A MCEA based passive forensics scheme for detecting frame-based video tampering

doi:10.1016/j.diin.2012.07.002

Digital Investigation

Volume 9, Issue 2, November 2012, Pages 151-159

https://doi.org/10.1016/j.diin.2012.07.002 Get rights and content

Abstract

Without the use of digital signature or digital watermark, video passive forensics only utilizes the statistical characteristics of digital video to verify its integrity and authenticity. For frame-based video tampering, it usually suffers from double MPEG compression. In this paper, a motion-compensated edge artifact (MCEA) based passive forensics scheme is proposed for detecting frame-based video manipulation. It exploits the MCEA difference between adjacent P frames, and the decision is made by judging whether there are any spikes in the Fourier transform domain after double MPEG compression. Experimental results show that the proposed approach is effective for frame-based tampering, such as adding/deleting frames and GOP structure change, and can predict the GOP structure of original video.

Introduction

With the wide availability of digital video camera and the prevalence of video sharing websites, digital videos are playing important roles in our daily life. Meanwhile, it is becoming much easier to manipulate and tamper digital video without leaving any visual clues with the continuous development of advanced video editing tools (Rocha et al., 2011). As a consequence, various video forgery operations for malicious purposes are more common than ever. There is an urgent need to develop effective forensics techniques for exposing those malicious video manipulations (Chuang et al., 2011). The conventional active methods must embed digital signature or digital watermark into video data in advance to verify its origin or authenticity. Passive video forensics aims at providing tools to support blind investigation because it utilizes only the statistical characteristics of digital video itself. Therefore, passive video forensics does not assume any a-priori knowledge about the original video, which appeals the research efforts in the field of information security.

Digital video can be regarded as an extension of digital image in the time axis. Though there are many works about digital image forensics, the research on digital video forensics is still in its infancy. The reasons are summarized as follows. First, the tampering of digital video is more sophisticated and time-consuming than digital image. Furthermore, due to the large amount of video data, it is usually encoded before storage and transmission. As a result, it is more difficult for video forensics. Second, since digital video has an additional temporal dimension, this brings some forgery operations specific to digital video, such as frame-based tampering. In this paper, we put emphasis on the passive forensics for detecting frame-based tampering.

For an MPEG video, it is usually re-saved in MPEG format after tampering operations. This leads to the so-called double MPEG compression in video forensics. In the literature, there are already several kinds of approaches for detecting double MPEG compression. The most representative algorithm proposed by Wang and Farid (2006) exploits the static and temporal artifacts introduced by double MPEG compression. I frame is viewed as a static image which is similarly subjected to JPEG encoding, and the double JPEG compression detection algorithm is directly extended to double MPEG compression detection. In the temporal domain, it has been stated that motion compensation errors for P-frames are a function over time exhibiting a periodic pattern after frame deletions and recompression. However, this property can only be exploited with some constrains: The number of deleted frames must be multiple times of frame number in a GOP (Group of Picture), and the GOP structure must be kept during tampering. For the detection of GOP structure change in video tampering, Qin et al. (2010) propose a blind forensics technique based on GOP abnormality. It utilizes the Fourier analysis of motion errors. It is effective for the detection of video splicing. Luo et al. (2008) present a feature curve to reveal the compression history of an MPEG video file with a given GOP structure, and use the temporal patterns of block artifacts as evidence to detect tampering. Su and Zhang (2009) utilizes the motion-compensated edge artifacts (MCEA) for the exposing of digital video forgery. However, it needs a hard threshold factor α to detect frame-deleting forgery. Moreover, at least three P frames must be deleted. This seriously constrains its adaptability in practice.

MPEG-2 video system adopts a hybrid coding structure, which integrates these three classical techniques: prediction coding, transform coding and entropy coding. When coarse quantization is combined with motion compensation prediction, the blocking artifacts propagate from I-frames into subsequent frames and accumulate. This will cause structured high frequency noise. The MCEA involves high frequency noise within those blocks in every P frame. In one GOP, the P frames' MCEAs are non-decreasing. By observation, we found that the frame-based forgery operations, such as adding frames, deleting frames or changing the GOP structure, will make the MCEAs of adjacent P frames larger, and they are shown as a periodic characteristics. In this paper, a MCEA based passive forensics scheme is proposed for frame-based video tampering. It is in fact an improved algorithm on Su's work (Su and Zhang, 2009) for detecting double MPEG compression. The block diagram of the proposed approach is illustrated in Fig. 1. The MCEA difference sequences between adjacent P frames are exploited to judge whether there are any spikes in the Fourier transform domain after double MPEG compression. The main contribution of the proposed approach is that it overcomes the shortcomings of the hard threshold in the Su's work (Su and Zhang, 2009). It can not only detect the frame adding/deleting operations, but also is effective for the forensics of GOP structure change.

The rest of this paper is organized as follows. In Section 2, the MPEG-2 video codec and re-compression process are briefly introduced. Section 3 discusses the calculation of the P frame's MCEA and its application for forensics. Section 3 presents the proposed video tampering detection algorithm. Experimental results are reported in Section 5, and conclusions and future work are given in Section 6.

Section snippets

MPEG-2 codec and double MPEG compression

MPEG videos are compressed by removing both the temporal redundancy and spatial redundancy. In the general MPEG architecture, there are three types of frames in video encoding: I (intra-coded) frame, P (forward predictive coded) frame and B (bi-directionally predictive coded) frame. Let N be the total number of frames in a given GOP structure, and M be the minimum distance between P-frames. For example, the GOP structure shown in Fig. 2 can be represented as (N = 12, M = 3).

Due to the

The calculation of MCEA and its application in forensics

For typical in video codec, when coarse quantization is combined with motion compensation prediction, the blocking artifacts propagate from I-frames into subsequent frames. It causes structured high frequency noise that is no longer located at block boundaries. These kind of motion-compensated edge artifacts (MCEA) are referred to be false edges, and their energies accumulate in each GOP (Leontaris et al., 2007). As a no-reference video quality metrics, MCEA is proposed to measure the

The FFT of MCEA difference

For one GOP (N, M), the number of P frames N_p is N/M − 1. According to the Formula (6), the MCEA values of all the P frames can be calculated, and a difference sequence ΔM is defined as the difference of MCEA between adjacent P frames. $Δ M = {MCEA}^{i} - {MCEA}^{i + 1}, i \in (1, N_{p} - 1)$

For all the GOP groups in a sequence, their difference sequence dM can be computed. The change of dM is relatively steady. However, the double recompression after frame manipulation or changing the GOP structure brings greater motion

Experimental results

In order to verify the effectiveness of the proposed approach, four typical test video sequences are selected for experiments (Testing samples). They are Carphone, Container, Hall and Mobile (in CIF and QCIF format). Among them, Container and Hall represent those video sequences with nearly static background or simple motions, whereas Carphone and Mobile represents those video sequences with acute motion. The MPEG-2 codec by MPEG Software Simulation Group (MSSG) http://www.mpeg.org/MPEG/video

Conclusions

In this paper, a MCEA-based passive forensics scheme is proposed for frame-based video tampering. It exploits the MCEA difference between adjacent P frames, and judges whether there are any spikes in the Fourier transform domain after double MPEG compression. Experimental results on several test sequences show that the proposed scheme is effective for the forensics of deleting integer multiple M in GOP (N, M) and the GOP structure change in double MPEG compression. Furthermore, it can deduce

Acknowledgments

This work was supported in part by the National Natural Science Foundation of China (61072122) and the Special Prophase Project on National Basic Research Program of China (2010CB334706), Key Project of Hunan Provincial Natural Science Foundation (11JJ2053) and the Program for New Century Excellent Talents in University (NCET-11-0134).

References (10)

Weihong Chuang et al.
Exploiting compression effects for improved source camera identification using strongly compressed video
Athanasios Leontaris et al.
Quality evaluation of motion-compensated edge artifacts in compressed video
IEEE Transactions on Image Processing
(2007)
Weiqi Luo et al.
MPEG recompression detection based on block artifacts
Yunlong Qin et al.
Blind detection of video sequence montage based on GOP abnormality
Chinese Journal of Electronic
(2010)
Anderson Rocha et al.
Vision of the unseen: current trends and challenges in digital image and video forensics
ACM Computing Surveys
(2011)

There are more references available in the full text version of this article.

Cited by (54)

