Abstract
Detection of double joint photographic experts group (JPEG) compression is of great significance in the field of digital forensics. Some successful approaches have been presented for detecting double JPEG compression when the primary compression and the secondary compression have different quantization matrixes. However, when the primary compression and the secondary compression have the same quantization matrix, no detection method has been reported yet. In this paper, we present a method which can detect double JPEG compression with the same quantization matrix. Our algorithm is based on the observation that in the process of recompressing a JPEG image with the same quantization matrix over and over again, the number of different JPEG coefficients, i.e., the quantized discrete cosine transform coefficients between the sequential two versions will monotonically decrease in general. For example, the number of different JPEG coefficients between the singly and doubly compressed images is generally larger than the number of different JPEG coefficients between the corresponding doubly and triply compressed images. Via a novel random perturbation strategy implemented on the JPEG coefficients of the recompressed test image, we can find a “proper” randomly perturbed ratio. For different images, this universal “proper” ratio will generate a dynamically changed threshold, which can be utilized to discriminate the singly compressed image and doubly compressed image. Furthermore, our method has the potential to detect triple JPEG compression, four times JPEG compression, etc.
Index Terms—Digital forensic, double joint photographic experts group (JPEG) compression, quantization matrix.
I. INTRODUCTION
DOUBLE joint photographic experts group (JPEG) compression means that a JPEG image has been compressed once again by JPEG compression. The detection of double JPEG compression is of great significance in digital forensics. There are at least two reasons why forensic experts pay attention to the detection of double JPEG compression [1], [2]. The first one is that the doubly compressed JPEG images often result from image forgery. For example, in image-splicing, one part of the source image is copied to the target image to generate a new composite image. If the source image or target image is in JPEG format, the spliced image may need to be JPEG compressed, hence exhibiting traces of double JPEG compression. These traces can be used to detect the forgery image or even identify the manipulated areas [3], [4]. The second one is that some JPEG steganographic schemes such as F5 [5] and Out- Guess [6] may generate doubly compressed images if the input cover image is in JPEG format. Detection of double JPEG compression can help to identify the steganographic algorithm or improve the detection accuracy rate of the steganalytic schemes. Furthermore, in addition to the aforementioned two applications, the techniques and methods resulted from the research of double JPEG compression detection can also be applied to digital audio [7] and digital video [8], [9] forensics. Recently, some successful approaches have been presented for detecting double JPEG compression when the primary compression and the secondary compression have different quantization matrixes (sometimes referred to as quantization tables). Lukáˇs and Fridrich [1] addressed the distribution of JPEG coefficient (i.e., the quantized discrete cosine transform (DCT) coefficient) histogram of the individual mode in a doubly compressed JPEG image, and pointed out that some abnormal propertiessuchas“missingvalues”and“doublepeak”mightexist in theJPEGcoefficient histogram if the primary compression and the secondary compression had different quantization matrixes. Three different approaches that could estimate the primary quantization matrix from the doubly compressed image were presented. Popescu and Farid [10], [11] also pointed out that different quantization matrixes in the primary and the secondary compression might introduce some abnormal patterns in the JPEG coefficient histogram of the individual mode, and a doubly compressed JPEG image could be detected via evaluating the periodic property belonging to the Fourier transform of the JPEG coefficient histogram of the individual mode. In [12], Fu et al. presented a model called generalized Benford’s law to fit the distribution of the first digits of JPEG coefficients from all JPEG alternate current (ac) modes. Through observing whether the distribution fits the presented model, double JPEG compression can be detected. In [13], Li et al. pointed out that through using generalized Benford’s law to fit distribution of the first digits of JPEG coefficients from some selected individual ac modes, the performance of detecting double JPEG compression could be greatly enhanced


Download full report
http://googleurl?sa=t&source=web&cd=1&ve...560817.pdf%3Farnumber%3D5560817&ei=1mRbTvG3GpHyrQe38bmMCw&usg=AFQjCNGTHoMIUjI4k3HACK_HRDEpNfU8PQ