Journal of Network and Computer Applications

Transcription

1 Journal of Network and Computer Applications 34 (2011) Contents lists available at ScienceDirect Journal of Network and Computer Applications journal homepage: A passive image authentication scheme for detecting region-duplication forgery with rotation Guangjie Liu a,n, Junwen Wang a, Shiguo Lian b, Zhiquan Wang a a School of Automation, Nanjing University of Science & Technology, Nanjing , China b France Telecom R&D (Orange Labs) Beijing, Beijing , China article info Article history: Received 6 March 2010 Received in revised form 9 August 2010 Accepted 1 September 2010 Available online 7 September 2010 Keywords: Region duplication Image forensics Passive authentication Hu moment Rotation Robustness abstract Region-duplication forgery is one of most common tampering artifices. Several methods have been developed to detect and locate the tampered region, while most methods do fail when the copied region is rotated before being pasted because of the de-synchronization in the searching procedure. To solve the problem, the paper proposes an efficient and robust passive authentication method that uses the circle block and the Hu moments to detect and locate the duplicate regions with rotation. Experimental results show that our method is robust not only to noise contamination, blurring and JPEG compression, but also to the rotation. Meanwhile, the proposed method has better time performance compared with exiting methods because of the lower feature dimension. & 2010 Elsevier Ltd. All rights reserved. 1. Introduction It is a very sophisticated skill to tamper images in the past film time, which usually requires the forger to have professional dark-room equipments such as the special developer, the photographic paper, and so on. With the wide application of powerful digital image processing software, such as Photoshop, it has become easier and easier to create digital forgeries from one or multiple images. The tampered image might cause some great threats. For example, in 2007, the event of South China tiger s photograph misled many people to believe the existence of wild South China tiger, while finally, the photograph was proved to be a paper tiger (Lian and Zhang, 2010). In 2008, Iran published a picture of missile test, which contains 4 missiles in rocketing. It is doubted that one of the missile is copied from another one (Lian and Zhang, 2010). Through the above examples, we can find that the multimedia forgery will bring many troubles. In the photo contest, some journalists make the forgery photos, which disobey the principle of fair play. In the news reports, the forgery pictures will distort the truth and mislead public opinions. And, someone may change the person s face in a photo with another person s, and put the n Corresponding author. addresses: gjieliu@gmail.com (G. Liu), junwen_wang@yahoo.com.cn (J. Wang), shiguo.lian@orange-ftgroup.com (S. Lian), wangzqwhz@yahoo.com.cn (Z. Wang). forged image over Internet, which also destroys the person s privacy or reputation. A faked image also may be used in the academic paper to indicate a better experimental result. Furthermore, the important object may be wiped off from an evidence image, which causes the miscarriage of the court. Thus, it is important and critical to tell When is seeing believing? According to the above analysis, a multimedia forensics system (MFS) is urgently needed for identification of the authenticity of a multimedia object as illustrated in Fig. 1. Here, we just discuss the forensics of digital image. There are two kinds of techniques, the active authentication and the passive one (Lian et al., 2009). The active methods can be divided into two classes. The first class is based on digital watermarking that embeds a watermark into the image at the acquirement end and extracts it at the authentication end to check whether the image is tampered. The second class is based on the digital signature. It generates a signature at the acquirement end and regenerates another one using the same method at the authentication end. Through comparison, the authenticity of the image can be identified. The passive authentication, also called digital forensic, is the method to make authentication without any help of the additional information. The typical applications include media source identification (Ng and Tsui, 2009a,b), forgery detection (Wang et al., 2009a,b), etc. Taking image forgery detection for example, it makes use of images distinct properties to detect unnatural operations and identify the tampered regions (Zhang and Kong, 2009; Cao et al., 2009) /$ - see front matter & 2010 Elsevier Ltd. All rights reserved. doi: /j.jnca

