新数字视频取证工具：无痕验证与伪造检测

需积分: 10 7 浏览量更新于2024-07-29 收藏 9.58MB PDF 举报

本篇论文标题为《数字视频法医鉴定》，主要探讨了在不依赖水印或专用硬件的情况下，如何开发新的法医工具来检测数字视频中的篡改痕迹。作者Weihong Wang博士，作为计算机科学领域的博士研究生，于2009年6月提交了这篇论文，旨在为数字视频的真伪验证提供一种全新的方法。论文的核心观点是基于这样一个假设：数字视频中存在自然产生的属性，这些属性在被篡改时会受到干扰，且可以量化、测量并用来揭露虚假视频。作者提出了五种关键的法医工具： 1. 交错检测（Interlaced）：此工具关注的是逐行扫描视频（交错视频）中因编辑或合成而产生的不连续性，通过分析帧之间的交错模式来识别可能的篡改。 2. 去交错（De-interlaced）：针对经过交错编码的视频，该工具专注于恢复原始帧结构，寻找由插补过程留下的特征，用于检测非原始内容的插入或删除。 3. 双重压缩分析（Double Compression）：许多视频可能会经历多次压缩，此工具研究不同压缩算法对视频质量的影响，对比原始和处理后的数据，揭示压缩过程中的异常。 4. 复制检测（Duplication）：通过比较视频片段的相似度，识别是否存在重复或剪辑痕迹，这对于发现拼接或剪辑的视频片段特别有用。 5. 重新投影（Re-projection）：此技术关注几何失真，通过检测视频中物体边缘的重投影是否一致，来判断是否存在修改或伪造的迹象。这些工具的结合使用形成了一个强大的初步法医鉴定体系，对于确保数字视频的真实性和完整性具有重要意义。论文的最后部分还感谢了导师Hany Farid博士以及其他评审委员会成员的指导和支持。这篇论文在数字视频取证领域做出了重要贡献，它不仅展示了新的技术手段，还为视频真伪鉴别提供了实用的工具和理论基础，为打击网络虚假视频和维护信息安全提供了科学依据。

where Ω denotes a spatial neighborhood. Since this error function is non-linear in its un-

knowns, it cannot be minimized analytically. To simplify the minimization, we approximate

this error function using a ﬁrst-order truncated Taylor series expansion:

E(~v) ≈

x,y∈Ω



f(x, y, t) − (f(x, y, t) + v

(x, y, t) + v

(x, y, t) − f

(x, y, t))



x,y∈Ω



f − (f + v

+ v

− f

)



(2.3)

where f

(·), f

(·), and f

(·) are the spatial and temporal derivatives of f(·), and where for

notational convenience the spatial/temporal parameters are dropped. This error function

reduces to:

E(~v) =

x,y∈Ω



−v



x,y∈Ω

−

















x,y∈Ω



−



. (2.4)

Note that this quadratic error function is now linear in its unknowns, ~v. This error function

can be minimized analytically by diﬀerentiating with respect to the unknowns:

dE(~v)

d~v

x,y∈Ω

−2



−



(2.5)

and setting this result equal to zero, and solving for ~v:

~v = −







Ω







−1







Ω







, (2.6)

where again recall that the spatial/temporal parameters on the derivatives have been

dropped for notational convenience. This solution assumes that the ﬁrst term, a 2 × 2

matrix, is invertible. This can usually be guaranteed by integrating over a large enough

spatial neighborhood Ω with suﬃcient image content.

2.1.2 Spatial/Temporal Diﬀerentiation

The spatial/temporal derivatives needed to estimate motion in Equation (2.6) are deter-

mined via convolutions [11] as follows:

= (

(x, y, t) +

(x, y, t − 1)) ? d(x) ? p(y) (2.7)

= (

(x, y, t) +

(x, y, t − 1)) ? p(x) ? d(y) (2.8)

= (

(x, y, t) −

(x, y, t − 1)) ? p(x) ? p(y), (2.9)

where the 1-D ﬁlters are d(·) =



0.425287 0.0 −0.425287



and p(·) =



0.2298791 0.540242

0.2298791



. Note that while we employ 2-tap ﬁlters for the temporal ﬁltering (





and



−



), 3-tap ﬁlters are used for the spatial ﬁltering. Despite the asymmetry, these ﬁlters

yield more accurate motion estimates. To avoid edge artifacts due to the convolution, the

derivatives are centrally cropped by removing a 2-pixel border.

