Detecting Double Compressed JPEG Images by Using Moment Features of Mode Based DCT Histograms Feng ZHAO 1 2
Zhenhua YU 2 Shenghong LI 2
1.Wireless Network Laboratory Beijing University of Posts and Telecommunications Beijing 100876, China E-mail
[email protected]
2. Department of Electronic Engineering Shanghai Jiaotong University Shanghai 200030, China E-mail
[email protected]
Abstract—The double compression of JPEG images is one of the important evidences of image tampering. The paper proposes a novel passive double compressed JPEG image detection algorithm using the moment features of the modes based DCT histogram’s characteristic function. Support vector machine is used as the classifier. Experimental results demonstrate that the proposed algorithm significantly increases the detection accuracy when the first compressing quality factor is large such as 95. In order to further improve the overall detection accuracy of double compressed JPEG in various quality factors, the paper proposes an improved algorithm by combing the moment features with the Mode Based Fist Digit features (MBFDF). The experimental results show that the overall detection accuracies can be further improved and the proposed algorithm outperforms some traditional methods, especially when the first compressing quality factor is large such as 95.
most crucial step and its effectiveness greatly affects the classification performance. There are some machine learning based algorithms to detect double compressed JPEG images in the literature [1][2]. Chen et al. [1] used the Markov based transition probability matrix as the features and employed the Support Vector Machine as the classifier. The authors [1] claimed that their algorithm outperformed the prior work [3] which is not based on the machine learning scheme. Li et al. [2] analyzed three feature extraction methods, and proposed the Mode Based Fist Digit features based on the Benford's Law. Both of the above method cannot detect the double compressed JPEG image with the same two compressing quality factors, which is determined by the principle of JPEG compression procedure. Besides, both of them cannot get satisfactory results when the first compressing quality factor is relatively large such as 95 and the second compressing quality factor is relatively small.
Keywords-Double JPEG compression; characteristic function; moments; DCT histogram; support vector machine
I.
INTRODUCTION
JPEG (Joint Photographic Experts Group) is the most popular image format and is widely used on the Internet. The default storage format of most digital cameras is JPEG. Therefore, the research of the JPEG image forensics is of great importance. The double compressed JPEG image indicates that an image is originally a JPEG image and is compressed once again by JPEG. In the process of tampering an image by some image editing software, the original single compressed JPEG image is edited (e.g. splicing, copy and paste) and then recompressed to a double compressed JPEG image. Therefore, the double JPEG compression is one of the important evidences of image tampering. The detection of JPEG double compression is basically a binary classification problem, i.e. the detection aims to differentiate whether a given JPEG image is compressed once or double compressed. Therefore, the machine learning approach is an effective scheme to detect the double compressed JPEG image passively. Generally, the machine learning based detection methods include three key steps: feature extraction, classifier selection, and the images database for training the classifier. The feature extraction scheme is the
In this paper, a new feature extraction scheme is proposed to improve the detection accuracy in the case that first compressing quality factor is relatively large. Firstly, the 64 models of DCT coefficient histograms are extracted, and the first 4 order moments of the DCT histogram’s characteristic function are then calculated, which construct the feature vector. Finally, the support vector machine (SVM) is used to train and classify the single and double compressed JPEG images. We also improve our proposed approach by combining the moment features with the Mode Based Fist Digit features. The rest of this paper is organized as follows: Section Ċ presents the proposed features extraction approach and section ċ presents the improved approach. The experiment results are shown in Section Č. Conclusions are given in Section č. II.
THE PROPOSED FEATURE EXTRACTION APPOACH
In JPEG compression, the original image is first divided into non-overlapped 8 h 8 blocks. Then the two-dimensional Discrete Cosine Transform (DCT) is applied to each 8h 8 block to form the 8h8 block-DCT coefficients. We denote the block-DCT coefficient in the coordination (i, j ) of the
kth block as Dijk . All the block-DCT coefficients in the same
978-1-4244-7874-3/10/$26.00 ©2010 IEEE
(i, j ) ∈ {1, 2,...,8} × {1, 2,...,8} constitute a mode. So there are totally 64 modes. Secondly, all the block-DCT coefficients in each block are quantized by the same 8h8 quantization matrix. The 64 values in the quantization matrix are called quantization steps, which are determined by the quality factor (QF). We can see that the block-DCT coefficients in the same mode are quantized by the same quantization step. Finally, the entropy encoding transforms the quantized block-DCT coefficients in to a stream of compressed data.
K /2
Ml =
¦x
l i
H ( xi )
i =1 K /2
(1)
¦ H (x ) i
i =1
where
H ( xi ) is the CF component at frequency xi and l is
the order of the moments.
