Integrity verification of the ordered data structures in manipulated video content

doi:10.1016/j.diin.2016.06.001

Digital Investigation

Volume 18, September 2016, Pages 1-7

https://doi.org/10.1016/j.diin.2016.06.001 Get rights and content

Abstract

Video content stored in Video Event Data Recorders (VEDRs) are used as important evidence when certain events such as vehicle collisions occur. However, with sophisticated video editing software, assailants can easily manipulate video records to their advantage without leaving visible clues. Therefore, the integrity of video content recorded through VEDRs cannot be guaranteed, and the number of related forensic issues increases. Existing video integrity detection methods use the statistical properties of the pixels within each frame of the video. However, these methods require ample time, because they check frames individually. Moreover, the frame can easily be replaced and forged using the appropriate public software. To solve this problem, we propose an integrity checking mechanism using the structure of ordered fields in a video file, because existing video editing software does not allow users to access or modify field structures. In addition, because our proposed method involves checking the header information of video content only once, much less detection time is required compared with existing methods that examine the entire frames. We store an ordered file structure of video content as a signature in the database using a customized automated tool. The signature appears according to the video editing software. Then, the suspected video content is compared to a set of signatures. If the file structure matches with a signature, we recognize a manipulated video file by its corresponding editing software. We tested five types of video editing software that cover 99% of the video editing software market share. Furthermore, we arranged 305,981 saving options for all five video editing suites. As a result, we obtained 100% detection accuracy using stored signatures, without false positives, in a collection of 305,981 video files. The principle of this method can be applied to other video formats.

Introduction

Vehicle accidents are an unavoidable part of our daily lives. When we become involved in a vehicle accident, there is no doubt that one of the most important problems, with the exception of saving lives, is clarifying responsibility for the accident, including any legal issues. In the last decade, Video Event Data Recorders (VEDRs) have been used as effective and trustworthy witnesses to vehicle accidents and even other criminal incidents. VEDRs are also known as Car Dashboard Camcorders, Vehicle Road Dash Video Camera, Car Black Boxes, and Driving Recorders. In this paper, we refer to such devices collectively as VEDRs. The installation and use of VEDRs is increasing rapidly, and there are a number of countries that mandate the installation of such devices. However, sophisticated video editing software makes it easy to manipulate video content without leaving visible clues. Therefore, it is not possible to be entirely convinced of the integrity of video content recorded by VEDRs (Poisel and Tjoa, 2011, Lee et al., 2015). Some efforts have been directed at ensuring the integrity of video content in digital images and video files in advance (Hu et al., 2015). However, such technologies have a limitation wherein the video recorder system must be pre-processed when it is established, for example, by calculating hash values, embedding watermarks into the video, and so on. Therefore, digital video forensics has become a popular technique for video integrity verification without pre-registration or pre-embedded information; this process is referred to as passive-blind video forensics.

Existing methods mainly focus on digital still images. Zheng used the statistical anomalies of each pixel in an image (Zheng et al., 2015, Rad and Wong, 2015). Qu used the statistical characteristics of image compression (Qu et al., 2014, Cao et al., 2014). Geradts checked the trace caused by a camera color filter and charged-couple device (CCD) (Geradts et al., 2001). Carvalho examined the geometric relationship between an object and light (Carvalho et al., 2015). The principles behind these methods can be applied to video content. However, such evidence can easily be replaced and forged in the image source using publicly available software (Sencar and Memon, 2008). In addition, existing methods must check entire frames in order to detect video forgeries (Wang and Farid, 2007). On an average, 1 min of video content contains 1800 frames, and thus these methods must repeatedly check all 1800 frames. If the video content has low resolution, the detection rate for these methods is reduced significantly.

To address these problems, we propose a mechanism for detecting the modification of video content with video editing software. We focus on the ordered data structures in a video file for integrity verification. The internal ordered data structures are particularly valuable and contain distinct information on video editing software authentication. Existing video editing software and metadata editors do not modify the file's data structures (Gloe, 2012). Therefore, data structure information is reliable for checking video integrity. In addition, this method requires relatively little time for detection, because it simply checks the header information of video content a single time. Moreover, this method is not affected by the resolution, because it checks the data header information exclusively.

We investigate the video file structure characteristics for each type of video editing software that would leave traces from processing the video editing software. Because such traces are an inherent characteristic of each respective video editing software suite, we can detect the specific video editing software used to manipulate the video, in addition to whether the video was, indeed, manipulated. To evaluate the accuracy of this technique, we examined 296 unmodified Audio Video Interleave (AVI) video files. We performed this examination using popular versions of video editing software, namely, Adobe Premiere CS3, Adobe Premiere CS4, Adobe Premiere CS5, Adobe Premiere CS6, Adobe Premiere CC, Sony VEGAS 9, Sony VEGAS 10 Sony VEGAS 11, Sony VEGAS 12, Sony VEGAS 13, Edius 6, Edius 7, Avid Media Composer (Avid MC) 5, Avid MC 6, and Avid Studio 1. These software suites comprise 99% of the video editing software market share. (Notably, we excluded Final Cut, because it does not support the AVI format without an additional plugin.) Although the same video editing software is used in certain cases, depending on the rendering option, the files can appear to have different ordered data structures. Therefore, we arranged 305,981 saving options for all five video editing software suites.

As a result, we found that the AVI data structures in modified video files appear consistently according to each video editing software suite. Each resulting data structure is unaffected by the original video file structure. These ordered data structures are stored in a database as the signature of each type of video editing software. Moreover, given the need to include other video editing software, the database can be extended easily. We used our own customized file parser to read, extract, and detect video content. As a result, we obtained 100% detection accuracy using the stored signatures, with no false negatives (FNs) or false positives (FPs) in our experimental environments. Using the proposed method, we can check the integrity of suspected video, and we can also find the video editing software used for the manipulation.

The main contribution of this paper is the proposal of a method for detecting the integrity violator of video content. To the best of our knowledge, this work is the first attempt to generate a video editing software signature database. Our method does not require pre-processing, and its detection accuracy is not affected by the resolution.

In the following section, we explain the general AVI file format structures. Then, we introduce the practical test setup and explain the proposed signature algorithm. Based on this method, we analyze the original video contents and store video editing software specifications into a database. Using this database, we then describe our evaluation of its detection accuracy. Finally, we summarize our investigation and provide a discussion of the experimental results.

Section snippets

Background

The majority of the multimedia formats used in VEDRs are AVI files. The second most common format is MP4. Only a few test devices use WMA containers. Nevertheless, the proposed method can be applied for AVI, MP4 and WMA formats. Without loss of generality, we discuss the case of the AVI format in this paper. For clarification, we explain the general AVI file format structure.

Video editing software

We collected 232 original videos from an internet VEDR community site,¹ along with 64 videos from a forensic center. We classified them according to a sequence of field data structure types.

For each original video field data structure type, video editing software was used to manipulate the video content. We examined the videos using five types of video editing software, representing 99% of the video

Automated signature collection method

We analyzed hundreds of thousands of video content samples. Therefore, for efficiency, we created a customized file parser. This parser extracts field structures and stores them into the database as a signature, which makes it easy to extend the database. We extracted field data structures from manipulated video content using our customized parser. If the extracted field data structure is new, we store it, as shown in Fig. 3. This principle was used while collecting original VEDR field data

Video editing software observation results

There were 12 different AVI field data structures in the original 296 video contents, as shown in Table 2. In order to generate manipulated video content, we manipulated 12 types of original video content. We applied all 12 types to one type of video editing software. The resulting field data structure is not affected by that of the original video content. Therefore, we manually tested 305,981 options in a single file. To improve the rendering speed, we used a small AVI file. As a result, all

Detection algorithm and evaluation

Using the video editing software signature database, we can detect manipulated video content. In order to automate such detection, we designed an automated detection parser.

Algorithm 2

Script for verifying the integrity of video.

