Non-intrusive Forensic Detection Method Using DSWT with Reduced Feature Set for Copy-Move Image Tampering

Abstract

The key intention of non-intrusive image forensic detection is to resolve whether an image is original or tampered. In contrast to intrusive methods, there is no supporting pattern that has been embedded into an image to ensure image authenticity. The only accessible cue is the original characteristics of an image. Various non-intrusive techniques have been proposed to ensure image authenticity but no adequate solution exists so far. This article introduced a robust technique by means of Discrete Stationary Wavelet Transform along with Multi Dimension Scaling to detect familiar category of copy-move image tampering. Experimental outcomes shows that proposed technique decreases computational complexity by reducing feature dimension and locate the tampered region more accurately even when the tampered image is blurred, brightness altered, colour reduced and pasted in multiple locations. Overall tamper detection accuracy is greater than 97% and false positive rate close to zero, which indicates that proposed technique will discover tampered region more precisely compared with existing methods.

1 Introduction

Digital image tampering is not a difficult task owing to the rapid growth of dominant image manipulation software’s and practices. It does not require any professional skills or training hence, an average user can perform it without leaving any visual cues. Images are manipulated for various reasons and some manipulations are performed with precise intention to deceiving a court, public or forgery. Other manipulations are performed without any explicit intension such as entertainment or marketing products [1, 2]. There exists different ways to counterfeit the content of an image. Copy-move, image compositing and retouching are most common techniques of forgery [3]. Image splicing employs assortment, renovation and merging of image area’s for structuring spliced image. Unlike image splicing, image retouching is not as much of impairment. Instead of altering the content of an image, retouching can increase or decrease certain features in the image. This technique is most popular with magazine picture editors to project their wrapper images [4]. Copy-move is familiar image tampering technique where specific region in the image is copied as well as inserted at different area of an image as shown in Fig. 1 [5].

Fig. 1

Illustration of copy-move tampering. a, c Authentic images, b tampered image with duplicated region, d tampered image which conceal one object

It is essential to ensure the genuineness of image content when it is used as evidence. Developing an automatic tamper detection algorithm to ensure trustworthiness of an image is most prominent research area in image processing [6]. Many techniques have been proposed to authenticate image content that are categorized into two types such as intrusive and non-intrusive techniques. In intrusive technique, digital watermark or digital signature is implanted for ensuring integrity of an image [7]. The user specified algorithms are used in non-intrusive techniques for source identification and tamper detection. Source identification is a process of identifying imaging devices such as digital camera, digital scanner, mobile phone or medical imaging devices. Imaging devices can be identified in the presence of lens radial distortion, sensor noise, pixel defects and color filter array (CFA) interpolation.

Tamper detection is achieved by checking inconsistencies in camera characteristics, physical environment and image manipulation. Non-intrusive Image forensics detection is comparatively a new research direction in forensic domain. The proposed algorithm is introduced to discover tampered image region with high accuracy and low false positive rate even the tampered region is distorted. The potential application of image tamper detection has higher influence in different domains such as forensic investigation, law enforcement, scientific journals and insurance claim processing [8].

2 Copy-Move Tamper Detection Methods-A View

Numerous non-intrusive forensic methods for copy-move tamper discovery are proposed during last decade. These techniques were separated with block oriented and key point oriented techniques [9, 10]. In block oriented methods, suspected image is alienated with overlapping and non-overlapping sub-blocks and feature vectors were retrieved to match its nearest neighbor. However, key point based methods identify key points with high entropy image regions as well as matching key point features to locate tampered region. It outperforms block based method when the tampered region is affected by geometric or illumination distortion. Fridrich et al. introduced familiar technique through Discrete Cosine Transform (DCT) coefficients for fixed size image blocks. This method was efficiently discovers copy-move tampered region even it is enhanced or retouched however, the algorithm did not carry out any other robustness test and dimension of feature vectors leads higher computational complexity [11].