2.1.3 Inter-Field and Inter-Frame Motion

Recall that we are interested in comparing the inter-ﬁeld motion between f(x, y, t) and

f(x, y, t + 1) and the inter-frame motion between f(x, y, t + 1) and f(x, y, t + 2), for t

odd. The inter-ﬁeld motion is estimated in a two-stage process (the inter-frame motion is

computed in the same way).

In the ﬁrst stage, the motion is estimated globally between f(x, y, t) and f(x, y, t + 1),

that is, Ω is the entire image in Equation (2.6). The second ﬁeld, f(x, y, t+1), is then warped

according to this estimated motion (a global translation). This stage removes any large-scale

motion due to, for example, camera motion. In the second stage, the motion is estimated

locally for non-overlapping blocks of size Ω = n × n pixels. This local estimation allows us

to consider more complex and spatially varying motions, other than global translation. For

a given block, the overall motion is then simply the sum of the global and local motion.

The required spatial/temporal derivatives have ﬁnite support thus fundamentally limit-

ing the amount of motion that can be estimated. By sub-sampling the images, the motion

is typically small enough for our diﬀerential motion estimation. In addition, the run-time

is suﬃciently reduced by operating on sub-sampled images. In both stages, therefore, the

motion estimation is done on a sub-sampled version of the original ﬁelds: a factor of 16

for the global stage, and a factor of 8 of the local stage, with Ω = 13 × 13 (correspond-

ing to a neighborhood size of 104 × 104 at full resolution). While the global estimation,

done at a coarser scale, yields a less accurate estimation of motion, it does remove any

large-scale motion. The local stage done at a higher scale then reﬁnes this estimate. For

computational considerations, we do not consider other scales, although this could easily be

incorporated. To avoid wrap-around edge artifacts due to the global alignment correction,

six pixels are cropped along each horizontal edge and two pixels along each vertical edge

prior to estimating motion at 1/8 resolution.

In order to reduce the errors in motion estimation, the motion across three pairs of ﬁelds

is averaged together, where the motion between each pair is computed as described above.

The inter-frame motion is estimated in the same way, and the norm of the two motions,

k~vk =

+ v

, are compared across the entire video sequence.

2.2 Results

An interlaced video sequence, F (x, y, t), of length T frames is ﬁrst separated into ﬁelds,

f(x, y, t) with t odd corresponding to the odd scan lines and t even corresponding to the

even scan lines. The inter-ﬁeld motion is measured as described above for all pairs of ﬁelds

f(x, y, t) and f (x, y, t + 1), for t odd, and the inter-frame motion is measured between all

pairs of ﬁelds f(x, y, t + 1) and f(x, y, t + 2), for 3 ≤ t ≤ 2T − 3. We expect these two

motions to be the same in an authentic interlaced video, and to be disrupted by tampering.

We recorded three videos from a SONY-HDR-HC3 digital video camera. The camera

was set to record in interlaced mode at 30 frames/sec. Each frame is 480 × 720 pixels in

size, and the average length of each video sequence is 10 minutes or 18, 000 frames. For the

ﬁrst video sequence, the camera was placed on a tripod and pointed towards a road and

sidewalk, as a surveillance camera might be positioned. For the two other sequences, the

camera was hand-held.

Shown in Figure 2.2 are the estimated inter-ﬁeld and inter-frame motions for each video

Figure 2.2: Shown in each panel is the normalized inter-ﬁeld motion versus the normalized inter-

frame motion for three diﬀerent video sequences. The solid line represents a line ﬁt to the underlying

data points. We expect the motion ratio to be near 1 in an authentic video sequence and to deviate

signiﬁcantly for a doctored video.

sequence. Each data point corresponds to the estimate from a single 13 × 13 block (at 1/8

resolution). Since we are only interested in the motion ratio, the motions are normalized

into the range [0, 1]. Also shown in each panel is a line ﬁt to the underlying data (solid

line), which in the ideal case would be a unit-slope line with zero intercept. The average

motion ratio for each sequence is 0.98, 0.96, and 0.98 with a variance of 0.008, 0.128, and

0.156, respectively.