2 1558 G. Liu et al. / Journal of Network and Computer Applications 34 (2011) Fig. 1. Application scenarios of multimedia forensics system. We know that in the process of a skilled forgery, besides changing the important region about the image content, there are lots of post-processing manners that can be used to remove the artificial trace. The post-processing will not make the forensic work, so how to deal with various post-processing and improve the robustness of forensic methods has become a very important subject. In this paper, we propose a method to deal with a complex region-duplication forgery including region-rotation and other kinds of post-processing. The rest of the paper is organized as follows. In Section 2, the related work about the passive authentication and the regionduplication forgery model are introduced. The mechanism of feature extraction and the detection method are presented in detail in Section 3. In Section 4, some experimental results are given and the corresponding analysis is presented. Finally, some conclusions are drawn in Section Related work In recent years, many researchers have started to develop passive techniques for detecting various forms of image forgeries. Farid et al. developed several statistical methods for detecting forgeries based on region duplication (Popescu and Farid, 2004), color filter interpolation (Popescu and Farid, 2005a,b), re-sampling (Popescu and Farid, 2005a,b) and lamp direction (Johnson and Farid, 2005). Fridrich et al. (2003) presented methods for detecting the copy-move forgery and performed the forgery detection based on the pattern noise of digital cameras sensor (Lukas et al., 2006). Ng and Chang (2004) and Ng et al. (2005) proposed an image spicing model to detect photomontage and physics-based models to distinguish computer graphics from natural photographs. Luo et al. (2007) developed a method to detect cropped and recompressed image blocks. They also presented a new method for detecting the region-duplication forgery (Luo et al., 2006). Zhou et al. (2007) and Kirchner (2008) proposed some methods to detect re-sampling and blur. Here we mainly pay our attention to region-duplication forgery Model of region-duplication forgery Luo et al. (2006) gave a model of region-duplication forgery. This model describes four basic constraints of region-duplication forgery, including the region connectivity, two regions unintersection, translation vector constraint and the duplicate region area threshold. It assumes that the largest copied region must be holeless and be pasted away from its original location without intersecting with its primer location. However, this model cannot describe the forgery when one copy region is pasted onto two places, and the copy region is rotated before being pasted. A more comprehensive region-duplication forgery model was given by Wang et al. (2009a, b). Assuming that the translation vector threshold is V T ¼[V tx,v ty ], and the copy-region area threshold (defined as the ratio of the copy region s area and the whole image s) is A T, we say an image I is tampered to I 0 via regionduplication means, if i) The copy region C i, ia{1,2,y,n} is connective and has no hole inside, and its area is larger than A T a(i), where a(i) denotes the area of the image I. ii) Suppose the duplication of the copy region C i is M i,theremightbe many region-duplication pairs {C 1 99M 1,C 2 99M 2,y,C n 99M n },C i,m i CI 0, which satisfy C i ac j,8iaj, i,jaf1,2,...,ng and C i \M i ¼. Forany pair C i 99M i, defining the origin of the reference frame as the rotation center, the duplication forgery can be considered as shifting after rotating, described by 8ðx,yÞAC i, f ðx,yþ¼fuðxu,yuþ xu ¼ xcosy ysinyþd x yu ¼ xsinyþycosyþd y qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi D 2 x þd2 y Z9V T 9 aðc i Þ4A T UaðIÞ ð1þ Here, f denotes the pixel at the position (x,y), D x,d y is the shift distance along x and y axis, respectively, and y is the rotation angle. It should be noted that in an intact forgery process, the image tampered by region-duplication artifice is often processed by other operations to eliminate the imprint caused by the forgery. The common means are lossy compressing, noise contamination, filtering and so on. Therefore the two duplicate regions are not equal exactly, and how to make the duplication detection with the inferences of post-processing has become an important issue Current region-duplication forgery detection methods According to the forgery process, the similar regions have large size is more possible to be faked. Therefore the detection focuses on how to find the similar regions with as short time as possible. For improving the robustness and decreasing the computational complexity, Fridrich et al. (2003) analyzed the DCT coefficients of each block and proposed the method based on fuzzy matching. The method just worked well under the JPEG compression attack. Popescu and Farid (2004) proposed to capture the main feature of image blocks by principal component analysis (PCA), and complete