Popescu et al. make use of Principle Component Analysis coefficients to obtain condensed dimension depiction of image blocks. Accuracy of this technique is high compared with previous methods however, the method is inappropriate to the images with stumpy JPEG qualities and small image blocks [12]. Mehdi et al. introduced a technique by means of Discrete Wavelet Transform (DWT) and DCT Quantization Coefficients for recognizing tampered region of an image. This approach reduced the feature dimension as 16 to improve computational speed but it fails to detect tampered region with some geometric transformations [13]. Zhao et al. presented a technique with respect to DCT and Singular Value Decomposition (SVD) to represent image segments. This technique diminish the computational complexity by reducing feature dimension and successfully detects multiple copy-move regions even though it was contaminated by Additive White Gaussian Noise (AWGN), JPEG compression along with its mixture operation. Accuracy was degraded while Signal to Noise Ratio is more than 45 db and JPEG quality factor is below 70% [14]. Bravo et al. used log polar transformation by mapping the Cartesian space coordinates into radius(r) and angle θ (theta) relative to the origin of coordinate system. This procedure enormously reduces the size of feature vector used in block matching phase and suitable to detect tampered region with rotation and scaling however, it is not appropriate for tampered image with additive noise, blurring and JPEG compression [15].

Cao et al. developed a circle block method. In which every DCT coefficient square blocks are transformed into a circle block to reduce feature dimensionality. Feature descriptors were lexicographically arranged and matched with threshold value. This technique is efficient to perceive multiple copy-move regions as well as the copy-move region with blurring and noise distortion but it is not appropriate to detect copy-move tampering with some basic geometric operations [16]. Cheng et al. employed a robust technique to detect copy-moved and in-painted tampered images. Suspected image regions are discovered by comparing similarity between blocks and tampered regions are located with multi-region relation model. Weight transformation based searching algorithm was deployed to enhance the computation speed. This approach fails in situation where the tampered region is too small and distressed by blurring [17]. Leida et al. projected an efficient scheme in the direction of perceiving a tampered area which is rotated or scaled. Suspected image was separated to circular blocks as well as feature descriptors were retrieved by polar harmonic transform. Feature matching is performed by lexicographical sorting and tampered regions are marked by identifying similar circular blocks [18].

Li et al. presented a technique by means of DWT and SVD to distinguish tampered image with original. This process decreases computational complexity but not succeeded to detect the tampered region which is blurred or flipped [19]. Yang et al. implements an efficient method through Discrete Wavelet Transform and Fast Walsh-Hadamard Transform. Tamper detection time is successfully reduced compared with other methods but it is not efficient to detect the tamper region which is distressed with some geometric transformation attacks [20]. Lee et al. deployed a method based on Histogram Oriented Gabor Magnitude (HOGM) to discover and localize the copy-move tampering. Noise detector method is developed with the intension of reducing false matches. Euclidean distance is employed to match tampered region. This technique is robust against various image deformation operations like rotation, resizing, JPEG compression, blurring and brightness change [21].

3 Role of DSWT and MDS in Tamper Detection

Wavelet transformation is employed to view or process the image at multiple resolution through which different frequencies are examined with different resolutions. In contrast to Fourier transform that reveals only frequency characteristics, wavelet transform reveals both frequency and spatial characteristics of an image. It decompose an image into approximate and detail sub bands.

3.1 Discrete Stationary Wavelet Transform (DSWT)

Most of the existing method uses DWT in support of copy-move tamper discovery. However, DWT is non shift invariant descriptor since it entailed down sampling and produce blurring along with noise in the edge regions. To overcome the above drawback DSWT is proposed which is shift and time invariant in nature. For example, while performing copy–move tampering the tampered regions may possibly situated at different locations in two blocks (refer Fig. 2), the non-shift invariant descriptor produce two different representations and fails to notice tampered region. Conversely, shift invariant descriptors like DSWT treated these blocks are similar. DSWT have identical number of coefficients at every levels and suitable for edge recognition, de-noising and pattern recognition. The approximate and detailed coefficients of DSWT at a particular level j for an R × C input image can be obtained using the formula,

$${\text{A}}_{\text{j}} \left[ {\text{R, C}} \right]{ = }\left( {{\text{lf}}^{\text{j}} {\text{lf}}^{\text{j}} *{\text{a}}_{\text{j}} } \right)\left[ {\text{R,C}} \right]$$

