Skip to main content
SpringerLink
Log in

Towards Efficient On-Site CSAM Triage by Clustering Images from a Source Point of View

  • Conference paper
  • First Online:
Digital Forensics and Cyber Crime (ICDF2C 2022)

Included in the following conference series:

Abstract

In digital forensics the Computer Forensics Field Triage Process Model (CFFTPM) addresses use cases, where an immediate on-site processing of digital evidence is necessary to impede ongoing severe criminal offences like child abuse, abduction or extortion. For instance in case of Child Sexual Abuse Material (CSAM) an instant in situ digital forensics investigation of seized devices may reveal digital traces to identify incriminated pictures produced by the suspect himself. In order to protect the victims from further violation the fast and reliable identification of such self produced CSAM files is of utmost importance, however, it is a non-trivial task. In this paper we propose an efficient and effective clustering method as part of the CFFTPM to identify self-produced incriminated images on-site. Our concept extends the classical hash-based identification of chargeable data and makes use of image metadata to cluster pictures according to their source. We successfully evaluate our approach on base of a publicly available image data set and show that our clustering even works in the presence of anti-forensics measures.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 79.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 99.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    The used metadata and source code is available at https://cloud.digfor.code.unibw-muenchen.de/index.php/s/xq2jtbqpEnTdNEZ

  2. 2.

    https://exiftool.org/

  3. 3.

    https://pypi.org/project/umap-learn/

  4. 4.

    Circle size is arbitrary.

References

  1. Bouhours, B., Broadhurst, R.: On-line child sex offenders: Report on a sample of peer to peer offenders arrested between July 2010–June 2011 (2011). SSRN 2174815

    Google Scholar 

  2. Bissias, G., et al.: Characterization of contact offenders and child exploitation material trafficking on five peer-to-peer networks. Child Abuse Neglect 52, 185–199 (2016)

    Article  Google Scholar 

  3. Gewirtz-Meydan, A., Walsh, W., Wolak, J., Finkelhor, D.: The complex experience of child pornography survivors. Child Abuse Neglect 80, 238–248 (2018)

    Article  Google Scholar 

  4. Cale, J., Holt, T., Leclerc, B., Singh, S., Drew, J.: Crime commission processes in child sexual abuse material production and distribution: a systematic review. Trends Issues Crime Crim. Justice 617, 1–22 (2021)

    Google Scholar 

  5. Rogers, M.K., Goldman, J., Mislan, R., Wedge, T., Debrota, S.: Computer forensics field triage process model. J. Digit. Forensics Secur. Law 1(2), 2 (2006)

    Google Scholar 

  6. Casey, E., Ferraro, M., Nguyen, L.: Investigation delayed is justice denied: proposals for expediting forensic examinations of digital evidence. J. Forensic Sci. 54(6), 1353–1364 (2009)

    Article  Google Scholar 

  7. McInnes, L., Healy, J., Melville, J.: UMAP: uniform manifold approximation and projection for dimension reduction. arXiv preprint arXiv:1802.03426 (2018)

  8. Hadwiger, B., Riess, C.: The Forchheim image database for camera identification in the wild. In: Del Bimbo, A., et al. (eds.) ICPR 2021. LNCS, vol. 12666, pp. 500–515. Springer, Cham (2021). https://doi.org/10.1007/978-3-030-68780-9_40

    Chapter  Google Scholar 

  9. Riley, J.: Understanding metadata, vol. 23. National Information Standards Organization, Washington DC, United States (2017). http://www.niso.org/publications/press/UnderstandingMetadata.pdf

  10. Exchangeable image file format for digital still cameras: Exif version 2.32. Standard, Camera & Imaging Products Association (2019)

    Google Scholar 

  11. JPEG file interchange format (JFIF), version 1.02. Standard, International Organization for Standardization, May 2013 (2013)

    Google Scholar 

  12. Graphic technology—Extensible metadata platform (XMP) specification—Part 1: data model, serialization and core properties. Standard, International Organization for Standardization, February 2012 (2012)

    Google Scholar 

  13. Kruskal, J.B.: Multidimensional scaling by optimizing goodness of fit to a nonmetric hypothesis. Psychometrika 29(1), 1–27 (1964)