3 G. Liu et al. / Journal of Network and Computer Applications 34 (2011) the duplication detection through the matching of PCA coefficients. The method would fail when the JPEG compression factor was lower than 50 or the SNR after adding Gaussian white noise is smaller than 24 db. To make the detection method faster and more robust, Luo et al. (2006) presented a detection method based on the elaborately chosen characteristic features. Performance comparison of different region duplication methods can be seen in Table 1. The three methods mentioned above use the features to match two blocks, and they have a limitation, i.e., only the postprocessing is considered. When the copy region is rotated, the manner to choose square image block will fail as shown in Fig. 2(a). The block B 1 is obtained by the square block matching, while the same block B 2 cannot be obtained by the same fashion. In the paper, we present to use the circle region to replace the square block and adopt the invariant moments of the circle region to overcome the effect of rotation. Fig. 2(b) gives the pattern of the circle block. We can see that C 2 is actually the rotated version of C 1. Hence, if we construct the rotation-invariant features, the traditional matching procedure can also work. 3. Proposed region-duplication detection scheme Different from existing methods, the proposed method matches the blocks based on circles. Firstly, the image is decomposed by Gaussian pyramid, and the produced sub-image in low frequency is chosen to overcome the possible distortion caused by JPEG compression and noise contamination. Then, the sub-image is divided into many circle blocks overlapping each other. And, the features of Hu moments are extracted from the circle blocks, used as the matching features. Here, the circle-block mode and the Hu moments are able to eliminate the effect of rotation. At last, the forgery regions are located by comparing shift vectors and copy-region areas. down using a Gaussian average (Gaussian blur) and scaled down. When this technique is used multiple times, it creates a stack of successively smaller images, with each pixel containing a local average that corresponds to a pixel neighborhood on a lower level of the pyramid. Fig. 3 gives the illustration about Gaussian pyramid decomposition. Let the original image be G 0, which is taken as the zero level, the lth level image of Gaussian pyramid decomposition can be obtained by making the l 1th level image convoluted by a window function w(m,n) with low-pass characteristics, and doing the downsampling after the convolution. The process can be described as G l ði,jþ¼ X2 X 2 m ¼ 2n ¼ 2 wðm,nþg l 1 ð2iþm,2jþnþ The window function w is also called the weight function or the generation kernel, whose size is usually chosen as 5 5. Here, the Gaussian pyramid decomposition can not only reduce the complexity of the detection algorithm, but also help to improve the detection result when there are some post-processing operation such as JPEG compression and noise contamination. The reason is that the features extracted from the Gaussian pyramid decomposed image are more robust against those operations Hu invariant moments Image moments (Flusser and Suk, 2006) have been widely used in image processing, computer vision and related fields. For a 2-D continuous function f(x,y), the moment (sometimes called ð2þ 3.1. Feature extraction Gaussian pyramid decomposition Gaussian pyramid (Fosyth and Ponce, 2000) is a common decomposition manner often used in image processing. The technique involves creating a series of images which are weighted Table 1 Performance comparison of different region duplication methods. Methods Robustness to post-processing computation complexity Popescu and Farid Middle High Fridrich et al. Middle High Luo et al. High Middle Fig. 3. The illustration of Gaussian pyramid decomposition. Fig. 2. Model of region-duplication forgery: (a) model with square block and (b) model with circle block.