(1)

$${\text{H}}_{\text{j}} \left[ {\text{R, C}} \right]{ = }\left( {{\text{lf}}^{\text{j}} {\text{hf}}^{\text{j}} *{\text{a}}_{\text{j}} } \right)\left[ {\text{R,C}} \right]$$

(2)

$${\text{V}}_{\text{j}} \left[ {\text{R, C}} \right] = \left( {{\text{hf}}^{\text{j}} {\text{lf}}^{\text{j}} *{\text{a}}_{\text{j}} } \right)\left[ {\text{R, C}} \right]$$

(3)

$${\text{D}}_{\text{j}} \left[ {\text{R, C}} \right] = \left( {{\text{hf}}^{\text{j}} {\text{hf}}^{\text{j}} *{\text{a}}_{\text{j}} } \right)\left[ {\text{R,C}} \right]$$

(4)

where A, H, V, D are the approximate, horizontal, vertical and diagonal coefficients respectively and hf, lf represents high and low pass filters. Size of the 2D image is represented as R × C [22]. Figure 3 illustrates how DSWT is applied to 2D image.

Fig. 2

Example for shifting in copy-move forgery

Fig. 3

DSWT decomposition of 2D image at level one

3.2 Multi Dimensional Scaling (MDS)

MDS provides visual representation of similarities or dissimilarities among the set of data items. It is a classical approach to perform dimensionality reduction by transforming higher dimensional data into lower dimensional representation by retaining distance between data points. For example given m data items in a q-dimensional space, MDS generates k-dimensional representations of the data items such that k ≤ q. It provides analytical solution without requiring any iterative procedure. Euclidean distance is used to measure similarities or dissimilarities among the data items. If the distance is small then the data items are similar otherwise dissimilar. MDS is widely used to discover hidden structure, data visualization in fMRI analysis and molecular modelling. For a given input matrix, the proximities between every pair of data items P = [d_pq] is computed using the formula,

$${\text{d}}_{\text{pq}} { = }\sqrt {\left( {{\text{x}}_{\text{p}} - {\text{ x}}_{\text{q}} } \right)^{ 2} { + }\left( {{\text{y}}_{\text{p}} - {\text{ y}}_{\text{q}} } \right)^{ 2} }$$

(5)

where $\text{d}_{{\text{pq}}}$ represent distance among pth and qth data item. The coordinate matrix C can be derived by Eigen value decomposition with the following procedure.

Algorithm:

Step 1 Set up the squared proximity matrix $\text{p}^{\text{2}} \text{ = d}_{{\text{pq}}}^{\text{2}}$

Step 2 Scalar product matrix S can be constructed from the proximity matrix P using the formula,

$$S = - \frac{1}{2}QP^{2} Q$$

(6)

Matrix $Q$ is calculated with double centring method, $Q = \text{I} - \text{nd}^{ - 1} {\tilde{I}}$, where $\text{I}$ is a unit matrix, ${\tilde{I}}$ indicate matrix of ones and nd represents number of data items.

Step 3 Extract m largest Eigen values $\text{e}_{{_{\text{1}} }} \ldots \text{e}_{\text{m}}$ of S and the corresponding Eigen vectors $\text{V}_{{_{1} }} \ldots V_{m}$

Step 4 The m dimensional organization of n items are obtained from the coordinate matrix

$$\text{C} = \text{V}_{\text{m}} \text{D}_{\text{m}}^{{\text{1/2}}}$$

(7)

where $\text{V}_{\text{m}}$ is a matrix with m Eigen vectors moreover, $D_{m}^{{}}$ illustrate diagonal matrix with m Eigen values of S. Degree of correspondence between data items implied by MDS map and input matrix is expressed by two metrics such as stress function and Sammon cost function. Stress function is represented as

$$\text{f(y) = }\sum\limits_{{\text{i,j}}} \text{(} \text{||h}_{\text{i}} - \text{h}_{\text{j}} \text{||} - \text{||l}_{\text{i}} - \text{l}_{\text{j}} \text{||)}^{\text{2}}$$

(8)

where the value of $\text{f(y)}$ shows degree of correspondence among low and high-dimensional representation of data, $\text{||h}_{\text{i}} - \text{h}_{\text{j}} \text{||}$ indicates Euclidean distance among high dimensional data points h _i and h _j . Euclidean distance among low dimensional data points $\text{l}_{\text{i}}$ and $\text{l}_{\text{j}}$ is $\text{||l}_{\text{i}} - \text{l}_{\text{j}} \text{||}$. Sammon cost function is varying from stress function where it put more importance to hold the distances that were originally small. It is calculated using the formula,

$$\uprho({\text{Y}}) = \frac{1}{{\sum\limits_{{{\text{i}},{\text{j}}}} {\left\| {{\text{h}}_{\text{i}} - {\text{h}}_{\text{j}} } \right\|} }}\sum\limits_{{{\text{i}}^{1} {\text{j}}}} {\frac{{\left( {\left\| {{\text{h}}_{\text{i}} - {\text{h}}_{\text{j}} } \right\| - \left\| { 1_{\text{i}} - 1_{\text{j}} } \right\|} \right)}}{{\left\| {{\text{h}}_{\text{i}} - {\text{h}}_{\text{j}} } \right\|}}^{2} }$$

(9)

where $\rho (\text{y})$ holds minimum distance data points [23].

4 Proposed Tamper Detection Approach

The proposed method employs Discrete Stationary Wavelet Transform (DSWT) to segregate suspected image at various frequency bands such as LL, LH, HL and HH at level one. Out of four different bands LL is better for tamper detection since it contains all approximate coefficients of input image. Multi Dimensional scaling (MDS) is deployed for diminishing dimension of feature descriptors. Similarities between the blocks are identified with lexicographical sorting, finally tampered region is located.

4.1 Proposed Approach

The proposed non-intrusive forensic discovery procedure is exposed in Fig. 4. Entire algorithm structure involves six steps: (1) Converting color image into intensity image (2) Applying DSWT to preprocessed image (3) Extract LL sub-band and divide it into overlapping blocks (4) Applying multi dimensional scaling to decrease feature dimension (5) Match features vectors using lexicographical sorting and (6) Localize the tampered region.

Fig. 4

The proposed framework

Algorithm

Step 1 Input color image is preprocessed by the equation,

$${\text{LC }} = \, 0.299 \, R + 0.587 \, G + 0.114 \, B$$

(10)

In the above equation $R$,$G$ and $B$ indicates three color components and $LC$ is the luminance component of input image.

Step 2 Discrete Stationary Wavelet Transform (DSWT) is applied to preprocessed input image at level one.

Step 3 The approximate coefficients (LL) of DSWT has been extracted, since it contains most of the image information than the detailed coefficients (LH, HL, and HH). Comparing every pixel with all other pixels leads higher computational complexity thus the suspected image is separated with overlapping blocks of stipulated size BS × BS. For a given input image of size R × C, total blocks should be (R − BS + 1) (C − BS + 1). Where R and C indicate number of rows and columns respectively and BS represents block size.

Step 4 To reduce the feature dimension, MDS is applied to each overlapping block of size 8 × 8.

Step 5 Reduced feature vectors are stored in a two dimensional matrix CA of (R − BS + 1) (C − BS + 1) rows with 8 columns, subsequently the algorithm stores position of two rows if they are identical and shift vector S is calculated using the formula,

$$S = \, ||i_{1} - \, j_{1} , \, i_{2} - j_{2} ||$$

(11)

where $i_{1}$,$i_{2}$ and $j_{1}$, $j_{2}$ indicates the positions of identical rows. To remove false matches the proposed algorithm employs threshold value. When the shift vector occurrence exceeds the threshold value then only the blocks are considered as tampered.

5 Experimental Results

5.1 Data Set

Tamper detection performance of proposed technique is assessed with two different publically available data sets designed for unrestricted research usage. First dataset includes 24 true uncompressed color images with 768 × 512 pixels launched by Kodak Corporation [24]. Moreover the second one is CoMoFoD data set which consists of 200 color images with dimension 512 × 512 introduced by video communication laboratory [25].

