Thèses sur le sujet « Multimedia forensic »

Distribution of video contents over the Internet has increased drastically over the past few years. With technological advancements and emergence of social media services, video content sharing has grown exponentially. An increased number of cyber crimes today belong to possession or distribution of illegal video contents over the Internet. Therefore, it is crucial for forensic examiners to have the capability of recovering and analyzing illegal video contents from seized storage devices. File carving is an advanced forensic technique used to recover deleted contents from a storage device even when there is no file system present. After recovering a deleted video file, its contents have to be analyzed manually in order to classify them. This is not only very stressful but also takes a large amount of time. In this thesis we propose a carving approach for streaming multimedia formats that allows forensic examiners to recover individual frames of a video file as images. The contents of these images then can be classified using existing techniques for forensic analysis of image sets. A carving tool based on this approach is developed for MPEG-1 video files. A number of experiments are conducted to evaluate performance of the tool. For each experiment an MPEG-1 file with different encoding parameters is used. Moreover, each experiment contains 18 runs and with each run chunk size of the input MPEG-1 file is varied in order to create different amount of disk fragmentation For video only MPEG-1 files, 87.802 % frames are fully recovered when the chunk size is equal to 124 KB. Where as in the case of MPEG-1 files containing both audio and video data 90.55 % frames are fully recovered when the chunk size is 132 KB.

Forensic Science, which concerns the application of technical and scientific methods to justice, investigation and evidence discovery, has evolved over the years to the birth of several fields such as Multimedia Forensics, which involves the analysis of digital images, video and audio contents. Multimedia data was (and still is), altered using common editing tools such as Photoshop and GIMP. Rapid advances in Deep Learning have opened up the possibility of creating sophisticated algorithms capable of manipulating images, video and audio in a “simple” manner causing the emergence of a powerful yet frightening new phenomenon called deepfake: synthetic multimedia data created and/or altered using generative models. A great discovery made by forensic researchers over the years concerns the possibility of extracting a unique fingerprint that can determine the devices and software used to create the data itself. Unfortunately, extracting these traces turns out to be a complicated task. A fingerprint can be extracted not only in multimedia data in order to determine the devices used in the acquisition phase, or the social networks where the file was uploaded, or recently define the generative models used to create deepfakes, but, in general, this trace can be extracted from evidences recovered in a crime scene as shells or projectiles to determine the model of gun that have fired (Forensic Firearms Ballistics Comparison). Forensic Analysis of Handwritten Documents is another field of Forensic Science that can determine the authors of a manuscript by extracting a fingerprint defined by a careful analysis of the text style in the document. Developing new algorithms for Deepfake Detection, Forensic Firearms Ballistics Comparison, and Forensic Handwritten Document Analysis was the main focus of this Ph.D. thesis. These three macro areas of Forensic Science have a common element, namely a unique fingerprint present in the data itself that can be extracted in order to solve the various tasks. Therefore, for each of these topics a preliminary analysis will be performed and new detection techniques will be presented obtaining promising results in all these domains.

Thesis (Ph. D.) -- University of Maryland, College Park, 2008.
Thesis research directed by: Dept. of Electrical and Computer Engineering. Title from t.p. of PDF. Includes bibliographical references. Published by UMI Dissertation Services, Ann Arbor, Mich. Also available in paper.

Digital images and videos used in the investigation of a crime often undergo several concurrent enhancement operations for improved analysis by humans or automated systems. When applying multiple image processing techniques to an image, the order and method in which processes are applied can have a profound impact on the result. However, the effect that one enhancement algorithm will have when applied in conjunction with another is not always obvious. When applied incorrectly, at best, there will be a negative impact to the amount of information that can be extracted from an image. At worst, the information contained in a processed image could be misrepresented. This thesis proposes a tool independent workflow for forensic image enhancement with a strong emphasis on an order of operations that maximizes the efficacy of each enhancement technique while observing the responsibilities and best practices of the forensic science community. This work will be useful for developing an understanding of common image enhancement techniques, understanding how these techniques relate to forensic science, and aiding in the creation of quality assurance standards for forensic image enhancement. Chapter 1 gives an introduction to image enhancement and discusses its role in forensic science and litigation. Chapter 2 summarizes the digital image creation process and its relationship to the human visual system. Chapter 3 reviews the most commonly used image enhancement techniques, including their theoretical background, strengths, and limitations. Chapter 4 introduces a framework for image enhancement and the rationale behind it through a series of practical examples.