4 1560 G. Liu et al. / Journal of Network and Computer Applications 34 (2011) raw moment ) of order (p+q) is defined as ZZ m pq ¼ x p y q f ðx,yþdxdy p,q ¼ 0,1,2... ð3þ scaling, translation and rotation. The seven moments are defined as f 1 ¼ y 20 þy 02 ð7þ Adapting this to gray image with pixel intensities I(x,y), the raw image s moments m ij are calculated by m ij ¼ X X x i y j Iðx,yÞ: ð4þ x y f 2 ¼ðy 20 þy 02 Þ 2 þ4y 2 11 f 3 ¼ðy 30 3y 12 Þ 2 þð3y 21 y 03 Þ 2 f 4 ¼ðy 30 þy 12 Þ 2 þðy 21 þy 03 Þ 2 ð8þ ð9þ ð10þ The zero-order moment denotes the mass of an image: ZZ m 00 ¼ f ðx,yþdxdy ð5þ f 5 ¼ðy 30 3y 12 Þðy 30 þy 12 Þ½ðy 30 þy 12 Þ 2 3ðy 21 þy 03 Þ 2 Š þð3y 21 y 03 Þðy 21 þy 03 Þ½3ðy 30 þy 12 Þ 2 ðy 21 þy 03 Þ 2 Š ð11þ The first-order moments (m 10,m 01 ) are commonly used to determine the centroid of an image by (x c,y c ): x c ¼m 10 /m 00, y c ¼m 01 /m 00. If the origin of the reference frame is moved to the centroid, the centralized moments can be obtained by ZZ u pq ¼ ðx x c Þ p ðy y c Þ q f ðx,yþdxdy p,q ¼ 0,1,2... ð6þ f 6 ¼ðy 20 y 02 Þ½ðy 30 þy 12 Þ 2 ðy 21 þy 03 Þ 2 Š þ4y 11 ðy 30 þy 12 Þðy 21 þy 03 Þ f 7 ¼ð3y 21 y 03 Þðy 30 þy 12 Þ½ðy 30 þy 12 Þ 2 3ðy 21 þy 03 Þ 2 Š þð3y 12 y 30 Þðy 21 þy 03 Þ½3ðy 30 þy 12 Þ 2 ðy 21 þy 03 Þ 2 Š ð12þ ð13þ The centralized moments have the characteristic of translation invariance. When the image is rotated or scaled the centralized moments will not change. Construction of moments with rotation, scaling and translation invariance is very important for many applications such as pattern recognition, multimedia searching and digital watermarking. For the goal, the normalized centralized moments are built up as y pq ¼ u pq =u r 00, r¼(p+q+2)/2, p+q¼2,3,y, which are invariant against scaling. Hu (1962) utilized the second and third order normalized centralized moments to construct seven invariant moments, which can hold invariant against In this paper, because of using circle blocks, the Hu moments is computed only in the circle region, as shown in Fig. 4(a). To evaluate the invariance of Hu moments, we perform an experiment: choose the circle block with radius equaling to 10, and perform many post-processing operations such as rotation 451, adding Gaussian noise, Gaussian blurring and so on. The seven Hu moments of the block and its neighboring circle block are computed as shown in Table 2. The original block is the block of image goldhill covering pixels (100:120,100:120), while the other block (pasted) covers pixels (105:125,105,125). In Table 2, Fig. 4. Circle block pattern: (a) circle region and (b) circle choosing in the image. Table 2 Invariance of Hu moments Moment absolute log value Original block Rotate 45 o Gaussian blurring Noise adding JPEG Compressing (quality¼70) Other block f f f f f f f

5 G. Liu et al. / Journal of Network and Computer Applications 34 (2011) we can see that Hu moments are robust against rotation, blurring, noise adding and JPEG compression, and they can be taken as features to stand for the block because the moments values are very different for two different regions. Thus, they are suitable features for checking block matching. With the consideration of decreasing the computational complexity, we choose the first four moments as the feature, F¼[f 1,f 2,f 3,f 4 ]. threshold T d is chosen as 12 to improve the performance of correct detection. As we know that when there are no larger flat areas in an image (such as sky, cloud), the similar regions will seldom occur. Luo et al. (2006) indicated that the area of the similar region is not less than 0.85% of the area of the whole image. Therefore, we choose the area threshold T a equal to 0.85% a(i) Forgery detection Sorting the component of F Let the size of image be X Y, after Gaussian pyramid decomposition, the low frequency part is X=2 y=2. After dividing the sub-image into 2r 2r square block, the neighboring blocks will have only one different column or row as shown in Fig. 4(b). Thus, we can get T ¼ð X=2 2r þ1þð Y=2 2r þ1þ circles from these blocks. For each circle, we compute the first four Hu moments to construct the feature F i, i¼1,y,t. To improve the search speed, we sort these features by the first component f 1, and store them into a matrix X, which has 4 T components. In the searching process, for the feature F i, we just need to search a given scope in X, which can debase the computational time. Here, we define the searching scope as L, for a given feature, only the left and right L columns in the matrix X are searched Thresholds setting In this method, there are three thresholds to be predetermined. They are the similarity threshold T s, the distance threshold T d and the area threshold T a, respectively. To measure the similarity, the Euclid distance between two feature vectors are computed by vffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi ux 4 SIMðF 1,F 2 Þ¼t i ¼ 1 ðf 1 i f2 i Þ2 F 1 ¼½f 1 1,f1 2,f1 3,f1 4 Š, F 2 ¼½f 2 1,f2 2,f2 3,f2 4 Š ð14þ To determine the threshold, we perform an experiment. In the experiment, we firstly choose 500 images to make random forgery, with the size of tampered block as Then, the tampered images are processed by adding Gaussian white noises, JPEG compression with quality equal to 50, and Gaussian blurring, by computing the similarity defined by Eq. (14). Because we know which blocks are duplicated, we can calculate the similarity of the duplicated regions and obtain the average threshold. According to the experiment the threshold T s is chosen as 0.4. Because the neighboring blocks often have greater similarity, the distance Detection algorithm According to the above discussion, the whole forgery detection algorithm, shown in Fig. 5, can be described as follows: i) For the suspicious image I, perform Gaussian pyramid decomposition, extract the low frequency part G 1. ii) Divide G 1 into ð X=2 2r þ1þð Y=2 2r þ1þ overlapped square blocks with two neighboring blocks having only one pixel distance along horizontal or vertical direction, and get the corresponding circle region. iii) Calculate the feature F i for each circle, sort them by the first component of F i, f 1, to get a matrix X, and recode the coordinate of each feature as (x i,y i ), which equals to the center of each circle. Here the sort process is used to decrease the searching space. iv) Initialize a zero matrix J with the size equaling to G 1. In the matrix X, search similar blocks by the following algorithm, and record the search results into J. Search circle similar to the circle i for(k¼i L,koi+L,i++) { qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi if SIMðF i,f k ÞrT s & ðx i x k Þ 2 þðy i y k Þ 2 ZT d J(x i,y i )¼J(x k,y k )¼1; } v) Perform morphologic operations on J to fill the holes in the marked regions, and remove the small and isolated regions according to the area threshold T a. 4. Experiments and analysis In our algorithm, we choose gray images as examples. For color images, the detection can perform on the intension components. The size of images for testing is , and the radius of circle is chosen as 7. Fig. 5. Steps of the proposed forgery detection process.

6 1562 G. Liu et al. / Journal of Network and Computer Applications 34 (2011) Robustness against JPEG compression and noise contamination We use Photoshop CS3 to make the region-duplication forgery. The original image is shown in Fig. 6(a), the tampered image is shown in Fig. 6(b). Without any post-processing, the detection result is shown in Fig. 6(c). Thus, our method can detect the multiple regionduplication forgery. For evaluating the robustness, we make a series of postprocessing such as noise contamination, JPEG compressing and Gaussian blurring. The experimental results are shown in Figs. 7 9, respectively. As can be seen, the proposed scheme is robust to the common signal processing operations Robustness against rotation The basic motivation of our scheme is to use the circle block and Hu moments to present the invariant features when the copy regions are rotated. The following experiments shown in Fig. 10 are designed to detect the duplicate region when it is rotated with different degrees Detection performance The performance of the algorithm can be described by the following two indices: P r ¼ i ð9c i \ Cu i 9þ9M i \ M 0 i P 9Þ i ð9c i9þ9m i 9Þ ð15þ P i w ¼ ð9c i [ Cu i 9þ9M i [ M 0 i P 9Þ i ð9c r i9þ9m i 9Þ ð16þ Here, C i is the copy region and M i is the tampered region. Correspondently, Cu i and Mu i are the detected copy region and the detected tampered region, respectively. The index r is the ratio of right detection (detection ratio), while w is the ratio of wrong detection (false ratio). Choose 500 images each with size equaling to , copy one block in an image, paste onto other unintersective region, and perform a series of post-processing including Gaussian blurring, JPEG compressing, adding Gaussian white noise. In the test, we use the four different tampering block size 0.853%(32 32), 1.92%(48 48), Fig. 6. Basic test: (a) original image, (b) tampered image and (c) detection result. Fig. 7. Test under AWGN: (a) SNR¼35, (b) SNR¼25 and (c) SNR¼15. Fig. 8. Test under JPEG compressing: (a) quality¼85, (b) quality¼65 and (c) quality¼45.