5.2 Performance Evaluation

Performance of proposed technique is assessed by means of two evaluation criteria such as Accuracy Rate (AR) and False Positive Rate (FPR) which is determined using the formula,

$$AR = \frac{TP + TN}{TP + TN + FN + FP}$$

(12)

In the above equation, TP indicates true positive which designates amount of tampered pixels that are accurately categorized as tampered. The amount of genuine pixels that are rightly classified as such is measured by true negative (TN). Metric FP refers false positive which measures fraction of genuine pixels that are categorized with tampered. FN specifies false negative which indicates amount of tampered pixels that is categorized as original. AR value indicates how accurate the proposed algorithm locates pixels of copy-move tampered region. False positive rate is calculated with the formula,

$$FPR = \frac{FP}{FP + TN}$$

(13)

where FPR indicates the amount of pixels that are not included in tampered area however; it is erroneously incorporated with proposed technique. If the value of AR and FPR is closer to 1 and 0 respectively then the detection method has high accuracy.

5.3 Efficiency and Accuracy Test

To exhibit efficiency and accuracy of proposed scheme 24 color images of size 768 × 512 were selected from the first data set and 40 source images of size 512 × 512 were selected from the second data set. Test images used in this experiment does not require any post processing operations. Due to space constraint, simply a few experimental outcomes were shown here. Proposed technique effectively identify the simple and multiple non-regular copy-move tampered areas even the tampered region is too small. Figure 5 illustrate the detection result of non-regular copy-move tampering. Detection outcome of multiple region tampering is exposed at Fig. 6.

Fig. 5

a Authentic image, b manipulated image, c discovered outcome, AR/FPR rates are 0.9845/0.0126

Fig. 6

a Authentic image, b manipulated image, c discovered outcome, AR/FPR rates are 0.9897/0.007

Detection result reveals that the proposed technique successfully detects tampered image even it has multiple copy-move regions. The statistical detection rate of proposed method is evaluated under two different data sets. Experimental results shows that Accuracy Rate (AR) is greater than 0.9 and false positive rates (FPR) are near to 0. This shows that the proposed scheme more precisely locating tampered region.

5.4 Robustness Test

5.4.1 Robustness Against Blurring

Numerous alterations are made with tampered images, blurring is frequently applied technique towards to cover traces of tampering. In this section robustness of proposed algorithm is evaluated under different blurring conditions. CoMoFoD database is employed for this purpose which contains 120 tampered images (Image No. 001_F_IB1 to 040_F_IB3) blurred through three dissimilar averaging filters (3 × 3, 5 × 5 and 7 × 7). Figure 7 shows the tampered image blurred with 5 × 5 averaging filter and its discovered outcome. Table 1 demonstrates the empirical outcome of 120 forged images with three different averaging filters. Proposed algorithm attains high accuracy and low false positive rate when tampered images are blurred with 3 × 3 and 5 × 5 averaging filter. However, detection performance fall under 7 × 7 averaging filter.

Fig. 7

a Authentic image, b tampered image blurred by 5 × 5 averaging filter, c detection result

Table 1 Detection performance against forged images deformed with Gaussian blurring

5.4.2 Robustness Against Brightness Change

Tampered images are distorted with brightness change by mapping the intensity values of forged image in the interval [0 1]. Intensity values below and above this intervals are saturated to minimum and maximum values, as a result three different ranges of brightness such as (0.01, 0.95) (0.01, 0.9) and (0.01, 0.8) were created. Kodak image data set does not include tampered image distorted by brightness change or color reduction hence, CoMoFoD database is employed in this purpose. Figure 8 shows tampered image with brightness altered in the range (0.01, 0.9) and corresponding detection result.

Fig. 8

a Authentic image, b tampered image with brightness altered range (0.01, 0.9), c discovered outcome

Average detection performance of 120 tampered images (Image:001_F_BC1 to 040_F_BC3 in the CoMoFoD database)with various ranges of brightness altered is listed in Table 2. AR and FPR values indicates that the proposed method exhibit excellent robustness against tampered image with different ranges of brightness change.

Table 2 Detection performance against forged images distorted by brightness change

5.4.3 Robustness Against Colour Reduction

In addition to handling blurring and brightness change proposed method is also capable of handling forged images which are deformed with colour changes. Colour diminishing is performed by consistent quantization of image pixel values [27]. In every colour channels of tampered image pixel values are diminished from the level 256–32, 64 or 128. Figure 9 is an example for forged image by colour reduced at level 64 as well as its equivalent discovered outcome.

