Practical methods for digital video forensic authentication

Transcription

1 Practical methods for digital video forensic authentication Jinhua Zeng, * Shaopei Shi, Yan Li, Qimeng Lu, Xiulian Qiu Institute of Forensic Science, Ministry of Justice, Shanghai , China *Corresponding Author Abstract With more and more emphasis on dairy security surveillance and lower cost of video recording devices, digital videos have been an important multimedia for case examination, evidence demonstration, and security surveillance. The forensic authentication of digital videos has become an important part of multimedia forensic examination, and has been of important significance and value both in theory research and practical applications. In this paper, the state-of-the-arts of the standard development in digital video forensic authentication in China were introduced. The advance of the academic research in video forensic authentication was described. After that, practical methods for video forensic authentication were analyzed and discussed in the point of examinations on video metadata, contents, attached audios and camcorder forensic identification. Finally feasible solutions and future trends of practical video forensic authentication were summarized. Our work would provide practical guidances for related examiners and researchers in future case examinations and theoretical research. Keywords: Digital video, Forensic authentication, Digital forensics, Pattern recognition, Camcorder forensic identification 1. Introduction With more and more important roles of digital video materials in case investigation, proof of evidence, and security surveillance, the authentication of digital video materials has been an essential problem which is in large focuses. Nowadays, main video editors include Adobe Premiere, Sony Vegas, Corel VideoStudio, etc. People are more familiar with these editors and have more chances to use them in practice. All of these factors contribute to demands of developing corresponding policies, regulations, and scientific methods for digital video forensic authentication. In China, current technical specifications for digital video forensic authentication include General Specification for Audio-Video Forensic Examination (No. SF/Z JD ) and its essential parts Specification for Video Forensic Examination (No. SF/Z JD ), Specification for Audio Forensic Examination (No. SF/Z JD ). All were issued in 2010 by Ministry of Justice, China. For the guidance of data recovery operations in the process of device examination during digital video forensic authentication, General Specification for Digital Science Forensics (No. GA/T ) issued in 2012 by Ministry of Public Security, China, and General Specification for Digital Forensics (No. SF/Z JD ) issued in 2014 by Ministry of Justice, China, could be used. In this paper, we focus on the analysis of the practical methods applied in digital video forensic authentication, which can be summarized as metadata examination, video content examination, attached audio examination, digital camcorder forensic identification, etc. The main problems and challenges encountered in practical case examination with regard to video authentication were then discussed. Finally, the feasible solutions for digital video forensic authentication and future trends were described. The main goal of the paper is to provide practical guidance and comprehensive analysis for related examiners and researchers in future case examinations and theoretical research. 2. Related works One digital video can be disassembled into a frame collection and its temporally sequential relationships, which is encoded by specific algorithms into a data set with certain formats. Researchers made full uses of these inherent features of the digital videos, and proposed lots of methods, which International Journal of Digital Content Technology and its Applications(JDCTA) Volume 9, Number 1, February

2 could be categorized into intra-frame and inter-frame based examination methods [1], or coding-related and content-related detection methods. The core principle of the frame-based detection methods was that inherent patterns were extracted in each frame and then were built into pattern sequences. After that, the continuity, similarities or differences of the elements in the sequence were analyzed to detect tampering, such as the method proposed in [2]. The encoding algorithms of videos might affect effectiveness and stability of extracted pattern features. The methods of coding artifact detection were mainly focused on coding parameter identification and multi-compression artifact detection in specific compression algorithms, such as MPEG [3][4], etc. In addition, camcorder identification by video recording analysis was widely concerned and was considered as a valuable method for practical applications. In the camcorder identification, the main works were concentrated in the extraction of background noises from recorded videos, which were originated by used camcorders. Kurosawa et al. [5] firstly proposed a method for camcorder identification by extraction of additive noises from CCD chips, which were fixed pattern noises physically induced by chip dark-current. Through the detection of defected pixels in imaging sensors, Geradts et al. [6] offered a method to identify the source of a given video. With the advances of device manufacture and post-processing techniques, more and more camcorder artifacts were concealed and made indiscoverable. Later, a stronger and more reliable fingerprint of camcorders was proposed, which was called photo-response non-uniformity (PRNU) noise pattern [7,8]. Nowadays, the PRNU pattern was widely applied in video doctoring detection both in academic research and forensic tool development, such as PRNU Compare [9], as shown in Figure 1. Figure 1. The main window of the PRNU Compare 3. Practical methods for digital video forensic authentication In China, digital video forensic authentication must follow certain technical specifications described above. The methods used in practical case examination should be tested and verified, and were approved by experts. 24

