• International Journal of Computer Science & Network Security
• /
• v.21 no.9
• /
• pp.203-211
• /
• 2021

Image tampering detection and localization have become an active area of research in the field of digital image forensics in recent times. This is due to the widespread of malicious image tampering. This study presents a new method for image tampering detection and localization that combines the advantages of dilated convolution, residual network, and UNET Architecture. Using the UNET architecture as a backbone, we built the proposed network from two kinds of residual units, one for the encoder path and the other for the decoder path. The residual units help to speed up the training process and facilitate information propagation between the lower layers and the higher layers which are often difficult to train. To capture global image tampering artifacts and reduce the computational burden of the proposed method, we enlarge the receptive field size of the convolutional kernels by adopting dilated convolutions in the residual units used in building the proposed network. In contrast to existing deep learning methods, having a large number of layers, many network parameters, and often difficult to train, the proposed method can achieve excellent performance with a fewer number of parameters and less computational cost. To test the performance of the proposed method, we evaluate its performance in the context of four benchmark image forensics datasets. Experimental results show that the proposed method outperforms existing methods and could be potentially used to enhance image tampering detection and localization.

• Journal of the Korea Society of Computer and Information
• /
• v.26 no.12
• /
• pp.111-121
• /
• 2021

As the main carrier of information, digital image is becoming more and more important. However, with the popularity of image acquisition equipment and the rapid development of image editing software, in recent years, digital image counterfeiting incidents have emerged one after another, which not only reduces the credibility of images, but also brings great negative impacts to society and individuals. Image copy-paste tampering is one of the most common types of image tampering, which is easy to operate and effective, and is often used to change the semantic information of digital images. In this paper, a method to protect the authenticity and integrity of image content by studying the tamper detection method of image copy and paste was proposed. In view of the excellent learning and analysis ability of deep learning, two tamper detection methods based on deep learning were proposed, which use the traces left by image processing operations to distinguish the tampered area from the original area in the image. A series of experimental results verified the rationality of the theoretical basis, the accuracy of tampering detection, location and classification.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.31 no.4
• /
• pp.661-674
• /
• 2021

Malware, such as a rootkit that modifies the kernel, can adversely affect the analyst's judgment, making the analysis difficult or impossible if a mechanism to evade memory analysis is added. Therefore, we plan to preemptively respond to malware such as rootkits that bypass detection through advanced kernel modulation in the future. To this end, the main structure used in the Windows kernel was analyzed from the attacker's point of view, and a method capable of modulating the kernel object was applied to modulate the memory dump file. The result of tampering is confirmed through experimentation that it cannot be detected by memory analysis tool widely used worldwide. Then, from the analyst's point of view, using the concept of tamper resistance, it is made in the form of software that can detect tampering and shows that it is possible to detect areas that are not detected by existing memory analysis tools. Through this study, it is judged that it is meaningful in that it preemptively attempted to modulate the kernel area and derived insights to enable precise analysis. However, there is a limitation in that the necessary detection rules need to be manually created in software implementation for precise analysis.

• Journal of Internet of Things and Convergence
• /
• v.9 no.6
• /
• pp.23-28
• /
• 2023

Windows operating system generates various logs with timestamps. Timestamp tampering is an act of anti-forensics in which a suspect manipulates the timestamps of data related to a crime to conceal traces, making it difficult for analysts to reconstruct the situation of the incident. This can delay investigations or lead to the failure of obtaining crucial digital evidence. Therefore, various techniques have been developed to detect timestamp tampering. However, there is a limitation in detection if a suspect is aware of timestamp patterns and manipulates timestamps skillfully or alters system artifacts used in timestamp tampering detection. In this paper, a method is designed to detect changes in timestamps, even if a suspect alters the timestamp of a file on a storage device, it is challenging to do so with precision beyond millisecond order. In the proposed detection method, the first step involves verifying the timestamp of a file suspected of tampering to determine its write time. Subsequently, the confirmed time is compared with the file size recorded within that time, taking into consideration the performance of the storage device. Finally, the total capacity of files written at a specific time is calculated, and this is compared with the maximum input and output performance of the storage device to detect any potential file tampering.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.7 no.11
• /
• pp.2941-2956
• /
• 2013

In this paper, we propose an effective fragile image watermarking scheme for tampering detection and content recovery. Cover image is divided into a series of non-overlapping blocks and a block mapping relationship is constructed by the secret key. Several DCT coefficients with direct current and lower frequencies of the MSBs for each block are used to generate the reference bits, and different coefficients are assigned with different bit numbers for representation according to their importance. To enhance recovery performance, authentication bits are generated by the MSBs and the reference bits, respectively. After LSB substitution hiding, the embedded watermark bits in each block consist of the information of itself and its mapping blocks. On the receiver side, all blocks with tampered MSBs can be detected and recovered using the valid extracted reference bits. Experimental results demonstrate the effectiveness of the proposed scheme.