Fig. 9

a Authentic image, b forged image with colour depth diminished to level 64, c detection result

In the direction of estimating performance of proposed technique CoMoFoD database is employed. This include 120 tampered images (Image: 001_F_CR1 to 040_F_CR3) which were distorted by color reduction at three different levels. Table 3 exposed that the proposed technique achieved high accuracy rate (AR) and low false positive rate (FPR) even the tampered images are distorted by different color reduction levels.

Table 3 Detection performance against tampered images distorted by color reduction

5.5 Comparisons with Existing Methods

5.5.1 Computational Complexity

The computational complexity is a significant problem to any non-intrusive tamper detection algorithm. It is examined against state of art approaches by means of feature dimension. The suspected image is alienated with overlapping blocks with size 8 × 8 to extract DSWT feature descriptor and MDS is applied to every block to reduce its feature dimension. Every block coefficients are accumulated in a single row of two dimensional matrix CA. Number of rows in the matrix represent total blocks and number of columns specifies feature dimension. Before applying dimensionality reduction method, 64 features have used to represent each block. After applying dimensionality reduction method, 8 features have been used to represent each block. Table 4 illustrates the comparison result of feature dimension.

Table 4 Feature dimension comparison with existing algorithms

5.5.2 Detection Performance

Detection outcome of proposed technique is examined among existing methods by means of Accuracy Rate (AR) and False Positive Rate (FPR). Data set images used by Zhao et al. [14] and Lee et al. [21] were utilized to assess detection performance. Images in Fig. 10 used by Zhao et al. are tested by proposed technique and discovered outcomes are displayed. Similarly images in Fig. 11 used by Lee et al. are tested and discovered outcomes are displayed.

Fig. 10

a, d Authentic images, b, e forged images, c, f detection result of proposed method

Fig. 11

a, d Authentic images, b, e forged images, c, f detection result of proposed method

Performance of proposed technique is evaluated with Zhao et al. [14] and Lee et al. [21] methods and resultant values are given in Table 5. It illustrate that Accuracy Rate (AR) of proposed technique is above 0.95 and False Positive Rates (FPR) are close to 0. This indicates that the proposed technique discover tampered region exactly even though the tampered regions are too small and non- regular.

Table 5 Detection result of tampered images using proposed method, Zhao et al. [14] and Lee et al. [21] methods

Figure 12 demonstrates the performance assessment curves of proposed method with existing well known techniques namely Fridrich et al. [11], Popescu et al. [12] and Lee et al. [21] under different image distortion like blurring, brightness change and color reduction. AR curve in Fig. 12a, demonstrate that the proposed technique outperforms other techniques for tampered images blurred with different averaging filters. FPR curve in Fig. 12b reveals that the proposed method provides lower FPR values even the tampered images is blurred with 7 × 7 averaging filter. Figure 12 c, d shows the comparison result of tampered images with brightness change in three different levels (0.01, 0.9) (0.01, 0.95) and (0.01, 0.8). Raising brightness level leads to increase the AR value and reduce the FPR value in all four methods. AR and FPR curves of proposed method exhibit good performance than the existing methods. Figure 12e, f displays the comparison outcome of forged images deformed with colour reduction in three different intensity levels (32, 64 or 128). Efficiency of proposed technique improves at higher intensity level changes than the lower level changes [26].

Fig. 12

AR/FPR curves acquired using different methods: a, b Blurring with different averaging filters, c, d different brightness change ranges, e, f different color reduction levels

6 Conclusion

In this article a robust non-intrusive forensic detection technique using DSWT and MDS is proposed. DSWT and MDS feature descriptors can automatically identify copy-move tampered region without the knowledge of image content. The algorithm use less features to characterize all block. Empirical outcome shows that the proposed technique not merely discover forged area which is too small and non-regular but also has strong robustness to detect multiple tampered region and tampered region distorted by blurring with different average filter, brightness and color reduction at different levels. Compared with state of art techniques, proposed technique has less computational difficulty and high accuracy. This effort makes valuable contribution in image forensic detection. Reliable method that automatically detects the tampered region with some geometric transformations can be developed in future.