The works in [3][4][5] discussed the DQ (Double Quantization) effect of double quantized one-dimension discreet signal and double compressed JPEG images. For the double quantized one-dimension discreet signal, the histogram will show periodic artifacts if the pair of quantization steps satisfies the following two conditions: 1) the quantization steps are different; 2) the second quantization step is not the integer multiple of the first quantization step. For the double JPEG compressed images, the block-DCT coefficients in the same mode are quantized by the same pair of quantization steps. So if the pair of the quantization steps in some mode (i, j ) satisfies the above two conditions, the histogram of the block-DCT coefficients sequence in the mode (i, j ) will also show the DQ effect as the one-dimension discreet signal. The mode (i, j ) is called the distinguished mode [3]. For the double JPEG compressed image, the distinguished modes are determined by the pair of quality factors. For example, if an image is first JPEG compressed with quality factor QF1=95 and then compressed with the quality factor QF2=50, the distinguished mode can be predicted directly from the quantization matrix of the QF1=95 and QF2=50. Figure 1 shows the quantization matrixes for QF1=95 and QF2=50. It can be observed that there are 40 distinguished modes in total.
Figure 1. The quantilization matrixes for QF1=95(left) and QF2=50(right). The distinguished modes are marked with underlined boldface font.
In our approach, the characteristic function (CF) of the block-DCT coefficients sequence is adopted to analyze and model the DQ effect of the double JPEG compressed image. The periodic artifacts of the histogram in the distinguished mode basically results from the changes of the coefficients probability distribution and CF can represent the distribution very well. The histogram can be represented as the probability density function (pdf) and the characteristic function is the Fourier transform of the pdf . Based on the above idea, in the proposed approach, the statistical moments of the CFs of block-DCT coefficients sequence of all the 64 modes are employed as features for the DQ effect modeling, which are defined as follows:
Figure 2.
Feature extraction procedure
Figure 2 shows the framework of our features extraction method, which runs as follows: 1) For a given JPEG image, read the block-DCT coefficients directly from the JPEG file. 2) Calculate the block-DCT coefficients histogram for all the modes. For simplicity, we only apply this scheme to the Y component of the YUV space for JPEG image. Therefore, 64 histograms are obtained. 3) For each histogram, apply the Discrete Fourier Transform to get the corresponding CF. 4) Calculate the statistical moments of the 64 CFs with the order l = 1, 2, 3, 4 respectively according to formula (1), resulting in a set of 4h64=256 features. Thus, a 256-D feature vector is built for the given JPEG image. III.
COMBINING WITH THE MBFDF FEATURES
In order to further improve the detection accuracy of double compressed JPEG images, we combine the moments of characteristic function features in section Ċ with the Mode based First Digit Features (MBFDF) [2]. Base on the knowledge that the double compressed JPEG images do not fit the generalized Benford’s law, the MBFDF [2] algorithm utilizes the probabilities of the 9 first digits of the block-DCT coefficients from 20 AC modes in the zigzag order,
to form a feature vector of 20h9=180 dimensions. The first digit of x can be computed as:
« x » d = « «log x » » ¬10 ¬ 10 ¼ ¼
(2)
For a given JPEG image, the moments of characteristic function 256-D feature vector are first extracted according to the procedure in section Ċ. Then the MBFDF 180-D feature vector is generated by calculating the probability of first digit for 20 AC modes. Finally, we combine the above two feature vectors to form a 436-D feature vector, which will be used to train and test the classifier. IV.
the images with QF1 equal to QF2 as the work [1] [2] [3] because no distinguished mode exists in such case. In general, the performance our approach can match that of the prior work [1][2] for most of the quality factor pairs. Moreover, our approach outperforms them in the case when the first compressing quality factor QF1 equals to 95. Figure 3 shows the comparison of the detection accuracy for the QF1=95. It can be observed that compared with GFDF, AHF, MBFDF in [2] and Markov in [1], the proposed features significantly improve the detection accuracy of double JPEG compressed images with the quality factor pair 95/50, 95/55, 95/60, and 95/70. TABLE I.
EXPERIMENTS AND RESULTS
DETECTION ACCURACY OF PROPOSED APPROACH
A. Classifier Selection The support vector machine (SVM) is used as the classifier in our experiments. The SVM is a kind of supervised machine leaning method and widely used in pattern recognition applications. In our work, the quadratic polynomial kernel is used and the cross validation method is applied to determine the proper parameters for the polynomial kernel. The SVM toolbox in Matlab code [6] is adopted in our experiments. B. Training/testing strategy In our experiments, 1338 uncompressed images with the size of 348h512 from UCID [7] are used as our source images. The 1338 uncompressed images are first JPEG compressed with the quality factor ranging from 50 to 95 with a step size of 5, which forms 10 groups of single compressed JPEG images. Then these single compressed JPEG images are JPEG compressed again with the quality factor ranging from 50 to 95 with a step size of 5, which forms 100 groups of double compressed JPEG images. Similar to the experimental procedure in [1], we randomly select 5/6 of the single JPEG compressed images with quality factor QF2 and 5/6 double JPEG compressed images with quality factor QF1 followed by quality factor QF2 to train the SVM classifier. The remaining 1/6 single and double JPEG compressed images are used to test the trained classifier. C.
Results of proposed approach using 256-D features In this experiment, only the 256-D moments of characteristic function features are used. The averaged detection accuracies of 20 times of random tests are shown in Table ĉ. From the Tableĉ it can be observed that the proposed approach performs well in the upper right triangle portion of the table, where the second compressing quality factor QF2 is greater than the first compressing quality factor QF1. For some quality factor pairs near the diagonal of the table such as the 50/55, 55/50, 55/60, and 60/55, the detection accuracies are not good enough. The reason is that the second quantization steps are close to the first quantization steps in such case and for some modes, the second quantization step QS2 is equal to first quantization step QS, which makes the distinguished modes become less. It should be noted that our approach cannot detect
Figure 3. Comparison of detection accuracy for the first compressing quality factor QF1=95
D.
Results of the improved approach using 436-D features In this experiment, the 436-D feature vector, which is composed of the 256-D moments of characteristic function features and the 180-D MBFDF features, is employed. The averaged detection rate of twenty random tests is shown in table Ċ. The improved parts are highlighted in the table with underlined boldface font. The detection accuracies for 39 pairs of compressing quality factor are improved. In particular, the accuracies for the pairs of quality factor 50/55, 55/50, 55/60,
and 60/55 can reach 99% by combing the MBFDF feature vector. Compared with the current methods in [2], our improved approach can match their performance in general and even outperform them when the first quality factor is large such QF1=95. Hence, it can be concluded that the features obtained by the proposed feature extraction method is a useful addition to the MBFDF features. TABLE II.
DETECTION ACCURACY OF IMPROVED APPROACH
(MBFDF), the overall detection accuracy of double compressed JPEG in various quality factors can be further improved. The final results can match the prior works for most of the pairs of the compressing quality factor and outperform them when the first compressing quality factor is large such as 95. ACKNOWLEDGMENT The authors should say thanks for the support from National Scientific Foundation of China (NO.60772098/60772042), and National 863 plan project of China (NO.2007AA01Z455). REFERENCES [1] [2]
[3]
V.
[4] CONCLUTIONS
In this paper, a new passive double JPEG compressed images detection algorithm using the moment features of the modes based DCT histogram’s characteristic function is proposed. The moment features include all the 64 modes of block-DCT coefficients and thus cover all the distinguished modes. Compared with the prior works, our algorithm can improve the detection accuracy in the case that the first compressing quality factor is large such as 95. By combining the moment features with the Mode Based Fist Digit features
[5]
[6] [7]
C. Chen, Yun Q. Shi, W. Su, “A machine learning based scheme for double JPEG compression detection”. ICPR 2008, pp. 1-4 B. Li, Yun Q. Shi, and J. Huang, “Detecting doubly compressed JPEG images by using Mode Based First Digit Features”. MMSP 2008, pp. 730-735 A. C. Popescu, “Statistical tools for digital image forensics”, PhD thesis, Dartmouth College, Hanover, NH, USA, December 2004 (advised by H. Farid). Z. Lin, J. He, X. Tang, and C. Tang, “Fast, automatic and fine-grained tampered JPEG image detection via DCT coefficient analysis”, Pattern Recognition. 2009, 42(11), pp. 2492-2501. J. Lukas and J. Fridrich, "Estimation of primary quantization matrix in double compressed JPEG images", Digital Forensic Research Workshop, Cleveland, OH, USA, August 2003 Chang. C. C. and Lin, C. J. LIBSVM: A Library for Support Vector Machines. 2001. http://www.csie.ntu.edu.tw/cjlin/libsvm. G. Schaefer, M. Stich. “UCID - An Uncompressed Colour Image Database”. Proc. SPIE, Storage and Retrieval Methods and Applications for Multimedia, San Jose, USA. 2004, pp. 472-480.