    Article  MathSciNet  MATH  Google Scholar 

  14. Sorrell, M.J.: Digital camera source identification through JPEG quantisation. In: Multimedia Forensics and Security, pp. 291–313. IGI Global (2009)

    Google Scholar 

  15. Orozco, A.S., González, D.A., Corripio, J.R., Villalba, L.G., Hernandez-Castro, J.: Techniques for source camera identification. In: Proceedings of the 6th International Conference on Information Technology, pp. 1–9 (2013)

    Google Scholar 

  16. Kee, E., Johnson, M.K., Farid, H.: Digital image authentication from JPEG headers. IEEE Trans. Inf. Forensics Secur. 6(3), 1066–1075 (2011)

    Article  Google Scholar 

  17. Mullan, P., Riess, C., Freiling, F.: Forensic source identification using JPEG image headers: the case of smartphones. Digit. Investig. 28, S68–S76 (2019)

    Article  Google Scholar 

  18. Lukas, J., Fridrich, J., Goljan, M.: Digital camera identification from sensor pattern noise. IEEE Trans. Inf. Forensics Secur. 1(2), 205–214 (2006)

    Article  Google Scholar 

  19. Thai, T.H., Retraint, F., Cogranne, R.: Camera model identification based on the generalized noise model in natural images. Digit. Signal Process. 48, 285–297 (2016)

    Article  MathSciNet  MATH  Google Scholar 

  20. Freire-Obregón, D., Narducci, F., Barra, S., Castrillón-Santana, M.: Deep learning for source camera identification on mobile devices. Pattern Recognit. Lett. 126, 86–91 (2019). Robustness, Security and Regulation Aspects in Current Biometric Systems

    Google Scholar 

  21. Bharathiraja, S., Rajesh Kanna, B., Hariharan, M.: A deep learning framework for image authentication: an automatic source camera identification Deep-Net. Arab. J. Sci. Eng. 48, 1–13 (2022)

    Google Scholar 

  22. Choi, K.S., Lam, E.Y., Wong, K.K.Y.: Automatic source camera identification using the intrinsic lens radial distortion. Opt. Express 14, 11551–11565 (2006)

    Article  Google Scholar 

  23. Bernacki, J.: Digital camera identification by fingerprint’s compact representation. Multimed. Tools Appl. 81, 1–34 (2022)

    Article  Google Scholar 

  24. Gloe, T.: Feature-based forensic camera model identification. In: Shi, Y.Q., Katzenbeisser, S. (eds.) Transactions on Data Hiding and Multimedia Security VIII. LNCS, vol. 7228, pp. 42–62. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-31971-6_3

    Chapter  Google Scholar 

  25. Lorch, B., Schirrmacher, F., Maier, A., Riess, C.: Reliable camera model identification using sparse Gaussian processes. IEEE Signal Process. Lett. 28, 912–916 (2021)

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Research Institute CODE, University of the Bundeswehr Munich, Neubiberg, Germany

    Samantha Klier & Harald Baier

Authors
  1. Samantha Klier
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Harald Baier
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Samantha Klier .

Editor information

Editors and Affiliations

  1. University at Albany, Albany, NY, USA

    Sanjay Goel

  2. University College Dublin, Dublin, Ireland

    Pavel Gladyshev

  3. Horangi Cyber Security, Singapore, Singapore

    Akatyev Nikolay

  4. Missouri University of Science and Technology, Rolla, MO, USA

    George Markowsky

  5. Rochester Institute of Technology, Rochester, NY, USA

    Daryl Johnson

Rights and permissions

Reprints and permissions

Copyright information

© 2023 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Klier, S., Baier, H. (2023). Towards Efficient On-Site CSAM Triage by Clustering Images from a Source Point of View. In: Goel, S., Gladyshev, P., Nikolay, A., Markowsky, G., Johnson, D. (eds) Digital Forensics and Cyber Crime. ICDF2C 2022. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 508. Springer, Cham. https://doi.org/10.1007/978-3-031-36574-4_2

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-36574-4_2

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-36573-7

  • Online ISBN: 978-3-031-36574-4

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation