DETECTION OF NON-LINEAR FILTERING IN IMAGES FOR

FORENSIC APPLICATIONS

PROJECT REPORT
SUBMITTED IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE AWARD
OF THE DEGREE OF

Bachelor of Technology in
Electronics Engineering

Submitted by

PALLAVI
14LEB075

AYESHA SHAHREER AHMAD

14LEB057

Under the supervision of

PROF. EKRAM KHAN

DEPARTMENT OF ELECTRONICS ENGINEERING

ZAKIR HUSAIN COLLEGE OF ENGINEERING & TECHNOLOGY
ALIGARH MUSLIM UNIVERSITY ALIGARH
ALIGARH-202002 (INDIA)
APRIL, 2018
 STUDENTS’ DECLARATION

We hereby certify that the work which is being presented in this project report entitled “Detection of
Non-linear filtering in Images for Forensic Applications” in partial fulfilment of the requirements
for the award of the degree of Bachelor of Technology and submitted in the Department of Electronics
Engineering of the Zakir Husain College of Engineering & Technology, Aligarh Muslim University,
Aligarh is an authentic record of our own work carried out during final year of B. Tech. under the
guidance of Prof. Ekram Khan, Department of Electronics Engineering, Aligarh Muslim University,
Aligarh.

Pallavi Ayesha Shahreer Ahmad

This is to certify that the above statement made by students is correct to the best of my knowledge.

Prof. Ekram Khan

(Project Supervisor)

Date:

2
 ACKNOWLEDGEMENTS

First of all, we are thankful to The Almighty without whose grace we couldn’t have reached to this
stage of writing our B.Tech final year project report.

Secondly, we would like to express profound gratitude to our parents whose unfailing support and
encouragement throughout our years of study made us reach till here.

Thirdly, we would like to thank our supervisor Prof. Ekram Khan of the Electronics Engineering
Department at Zakir Husain College of Engineering & Technology, AMU, Aligarh, without whom this
project wouldn’t have seen the light of the day. We always had his help and support. Whenever we
were in trouble, whether it was related to programming or report writing, the door of his office room
was always open. He allowed this to be our own work and guided us in the right direction whenever
he thought we needed it.

Fourthly, we are thankful to Mr. Saquib Mazhar whose dissertation report provided us the initial
guidance when the project started.

Thank You,

Ayesha and Pallavi

3
 ABSTRACT

The idiom “Seeing is believing” proves that visual clues are more powerful than verbal clues. However,
today it’s very easy to access, process and share information. Thus, the phrase “Seeing is no longer
believing” is more apt. Manipulation of images has become facile due to easily available applications
and software tools. Tampering of images is acceptable as long as it is done for enhancing the image
quality. But when it is intentionally done to hide relevant information for unauthentic purposes,
checking the authenticity of images becomes important. This has made the development of forensic
techniques necessary. The report addresses towards using blind forensic techniques to detect non-linear
filtering operations in images. Non-linear filtering includes Histogram Equalization and median
filtering. This report is dedicated towards finding the traces of median filtering. Median filtering is
often used by forgers to smoothen out and denoise images while preserving the edges of the images.
Therefore, detection of Median filtering is important.

To detect the traces of median filtering, features from spatial and frequency domain are employed. In
spatial domain, streaking artifacts are exploited to separate median filtered images from unfiltered
images. The Discrete Cosine Transform is employed to extract a feature in frequency domain to further
separate median filtered images from low pass and high pass filtered images.

The training and testing is done using images from UCIDv2 dataset which comprises of 1336
uncompressed images in TIFF format. A total of 9352 images have been used for training and testing
the classifier designed to obtain the final results. The proposed method can differentiate between
unfiltered, median, low pass, and high pass filtered images with accuracies between 79.4%-96.2%. The
results obtained verify that median filtering can be detected and separated from unfiltered, low pass
and high pass filtered images by using a single algorithm which employs features from spatial and
frequency domain.

4
 TABLE OF CONTENTS

LIST OF FIGURES I

LIST OF TABLES III

LIST OF SYMBOLS IV

LIST OF ABBREVIATIONS V

CHAPTER 1: Introduction
1.1 Project Objective 3
1.2 Report Organization 4

CHAPTER 2: Literature Review

2.1 Introduction 5
2.2 Digital Image Forgery
2.2.1 Image Retouching 5
2.2.2 Copy Move Forgery 6
2.2.3 Image Forgery Using Splicing 6
2.3 Digital Image Forensic Techniques 7
2.4 Active Image Authentication Approach
2.4.1 Digital Signature Based Image Authentication 8
2.4.2 Digital Watermarking Based Image Authentication 8

2.5 Passive Image Authentication Approach

2.5.1 Techniques based on Traces left in Image Acquisition 9

2.5.2 Techniques based Traces left in Image Storage 9

2.5.3 Techniques based on Image Editing Traces 9

2.6 Related Works 10

5
2.7 Summary 13

CHAPTER 3: Image Filtering Operations

3.1 Introduction 14

3.2 Median Filtering 14

3.3 Low Pass Filtering 15

3.4 High Pass Filtering 17

3.5 Streaking Artifact 18

3.6 Discrete Cosine Transform 18

3.7 Summary 19

CHAPTER 4: Median Filtering Detection

4.1 Introduction 20

4.2 Spatial Domain Feature Extraction 20

4.3 Frequency Domain Feature Extraction 24

4.4 Proposed Model 26

4.5 Summary 26

CHAPTER 5: Simulation Results and Discussion

5.1 Introduction 27

5.2 Simulation Particulars

5.2.1 Spatial Domain Simulations 27

5.2.2 Frequency Domain Simulations 29

6
 5.3 Classifier Design 31

5.4 Results and Discussion 33

5.5 Summary 35

CHAPTER 6: Conclusions and Further Scope

7.1 Conclusions 36

7.2 Future Scope 37

REFERENCES 38

APPENDIX 40

7
 LIST OF FIGURES
Figure No. Caption Page No.
Fig. 1.1 (a) Original Image and (b) Edited Image of Taj Mahal 1

Fig. 1.2 Example of two images being forged and traces removed 2
Fig. 2.1 (a) Original Image and (b) Image after retouching 6
Fig. 2.2 (a) Original Image and (b) Image with copy-move forgery 6
Fig. 2.3 (a) Original Image and (b) Image forged by splicing 7
Fig. 2.4 Digital Image Forensic Techniques 8
Fig 3.1 Illustration of Median Filtering 14
Fig. 3.2 (a) Original image (b) Original image forged with a noisy image 15
(c) Median filtered image

Fig. 3.3 (a) Kernel 1: Averaging LPF and (b) Kernel 2: Gaussian 15
LPF
Fig. 3.4 (a) Original image and (b) Low pass filtered image 16
Fig. 3.5 (a) Kernel 1: Laplacian HPF kernel and (b) Kernel 2: 17
Laplacian HPF kernel with diagonal neighbors included.
Fig. 3.6 (a) Original Image (b) Gray Scale Image (c) HPF Image 17
obtained using Laplacian Kernel 1

Fig. 3.7 (a) Original Image, (b) DCT of (a), (c) Inverse DCT of (b) 19
Fig 4.1 Block diagram of detection process 20
Fig. 4.2 An image with lags (k, l) as (0.-1), (1,0), (0,1), (-1,0) 21
Fig. 4.3 Process Flow Diagram of Spatial Domain 22
Fig. 4.4 Histograms of First order difference (a) unfiltered and (b) its 23
median filtered image

Fig. 4.5 Separation using features from histogram of first order 23

difference image

Fig. 4.6 Average histograms of: Unfiltered Image, Median Filtered 24

image, Low Pass Filtered Image and High Pass Filtered
Image
Fig. 4.7 Process Flow Diagram of Frequency Domain 25

I
Figure No. Caption Page No.
Fig. 4.8 Model for detection of filtering operations 26
Fig. 5.1 FS values for (a) 836 unfiltered and 3 × 3 median filtered 28
images (b) 836 unfiltered, 3 × 3 median filtered, low pass
and high pass filtered images

Fig. 5.2 FF values for (a) 836 low pass filtered and 3 × 3 median 30
filtered images (b) 836 unfiltered, low pass and high pass
filtered images (c) 836 unfiltered and high pass filtered
images

Fig. 5.3 Flow chart working of the classifier 32

Fig. 5.4 ROC curve for threshold (a) T1 and (b) T2 33
Fig. 5.5 Classification Accuracy for different types of filtering 34
Fig A.a Image of flowers from UCIDv2 database 40
Fig A.b Image of birds from UCIDv2 database 40
Fig A.c Image of nature from UCIDv2 database 41
Fig A.d Image of buildings from UCIDv2 database 41
Fig A.e Image of soft toy from UCIDv2 database 42
Fig A.f Image of showpiece from UCIDv2 database 42

II
 LIST OF TABLES

Table No. Title Page No.

Table 1.1 Literature Survey 8

Table 5.1 Summary of Classification Accuracy 34
Table 5.2 Accuracy of proposed methods and compared methods 35

III
 LIST OF SYMBOLS

FS Spatial Domain Feature

FF Frequency Domain Feature
T1 Threshold in spatial domain
T2 Threshold in frequency domain to separate low pass filtered from
median filtered image

T3 Threshold in frequency domain to separate low pass filtered from

high pass filtered and unfiltered image

T4 Threshold in frequency domain to separate high pass filtered from

unfiltered image

∇𝑈 First order difference image

IV
 LIST OF ABBREVIATIONS

MF median filtered

LPF low pass filtered

HPF high pass filtered
UF unfiltered
DCT discrete cosine transform
CFA color filter array

SPAM subtractive pixel adjacent matrix

MRF median filtered residue
MFF median filter forensic
GFP global probability feature
local correlation feature
LCF
TIFF tagged image file format
ROC receiver operating characteristics
SVM soft margin support vector machine

V
CHAPTER 1

INTRODUCTION
In the early 1990s, the proverb “A picture is worth a thousand words” was very famous. It emphasizes
the power of image in describing and displaying complex scenes in an efficient and lucid manner.
Pictures have always been used to convey information in details and are also pleasant to look at. Any
information when conveyed by only using text can never be as interesting and informative as when it
is done with the aid of images.

In today’s digital era, communication has become facile due to multimedia services. The most common
form of communication used is through phone calls, texts and images. The availability of software
tools, such as Adobe Photoshop, Adobe Sky Replace, and applications such as PhotoGrid, FaceApp
etc. have augmented manipulation of images without any signs of tampering left behind. Today, editing
digital images is widely accepted among the mainstream consumers because of free availability of such
software tools and applications. These tools satisfy the consumers by changing facial expression or
age, replacing skies and matching scene lighting, changing visual style of photographs etc. [1]. Many
of above mentioned techniques are not only available as free applications, but are also present as part
of default applications in smart phones. One such feature is the existence of different filters used for
beautification as part of the in-built camera. Fig. 1.1 shows an original image and its edited version
which has been obtained by using the filters available in a smart phone camera.

(a) (b)

Fig. 1.1 (a) Original Image and (b) Edited Image of Taj Mahal

1
Tampering of images is not desirable when it is intentionally done to hide relevant information. It is
very important to check authenticity of digital images when the power of images to convey information
is being used for detrimental purposes as they can be used as evidence in courts, forensic investigation,
law enforcement, medical imaging, etc. This is where the role of forensic techniques comes into play.

Today’s need is to discriminate between an original image and its manipulated version, which is a
challenging task. An example of image forgery where filtering is used to hide the traces, is illustrated
in Fig.1.2. [16]. Fig. 1.2 (a) shows an original image of flying aeroplane and (b) is another image
captured by a smart phone camera. On combining (a) and (b), image (c) is obtained. It is clearly visible
in (c) that it is not a single image but is a combination of two as the edges of (a) are visible in (c).
Image (d) is obtained from image (c) after it has undergone an editing process using smoothening filter
to remove the traces of forgery.

+ =

(a) (b) (c)

After Processing

(d)

Fig. 1.2 Example of two images being forged and traces removed

2
In general digital image forensic approaches can be broadly classified into active and passive. Active
forensic approaches usually involve embedded watermarks or fingerprints of various kinds. These can
detect tampering of images accurately but it is impossible to watermark all the images which exist
today on the internet or elsewhere. Thus, passive approaches are being used for forensic application.
These do not rely on any prior information and hence have broader application [2].

Digital image filtering operations are broadly classified as linear filtering and non-linear filtering
operations. Linear filtering operations includes low pass and high pass filtering while non-linear
includes median filtering and histogram equalization. The detection of linear filtering is easier as
compared to non-linear filtering operations due to the linear relationship between the original and
processed images.

To the best of our knowledge, most of the work that has been done till date is either focused on detecting
traces of linear filters and/or non-linear filters by extracting features either from spatial domain or
frequency domain. In [3], [4], [5], [6] and [7], features from spatial domain have been used in detection
of median filtering. These are focused on distinguishing median filtered images from unfiltered images.
In [8], [9], and [10], the authors have tried to distinguish median filtered images from other kinds of
images such as raw images, rescaled images, denoised images produced by linear filters such as
Gaussian low pass filter and Laplacian high pass filter. The features used in distinguishing median
filtering from other types of filters are employed from spatial domain. Frequency domain features are
used in [11] to distinguish low pass and high pass filtering in images. Thus, almost all the works are
either focused on extracting features from spatial domain to detect non- linear filtering. None of the
works have employed features from spatial domain as well as frequency domain to detect and separate
non-linear filtering from linear filtering.

1.1 Project Objective

Today, tampering of images in not done just to improve their quality but also for detrimental purposes.
This has urged the need for verifying the authentication of digital images which is not an easy task.
Many image filtering and enhancement techniques like low pass filter (LPF), high pass filter (HPF),
median filtering (MF), and histograms equalization are used to hide the traces of image forgery.
However, these operations leave some traces in images which can be exploited to detect them. The aim
of this project is to use blind forensic techniques to detect non-linear filtering operations.

There are two types of non-linear filtering operations- median filtering and histogram equalization.
Work done in this project is dedicated towards the detection of median filtering in images by employing

3
features from the spatial domain as well as frequency domain. The feature employed from spatial
domain is streaking artefact. In frequency domain, features are extracted from histograms of DCT
coefficients of the image. The focus is not only to detect median filtering, but also to successfully
differentiate it from unfiltered images and linear filtering operations such as LPF and HPF.

1.2 Report Organisation

The rest of the report is organised as follows. In Chapter 2, a literature survey on the types of digital
image forensic techniques and the different works which have been dedicated towards MF detection
are discussed. The different types of linear and non-linear filtering techniques are discussed in Chapter
3. Artifacts which exist in MF and Discrete Cosine Transform (DCT) are also discussed in Chapter 3.
DCT is a means of conversion from spatial domain to frequency domain and hence can be used in
detection of linear filtering operations. The work done in this project is discussed in Chapter 4 followed
by Chapter 5 in which the simulation particulars, classifier design and results are discussed. Finally,
the report ends with concluding remarks and scope of future work in Chapter 6.

4
CHAPTER 2

LITERATURE REVIEW

2.1 Introduction

In today’s digital era, most of the information is shared through the internet where it is conveyed with
the help of digital images on social media platforms such as Facebook, Twitter, WhatsApp, Instagram,
and Snapchat. According to a survey more than 95 million photos are uploaded on Instagram every
day! [17]. Not only sharing of images has become facile, so has their storage. The manipulation of
images has also augmented in recent years. Tampering of images for retouching and beautification is
not harmful. But sometimes it is done intentionally to hide relevant information. Like any other
pernicious and illegal activity, image forgery can be detrimental to human society. Thus, there is a
need for image forensic techniques for the authentication and verification of integrity of images.

2.2 Digital Image Forgery

The different types of digital image forgery which exit are:

(i) Image retouching

(ii) Copy-move forgery
(iii) Image forgery using splicing

2.2.1 Image retouching

Image retouching is commonly used in entertainment industry to enhance the image quality. It is a
desirable and least harmful image processing operation. It does not change the image in a significant
way but emphasizes some desirable feature of the image to make it more attractive [12]. It becomes
undesirable when the images undergone retouching have to be used for authentic purposes. Many of
human features like hair pattern, skin tone, eye color, face shape etc. form an important identity set
and are used for recognition; tampering of these can lead to false identity. An example of image
retouching [18] is shown in Fig. 2.1.

5
 (a) (b)

Fig. 2.1 (a) Original Image and (b) Image after retouching

2.2.2 Copy-move forgery

Copy-move forgery involves copying and pasting certain portions of image to another location in the
same image. It is done either to hide relevant information or duplicate image portions. Since portions
of same image are copied and pasted, most of the visible image properties like brightness and contrast
do not change. Properties such as noise and the image histograms suffer very less amount of change
and so it is difficult to detect copy-move forgery. Fig. 2.2 shows an example of copy-move forgery
[19].

(a) (b) Fig. 2.2 (a) Original Image and (b) Image with copy-move
forgery

2.2.3 Image forgery using splicing

In image forgery splicing, different image parts of same or different images are manipulated to create
new images. When two images are manipulated and combined together, the surrounding boundaries of

6
the two images are perceptually visible to the naked eye. Some image filtering operations are applied
to the spliced region to make the boundaries visually imperceptible. Detection of image splicing
requires the analysis of whole image content using robust statistical methods [12]. The illustration of
two images being forged together done in Fig. 1.2 is an example of splicing. Fig. 2.3 also shows an
example of splicing [20].

(a) (b) Fig. 2.3 (a) Original Image and (b) Image forged by splicing

2.3 Digital Image Forensic Tools

Fig 2.4 shows different digital image forensic tools which can be broadly classified as active and
passive. In active forensics approaches, usually a watermark or finger print of the image content is
designed and embedded into to digital image. During the authentication stage, the embedded
watermark or fingerprint is extracted and examined to determine the integrity of the image. The active
approaches can detect tampering in digital images accurately, but they have not been widely used
because it is not practically possible to watermark all the images that exist on internet or elsewhere
today. Passive approaches do not rely on any prior information and thus are used widely in image
forensics [2].

2.4 Active Image Authentication Approaches

The main approaches of active image authentication are based on digital signatures and digital
watermarking.

2.4.1. Digital Signature Based Image Authentication

7
A digital signature includes the encrypted authentication code, along with some other information like
the owner, the issuer, and the validity period of the public key. Digital signature is generated from
sender’s. The original data/message is then sent to the intended recipients along with its signature. The
recipient on the other side uses the sender’s public key and affirms whether the received message has
been altered and was really from the sender. The two hash codes (one decrypted from the signature
and the other obtained by re-hashing the message) are then compared bit by bit to draw the final
authentication result. Even a single bit difference will be viewed as unauthentic [13].

2.4.2 Digital Watermarking Based Image Authentication

Authentication watermarks are embedded irreversibly in the image. They are carefully designed and
are imperceptible in the image content. The consistency of the watermark is analyzed by a decoder
which verifies the integrity of the image under investigation. Authentication watermarks deliver
advanced features such as localization of a forgery or restoration of the original appearance [1].

Digital Image Forensic Techniques

Active Image Authentication Passive Image Authentication

Digital Signatures Digital

Watermarking

Image Image Image

Acquisition Storage Editing
Traces Traces Traces

Pixel Physics
based based

Fig. 2.4 Digital Image Forensic Techniques

2.5 Passive image authentication approaches

Passive approaches do not require the original image for authentication, only the filtered image is
required. These techniques are known as blind forensic techniques. They are broadly classified into

8
three major categories: (i) image acquisition traces, (ii) image storage traces and (iii) image editing
traces.

2.5.1 Techniques based on Traces left in Image Acquisition

Several different processing stages are involved in image acquisition process of digital images. First,
the light goes through a series of lenses before entering the image capturing device, which conveys the
light to color filter array (CFA). In CFA a specific color mosaic is performed which permits only a
certain component of the light to pass through a specific area. Only RGB color components are allowed
for each pixel in most of the digital cameras. The light reaches the image sensors after CFA filtering
[2]. Artifacts are embedded in the different stages of the image creation process and they can be
exploited to detect traces of tampering.

2.5.2 Techniques based Traces left in Image Storage

Forgery detection can become a challenging task when forged images are transformed for compression.
JPEG is the most widely used format for compression which makes forgery detection very difficult.
However, JPEG inevitably introduces certain compression patterns during image compression which
can be exploited in forensic analysis. Some forensic cues can be deduced by analyzing these patterns
which are (i) the number of times the image has been compressed and (ii) whether the compression
done on all the regions in the image is equal [2].

2.5.3 Techniques based on Image Editing Traces

Image editing leaves traces which can be used in image forgery detection. These techniques based on
traces left in image editing are classified into (i) pixel based and (ii) physic based.

(i) Pixel based

During tampering process, statistical irregularities occur which can be exploited for
forensic detection and are used in pixel based techniques. These techniques also analyze
correlation among pixels in spatial domain or a transformed domain which are introduced
due to the specific form of tampering. The basic assumption is that manipulation in any
form, may not be visually detectable but can change some specific statistics at pixel level.

DCT is one of the efficient algorithms for this technique which reduce computational
complexity.
(ii) Physic based
In this technique image forgery detection is done by analyzing the lighting inconsistency in
images. Natural photographs are usually taken under different lighting conditions. Thus,

9
 lighting of forged region may not match the original in splicing operations (two or more
images are used to create a forged image).