A frame is classiﬁed as manipulated if at least one block in the frame has a motion

ratio that is more than 0.2 from unit value. In order to avoid spurious errors, we also insist

that at least 3 successive frames are classiﬁed as manipulated. For the ﬁrst video sequence,

only one block out of 221, 328 blocks was incorrectly classiﬁed as manipulated. For the

second and third sequence, two and eight blocks, respectively, were misclassiﬁed out of a

total of 241, 248 and 224, 568 blocks. After imposing the temporal constraints, no frames

were mis-classiﬁed.

Shown in the ﬁrst two rows of Figure 2.3 are ten frames of an original interlaced video.

This video shows a person walking against a stationary background and being ﬁlmed with

a stationary camera. Shown in the next two rows of this same ﬁgure is a doctored version

of this video sequence. In this version, a diﬀerent person’s head has been spliced into each

frame. Because this person was walking at a slower speed than the original person, the

inter-ﬁeld interlacing is smaller than in the original. Shown in lower portion of Figure 2.3

are the resulting inter-ﬁeld and inter-frame motions. The data points that lie signiﬁcantly

away from the unit-slope line correspond to the blocks in which the new head was introduced

– occasionally this would occupy two blocks, both of which would deviate from the expected

motion ratio. Even though the doctored video looks perceptually smooth, the tampering is

easily detected.

Since compression will introduce perturbations into the image, it is important to test

the sensitivity of the motion estimation algorithms to compression. The ﬁrst video sequence

described above was compressed using Adobe Premiere to a target bit rate of 9, 6, and 3

Mbps. The same inter-ﬁeld and inter-frame motions were estimated for each of these video

sequences. For the original sequence, only 1 block out of 221, 328 blocks was incorrectly

classiﬁed as manipulated. After the temporal ﬁltering, no frames out of 18, 444 frames were

incorrectly classiﬁed. For the three compressed video sequences, 1, 4, and 3 blocks were

mis-classiﬁed, and 0, 1, and 0 frames were mis-classiﬁed. The motion estimation algorithm

is largely insensitive to compression artifacts. One reason for this is that we operate on

a sub-sampled version of the video (by a factor of 1/16 and 1/8) in which many of the

compression artifacts are no longer present. In addition, the motion is estimated over a

spatial neighborhood so that many of the errors are integrated out.

2.2.1 Frame Rate Down-Conversion

This technique can be adapted to detect frame rate down-conversion. Consider an original

video sequence captured at 30-frames per second that is subsequently manipulated and saved

at a lower rate of 25-frames per second. The standard approach to reducing the frame rate

is to simply remove the necessary number of frames (5 per second in this example). In so

doing, the inter-ﬁeld and inter-frame motion ratio as described in the previous section will

be disturbed. Speciﬁcally at the deleted frames, the inter-ﬁeld motion will be too small

relative to the inter-frame motion.

A video sequence of length 1200 frames, originally recorded at 30 frames per second,

was converted using VirtualDub to a frame rate of 25 frames per second, yielding a video of

length 1000 frames. The inter-ﬁeld and inter-frames motions were estimated as described.

In this frame rate converted video every 5

frame had an average motion ratio of 2.91,

while the intervening frames had an average motion ratio of 1.07.

剩余110页未读，继续阅读

gongjiachang

粉丝: 0
资源: 2

新数字视频取证工具：无痕验证与伪造检测

Digital Forensics with open source tools

Digital Forensics And Cyber Crime

extracting camera-based fingerprints for video forensics

x-ways forensics说明书

X-Ways Forensics找压缩包

写出20个在中国的与网络安全相关的专业期刊名称

X-Ways Forensics压缩

CTF forensics

mkdir /mnt/forensics mount -o rw fatimage.dd /mnt/forensics

x-ways forensics使用

最新资源