Forensic multimedia is the specific term for computer simulation and computer animation presented as evidence in a court of law. Since its first use in the courtroom in the early 1990's, many high profile legal teams have used forensic multimedia to present arguments to reproduce an occurrence of events. Since that time, significant literature has been written on the use of forensic multimedia in the courtroom specifically targeted “towards the legal aspects of inclusion of the media as evidence, and rules and regulations about its admissibility. Special courtrooms have been developed to facilitate the use of multimedia, yet there has been no published research on the subject of the capabilities of lawyers to understand the process and address the educational aspects of the medium. The author's goal for this dissertation was the evaluation of the use of forensic multimedia in the greater Atlanta legal community. The study includes research on the use of forensic multimedia in the target area, a usability evaluation of a forensic multimedia product, a survey of southern US law school curricula as to the inclusion of forensic multimedia conceptual training in the programs, and a survey of the capabilities of lawyers in the target area as to their understanding of the multimedia process and use of forensic multimedia in the courtroom. Results of the research indicate a lack of formal education by law schools in the concepts and use of forensic multimedia. A survey of legal professionals confirms that lawyers are unfamiliar with the components and methodologies of use of the media. In addition, usability research of forensic multimedia software indicates areas for usability improvement.

Thanks to their huge expressive capability, coupled with the widespread use of the Internet and of affordable and high quality cameras and computers, digital multimedia represent nowadays one of the principal means of communication. Besides the many benefits, the wide proliferation of such contents has lead to problematic issues regarding their authen- ticity and security. To cope with such problems, the scientific community has focused its attention on digital forensic techniques. The objective of this doctoral study is to actively contribute to this field of research, developing efficient techniques to protect digital contents and verify their integrity. Digital Watermarking has been initially proposed as a valuable instrument to prove con- tent ownership, protect copyright and verify integrity, by imperceptibly embedding a mes- sage into a documents. Such message can later be detected and used to disclose possible copyrights violations or manipulations. For specific applications, such as copyright pro- tection, the watermark is required to be as robust as possible, surviving possible attack a malevolent user may be willing to apply. In light of this, we developed a novel watermark- ing benchmarking tool able to evaluate the robustness of watermarking techniques under the attack of multiple processing operators. On the other hand, for specific applications, such as forensic and medical, the robustness requirement is overtaken by integrity preser- vation. To cope with this aim, fragile watermarking has been developed, assuming that the watermark is modified whenever a tampering occurs, thus its absence can be taken as ev- idence of manipulation. Among this class of techniques, we developed a prediction-based reversible watermarking algorithm, which allows a perfect recovery of both the original content and the watermark. More recently, passive forensics approaches, which work in absence of any watermark or special hardware, have been proposed for authentication purposes. The basic idea is that the manipulation of a digital media, if performed properly, may not leave any visual trace of its occurrence, but it alters the statistics of the content. Without any prior knowledge about the content, such alterations can be revealed and taken as evidence of forgery. We focused our study on geometric-based forensic techniques both for images and videos au- thentication. Firstly we proposed a method for authenticating text on signs and billboards, based on the assumption that text on a planar surface is imaged under perspective projec- tion, but it is unlikely to satisfy such geometric mapping when manipulated. Finally, we proposed a novel geometric technique to detect physically implausible trajectories of ob- jects in video sequences. This technique explicitly models the three-dimensional trajectory of objects in free-flight and the corresponding two-dimensional projection into the image plane. Deviations from this model provide evidence of manipulation.

Thesis (Ph. D.) -- University of Maryland, College Park, 2004.
Thesis research directed by: Electrical Engineering. Title from t.p. of PDF. Includes bibliographical references. Published by UMI Dissertation Services, Ann Arbor, Mich. Also available in paper.