2.6 Related Work

In [3]-Kirchner and Fridrich have used streaking artefacts to detect Median filtering in images without
post JPEG compression (after median filtering). Streaking artifacts are the characteristics of spatial
domain in which the probability of the neighbouring pixels being same is non-zero. Streaking artefacts
have been analysed by means of first order differences. Median filtering detection after JPEG
postcompression is done using the subtractive pixel adjacency matrix (SPAM) features as a means to
analyse the conditional joint distribution of first order images.

In [8], the authors have proposed a blind forensic algorithm to detect median filtering which exploits
the probability of zero values on the first order difference map in texture regions.

In [4], the authors have proposed to detect MF based on histogram features. Histograms can present
most of the image information, authors utilise them by taking several high histogram bins of the
residual images as their forensic tool. The method is successful in achieving a very high degree of
accuracy.

In [5], the authors use median filtered residual (MFR) which is generated by computing difference of
the median filtered and the original image. Then, three features i.e., histogram, autocorrelation and
gradient are extracted from MFR. The proposed method achieves better detection rate and lower
computational complexity in comparison with other MF detection methods.

In [6], Rhee uses a feature vector which is extracted from variations between the neighbouring line
pairs in the row and column directions. The variations include gradient difference of the intensity
values between the neighbouring line pairs and coefficient difference of the Fourier Transform between
the neighbouring line pairs.

In [9], Yuan has proposed a feature set called median filter forensic (MFF) set as the forensic tool to
detect Median filtering in arbitrary images as well as in low-resolution and JPEG compressed images.
The MFF consists of 5 different feature. The 5 features included in feature set are: Distribution of block
median, Block-centre gray level occurrence, No. of distinct gray levels in a block, distribution of
blockcentre gray level in the stored gray levels. Also, the paper addresses to reliably detect tampering
when part of a Median- filtered image is inserted into a non-median filtered image and/or vice-versa.

10
In [10], the authors introduce two feature set to distinguish between a median filtered image from an
untouched image or average-filtered one. The two feature sets are global probability feature set (GFP)
and local correlation feature (LCF) Set. GFP includes the cumulative distribution function of first order
difference while LCF includes correlation between adjacent difference pairs in the difference domain.

In [7], the authors detect MF by using the MFR. The statistical properties of MFR are captured using
an autoregressive (AR) model which essentially performs linear prediction. This AR model along with
other methods such as SPAM, MFF and GLF is used to differentiate between MF and other popular
tools such as Gaussian filtering, 3×3 average filtering, up scaling and downscaling. Also, the proposed
AR method is used to differentiate between MF using 3×3 and 5×5 with high accuracy.

In [11], the authors study the combination of JPEG compressed image followed by linear filtering. The
study is carried out by observing the histograms of DCT (Discrete Cosine Transform) of the original
and the compressed image. Histograms are plotted by collecting the same DCT coefficients from each
8×8 block of images.

11
 Table 2.1- Literature Survey
S No. Paper Title Features Used Classifiers Accuracy Dataset
Used
1. On Detection of Streaking Artefacts SVM ----- Ker’s
Median filtering and by means of First ‘gold
digital Images [2] order difference standard’
2. Forensic Detection Probability of zero ----- ----- UCID
Of Median Filtering value on the (512×512)
in digital Images[8] difference map of
textured pixels
3. Blind Median Histogram of C-SVM 99.86% BossBasc
Filtering Detection residual image of (512×512) (512×512)
based on histogram difference in
features [4] horizontal direction.
4. An Efficient Blind Histogram, SVM ----- UCID
Detection Autocorrelation,
Algorithm of Gradient from MFR
Median Filtered
Image [5]
5. Median filtering Gradient Difference C-SVM ----- UCID,
detection using of Intensity Value, BOSE2,
variation of Coefficient SAM
neighboring line Difference of the
pairs for image Fourier Transform
forensics [6] between
neighboring line
pairs.
6. Blind Forensics of MFF C-SVM ---- UCID,
Median Filtering in BOWS2,
Digital Images [9] BOSS
RAW,
NRCS
7. Blind Detection of GFP and LCF ---- ----
Median Filtering in BOWS2,
Digital Images: A NRCS,
Difference Domain DID
Based Approach
[10]

8. Robust Median MRF with linear SVM 99.5% UCID,

Filtering Forensics prediction (JPEG_90, BOSS
Using an 512×384) RAW,
Autoregressive NRCS,
Model [7] DID,
BOWS2

12
 9. Forensic detection Probabilistic SVM 90.2% UCID
of processing distribution of DCT (JPEG_90)
operator chains: coefficients of
recovering the JPEG compressed
history of filtered image followed by
JPEG images[11] linear filtering

2.7 Summary
This chapter presents the study of various digital forensic tools available to authenticate digital images
and to detect image manipulation. Different types of image forgery operation are explained. This
chapter also presents discussion on different active and passive image authentication approaches and
presents the need of forgery detection in digital images for forensic application. Also, a brief summary
of works related to MF has been included in this chapter.

13
CHAPTER 3

IMAGE FILTERING OPERATIONS

3.1 Introduction

Image filtering operations can be broadly classified into linear filtering and non-linear filtering
operations. Linear filtering operations follow superposition principle. Examples of linear filtering
operations are low pass filtering and high pass filtering. Non-linear filtering operations are of two
types- median filtering and histogram equalization. Filtering operations can be used for image
enhancement as well as for detrimental purposes. Manipulation of images done by using a particular
operation can be detected by studying the traces left by them. Detection of traces is done with the help
of blind image forensics. Traces can be observed in spatial domain and/or frequency domain.

3.2 Median Filtering

Median filtering is a non-linear operator which smoothens images while preserving their edges and
produces regions of near constant value.

In MF, pixel’s value is replaced with the median value of the pixels in a small window surrounding it.
This rudimentary idea of MF is depicted in Fig. 3.1. The window size used in Fig. 3.1 is 3×3.
Commonly, windows of odd sizes such as 3×3, 5×5 and 7×7 are used.

Fig. 3.1 Illustration of Median Filtering

As mentioned above, MF operation is performed on an image with the help of odd size windows which
are overlapping in nature. The overlapping of windows leads to MF having a special artifact in spatial
domain which is called streaking artifact. MF can be used for removing the fingerprints left by other
14
editing operators as well. Thus, MF can be used in forgery to make the forged images look perceptually
realistic. It can be used for removing impulse noise which is also known as salt and pepper noise as
shown in Fig. 3.2

(a) (b) (c)

Fig. 3.2 (a) Original image (b) Original image forged with a noisy image (c) Median filtered
image

3.3 Low Pass Filtering (LPF)

A low pass filter is a linear filter which averages out rapid changes in intensities. It is also called
“blurring” or “smoothing” filter. The simplest low pass filter is the average filter which calculates the
average of the pixel and its neighbours. Number of neighbours which are included in calculating the
average depends on the kernel (mask) size which can be 3×3, 5×5 etc. The resultant average is then
used to replace the original value of the pixel. This process is repeated for every pixel in the image and
leads to reduced sharp transitions in the image. Kernels shown in Fig. 3.3 i.e. kernel 1 and kernel 2,
can be used to perform low pass filtering:
1 1/16 1/8 1/16
/9 1/9 1/9
1/9 1/9 1/9 1/8 1/9 1/8

1/9 1/9 1/9 1/16 1/8 1/16

(a) (b)

Fig. 3.3 (a) Kernel 1: Averaging LPF and (b) Kernel 2: Gaussian LPF
The kernel of Fig. 3.3 (a) can be used to perform low pass filtering by simply averaging the pixels in
the neighbourhood and (b) is called weighted mask which can be used as Gaussian LPF since its gain
characteristic is similar to Gaussian function. Other types of low pass filters include Laplacian and
Gaussian filters. Average filters are used in noise reductions. However, they have an undesirable side

15
effect that they blur the edges. Edges are almost a desirable feature of images and are characterized by
sharp transitions in grey levels [15]. Fig.3.4 shows how average filtering of images blurs them.