7 G. Liu et al. / Journal of Network and Computer Applications 34 (2011) Fig. 9. Test under Gaussian blurring:(a) d 2 ¼1, (b) d 2 ¼2 and (c) d 2 ¼3. Fig. 10. Test under region rotation: (a) original image, (b) copy region rotated by 201, (c) copy region rotated by 121, (d) detection result of (b), (e) detection result of (c), (f) original image, (g) copy region rotated 901, (h) copy region with horizontal flipping, (i) detection result of (g) and (j) detection result of (h).

8 1564 G. Liu et al. / Journal of Network and Computer Applications 34 (2011) %(64 64) and 5.333%(80 80). The detection ratio and false ratio under different operations are shown in Table 3, Figs. 11 and 12, respectively. From these results, we can see that the proposed method works well under different conditions. When the tampered region area becomes larger, the detection ratio also becomes larger, while the false ratio becomes smaller. It opens out that the larger the tampered region, the more accurate the detection algorithm. The paper makes the improvement both from the two directions. By using Gaussian pyramid decomposition, the dimension of search space is reduced to the 1/4 of its original amount. And only the first four Hu moments are used as the feature of a block, so the feature dimension does also decrease. For the gray image with size equaling to , Table 4 gives the comparison between our method and other methods. As can be seen, our method uses the least block amount and feature dimension Computational complexity The important problem in region-duplication detection is the computational complexity. There are some artifices that can be used to reduce the computational complexity, which can be classified into two types. One is to find a method to search in the low dimension space, such as the low frequency wavelet subimage, DCT coefficient matrix, etc. The other is to endeavor reducing the dimension of each block, e.g., those methods based on PCA or statistics features. 5. Conclusions The region-duplication forgery is a very common forgery manner. Some researchers have proposed several efficient methods to detect and locate the regions. But because the forger can carry out more complicated forgery during the process of copying and pasting, the more powerful method should be studied. In this paper, we consider the disturbance from the Table 3 The detection results under Gaussian blurring (n 1 ¼n 2 ¼5, d 2 ¼1). Tampering region r w Table 4 Computation complexity comparisons. Methods Extraction domain Block amount Feature dimension Popescu and Farid PCA Fridrich et al. DCT Luo et al. Spatial domain Our method Low frequency part r w SNR/db SNR/db Fig. 11. Performance under adding noise: (a) detection ratio under adding noise and (b) false ratio under adding noise r w Compression Factor Compression Factor Fig. 12. Performance under JPEG Compression: (a) detection ratio under JPEG compression and (b) false ratio under JPEG Compression.