Video frame deletion detection based on time–frequency analysis
2022, Journal of Visual Communication and Image Representation
With the emergence of diverse multimedia editing software, a great number of edited or tampered video resources appear on the Internet, some of which can mix with the genuine ones. Digital video authenticity is an important step to make the best use of these video resources. As a common video forgery operation, frame tampering can change the video content and confuse viewers by removing or inserting some specific frames. In this paper, we explore the traces created by compression process and propose a new method to detect frame tampering based on the high-frequency features of reconstructed DCT coefficients in the tampered sequences. Experimental results demonstrate that our proposed method can effectively detect frame tampering operation, and accurately locate the breakpoint of frame tampering in the streams.
A comprehensive survey on digital video forensics: Taxonomy, challenges, and future directions
2021, Engineering Applications of Artificial Intelligence
With the explosive advancements in smartphone technology, video uploading/downloading has become a routine part of digital social networking. Video contents contain valuable information as more incidents are being recorded now than ever before. In this paper, we present a comprehensive survey on information extraction from video contents and forgery detection. In this context, we review various modern techniques such as computer vision and different machine learning (ML) algorithms including deep learning (DL) proposed for video forgery detection. Furthermore, we discuss the persistent general, resource, legal, and technical challenges, as well as challenges in using DL for the problem at hand, such as the theory behind DL, CV, limited datasets, real-time processing, and the challenges with the emergence of ML techniques used with the Internet of Things (IoT)-based heterogeneous devices. Moreover, this survey presents prominent video analysis products used for video forensics investigation and analysis. In summary, this survey provides a detailed and broader investigation about information extraction and forgery detection in video contents under one umbrella, which was not presented yet to the best of our knowledge.
Detection of frame deletion in HEVC-Coded video in the compressed domain
2019, Digital Investigation
In this paper, we propose an algorithm for detecting frame deletion in HEVC-coded video in the compressed domain. Specifically, we focus on the frame type changes occurring upon frame deletion, which cause slight differences between the coding patterns in original and forged video. Then, we identify discriminating coding patterns for use as features, which are classified by machine learning classifiers. Furthermore, we propose video sequence integrity detection on a group-of-picture basis, which is computationally efficient and robust even when applied to static videos and videos with genuine scene changes. The experimental results show that the proposed technique can classify HEVC-coded videos more accurately than previous methods. In addition, the results demonstrate that the selected features work harmoniously in discrimination and that the learning-based classifiers are more robust and reliable than model-based classifiers.
Differentiating synthetic and optical zooming for passive video forgery detection: An anti-forensic perspective
2019, Digital Investigation
Citation Excerpt :
These factors contribute false positives in normal camera zoom in (Hyun et al., 2013) and (Singh and Aggarwal, 2017). In the case of tampered videos with synthetic zooming, the investigator may discard the results of passive video tampering detection methods (Su et al., 2009; Dong et al., 2012; Abbasi Aghamaleki and Behrad, 2017; Kingra et al., 2017), in the belief that they are genuine frames due to camera zooming, leading to false negatives. A method for detecting zoomed frames in videos under investigation is discussed in (Sitara and Mehtre, 2017) for reducing false positives due to genuine camera zooming.
A video can be manipulated using synthetic zooming without using the state-of-the-art video forgeries. Synthetic zooming is performed by upscaling individual frames of a video with varying scale factors followed by cropping them to the original frame size. These manipulated frames resemble genuine natural (optical) camera zoomed frames and hence may be misclassified as a pristine video by video forgery detection algorithms. Even if such a video is classified as forged, forensic investigators may ignore the results, believing it as part of an optical camera zooming activity. Hence, this can be used as an anti-forensic method which eliminates digital evidence. In this paper, we propose a method for differentiating optical camera zooming from synthetic zooming for video tampering detection. The features used for this method are pixel variance correlation and sensor pattern noise. Experimental results on a dataset containing 3200 videos show the effectiveness of the proposed method.
Detection of inter-frame forgeries in digital videos
2018, Forensic Science International
Citation Excerpt :
Gironi et al. [30] extended the work in Ref. [21] for detecting frame deletion and frame insertion. Frame deletion detection using motion compensated edge artifact (MCEA) is discussed in Refs. [31,32]. Su et al. [33] utilized periodic artifacts in DCT coefficients of recompressed P and B frames which arises from frame shift due to frame deletion or frame insertion.
Videos are acceptable as evidence in the court of law, provided its authenticity and integrity are scientifically validated. Videos recorded by surveillance systems are susceptible to malicious alterations of visual content by perpetrators locally or remotely. Such malicious alterations of video contents (called video forgeries) are categorized into inter-frame and intra-frame forgeries. In this paper, we propose inter-frame forgery detection techniques using tamper traces from spatio-temporal and compressed domains. Pristine videos containing frames that are recorded during sudden camera zooming event, may get wrongly classified as tampered videos leading to an increase in false positives. To address this issue, we propose a method for zooming detection and it is incorporated in video tampering detection. Frame shuffling detection, which was not explored so far is also addressed in our work. Our method is capable of differentiating various inter-frame tamper events and its localization in the temporal domain. The proposed system is tested on 23,586 videos of which 2346 are pristine and rest of them are candidates of inter-frame forged videos. Experimental results show that we have successfully detected frame shuffling with encouraging accuracy rates. We have achieved improved accuracy on forgery detection in frame insertion, frame deletion and frame duplication.
Recent Advances in Digital Image and Video Forensics, Anti-forensics and Counter Anti-forensics
2024, arXiv

View all citing articles on Scopus

View full text

A MCEA based passive forensics scheme for detecting frame-based video tampering

Abstract

Introduction

Section snippets

MPEG-2 codec and double MPEG compression

The calculation of MCEA and its application in forensics

The FFT of MCEA difference

Experimental results

Conclusions

Acknowledgments

Exploiting compression effects for improved source camera identification using strongly compressed video

Quality evaluation of motion-compensated edge artifacts in compressed video

IEEE Transactions on Image Processing

MPEG recompression detection based on block artifacts

Blind detection of video sequence montage based on GOP abnormality

Chinese Journal of Electronic

Vision of the unseen: current trends and challenges in digital image and video forensics

ACM Computing Surveys