3 3.1. Video metadata examination In this paper, we further divided video metadata into video attribute data and digital attribute data. Video metadata examination should be comprehensive and accurate. Video attribute data covered the information with regard to the codec and contents, such as codec ID, duration, etc. A typical video attribute data of a given video recording was shown in figure 2. Figure 2. A typical video attribute data of a given video recording Digital attribute data referred to other digital information apart from video attribute data in videos, such as the extra digital data added in the end of video data by specific video editors. Currently, the useful tools for video attribute data examination include MediaInfo, ExifInfo, etc. For the digital attribute data examination, the software of Winhex and Beyond Compare can be used. One video recorded by a Sony digital camcorder with 3 minutes and 13 seconds duration was edited by using Adobe Premier and Photoshop. Some video segments were deleted and some frames were replaced with doctored ones edited by Adobe Photoshop. After the above operations, the video was rebuilt by using the same parameters as possible as to the original one. Using the MediaInfo, we found that, comparing with the original video, several video attribute data were changed or erased, such as encoded time, encoding related GOP parameter and used matrix coefficients, as shown in figure 3. In addition, by using Winhex, we found extra data were added in the end of the video, such as the 25

4 information of the used editors Adobe Photoshop CS5 and Adobe Premier Pro, as shown in figure 4. Figure 3. The video attribute data difference between the original video (a) and the doctored one (b) 26

5 Figure 4. The abnormal digital attribute data found in the doctored video 3.2. Video content examination According to examination contents and used methods, video content examination could be categorized into macroscopic and microscopic examinations. In the macroscopic examination, one video was considered as a unit, and was played by using corresponding players in the examination. Experts watched the video carefully in the visual inspection, analyzed and evaluated its continuity, rationality and consistency. Video examination consisted of the inspection both in semantic and imaging levels. In the continuity examination, one intact video usually had a progressive story and the steady intra-frame and inter-frame changes. Any abnormal interruption or discontinuity may indicate forgery. Rationality inspection mainly focused on the feasibility and possibility of video imaging and contents. Moreover, since the resolution and shooting performances of videos were largely depended on used camcorders, the image quality of questioned videos should be matched with the alleged recording devices. Any illogical event presented in questioned videos might mean artificial modification, such as some scenes in science fiction films, as shown in Fig. 5. Consistency examination inspected conformity of video contents in the contextual, and the matching between video contents and the proved evidence in the cases. 27

6 Figure 5. The artificial scene in the movie Upside Down issued in 2012 In the microscopic examination, questioned videos were further disassembled into frames. The basic unit in the examination was the video frames. The general steps in the microscopic examination included frame acquisition and frame-based image forensic authentication. Some image enhancement operations could be used, such as image super-resolution, alignment of image intensity, etc. The pattern recognition methods, such as copy-move detection, could also be applied to find abnormities. To sum up, in the video content examination, the macroscopic inspection was a basic and essential part for video forensic authentication, which can preview and select the region of interest for the subsequent microscopic examination. Meanwhile, the later offers a more detailed inspection of videos Attached audio examination Audio information is an important part of videos. Its authentication examination offers an essential point for video forensic authentication. First of all, we have to discern whether or not there are attached audio data in videos. The direct method for this problem is through auditory inspection by using specific video players. Note that the metadata examination cannot solve the question well because of vast varieties of video coding formats. In addition, in the auditory inspection, we must select specific video players. For example, for videos with suffix of.dav, Smart Player is a rational player for information decoding in the auditory inspection, while some other players can only properly decode image information but not audio data. For the audio forensic authentication, researchers have proposed many of solutions for it. The audio recording consists of target voices, device-related pattern noises and recording environment-related noises [10]. Target voice authentication can be implemented in the process of human voice forensic identification. Device-related pattern noises can be identified through audio recording device forensic identification. With regard to recording environments, environmental elements may include the recording time and location. The electric network frequency criterion was used to evaluate the recording time of questioned audio materials [11,12]. Acoustic reverberation effects were applied to analyze the spatial configuration of audio recording locations [13]. In addition, audio coding artifacts were also used to detection forgeries, such as multi-compression detection [14], etc. Currently, the normal methods in the practice of audio authentication examination include auditory inspection, audio metadata examination, audio recording device forensic identification, and some other pattern recognition methods based on statistical feature computation, such as Fourier coefficient computation [15], higher-order statistics [16], etc. The state-of-the-arts and detailed practical methods 28