Algorithm 2 shows the pseudocode for the process of detecting integrity based on our database. The basic principle to this detection algorithm is the same as the principle for the database algorithm. It reads four bytes for the chunk name from suspicious video content. Then, it

Discussion

In addition to AVI, we have applied the same approach to MP4 media format. We collected three different types of MP4 field data structures (Table 6). We manipulated three types of original video contents by Adobe Premiere series. As a result, we have constructed the signature from the field data structures of the content by Adobe Premiere series as shown in Table 7. While the proposed method can be applicable for detecting Adobe Premiere series as a working example, extension to other video

Summary and conclusion

As video editing software advances, malicious individuals can easily modify VEDR video content without leaving visible clues. Therefore, it is important to verify the integrity of videos used as evidence in criminal investigations. Existing methods require considerable detection time, and low-resolution images can degrade the detection rate.

For higher efficiency and faster detection, we proposed a detection algorithm that can easily collect signatures into a database and detect manipulated

Acknowledgments

This research was supported by the Public Welfare & Safety Research Program through the National Research Foundation of Korea (NRF) funded by the Ministry of Science, ICT & Future Planning (2012M3A2A1051118).

References (13)

J. Zheng et al.
Exposing image forgery by detecting traces of feather operation
J Vis Lang Comput
(2015)
G. Cao et al.
Contrast enhancement-based forensics in digital images
Inf Forensics Secur IEEE Trans
(2014)
T. Carvalho et al.
Exposing photo manipulation from user-guided 3d lighting analysis
Z.J. Geradts et al.
Methods for identification of images acquired with digital cameras
T. Gloe
Forensic analysis of ordered data structures on the example of jpeg files
W.-C. Hu et al.
Effective image forgery detection of tampered foreground or background image based on image watermarking and alpha mattes
(2015)

There are more references available in the full text version of this article.

Cited by (21)

Your car is recording: Metadata-driven dashcam analysis system
2021, Forensic Science International: Digital Investigation
Citation Excerpt :
They used the following two features: (1) chunk hierarchy (sequence) in container files from each device, and (2) signature values that can be stored in special areas such as INFO chunk in AVI and non-standard chunks in MP4. Song et al. proposed an algorithm for tampering detection using the internal structure of a video file (Song et al., 2016). They utilized chunk sequences generated by several video editing programs.
Dashcam as an on-board camera is useful as a source of potential digital evidence not only to reveal the truth of a traffic accident but also to explain the situation of a crime scene as a moving surveillance camera. It stores multimedia data as well as a variety of additional information needed for accident investigation including time, location, speed, accelerometer, etc. Under these circumstances, various studies have been conducted for dashcam forensics, but most of them focused mainly on extracting and interpreting visual video frames. In this paper, we identify and classify various metadata generated by 14 dashcam models produced by 11 manufacturers. Furthermore, we develop a normalized database schema to manage multiple different metadata and then discuss several dashcam forensic activities based on it. In addition, a prototype open-source tool is presented to support the proposed metadata-driven dashcam forensics.
A machine learning forensics technique to detect post-processing in digital videos
2020, Future Generation Computer Systems
Citation Excerpt :
The conclusion of this analysis was that the multimedia container structure is a useful feature to determine if a video is authentic or not. In [48], authors implement a technique to verify the integrity of videos with AVI format, generated by VideoEventDataRecorders (VEDRS). The method has two phases: First, they extract the structures or signatures from each AVI video (original or edited), with an extraction algorithm, and later are stored in a database.
Technology has brought great benefits to human beings and has served to improve the quality of life and carry out great discoveries. However, its use can also involve many risks. Examples include mobile devices, digital cameras and video surveillance cameras, which offer excellent performance and generate a large number of images and video. These files are generally shared on social platforms and are exposed to any manipulation, compromising their authenticity and integrity. In a legal process, a manipulated video can provide the necessary elements to accuse an innocent person of a crime or to exempt a guilty person from criminal acts. Therefore, it is essential to create robust forensic methods, which will strengthen the justice administration systems and thus make fair decisions. This paper presents a novel forensic technique to detect the post-processing of digital videos with MP4, MOV and 3GP formats. Concretely, detect the social platform and editing program used to execute possible manipulation attacks. The proposed method is focused on supervised machine learning techniques. To achieve our goal, we take advantage that the social platforms and editing programs, execute filtering and compression processes on the videos when they are shared or manipulated. The result of these transformations leaves a characteristic pattern in the videos that allow us to detect the social platform or editing program efficiently. Three phases are involved in the method: 1) Dataset preparation; 2) data features extraction; 3) Supervised model creation. To evaluate the scalability of the technique in real scenarios, we used a robust, heterogeneous and far superior dataset than that used in the literature.
Authentication and integrity of smartphone videos through multimedia container structure analysis
2020, Future Generation Computer Systems
Citation Excerpt :
These are divided into five groups and are based on metadata, image features, CFA matrix defects, and color interpolation, sensor imperfections, and wavelet transforms. In [15], the authors perform a technique to verify the integrity of AVI format videos, generated by Video Event Data Recorders (VEDRs), an analysis of the structure of 296 original videos was performed, which were later edited by five editing programs. The results of the study showed that the editors significantly changed the structure and metadata values compared to the originals.
Nowadays, mobile devices have become the natural substitute for the digital camera, as they capture everyday situations easily and quickly, encouraging users to express themselves through images and videos. These videos can be shared across different platforms exposing them to any kind of intentional manipulation by criminals who are aware of the weaknesses of forensic techniques to accuse an innocent person or exonerate a guilty person in a judicial process. Commonly, manufacturers do not comply 100% with the specifications of the standards for the creation of videos. Also, videos shared on social networks, and instant messaging applications go through filtering and compression processes to reduce their size, facilitate their transfer, and optimize storage on their platforms. The omission of specifications and results of transformations carried out by the platforms embed a features pattern in the multimedia container of the videos. These patterns make it possible to distinguish the brand of the device that generated the video, social network, and instant messaging application that was used for the transfer. Research in recent years has focused on the analysis of AVI containers and tiny video datasets. This work presents a novel technique to detect possible attacks against MP4, MOV, and 3GP format videos that affect their integrity and authenticity. The method is based on the analysis of the structure of video containers generated by mobile devices and their behavior when shared through social networks, instant messaging applications, or manipulated by editing programs. The objectives of the proposal are to verify the integrity of videos, identify the source of acquisition and distinguish between original and manipulated videos.
Detection of inter-frame forgeries in digital videos
2018, Forensic Science International
Citation Excerpt :
In such cases, as long as there is no change in its contents, a video cannot be classified as tampered. Song et al. [29] proposed video file structure based method for video tampering detection. As it works with file signature, it can detect those tampered videos whose file signatures are there in the stored database.
Videos are acceptable as evidence in the court of law, provided its authenticity and integrity are scientifically validated. Videos recorded by surveillance systems are susceptible to malicious alterations of visual content by perpetrators locally or remotely. Such malicious alterations of video contents (called video forgeries) are categorized into inter-frame and intra-frame forgeries. In this paper, we propose inter-frame forgery detection techniques using tamper traces from spatio-temporal and compressed domains. Pristine videos containing frames that are recorded during sudden camera zooming event, may get wrongly classified as tampered videos leading to an increase in false positives. To address this issue, we propose a method for zooming detection and it is incorporated in video tampering detection. Frame shuffling detection, which was not explored so far is also addressed in our work. Our method is capable of differentiating various inter-frame tamper events and its localization in the temporal domain. The proposed system is tested on 23,586 videos of which 2346 are pristine and rest of them are candidates of inter-frame forged videos. Experimental results show that we have successfully detected frame shuffling with encouraging accuracy rates. We have achieved improved accuracy on forgery detection in frame insertion, frame deletion and frame duplication.
Authentication and Integrity of Smartphone Videos through Multimedia Container Structure Analysis
2024, arXiv
Forensic integrity verification of video recordings based on MTS files
2023, Journal of Forensic Sciences

View all citing articles on Scopus

View full text

Integrity verification of the ordered data structures in manipulated video content

Abstract

Introduction

Section snippets

Background

Video editing software

Automated signature collection method

Video editing software observation results

Detection algorithm and evaluation

Discussion

Summary and conclusion

Acknowledgments

J Vis Lang Comput

Contrast enhancement-based forensics in digital images

Inf Forensics Secur IEEE Trans

Exposing photo manipulation from user-guided 3d lighting analysis

Methods for identification of images acquired with digital cameras

Forensic analysis of ordered data structures on the example of jpeg files

Effective image forgery detection of tampered foreground or background image based on image watermarking and alpha mattes