( a)

(b)

Fig. 3.4 (a) Original image and (b) Low pass filtered image

3.4 High Pass Filtering (HPF)

A high pass filter is a linear filter which makes an image appear sharper. It can improve the image
quality but if overdone, it degrades the image quality. HPF can be implemented with the help different
kernels. Two types of Laplacian kernels, kernel 1 and kernel 2, are shown in Fig. 3.5.

16
 0 -1 0 -1 -1 -1

-1 4 -1 -1 8 -1

0 -1 0 -1 -1 -1

(a) (b)

Fig.diagonal neighbors 3.5 (a) Kernel 1: included.Laplacian HPF kernel and (b) Kernel 2:
Laplacian HPF kernel with

High pass filters amplify noise and can cause small faint details to be exaggerated. Fig 3.6 shows an
original image and its resultant image obtained using the HPF kernel1 shown in Fig. 3.5 (a).

(a) (b) (c)

Fig. 3.6 (a) Original Image (b) Gray Scale Image (c) HPF Image obtained using Laplacian Kernel
1

Linear filtering operations like LPF and HPF can be detected in frequency domain and Discrete Cosine
Transform (DCT) can be used for converting from spatial to frequency domain.

3.5 Streaking Artifacts

In median filtering, overlapping filter windows exit which result in a non-zero probability of adjacent
or pixels at a certain distance in the output have same intensity values. This effect is called streaking.

17
Presence of such specific ‘probability pattern’ are strong indicators of MF and can be used in detection
of MF by using blind forensic techniques (Passive Authentication Approach). Analysis of steaking
artifacts with respect to two pixels can be carried out by means of their first order difference [2].

First order difference is given by:

𝑑𝑖(,𝑘𝑗,𝑙) = 𝑦𝑖,𝑗 − 𝑦𝑖+𝑘,𝑗+𝑙

where 𝑑𝑖(,𝑘𝑗,𝑙) is the first order difference image with lag (k,l) which is a combination of 0,1 and -1.

3.6 Discrete Cosine Transform (DCT)

DCT is a means of conversion from spatial to frequency domain. It converts intensity functions into
weighted sum of periodic basis (cosine) functions. It identifies bands of spectral information that can
be discarded without loss of quality.

The 2 D Forward DCT equation which computes the i ,jth entry of the DCT of an image is:
𝑁−1 𝑁−1
(2𝑥 + 1)𝑖𝜋 (2𝑦 + 1)𝑗𝜋
𝐷(𝑖, 𝑗) = 𝑃(𝑥, 𝑦) cos [ ] cos [ ]
√2𝑁 𝑥=0 𝑦=0

1
𝑖𝑓 𝑢 = 0 where,
𝐶(𝑢) = { √2
1 𝑖𝑓 𝑢 > 0

Here p(x,y) is the x,yth element of the image represented by matrix P. N*N is the size of the block on
which DCT is done. The equation calculates one entry (i ,jth) of the transformed image from the pixel
values of the original image matrix. For the standard 8*8 block that JPEG compression uses, N equals
to 8 and x and y range from 0 to 7.

The 2-D Inverse DCT equation which computes the x,yth entry of the IDCT of an image is:

𝑃
√𝑁 2𝑁 2
𝑖=0 𝑗=0

18
Here the function C is same as above.

DCT of an image and its IDCT are shown below in Fig. 3.7.

DCT IDCT

(a) (b) (c)

Fig. 3.7 (a) Original Image, (b) DCT of (a), (c) Inverse DCT of (b)

3.6 Summary
In this chapter the details about median filtering and how streaking artifacts are observed in median
filtered images have been discussed. Also, linear filtering operations, LPF and HPF, have been
discussed. DCT, a method of conversion from spatial domain to frequency domain has also been
explained in the chapter.

19
CHAPTER 4

MEDIAN FILTERING DETECTION

4.1 Introduction
The non-linear relationship between the original and the filtered image makes the detection of MF
difficult as compared to linear filters. The aim is to detect MF by employing features from spatial
domain as well as frequency domain. In spatial domain, streaking artifact has been exploited to detect
MF. DCT in frequency domain has been employed along with streaking artifact to separate MF images
from unfiltered and linear filtered images.

In Fig. 4.1 is a simple block diagram which depicts how the detection is to be carried out. First, features
from spatial and frequency domain have been extracted. Then, a model for the classifier having feature
from spatial and frequency domain as input is proposed in this chapter.

Spatial Domain MF
CLASSIFIER UF
IMAGE LPF
HPF
Frequency Domain

FEATURE EXTRACTION T1 T2 T3 T4

Fig. 4.1 Block diagram of detection process

4.2 Spatial Domain Feature Extraction

In spatial domain, unfiltered images and median filtered images can be separated by exploiting
streaking artifacts, which are analysed with the help of first order difference as explained in Section
3.2. An image along with its four lags having value (k, l) as (-1, 0), (1, 0), (0, 1), (0, -1) is shown in
Fig. 4.2.

20
 ( k, l ) = (0, −1) ( k, l ) = (1,0)

Fig.

( k, l ) = (−1,0)
( k, l ) = (0,1)

Fig. 4.2 An image with lags (k, l) as (0,-1), (1, 0), (0, 1), (-1, 0)

First order difference image can be obtained as

U is the First order difference image, and I is an image.

For analysing streaking in vertical direction

𝑎𝑛𝑑 (0, −1)

i.e.

𝑦 is the difference image.

For analysing streaking in horizontal direction

𝑎𝑛𝑑 (−1,0)

i.e.

𝑥 is the difference image

For including both the horizontal and vertical streaking,

𝑎𝑛𝑑 (−1,0) 𝑎𝑛𝑑 (0,1) 𝑎𝑛𝑑 (0, −1)

𝑈 is the first order difference image.