The increasing availability and pervasiveness of multimedia data in our society is before our very eyes. As a result of globalization and worldwide connectivity, people from all over the planet are exchanging constantly increasing amounts of images, videos, audio recordings on a daily basis. Coupled with the easy access to user-friendly editing software, this poses a number of problems related to the reliability and trustworthiness of such content, as well as its potential malevolent use. For this reason, the research field of multimedia forensics focuses on the development of forensic tools for verifying the authenticity of multimedia data. The hypothesis of pristine status of images, videos or audio tracks is called into question and can be rejected if traces of manipulation are detected with a certain degree of confidence. In this framework, studying traces left by any operation that could have been employed to process the data, either for malicious purposes or simply to improve their content or presentation, turns out to be of interest for a comprehensive forensic analysis. The goal of this doctoral study is to contribute to the field of multimedia forensics by exploiting intrinsic statistical and deterministic properties of multimedia data. With this respect, much work has been devoted to the study of JPEG compression traces in digital images, resulting in the development of several innovative approaches. Indeed, some of the main related research problems have been addressed and solution based on statistical properties of digital images have been proposed. In particular, the problem of identifying traces of JPEG compressions in images that have been decompressed and saved in uncompressed formats has been extensively studied, resulting in the design of novel statistical detectors. Given the enormous practical relevance, digital images in JPEG formats have also been considered. A novel method aimed at discriminating images compressed only once and more than once has been developed, and tested on a variety of images and forensic scenarios. Being the potential presence of intelligent counterfeiters ever increasingly studied, innovative counterforensic techniques to JPEG compression based on smart reconstruction strategies are proposed. Finally, we explore the possibility of defining and exploiting deterministic properties related to a certain processing operation in the forensic analysis. With this respect, we present a first approach targeted to the detection in one-dimensional data of a common data smoothing operation, the median filter. A peculiarity of this method is the ability of providing a deterministic response on the presence of median filtering traces in the data under investigation.

Nowadays, powerful and easy to use editing software which is available to almost everyone allows forgers to create convincing digital forgeries. As multimedia applications require a certain level of trust in the integrity and authenticity of the data become more common, there is an increasing need to restore some of the lost trustworthiness of digital media. In multimedia forensics, Digital Signature and Digital Watermarking have long been commonly used in video authentication, but these methods have proven to have shortcomings. The main drawback of these techniques is that information must generally be inserted at the time of video capture or before video broadcasting. Both techniques require two stages are: at the sender side and then at the receiver side, which in some real world applications is not feasible. For the problem of source type identification, digital fingerprints are usually extracted and then compared with a dataset of possible fingerprints to determine the acquisition devices. Photo-Response Non-Uniformity (PRNU), which is caused by the different sensitivity of pixels to the light, has proven to be a distinctive link between the camera and its images/videos. With this in mind, this thesis proposes several new digital forensic techniques to detect evidence of manipulations in digital video content based on blind techniques (Chapter 4 and Chapter 5) where there is no need for per-embedded watermarks or per-generated digital signature. These methods showed potential to be reliable techniques in digital video authentication based on the local video information. For the problem of determining the source of digital evidence, this thesis proposes a G-PRNU method (in Chapter 3) that overcomes the accuracy obtained in PRNU method in the problem of digital videos source type identification and it is less computationally expensive. Each proposed method was tested on a dataset of videos and detailed experimental results are presented.

Recent progress in professional policy and legislation at the federal level in the field of forensic science constructs a transformation of new outcomes for future experts. An exploratory and descriptive qualitative methodology was used to critique and examine Digital and Multimedia Science (DMS) as a justified forensic discipline. Chapter I summarizes Recommendations 1, 2, and 10 of the National Academy of Sciences (NAS) Report 2009 regarding disparities and challenges facing the forensic science community. Chapter I also delivers the overall foundation and framework of this thesis, specifically how it relates to DMS. Chapter II expands on Recommendation 1: “The Promotion and Development of Forensic Science,” and focuses chronologically on professional policy and legislative advances through 2014. Chapter III addresses Recommendation 2: “The Standardization of Terminology in Reporting and Testimony,” and the issues of legal language and terminology, model laboratory reports, and expert testimony concerning DMS case law. Chapter IV analyzes Recommendation 10: “Insufficient Education and Training,” identifying legal awareness for the digital and multimedia examiner to understand the role of the expert witness, the attorney, the judge and the admission of forensic science evidence in litigation in our criminal justice system. Finally, Chapter V studies three DME specific laboratories at the Texas state, county, and city level, concentrating on current practice and procedure.