7 for this problem can be referred to [10]. In addition, the mutual relationship between the video and audio information should also be noted Camcorder forensic identification Camcorder forensic identification is to analyze features of the questioned video and the alleged recording device. The features may include metadata, video imaging features, pattern noises, etc. As described above, metadata should cover the video attribute data and digital attribute data. Video imaging features may be resorted to factors such as video quality, visual and auditory flickers, etc. Pattern noises could be computed by statistical methods, and currently the PRNU pattern noise is a feasible measure for camcorder forensic identification although the video compression operations and low-quality of videos could hinder its identification. What s more, the digital data forensic examination methods, such as data recovery, are also valuable tools to evaluate the authentication of questioned videos. The data recovery can be implemented in the alleged camcorder to find the original one as far as possible. In some cases, a questioned video was provided for authentication examination, however, a different video with similar contents was found in the alleged camcorder through data recovery. 4. Future challenges and trends Currently, there are various digital video formats in the markets. Video manufacturers usually draw up their own video formats through the package, modification or encryption of original video coding standards. The varieties of video encoding formats make video normal operations such as decoding and frame acquisition, more difficult in the practice of video forensic examination. It is still absent of video processing software which could deal with lots of different encoded videos. Many dominant and mature video players, which could load decoders according to different video formats, didn t have perfect and user-friendly functions for video processing. The compromising implementation is through screen duplication. The questioned video was firstly decoded by using video players and was shown in the screen, and then interested images were continuously captured and saved in a lossless or limited loss video encoding formats. The limitations of the above operations may include distortion of video images and consume large amounts of storage spaces. With the advance of digital video editors, the practices of video forensic authentication must resort to more techniques and methods for abnormal artifact detection of doctored videos. The methods used in digital forensics would be valuable ones to inspect the authentication of digital video materials. On the one hand, the digital attribute data examination using Winhex, etc. should be emphasized in practices. On the other hand, the operation of data recovery in digital camcorders is also worth a try. Currently, most practical methods for video forensic authentication are manual dependence and are heavily relied on expert experiences. Once dealing with videos with long duration, the workload in the examination would be heavy onerous, which could cause artificial negligence and mistakes during the practice. The automatic techniques introduced in the fields of artificial intelligence and pattern recognition would offer a prospective and feasible solution. The outcomes in the study of camcorder forensic identification, coding artifact analysis, and copy-move detection all can be applied in practice. The mature commercial products for automatic video authentication examination are expectable. In the future, the multidisciplinary methods, such as digital forensics, will be promoted. The methods applied in video forensic authentication will be manual and automatic coexistence and codependence. 5. Acknowledgements This work was supported by Grants from the National Science and Technology Pillar Program during the 12th Five-Year Plan Period of China [2012BAK16B06], Ministry of Finance, PR China [GY2014G-2 and GY2013G-3], and Institute of Forensic Science, Ministry of Justice, PR China [GY2014Z-3]. 29

8 6. References [1] Simone Milani, Marco Fontani, Paolo Bestagini, Mauro Barni, Alessandro Piva, Marco Tagliasacchi and Stefano Tubaro. An overview on video forensics. APSIPA Transactions on Signal and Information Processing, 1, e2, [2] Mondaini, N.; Caldelli, R.; Piva, A.; Barni, M.; Cappellini, V.: Detection of malevolent changes in digital video for forensic applications, in Proc. Of SPIE, Security, Steganography, and Watermarking of Multimedia Contents IX, E.J.D.III and P.W.Wong, eds., vol.6505, no.1, SPIE, 2007, 65050T. [3] W. Wang, H. Farid. Exposing digital forgeries in video by detecting double MPEG compression, in MM&Sec, S.Voloshynovskiy, J. Dittmann, and J. J. Fridrich, eds., ACM, 2006, [4] Wang, W.; Farid, H.: Exposing digital forgeries in video by detecting double quantization, in Proc. 11th ACM Workshop on Multimedia and Security, MM&Sec 09, ACM, New York, NY, 2009, [5] K. Kurosawa, K. Kuroki, and N. Saitoh. Ccd fingerprint method identification of a video camera from videotaped images. In ICIP99, pages Kobe, Japan, [6] Z.J.Geradts, J.Bijhold, M.Kieft, K.Kurosawa, K.Kuroki, and N. Saitoh. Methods for identification of images acquired with digital cameras. SPIE, Enabling Technologies for Law Enforcement and Security, 4232: , [7] J. Lukas, J. Fridrich, and M. Goljan. Digital camera identification from sensor pattern noise. IEEE Transactions Information Forensics and Security, 1(2): , [8] M. Chen, J. Fridrich, M. Goljan, and J. Lukas. Source digital camcorder identification using sensor photo response non-uniformity. SPIE, Electronic Imaging, Security, Steganography, and Watermarking of Multimedia Contents IX, 6505:1G 1H, January 28-February [9] PRNU Compare, [10] J. Zeng, S. Shi, X. Yang, J. Xi, X. bian, Y. LI, and Q. Lu, The state of the art in digital audio forensic authentication, Chinese Journal of Forensic Science, 75:57-61, [11] Grigoras C. Digital audio recording analysis: The electric network frequency criterion. Forensic Science International, 2005, 12(1). [12] Huijbregtse M, Geradts Z. Using the ENF criterion for determining the timing of recording of short digital audio recordings. Proc. 3rd International Workshop Computational Forensics, Springer-Verlag, 2009: [13] Malik H, Farid H. Audio forensics from acoustic reverberation. Proc. IEEE Int. Conf. Acoustics, Speech, and Signal Processing, [14] Liu Q, Sung A H, Qiao M. Detection of double MP3 compression. J. Cognitive Computing, 2010, 2(4): [15] Buchholz R, Kraetzer C, Dittman J. Microphone Classification Using Fourier Coefficients. Information Hiding, LNCS 5806, Springer, 2009: [16] Malik H, Miller J W. Microphone identification using higher-order statistics, AES 46th international conference, Denver, USA,