Revealing Traces of Image Resampling and Resampling Antiforensics

Hindawi Advances in Multimedia Volume 2017, Article ID 7130491, 13 pages https://doi.org/10.1155/2017/7130491 Research Article Revealing Traces of Image Resampling and Resampling Antiforensics Anjie Peng,1,2 Yadong Wu,1 and Xiangui Kang2 1 School of Computer Science and Technology, Southwest University of Science and Technology, Sichuan, China Guangdong Key Lab of Information Security, School of Data and Computer Science, Sun Yat-Sen University, Guangzhou, China 2 Correspondence should be addressed to Xiangui Kang; Received 19 August 2016; Revised 23 November 2016; Accepted 12 December 2016; Published 12 January 2017 Academic Editor: Mei-Ling Shyu Copyright © 2017 Anjie Peng et al. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited. Image resampling is a common manipulation in image processing. The forensics of resampling plays an important role in image tampering detection, steganography, and steganalysis. In this paper, we proposed an effective and secure detector, which can simultaneously detect resampling and its forged resampling which is attacked by antiforensic schemes. We find that the interpolation operation used in the resampling and forged resampling makes these two kinds of image show different statistical behaviors from the unaltered images, especially in the high frequency domain. To reveal the traces left by the interpolation, we first apply multidirectional high-pass filters on an image and the residual to create multidirectional differences. Then, the difference is fit into an autoregressive (AR) model. Finally, the AR coefficients and normalized histograms of the difference are extracted as the feature. We assemble the feature extracted from each difference image to construct the comprehensive feature and feed it into support vector machines (SVM) to detect resampling and forged resampling. Experiments on a large image database show that the proposed detector is effective and secure. Compared with the state-of-the-art works, the proposed detector achieved significant improvements in the detection of downsampling or resampling under JPEG compression. 1. Introduction Resampling is a useful image processing tool, such as upscaling in consumer electronics, downscaling in the online store, social networking, and picture sharing portal. However, some people intentionally utilize the resampling to create tampered images and upload these images to social networks to spread rumors. Due to the abuse in image tampering, resampling forensics attracts researchers’ attentions [1–12]. Resampling forensics can also be used to reveal the image’s processing history or help people select the secure cover for stenography; for example, Kodovský and Fridrich analyzed how the parameters of downscaling affect the security of stenography [13]. Hou et al. utilized the resampling forensics for blind steganalysis [14]. Therefore, resampling forensics is of particular interest in the multimedia security field. Early works [1–10] of resampling forensics were based on the periodical artifacts resulting from equidistant sampling and interpolating. These detectors [1–10] can provide reliable results in the uncompressed resampled images. However, their detection accuracies significantly degraded in the case of resampling with JPEG compression. Recent works [11, 12, 15] utilized pattern recognition methods to detect resampling. These works extract the features at first and then perform classification by the machine learning tools. Feng et al. [11] exploited the normalized energy density as the characteristic of image resampling. They divided the DFT frequency spectrum of the second derivative of the image into 19 windows of varying size and then extracted the normalized energy density from each window to form a 19D feature. Li et al. [12] utilized a moment feature to reveal the position and amplitude distribution of resampling in the DFT frequency domain. They first divided the DFT frequency spectrum into 20 subbands with equal interval and then extracted the moment feature from each subband to form a 20D feature. For the sake of simplicity, we called the 19D normalized energy density feature [11] and 20D moment feature [12] as FE and FM, respectively. The machine learning-based detectors [11, 12, 15] get better results than periodical artifacts-based detectors [1–10] for the upsampling with JPEG compression. However, their 2 performances on the downsampling with JPEG compression still need to be improved. Besides, the above detectors [1–12, 15] have not considered the existence of malicious adversary, a practicable challenge in real life. For instance, Kirchner and Böhme [16] proposed an antiforensic scheme by removing the periodic artifacts with irregular sampling and successfully defeated the periodicity-based approach [1–10]. In the sequel, we called the resampling antiforensics [16] as forged resampling for short. The appearance of antiforensic technology has been drawing the researchers’ attentions to the security of the forensics [17, 18]. Sencar and Memon [18] formally define the security and robustness of the forensics. They pointed out that the security concerns the ability to resist intentionally concealed illegitimate postprocessing, while the robustness concentrates on the reliability against legitimate postprocessing. In our previous work [19], we employed partial autocorrelation coefficient to reveal the artifacts caused by the forged resampling. Li et al. [15] utilized steganalytic model, SRM, [20] to detect forged resampling and obtained excellent performance. For a test image, we have no knowledge whether it has been processed by resampling or forged resampling. To avoid missing detection, an alternative approach is that sequentially testing the image by the resampling detector and forged resampling detector. Only if two detectors both predict the image is innocent is the test image taken as an innocent image. To simplify the detection procedure, we propose an integrated detector which can simultaneously detect resampling and its forged resampling. As both the resampled image and forged resampled image are generated via interpolation, we employ the histogram and coefficients of AR model on multidirectional differences to capture the interpolation traces. Experimental results indicate that the proposed integrated detector is effective and secure. The rest of this paper is organized as follows. Section 2 reviews the resampling forensics and the antiforensic scheme [16]. In Section 3, we introduce a new feature set for resampling forensics. The experiments are presented in Section 4. Section 5 concludes the paper. 2. Background In this section, we first introduce the resampling and its periodical artifacts and then review the forged resampling scheme proposed by Kirchner and Böhme [16]. 2.1. Resam (...truncated)