21
Features from the histogram of the first order difference image (which includes both horizontal and
vertical streaking) have been used to differentiate the median filtered image from unfiltered image as
with the help of feature FS which is explained in Fig. 4.3. For feature extraction, the image I1 under test
is median filtered resulting in I2. The first order difference of both the images, I1 and I2, is computed
and their histograms are plotted. Histograms of an arbitrary image are shown in Fig. 4.4. A pattern was
observed in the difference of the 3rd and 4th peaks of the histograms which is found to be greater for I2
than I1. F1 is the difference of the peaks for image I1 and F2 is for I2. The feature FS extracted is the ratio
of F1 to F2 i.e. spatial domain feature FS:

FS = F1/F2

where, F1 is the difference of 3rd and 4th peak of histogram of first order difference image I1
F2 is the difference of 3rd and 4th peak of histogram of first order difference image I2

Image, I1 MEDIAN FILTERING Image, I2

First Order Image First Order Image

Difference, ∇I1 Difference, ∇I2

Histogram, H (∇I1) Histogram. H (∇I2)

F1 = H(∇I1)(3) – H(∇I1)(4) F2 = H(∇I2)(3) – H(∇I2)(4)

FS = F1 /F2

Fig. 4.3 Process Flow Diagram of Spatial Domain

22
 (a) (b)

Fig. 4.4 Histograms of First order difference image of (a) unfiltered and (b) its median filtered
image

Furthermore, the same process was followed for low pass and high pass filtered images. Based on the
feature extracted in spatial domain (Fs) the unfiltered, median filtered, low filtered and high filtered
images can be separated into Class 1 and Class2 as shown in block diagram given in Fig. 4.5. If an
image under test falls in Class 1 then it is either a median filtered or low pass filtered image, and if it
falls in Class 2 then it can be low pass filtered or high pass filtered or unfiltered image.

Median /
Low Pass Class 1

Test Image

Low Pass/ Class 2

High Pass/
Unfiltered

Fig. 4.5 Separation using features from histogram of first order difference image
4.3 Frequency Domain Feature Extraction

23
Frequency domain features are exploited to separate images within Class 1 and Class 2. DCT which
has been explained in Section 3.5 has been employed to convert an image from spatial to frequency
domain. DCT of an image was computed by taking N equal to 8. The same frequency DCT coefficients
from each 8×8 block of DCT matrix were collected and the histogram was plotted. The histograms
were plotted for (7, 7), (7, 8), (8, 7) and (8, 8) DCT coefficients and average of their frequencies was
taken to plot the average histogram of these high frequency coefficients. Fig. 4.6 shows the average
histograms plotted for 500 images under test, where (a), (b), (c), and (d) are the average histograms
obtained for unfiltered, median filtered, low pass filtered and high pass filtered images respectively.

Fig. 4.6 Average histograms of: Unfiltered Image, Median Filtered Image, Low Pass Filtered
Image and High Pass Filtered Image
It can be observed that a significant difference exits between the difference of 1st and 2nd peaks of the
four types of images. The feature FF is extracted which is the difference of the 1st and 2nd peak. Thus,
the feature FF obtained from the average histogram as shown in Fig. 4.7 has been used separate the

24
types of images lying in Class 1 and Class 2. Frequency domain feature FF is given by: FF = H(1) –
H(2)

where, H(1) is the 1st peak of average histogram

H(2) is the 1st peak of average histogram

Partition into
Test L1/8 × L2/8
images of Non-overlapping
size L1×L2 blocks of size 8×8

Transform each
block using 8×8
DCT
DCT

Collect DCT
coefficient of
particular
frequencies from
each block

Plot Average
Histogram, H

FF = H(1) – H(2)

Fig. 4.7 Process Flow Diagram of Frequency Domain

4.4 Proposed Model
Using the features stated in Section 4.1 and 4.2 a model to find whether test image has undergone-
median, low pass or high pass filtering is shown in Fig. 4.8. The block diagram shows how spatial and
frequency domain features can be combined to detect different filtering operation.

25
 Median
Filtered
Median /
Low Pass Low Pass
LowPass
Image under
Test
Low Pass
Low Pass/
High Pass/ High Pass
Unfiltered
High Pass /
Unfiltered
Unfiltered
Spatial Domain Frequency Domain

Fig. 4.8 Model for detection of filtering operations

4.5 Summary

This chapter describes how spatial domain feature can be used to separate the unfiltered and median
filtered images. On including LPF and HPF images along with unfiltered and MF, the spatial domain
feature separates the images into Class 1 and Class 2. This chapter also describes how frequency
domain features have been employed to identify the filter applied on images in Class 1 (the ones
suspected to have undergone median or low pass filtering) is median or low pass filter. Using the
similar frequency domain feature the filtering operation on images in Class 2 can be identified i.e. no
filtering or low pass or high pass filtering. In the end, a model combining the features of spatial and
frequency domain to detect filtering operations.

26
CHAPTER 5

SIMULATION RESULTS AND DISCUSSION

5.1 Introduction

As explained in Section 4.2, 4.3 and 4.4, median filtered images can be detected and separated from
unfiltered, low pass and high pass filtered images by employing feature FS and FF from Spatial Domain
and Frequency Domain. This chapter will discuss the classifier design which can successfully detect
filtering operations. An important step in designing the classifier is to find the threshold required for
different stages of the classifier which will be discussed in this chapter.

For training and testing the classifier, UCIDv2 dataset has been used which comprises of 1336
uncompressed images in TIFF format of size 512×384. The data set consists of images of different
varieties such as nature, monuments, human beings, cars etc. which are included in Appendix. The
1336 images have been converted to median filtered images using window size 3×3, 5×5 and 7×7.
Also, 1336 average filtered i.e. low pass and high pass filtered images using Gaussian and Laplacian
Kernels (as described in Section 3.4) are generated. Out of each type of 1336 images, 836 images have
been used for training and the remaining 500 images have been used for testing. Thus, a total of 5852
(836×7) images have been used for training and 3500 (500×7) have been used for testing the classifier.
The simulation was carried out on MATLAB and the results obtained are discussed in this chapter.

5.2 Simulation Particulars

5.2.1 Spatial Domain Simulations

The feature FS from spatial domain which is explained in section 4.2 has been calculated for 836
training images and their filtered counterparts which are:

1) MF images generated using the window size 3×3.

2) LPF images generated using averaging kernel.
3) HPF images generated using Laplacian kernel.

The scatter plots for all these 836×4 images is shown in Fig. 5.1.

27
 (a)

(b)

Fig. 5.1 FS values for (a) 836 unfiltered and 3 × 3 median filtered images (b) 836 unfiltered, 3 × 3
median filtered, low and high pass filtered images

The Fig. 5.1 (a) shows value of FS in original image and median filtered image on y-axis and image
indexes on x-axis. From the scatter plot it is clearly visible that the value of FS for the majority of

28
unfiltered images lies from -0.2 to 0.6 and it lies from 0.4 to 1 for median filtered images. So, to make
the decision on the basis of FS whether an image is unfiltered or median filtered, a threshold from 0.4
to 0.6 needs to be chosen. By the analysis of value of FS for 836 unfiltered and 836 median filtered
images an optimum accuracy for both was observed at 0.46 i.e. majority of images having F S above
0.46 are median filtered and those below it are unfiltered.

Fig. 5.1 (b) shows value of FS for unfiltered, median, low pass and high pass filtered images. From the
plot it is clear that for low pass filtered images FS varies from -0.4 to 1, and it varies from -0.5 to 0.3
for majority of high pass filtered images.

Thus, choosing T1 i.e. 0.46 as a threshold will result in separation of median filtered from unfiltered
and high pass filtered images as the majority of the former have value of FS greater than 0.46. Low
pass filtered images will club with both MF, and UF and HPF. Thus, the value of FS can be used to
decide whether an image under test falls in Class 1 or Class 2 as mentioned in Section 4.2.

