Effect of Compression on Sensor Fingerprint Based Camera Identification
Camera identification using sensor fingerprints is nowadays a well established technology for reliably linking an image or a video clip to a specific camera. The sensor fingerprint is typically estimated from images (video frames) provably taken by the imaging device. An image or a video clip is then associated with the fingerprint when some form of a matched filter exceeds a certain threshold, which is set to achieve a prescribed false alarm. However, when the images from which the sensor fingerprint is estimated are lossy compressed, the statistical properties of the detection statistic change, which requires an adjustment of the decision threshold to guarantee the same false alarm rate. In this paper, we study this effect both theoretically and experimentally. A very good match between the theoretical and experimental results validates our approach. This study is especially important for video forensic because of the higher compression rates. Motivation Today, camera identification based on sensor fingerprint is a mature area of research [1, 7, 10, 17] The method works by first estimating the so called sensor fingerprint from a set of images positively known to have been taken by the camera. To prove that a given image (or a video clip) under investigation was acquired by the exact same camera (not just the same model) one establishes the presence of the fingerprint in the image using signal detection techniques. A positive match between an image and a camera fingerprint ties the image with a very high certainty to the camera. Applications of this technology include all cases when a crime is committed by taking a picture, such as in child pornography and movie piracy cases. It can also be used for detection of malicious image manipulation [4, 5, 12, 6] and for general intelligence gathering. In July 2011, the methodology passed the Daubert challenge (http:/en.wikipedia. org/wiki/Daubert_standard) in the State of Alabama. It has also been used in high profile cases, such as the "Operation Algebra" (http:/p10.hostingprod.com/@spyblog. org.uk/blog/2009/05/ The methodology is applicable to all digital imaging devices that contain CCD or CMOS sensors. The vast majority of published work focuses on still images with only a handful of papers directed to digital videocameras [3, 8, 18, 19, 13] Lossy compression that is typically applied to images and video complicates setting appropriate detection thresholds to guarantee a preset false alarm (mistakenly identifying an image as coming from a specific camera) The authors are not aware of any systematic and rigorous study of the effect of lossy compression on sensor based camera identification. For still images, a large scale test [10] was used to experimentally determine the decision thresholds for the Peak Correlation to Energy ratio (PCE) [3] No such study is currently available for video. Although this forensic technique is applicable to both still images and video, there are some important differences: video usually has a much lower spatial resolution, harsher compression, and widely varying ISO. On the other hand, many more images (frames) for both estimation and detection of sensor fingerprint are available. The lower spatial resolution is somewhat compensated for by the large number of frames typically available for analysis, i.e. the total amount of information, which can be in the first approximation expressed using the file size, is typically much larger for video than for digital images. On the other hand, if there is a systematic artifact or modulation present in the compressed signal, it gets undesirably enhanced during fingerprint estimation. It has been recognized already in [3] that sensor fingerprints estimated from video frames contain "artifacts of JPEG compression" that need to be filtered out to lower the false alarm rate. In [3] a filter in the Fourier domain was proposed for this purpose. However, the effectiveness of this filter in controlling the false alarm (and its effect on positive detection) was never properly studied. The main goal of this paper is to analyze the effect of lossy compression on the detection statistic in order to properly adjust the decision threshold for a given false alarm. In the next section, we provide a brief overview of the technology behind camera identification using sensor fingerprints. Then, in the third section, we carry out theoretical analysis of the effect of lossy compression on the detection statistic PCE. The following section contains experiments carried out on still images as well as video. A close match between the theoretically derived results and experiment is observed. The focus of the study is on the statistical properties of the detection statistic under the null hypothesis when the fingerprints do not match as this is what determines the threshold for a fixed false alarm rate. The paper is concluded in the last section. Boldface symbols will be used for vectors and matrices, while their elements will be denoted with the corresponding non bold font. For example, pixel values in an uncompressed 8 bit grayscale image X will be denoted with Xij I {0, ,255} 1< i< n1,1< j n2, where n1xn2 are image dimensions. Whenever the range of indices i, j is not specified for brevity, it will always be assumed to be 1< i< n1,1< j n2. We will use N (m,s2) for a Gaussian random variable with mean m and variance s2. The fact that a random variable X follows distribution f will be denoted X f The probability of an event E is Pr{E} The operation of rounding to integers is 'round' Preliminaries The main part of the sensor fingerprint is the so called Photo Response Non Uniformity (PRNU) [14] which quantifies the fact that each pixel on the sensor outputs a photon count (charge) that slightly but consistently differs from its nominal value. Consequently, each image the sensor takes is overlaid with a unique noise like pattern modulated by the scene light intensity. Let us assume that we have N grayscale images taken by a single camera (alternatively, N luminance frames from a digital video) The pixel intensity of the i, j th pixel in the kth image X(k) will be denoted X ij 1 i n1, 1< j n2. Furthermore, we will denote the noise residual of the kth image as W(k) X(k) F (X(k) k 1, ,N, (1) where F is a denoising filter estimating the pixels' expectation. In this paper, we use the wavelet based denoising filter as described in our prior work [1, 7, 10, 17] Assuming the following linearized sensor model for the residual [2, 16, 9],1 W(k) K *X(k) +Ks(k) (2) where Ks(k) is an n1xn2 matrix of independent and identically distributed (i.i.d. Gaussian random variables with zero mean, the maximum likelihood estimator of the PRNU multiplicative factor K (the fingerprint) is: K N k=1 X (k) *W(k) N k=1(X) (3) We note that in Eqs. (2) (3) all matrices are of dimension n1 x n2 and all matrix operations are executed elementwise. Given two fingerprint estimates, K1 and K2, the detector is facing the following two channel hypothesis testing problem H0 K1 6= K2, H1 K1 K2, (4)
Media Watermarking, Security, and Forensics