The Forensic Science (sometimes shortened to Forensics) is the application of technical and scientific methods to the justice, investigation and evidence discovery domain. Specifically finding evidences can be trivial and in many fields is achieved with methods that exploits manual processes and the experience of the forensics examiner. Though human factor can be often discussed and the evidences collected and found without repeatable and scientific methods could be of no use in tribunal. For these reasons this thesis focus on the investigation and development of classification engine able to uniquely identify and classify evidences in a scientific and repeatable way: each decision is driven by features and is associated by a confidence number that is the evidence itself. Two application in two different domains of Ballistics will be described: Image Ballistics, that is the reconstruction of the history of an image, and Fire Weapon Ballistics, that is the identification of the Weapon that fired an investigated bullet from the imprintings left on the bullet cartridge. To understand how to solve these two real in-the-field problems, multimedia-based novel techniques will be presented with promising results both in Image and Classic Ballistics domain.

Esta tese discute o papel da Análise Forense de Imagens como reguladora de mídia digital na sociedade. Isto inclui um estudo com mais de 400 indivíduos para determinar suas capacidades de detectar edições em imagens. Os resultados desse experimento indicam que humanos são facilmente enganados por imagens digitais, tendo dificuldades em diferenciar entre imagens pristinas e editadas. A tese então analisa a efetividade do arsenal de análise forense de imagens contra o estado-da-arte de composição de imagens. Através da análise de padrões fundamentais de imagens, as técnicas forenses são capazes de detectar a presença da maioria das operações de composição testadas. A tese então apresenta uma abordagem alternativa para análise forense de imagens, baseada na geração automática de planos. Ao tratar o processo de inspeção de uma imagem como um plano composto de múltiplos passos, propusemos uma arquitetura que é capaz de indicar os passos necessários para analisar uma imagem. Os planos são baseados em uma modelagem formal do conhecimento e técnicas forenses, de modo que possam ser traduzidos em passos a serem executados. A tese então demonstra que os limites de tal abordagem dependem da dificuldade de validar tal solução. Isso é uma consequência da natureza dos problemas de análise forense de imagens: essencialmente, são problemas de confiança distribuída entre indivíduos com acesso limitado à informação. Essa configuração é analisada de diferentes perspectivas em busca dos limites práticos para a análise forense de imagens digitais. Os resultados dessa análise sugerem que a área falha em produzir soluções acessíveis para a sociedade não por limitações técnicas, mas pela falta de um engajamento multi-disciplinar. A tese então discute como paradoxos filosóficos surgem naturalmente em cenários de análise forense de imagens. A análise forense de imagens digitais lida, essencialmente, com comunicação humana e, como tal, está sujeita a todas suas complexidades. Finalmente, é argumentado que o caminho para construir soluções úteis para a sociedade requer um esforço coletivo de diferentes disciplinas do conhecimento. É responsabilidade da comunidade forense desenvolver uma teoria epistemológica comum e acessível para este projeto coletivo.
This thesis discusses the role of Digital Image Forensics as a regulator of digital media in society. This includes a perceptual study with over 400 subjects to assess their ability to notice editing in images. The results of such experiment indicate that humans are easily fooled by digital images, not being able to tell apart edited and pristine images. The thesis then analyzes the effectiveness of the available arsenal of digital image forensics technology to detect image editing performed by state-of-the-art image-compositing techniques. By analyzing fundamental image patterns, forensics techniques can effectively detect the occurrence of most types of image compositing operations. In response to these two studies, the thesis presents an alternative approach to digital image forensics, based on automated plan generation. By treating the image inspection process as a plan comprised of different steps, it proposes an architecture that is able to guide an analyst choosing the next best step for inspecting an image. The generated plans are flexible, adapting on the fly to the observed results. The plans are based on a formal modelling of current forensics knowledge and techniques, so that they can be translated in steps to be executed. The thesis then shows that the limits of such an approach lie in the difficulty to validate results, which is a consequence of the setup of forensics problems: they are problems of distributed trust among parties with limited information. This scenario is analyzed from different perspectives in search for the practical limits of Digital Image Forensics as a whole. The results of such an analysis suggest that the field is lacking in providing practical and accessible solutions to society due to limited engagement in multidisciplinary research rather than due to limited technical proficiency. The thesis then discusses how paradoxes from philosophy, mathematics, and epistemology arise naturally in both real forensics scenarios, and in the theoretical foundations of the field. Digital Image Forensics ultimately deals with human communication and, as such, it is subject to all its complexities. Finally, it is argued that the path for providing useful solutions for society requires a collective engagement from different disciplines. It is the responsibility of the forensics community to develop a common, accessible epistemological framework for this collective enterprise.