5.2.2 Frequency Domain Simulations

The feature FF which is explained in Section 4.3 when computed for unfiltered, 3 × 3 median filtered,
low pass and high pass filtered images can be plotted as shown in Fig. 5.2. This feature facilitates the
further separation of images lying in Class 1 and Class 2.

(a)

29
 (b)

(c)

Fig. 5.2 FF values for (a) 836 low pass filtered and 3 × 3 median filtered images (b) 836 unfiltered,
low and high pass filtered images (c) 836 unfiltered and high pass filtered images

30
Fig. 5.2 (a) shows scatter plot of FF for MF and LPF on y-axis and image index on x-axis. From the
scatter plot it can be seen that majority MF images have FF varying from 0 to 2500, and it varies from
1500 to 300 for LPF images. On analysis of FF for MF and LPF images, 2200 was found to be optimum
threshold for their detection. Ones above it are more probable to be LPF and ones below it have a
higher probability of being MF images. So, in this way images within Class 1 can be separated.

Fig. 5.2 (b) shows LF, UF, HPF images. Analysis of images under training shows that choosing 1475
as a threshold will separate the images lying in Class 2 into LF and UF or HPF.

Similar scatter plot for UF and HPF images is shown in Fig. 5.2 (c). Majority of HPF images have F F
from -100 to 150 and UF are from 100 to 1500. FF can be chosen as 100 for separation of UF and HPF
images.

Hence, using threshold T2 i.e. 2200, images within Class 1 can be separated into MF and LPF images
and using T3 and T4 i.e. 1475 and 100, images within Class 2 can be separated into LPF, UF and HPF
images.

5.3 Classifier Design

A statistical classifier has been designed using the threshold values discussed in Section 5.2.1 and 5.2.2
which are:

(i) T1 = 0.46
(ii) T2 = 2000
(iii) T3 = 1475
(iv) T4 = 100

The working of the classifier is explained with the help of a flow chart in Fig. 5.3. The classifier has
the two features: Fs and FF. First, Fs compared to threshold T1. If fs is greater than T1 this means that
image under test is either low pass filtered or median filtered. Then feature FF is compared to T2, if FF
is greater than T2, then image is low pass filtered otherwise it is median filtered.

If Fs is less than T1 then FF is compared to T3. If FF is found to be greater than T3, the image is low pass
filtered otherwise it is either unfiltered or high pass filtered then, FF is compared to threshold T4. The
image is unfiltered if FF is greater than T4 or else it is high pass filtered. Thus, using the two feature,
Fs and FF, and the four thresholds, T1, T2, T3, and T4, the classifier is able to detect whether the image
under test is unfiltered or is it MF or LPF or HPF.

31
 FEATURE SET:

Spatial domain feature: FS

Frequency domain feature: FF

FS > T1

NO YES

It is UF/LPF/HPF It is MF/LF

FF > T3 FF > T2

NO YES NO YES

UF/HPF LPF MF LPF

FF > T4

NO YES

HPF UF

Fig. 5.3 Flow chart of working of the classifier

32
5.4 Results and Discussion

For obtaining the results, 3500 images have been used as testing images. These 3500 images comprise
of 4 types of images which include unfiltered, median filtered, low pass filtered and high pass filtered
images. Out of these 3500, 1500 (3×500) images are MF which have been generated using 3×3, 5×5
and 7×7 as window sizes. 500 Low pass filtered images have been generated using Kernel 1(described
in Section 3.3) and 1000 (500×2) High pass filtered images have been generated using Kernel 1 and
Kernel 2 mentioned in Section 3.4.

Performance measure of the classifier in detection of 3×3 median filtered images is represented as ROC
curves corresponding to thresholds T1 and T2 in Fig. 5.4. From the ROC curves obtained, it may be
inferred that the classifier performance in detection of median filtered images is more sensitive to T 1
than to T2.

ROC curve for threshold T1 ROC curve for threshold T2

1.2 1.2

1 1

0.8 0.8

0.6 0.6

0.4 0.4

0.2 0.2

0 0
0 0.5 1 1.5 0 0.5 1 1.5
-0.2
False Positive Rate False Positive Rate

(b)
(a)

Fig. 5.4 ROC curve for threshold (a) T1 and (b) T2

The two thresholds in the classifier have been set by giving priority to MF (3×3) images. Extensive
simulations were done for determining the values of the two thresholds. From the simulations done, it
was observed that accuracy of detection of MF depended more on T2. T2 is chosen to be 2200 as
discussed in section 5.2.2.

For T2 below 2200, the accuracy of detecting MF was found to be below 90%. To increase the accuracy
of detection of MF, threshold T2 is chosen to be 2200. In Fig. 5.5 and Table 5.1, it can be observed that
by keeping T2 equal to 2200, the accuracies of detecting MF obtained are 95.20%, 90.4% and 85% for
MF images generated using 3×3, 5×5 and 7×7 window sizes. Also, the classification accuracies
obtained for LPF Kernel 1 and unfiltered images are observed to be 96.2% and 84%. Thus, 2200 and

33
0.46 are the optimum values for threshold T2 and T1.

CLASSIFICATION ACCURACY
UF MF
LPF HPF

UF MF (3 × 3) MF (5 × 5) MF (7 × 7) LPF KERNEL1 HPF KERNEL1 HPF KERNEL2

Fig. 5.5 Classification Accuracy for different types of filtering

Table 5.1 Summary of Classification Accuracy

From the classification accuracies obtained it is proved that the proposed method is not only successful
in detecting MF images with high accuracy, but also in differentiating it with unfiltered, LPF and HPF
images. Thus, the proposed method can be used as a means to detect non-linear and linear filtering
operations.

34
 Table 5.2 Accuracy of proposed method and compared methods
Average accuracy for different Frequency
Method filter types Spatial domain domain feature
Non-Linear Linear features used used

Conotter et. al. [11] - 73.25% No Yes

Cao et. al. [8] 85% (MF) 95%(LPF) Yes No
Proposed 90.2% (MF) 86.2% (LPF & Yes Yes
HPF)

The accuracy of the proposed method is compared with other methods in Table 5.2. Only the results
obtained by using uncompressed images as test images have been considered. The average accuracy
of proposed method for MF mentioned in Table 5.2 includes the accuracy of MF obtained using three
different window sizes i.e. 3×3, 5×5 and 7×7. It is to be noted that the individual accuracy of MF
obtained using the three windows are 95.2%, 90.4% and 85% respectively. Also, the average accuracy
of proposed method for linear filters (in Table 5.2) includes the accuracy of LPF Kernel 1, and HPF
Kernel 1 and Kernel 2. The individual accuracy of LPF Kernel 1, HPF Kernel 1 and HPF Kernel 2 are
96.2%, 83% and 79.4% respectively.

5.5 Summary

The method proposed in Chapter 4 to detect different filtering operations has been validated in this
chapter, by first setting the simulation particulars. Then, a statistical classifier has been designed using
the simulation particulars. This is followed by extensive simulations to check the effectiveness of the
classifier designed on the proposed method. From the simulation accuracies obtained, it is proved that
the proposed can be employed to detect linear and non-linear filtering operations.

