Determining Image Origin and Integrity Using Senso

74IEEETRANSACTIONSONINFORMATIONFORENSICSANDSECURITY,VOL.3,NO.1,MARCH2008DeterminingImageOriginandIntegrityUsingSensorNoiseMoChen,JessicaFridrich,Member,IEEE,MiroslavGoljan,andJanLukáˇsAbstract—Inthispaper,weprovideaunifiedframeworkforidentifyingthesourcedigitalcamerafromitsimagesandforrevealingdigitallyalteredimagesusingphoto-responsenonuni-formitynoise(PRNU),whichisauniquestochasticfingerprintofimagingsensors.ThePRNUisobtainedusingamaximum-like-lihoodestimatorderivedfromasimplifiedmodelofthesensoroutput.BothdigitalforensicstasksarethenachievedbydetectingthepresenceofsensorPRNUinspecificregionsoftheimageunderinvestigation.Thedetectionisformulatedasahypothesistestingproblem.Thestatisticaldistributionoftheoptimalteststatisticsisobtainedusingapredictoroftheteststatisticsonsmallimageblocks.Thepredictorenablesmoreaccurateandmeaningfulestimationofprobabilitiesoffalserejectionofacorrectcameraandmisseddetectionofatamperedregion.Wealsoincludeabenchmarkimplementationofthisframeworkanddetailedex-perimentalvalidation.Therobustnessoftheproposedforensicmethodsistestedoncommonimageprocessing,suchasJPEGcompression,gammacorrection,resizing,anddenoising.IndexTerms—Authentication,cameraidentification,digitalforensic,digitalforgery,imagingsensor,integrityverification,photo-responsenonuniformity.I.INTRODUCTIONWHILEdigitalrepresentationofrealitybringsunquestion-ableadvantages,digitalimagescanbeeasilymodifiedusingpowerfulimageeditingsoftware,whichcreatesaseriousproblemastohowmuchoftheircontentcanbetrustedwhenpresentedasasilentwitnessinacourtroom.Anotherproblemposedbydigitizationisverificationoforigin.Isitpossibletoprovethatacertainimagewastakenbyaspecificcamera?Reli-ablemethodsforestablishingtheintegrityandoriginofdigitalimagesareurgentlyneededinsituationswhenadigitalimageorvideoformsakeypieceofevidence,suchasinchildpornog-raphyandmoviepiracycases,insuranceclaims,andcasesin-volvingscientificfraud[1],[2].Thetasksofdigitalforensicscanbebroadlydividedintothefollowingsixcategories.ManuscriptreceivedMay7,2007;revisedOctober1,2007.ThisworkwassupportedbytheAFOSRunderGrantFA9550-06-1-0046.TheassociateeditorcoordinatingthereviewofthismanuscriptandapprovingitforpublicationwasProf.VijayaKumarBhagavatula.M.CheniswithJADAKTechnologies,Syracuse,NY13212USA(e-mail:[e-mail]).J.FridrichandM.GoljanarewithBinghamtonUniversity,Binghamton,NY13902-6000USA(e-mail:[e-mail];[e-mail]).J.LukáˇsiswithHoneywell,GlobalDesignCenter,AerospaceAdvancedTechnology,Brno63900,CzechRepublic(e-mail:[e-mail]).Colorversionsofoneormoreofthefiguresinthispaperareavailableonlineat)Sourceclassificationiswheretheobjectiveistoclassifyimagesaccordingtotheirorigin,suchasscansversusdig-italcameraimages,CanonversusKodak,etc.2)Deviceidentificationaimstoprovethatagivenimagewasobtainedbyaspecificdevice(provingthatacertaincameratookagivenimageorvideo).3)Devicelinkinggroupsobjectsaccordingtotheircommonsource.Forexample,givenasetofimages,wewouldliketofindoutwhichimageswereobtainedusingthesamecamera.4)Processinghistoryrecoveryiswheretheobjectiveistorecovertheprocessingchainappliedtotheimage.Here,weareinterestedinnonmaliciousprocessing(e.g.,lossycompression,filtering,resizing,contrast/brightnessadjust-ment,etc.).5)Integrityverificationorforgerydetectionisaprocedurethataimstodiscovermaliciousprocessing,examplesofwhichareobjectremovaloradding.6)Anomalyinvestigationdealswithexplaininganomaliesfoundinimagesthatmaybeaconsequenceofdigitalprocessingorotherphenomenaspecifictodigitalcameras.Inthispaper,wefocusondeviceidentificationandintegrityverification.Theproblemofimageorigin[Tasks1)–3)]hasbeenapproachedinthepastbydetectingcameraprocessingartifacts[3]–[5]andbyclassifyingimage-derivedfeatures[6].Whilethesemethodsareusefulforsourceclassification,theycannotbeusedfordeviceidentificationasthisproblemcallsforanequivalentofaunique“biometricsforcameras.”Thefirstsensorbiometricsweredefectivepixels(hotanddeadpixels)[7],[8].Recently[9],thepixelphoto-responsenonuniformity(PRNU)wasproposedassensorbiometricsandusedforreliabledeviceidentificationevenfromprocessedimages.Approachescom-biningsensornoisewithmachine-learningclassificationweredescribedin[9]–[14].Thesecondforensictaskinvestigatedinthispaperisintegrityverification,commonlyknownasforgerydetection.Recently,numerousmethodsfordetectingdigitalforgerieswereproposed[15]–[27],[38].Mostmethodsarebasedondetectinglocalinconsistencies,suchasinresamplingartifacts[19],colorfilterarray(CFA)interpolationartifacts[20],illumination[21],oropticaldefects[23].Someapproachesdetectidenticalregionsinacopy-moveforgery[25],[26].Adifferentclassofmethodsusesclassificationofimagefeatures[16]–[18],[24],[38].Eachmethodonlyworkswhenspecificassumptionsaresatisfiedandwillfailiftheassumptionsarenotmet.Obviously,digitalforgerydetectionisacomplexproblemwithnouniversallyapplicablesolution.Whatisneededisalargesetoftoolsbasedondifferentprinciplesthatcanallbeappliedtotheimageathand.Indeed,while