The amount of multimedia content shared everyday online recently underwent a dramatic increase. This, combined with the stunning realism of fake images that can be generated with AI-based technologies, undermines the trustworthiness of online information sources. In this work, we tackle the problem of preserving media trustworthiness online from two different points of view. The first one consists in assessing the human ability to spot fake images, focusing in particular on synthetic faces, which are extremely realistic and can represent a severe threat if used to disseminate fake news. A perception study allowed us to prove for the first time how people are more prone to question the reality of authentic pictures rather than the one of last-generation AI-generated images. Secondly, we focused on social media forensics: our goal is to reconstruct the history of an image shared or re-shared online as typically happens nowadays. We propose a new framework that is able to trace the history of an image over multiple sharings. This framework improves the state of the art and has the advantage of being easily extensible with new methods and thus adapt to new datasets and scenarios. In fact, in this environment of fast-paced technological evolution, being able to adapt is fundamental to preserve our trust in what we see.

Digital Forensics, and in a specific way Multimedia Forensics, has grown significantly in the last years. Digital Forensics is defined as the branch of Forensic Science which scientifically analyzes a digital evidence in order to obtain information about it. The Digital 2021 Global Overview Report 1 published in January 2021 certifies that the world’s population has reached the number of 7.83 billion. The 66.6% (i.e. 5.22 billion) use a mobile phone, the 59.5% (i.e. 4.66 billion) use internet and the 53.6% (i.e. 4.2 billion) are social media users. The same report declares that from 2015 to 2020 the daily time spent with social media increased of 34 minutes (it was 1 hours and 51 minutes in 2015) and that it’s destined to rise. In the described scenario the number of shared images, video and audio (or Multimedia) contents become difficult to manage. The described numbers and types of digital evidences have led to the birth of several fields of Digital Forensics, faced from different communities: Multimedia Security, Computer Forensics and Signal Processing. Image Forensics has the goal to obtain information about the most popular digital evidence: images. Developing new algorithms for forensic purposes was the main focus of my Ph.D.. In this thesis some advanced methods will be presented about two specific tasks: the first one is related to the Camera Model Identification (CMI) with the goal to identify the quantization table employed during the first JPEG compression; the second one exploits the image as the digitization of a real paper sheet in order to extract a unique fingerprint. Both the tasks produced relevant methods, widely compared with state-of-the-art to demonstrate their scientific goodness.

碩士
南華大學
資訊管理學系
101
With the mature development of video and audio streaming applications, the multimedia session streaming services have become one of the popular internet services. While using the session service, the session control channel is fixed and using a well-known port, but the data channel is using select a dynamical and unknown port. The data channel would be decided in the control messages. For SIP (Session Initiation Protocol) applications, the voice data channel would be aware from the SDP (Session Description Protocol) information of SIP messages. Therefore, it’s difficult to implement a digital forensics system for multimedia session streaming services. Because of the rapid development of network architecture, the speed and quality of networks is increasing continually, such as from traditional dial-up access networks to fiber optic networks. The malicious attack from internet becomes difficult to tracking and record the illegal network behavior. Many network security problems are spread. Thus, it has to be redrawn by using digital forensics system to diagnose and recover the security events. Digital forensics is also called computer forensics. The network situation and behavior of the security events would be replayed by using computer forensics technology. The network packets are captured in OLT (Optical Line Termination) by using a traditional network forensics for GPON (Gigabit-capable Passive Optical Networks). Due to the symmetrical network speed with 2.5Gbps, the forensics task could not be handled in the high-speed situation. Some packets could be lost and the forensics is incomplete. This thesis proposed a two-tier architecture of forensics system with distributed loading. The system components were developed: Snooping Agent, Analyzing Server, and Media Processing Server. The System is design for GPON environment. Snooping Agent on the ONU (Optical Network Unit) deals with the packet capturing of SIP control channel, and the captured SIP packets are sent to the back-end component (Analyzing Server). The port numbers of the data channels will be figured out by Analyzing Server. According the port numbers, the audio and video packets will be captured and delivered to Media Processing Server. All of the session information and users data is stored in database and presented with web interface for event search. This thesis presented the two-tier structure of forensics system with distributed loading can reduce the loading of the centralized analyzer and data storage. The most packets are filtered in each ONU, and only the captured packets would be analyzed or stored.