35
CHAPTER 6

CONCLUSION AND FUTURE SCOPE

6.1 Conclusion
In the past two decades, field of communication has developed rapidly. Multimedia services and
technologies have augmented this development. Images have become an integral part of day-to-day
communication. They play a crucial role in transfer of information. At the same time, manipulation of
images has become facile and can be done for detrimental purposes. This can be harmful to the human
society. Thus, different types of digital forensic techniques have been developed to check the
authenticity of images which have been discussed in Chapter 2 of this report.

This project report is dedicated towards the development of a blind forensic technique which can be
used to detect non-filtering as well as linear filtering operations. Non-linear filtering operation studied
and detected is median filtering. To the best of our knowledge, the technique developed in Chapter 4
of this report is the first approach which uses features from both the spatial domain and frequency
domain, to detect linear and non-linear filtering operations.

The proposed method exploits streaking artifacts in spatial domain by the means of first order
difference image. Features from the histogram of First order difference image, of test image and its
median filtered image can determine whether test image lies in Class 1 or Class 2.

For specifically determining which filtering operation has been performed on image, frequency domain
feature is used. This feature is obtained from average histogram of high frequency DCT coefficients.

Through extensive simulations over large database, the effectiveness of this algorithm, which is using
a spatial and frequency domain feature was established. It was found that the proposed method has
achieved the maximum accuracy of 95.20% for median filtered images and is also suitable to separate
MF from other linear filtering operations performed on uncompressed images. For detection of low
pass and high pass filtering operations, the maximum accuracies achieved are 96.2% and 83%.

36
6.2 Future Scope

In this project, the algorithm developed to detect non-linear and linear filtering operations has been
tested on median filtered images, low pass filtered images (averaging) and high pass filtered images
obtained using two different Laplacian kernels. There is a scope of testing and further developing the
algorithm for other low pass and high pass filtering kernels.

The algorithm can be expanded for detection of histogram equalization which is also a non-linear
filtering operation.

The classifier designed for obtaining the results is not efficient. Also, the algorithm developed is not a
single but a multi-stage process and will result in inefficient simulation when done with the help of
SVM classifier. This is because it will require SVMs for each stage cascaded together. To avoid
cascaded classifiers, Self-Organizing Maps (SOM) training can be employed for such algorithms.

37
 REFERENCES
[1] Pawel Korus, “Digital image integrity – a survey of protection and verification techniques”,
Elsevier, Digital Signal Processing, pp. 1-26, Vol. 71, September 2017.
[2] Xiang Lin, Jian-Hua Li, Shi-Lin Wang, Alan-Wee-Chung Liew, Feng Cheng and Xiao-Sa Huang,
“Recent Advances in Passive Digital Image Security Forensics: A Brief Review”, Elsevier,
Engineering, pp. 29-39, Vol. 4, February 2018.
[3] M Kirchner and J Fridrich, “On Detection of Median Filtering in Digital Images”, SPIE, Electron
Imaging, Media Forensics and Security II, pp. 1-12, Vol. 7541, 2010.
[4] Xinlu Gui, Xiaolong Li, Wenfa Qi and Bin Yang, “Blind Median Filtering Detection Based on
Histogram Features”, Asia-Pacific Signal and Information Processing Association (APSIPA
2014).
[5] Yongzhen Ke, Fan Qin, Weidong Min and Qiang Zhang, “An Efficient Blind Detection Algorithm
of Median Filtered Image”, International Journal of Hybrid Information Technology, pp. 181-192
Vol. 8, January 2015.
[6] Kang Hyeon Rhee, “Median filtering detection using variation of neighboring line pairs for image
forensics”, Journal of Electronic Imaging, Vol. 25, September/October 2016.
[7] Xiangui Kang, MatthewC. Stamm, Anjie Peng and K.J.Ray Liu, “Robust Median Filtering
Forensics Using an Autoregressive Model”, IEEE Transactions On Information Forensics And
Security, pp. 1456-1468, Vol. 8, September 2013.
[8] Gang Cao, Yao Zhao, Rongrong Ni, Lifang Yu and Huawei Tian, “Forensic Detection of Median
Filtering in Digital Images”, IEEE International Conference on Multimedia & Expo (ICME 2010),
August 2010.
[9] Hai-Dong Yuan, “Blind Forensics of Median Filtering in Digital Images”, IEEE Transactions on
Information Forensics and Security, pp. 1335-1345, Vol. 6, December 2011.
[10]Chenglong Chen, Jiangqun Ni, Rongbin Huang, and Jiwu Huang, “Blind Detection of Median
Filtering in Digital Images: A Difference Domain Based Approach”, Springer-Verlag Berlin
Heidelberg 2013, pp. 1-15, 2013.
[11]Valentine Conotter, Pedro Comesana, and Fernando Perez-Gonzalez, “Forensic detection of
processing operator chains: recovering the history of filtered JPEG images”, IEEE Transactions on
Information Forensics and Security, Vol. 11 , November 2015.
[12] Muhammad Ali Qureshi and Mohamed Deriche, “A bibliography of Pixel-based Image
Forgery Detection Techniques”, Elsevier, Signal Processing: Image Communication, pp. 46-74, Vol.
39, 2015.
[13] D. Lou and J. Liu, “For Resilient and Compression Tolerant Digital Signature for Image
Authentication”, IEEE Transaction on Consumer Electronics, pp. 31-39, Vol. 46, January 2000. [14]
Ken Cabeen and Peter Gent, “Image Compression and the Discrete Cosine Transform”,
http://booksc.org/s/?q=Image+Compression+and+the+Discrete+Cosine+Transform&t=0.
[15] Rafael C. Gonzalez and Richard E. Woods, “Digital Image Processing”, Tom Robbins, Second
Edition, 2002

38
[16] From-http://www.farehawker.com/About?The=Malaysia-Airlines-Flight-Ticket-Booking
[17]From-https://www.google.co.in/amp/s/www.socialpilot.co/blog/151-amazing-social-
mediastatistics-know-2017%%3fhs_amp=true#
[18] https://images.google.com/imgres?imgurl=http%3A%2F%2Fwww.bycornelia.com%2Fwpcontent%
2Fuploads%2F2011%2F03%2Fretusch3.png&imgrefurl=http%3A%2F%2Fwww.bycorneli
a.com%2Fportfolio%2Fphotography%2Fretouch&docid=d2BW3EUIXbo4DM&tbnid=15FMYdBo
UkEY2M%3A&vet=1&w=835&h=321&hl=en-sa&source=sh%2Fx%2Fim
[19] https://www.researchgate.net/figure/Example-of-copy-move-forgery-a-Original-image-
bhttps://www.researchgate.net/figure/Example-of-copy-move-forgery-a-Original-image-b-Forged-image-
duplicated-object_fig1_317495890Forged-image-duplicated-object_fig1_317495890
[20]http://www.computerscijournal.org/wpcontent/uploads/2016/02/Vol09_No1_Neur_Gau_Fig1.jp
g

39
 APPENDIX

Fig. (a) Image of flowers from UCIDv2 database

Fig. (b) Image of birds from UCIDv2 database

40
Fig. (c) Image of nature from UCIDv2 database

Fig. (d) Image of buildings from UCIDv2 database

41
 Fig. (e) Image of soft toy from UCIDv2 database

Fig. (f) Image of showpiece from UCIDv2 database

42