9 G. Liu et al. / Journal of Network and Computer Applications 34 (2011) rotation. Features are extracted from the first four Hu moments of the circle blocks in low frequency part of Gaussian pyramid decomposition. Experiments and analysis prove that the proposed method have nice robustness to post-processing and copy-region rotation, and obtain efficient detection performance compared with existing works. It should be noted that in our scheme, Hu moments are only computed on the inscribed circle of the square. Discarding the pixels outside the inscribed circle will have a little effect on the false alarm of the detection algorithm. Hence in future work, the new rotation-invariant features should be constructed directly on the circle region. Additionally, for other intermediate-processing such as resizing, cropping etc., the corresponding robust detection method will be investigated. Acknowledgments This study was supported by the China Post Doctor Foundation of China (Grant no ), NSF of Jiangsu and Post Doctor Foundation of Jiangsu province (Grant no. BK ), Graduate Research, Innovation Project of Jiangsu Province (CX09B_100Z) and NUST Research Funding (Grant no. 2010ZYTS048). References Cao G, Zhao Y, Ni R. Statistical fusion of multiple cues for image tampering detection. Proceedings of International Conference on Multimedia and Expo 2009: Flusser J, Suk T. Rotation moment invariants for recognition of symmetric objects. IEEE Transaction on Image Processing 2006;15: Fosyth D, Ponce J. Computer vision: a modern approach. Prentice Hall; Fridrich J, Soukal D, Lukas J. Detection of copy-move forgery in digital images. Proceedings of Digital Forensic Research Workshop Hu MK. Visual pattern recognition by moment invariants. IEEE Transaction on Information Theory 1962;8: Johnson MK, Farid H. Exposing digital forgeries by detecting inconsistencies in lighting. Proceedings of ACM Multimedia Security Workshop 2005:1 9. Kirchner M. Fast and reliable resampling detection by spectral analysis of fixed linear predictor residue. Proceedings of the ACM Workshop on Multimedia and Security 2008: Lian SG, Kanellopoulos D, Ruffo G. Recent advances in multimedia information system security. Informatica 2009;33:3 24. Lian SG, Zhang Y. Multimedia forensics for detecting forgeries. In: Stavroulakis Peter, Stamp Mark, editors. Handbook on communications and information security. Springer; Lukas J, Fridrich J, Goljan M. Digital camera identification from sensor pattern noise. IEEE Transaction in Information Forensics and Security 2006;1: Luo WQ, Huang JW, Qiu GP. Robust detection of region-duplication forgery in digital image. Proceedings of International Conference on Pattern Recognition 2006: Luo WQ, Qu ZH, Huang JW, Qiu GP. A novel method for detecting cropped and recompressed image block. Proceedings of IEEE Conference on Acoustics. Speech, and Signal Processing 2007: Ng TT, Chang SF, Hsu J, Xie L, Tsui MP. Physics-motivated features for distinguishing photographic images and computer graphics. Proceedings of the ACM Multimedia 2005: Ng TT, Tsui M. Camera response function signature for digital forensics Part I: theory and data selection. Proceedings of IEEE Workshop on Information Forensics and Security 2009a: Ng TT, Tsui M Camera response function signature for digital forensics Part II: signature extraction. Proceedings of IEEE Workshop on Information Forensics and Security 2009b Ng TT, Chang SF. A model for image splicing. Proceedings of International Conferenence of Image Processing 2004: Popescu A, Farid H. Exposing digital forgeries by detecting duplicated image regions. USA: Dartmouth College; Popescu AC, Farid H. Exposing digital forgeries by detecting traces of re-sampling. IEEE Transaction in Signal Processing 2005a;53: Popescu AC, Farid H. Exposing digital forgeries in color filter array interpolated images. IEEE Transaction on Signal Processing 2005b;53: Wang JW, Liu GJ, Dai YW, Wang ZQ. Detecting JPEG image forgery based on double compression. Journal of Systems Engineering and Electronics 2009a;20: Wang JW, Liu GJ, Zhang Z, Dai YW, Wang ZQ. Fast and robust forensics for image region-duplication forgery. Acta Automatica Sinica 2009b;35: Zhang P, Kong XW. Detecting image tampering using feature fusion. Proceedings of International Conference on Availability, Reliability and Security 2009: Zhou LN, Wang DM, Guo YB, Zhang JF. Blur detection of digital forgery using mathematical morphology. Proceeding of KES AMSTA 2007:990 8.