• Proceedings of the Korean Society of Broadcast Engineers Conference
• /
• 2017.06a
• /
• pp.63-65
• /
• 2017

This paper proposes a detection algorithm of video tampering by investigating the change of HEVC coding pattern. When a part of video is deleted and re-compressed, the characteristic patterns are generated by forgery. The proposed algorithm uses these patterns to classify whether video is forged. Experimental results show that the proposed method detects video forgery effectively.

• IEMEK Journal of Embedded Systems and Applications
• /
• v.17 no.6
• /
• pp.309-317
• /
• 2022

In this paper, we propose a machine learning-based copy-move forgery detection network with dual branches. Because the rotation or scaling operation is frequently involved in copy-move forger, the conventional convolutional neural network is not effectively applied in detecting copy-move tampering. Therefore, we divide the input into rotation-invariant and scaling-invariant features based on the wavelet coefficients. Each of the features is input to different branches having the same structure, and is fused in the combination module. Each branch comprises feature extraction, correlation, and mask decoder modules. In the proposed network, VGG16 is used for the feature extraction module. To check similarity of features generated by the feature extraction module, the conventional correlation module used. Finally, the mask decoder model is applied to develop a pixel-level localization map. We perform experiments on test dataset and compare the proposed method with state-of-the-art tampering localization methods. The results demonstrate that the proposed scheme outperforms the existing approaches.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2010.11a
• /
• pp.1118-1121
• /
• 2010

With the advent of cell phone digital cameras, and sophisticated photo editing software, digital images can be easily manipulated and altered. Although good forgeries may leave no visual clues of having been tampered with, they may, nevertheless, alter the underlying statistics of an image. Most digital camera equipped in cell phones employ a single image sensor in conjunction with a color filter array (CFA), and then interpolates the missing color samples to obtain a three channel color image. This interpolation introduces specific correlations which are likely to be destroyed when tampering with an image. We quantify the specific correlations introduced by CFA interpolation, and describe how these correlations, or lack thereof, can be automatically detected in any portion of an image. We show the efficacy of this approach in revealing traces of digital tampering in lossless and lossy compressed color images interpolated with several different CFA algorithms in test cell phones.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.8 no.6
• /
• pp.2005-2021
• /
• 2014

This paper proposes a novel image authentication scheme, aiming at tampering detection for block truncation coding (BTC) compressed image. The authentication code is generated by using the random number generator with a seed, and the size of the authentication code is based on the user's requirement, with each BTC-compressed image block being used to carry the authentication code using the data hiding method. In the proposed scheme, to obtain a high-quality embedded image, a reference table is used when the authentication code is embedded. The experimental results demonstrate that the proposed scheme achieves high-quality embedded images and guarantees the capability of tamper detection.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.13 no.8
• /
• pp.4005-4025
• /
• 2019

Copy-move forgery (CMF) in digital images is a detrimental tampering of artefacts that requires precise detection and analysis. CMF is performed by copying and pasting a part of an image into other portions of it. Despite several efforts to detect CMF, accurate identification of noise, blur and rotated region-mediated forged image areas is still difficult. A novel algorithm is developed on the basis of quaternion polar complex exponential transform (QPCET) to detect CMF and is conducted involving a few steps. Firstly, the suspicious image is divided into overlapping blocks. Secondly, invariant features for each block are extracted using QPCET. Thirdly, the duplicated image blocks are determined using k-dimensional tree (kd-tree) block matching. Lastly, a new technique is introduced to reduce the flat region-mediated false matches. Experiments are performed on numerous images selected from the CoMoFoD database. MATLAB 2017b is used to employ the proposed method. Metrics such as correct and false detection ratios are utilised to evaluate the performance of the proposed CMF detection method. Experimental results demonstrate the precise and efficient CMF detection capacity of the proposed approach even under image distortion including rotation, scaling, additive noise, blurring, brightness, colour reduction and JPEG compression. Furthermore, our method can solve the false match problem and outperform existing ones in terms of precision and false positive rate. The proposed approach may serve as a basis for accurate digital image forensic investigations.