c Forgery detection for 4 × 4 and 8 × 8 overlapping block

Full size image

4.3 Accuracy performance

The detection accuracy performance of the implemented method is evaluated in terms of precision (FP) and recall (FN) for the 10 selected images from CoMoFoD standard datasets. Each of the input images are evaluated on the effects of different overlapping block size 4 × 4 and 8 × 8 pixel on the accuracy performance for the forgery detection in terms of recall and precision.

Table 1 revealed the accuracy precision-recall performance of different overlapping block size in percentage. In general, performance for 4 × 4 overlapping block is low in precision but high in recall. It indicates that using 4 × 4 overlapping block size will result in a higher number of false positive value. Consequently, it decreases the accuracy performance of precision for the forged detection. For 8 × 8 overlapping block, as compared to 4 × 4 overlapping block, it obviously had perform well in accuracy performance in terms of precision and recall.

Table 1 Accuracy precision-recall performance of different block size in percentage (%)
Full size table

Implementation method block-based forgery detection using discrete cosine transform (DCT) with different overlapping block size will influence the accuracy performance in terms of precision and recall.

From the research result and accuracy performance result, 8 × 8 overlapping block achieve good accuracy performance as compared to 4 × 4 overlapping block. 4 × 4 overlapping block has successfully detect the forged area accurately. However, a large number of areas have been erroneously detected as forged influence the accuracy performance in terms of precision. Small overlapping block size increased the number of similarity between block, thus increased the number of false positive in forgery detection. For 8 × 8 overlapping block, it had a lesser number of false positive as compared to 4 × 4 overlapping block. Therefore, it can perform more accurately for forged area detection in terms of precision. For the area of the forgery detection influenced the accuracy performance in terms of precision and recall as well. For the small area of forgery detection, 4 × 4 overlapping block can achieve higher performance in terms of recall. Small overlapping block detects smaller area of forgery detection accurately; it decreased the number of false negative which is falsely missed forged areas. However, performance in recall for 8 × 8 overlapping block is lower than 4 × 4 overlapping block in a smaller area forgery detection.

Threshold \({\text{D}}_{\text{similar}}\) = 0.1 and distance threshold \({\text{N}}_{\text{d}}\) = 100 are used to implement in the 10 input images. However, the size of the forged area and the distance between two forged areas will influence the accuracy performance. The accuracy performance of the forged image will be influenced by the changes of threshold value. The value of the threshold value can change according to each forged image in order to get most accuracy performance.

Overall, 8 × 8 overlapping block achieve good accuracy performance in terms of precision and recall as compared to 4 × 4 overlapping block. Even though 4 × 4 overlapping block is able to decrease the number of false negative to perform better in recall for small area of forgery detection portion, 8 × 8 overlapping block can also achieve good accuracy performance in both precision and recall.

5 Conclusion

Digital images are the primary source of information in today’s digital era. With the accessibility of various powerful image editing software such as Photoshop, it is simple to influence digital images with no observable signs of exploitation.

Hence, it is almost impossible for one to detect any temperance of an image through naked eyes. Authenticity of image is highly significant in several fields like journalism, criminal, medical and others.

This research is meant to study about the effects of different block size ranging from 4 × 4 and 8 × 8 pixels on the performance in terms of FP and FN. The objectives of the study is to implement the block-based copy-move image forgery detection approach using DCT coefficients with various block size in order to investigate the effect of block size on FP and FN. In general, three objectives are carried out in this study based on the implementation method which is using DCT coefficients with different block size, in order to achieve the accuracy to detect the tampered region. As a result, 4 × 4 overlapping block size had high false positive thus decreased the accurately performance of forged detection in terms of precision. However, as compared to 4 × 4 overlapping block, 8 × 8 overlapping block outperformed for forged detection in terms of precision and recall. In a nutshell, the result of the accuracy performance of different overlapping block size are influenced by the different size of forged area, distance between two forged areas and threshold value are used for the research.