Automated approach for splicing detection using first digit probability distribution features

Abstract

Digital image tampering operations destroy inbuilt fingerprints and create own new fingerprint in the tampered region. Considering the Internet speed and storage space, most of the images are circulated in the JPEG format. In a single compressed JPEG image, the first digits of DCT coefficients follow a logarithmic distribution. This distribution is not followed by DCT coefficients of DCT grid aligned double compressed images. In a tampered image, the major portion of the original JPEG image is aligned double JPEG compressed. Hence, untampered region does not follow this logarithmic distribution. Due to the nonalignment of DCT compression grids, tampered region still follows this logarithmic distribution. Many tampering localization techniques have investigated this fingerprint, but the majority of them uses SVM classifier, specifically trained for the respective primary and secondary compression qualities of the test images. The efficiency of these classifiers is dependent on the knowledge of tampered image compression history. Hence, these approaches are not fully automated. In this paper, we have investigated a method, which does not require prior compression quality knowledge. Our experimental analysis shows that the addition of Gaussian noise can make the probability distribution of an aligned double compressed image similar to a nonaligned double compressed image. We divided the test image and its Gaussian version into sub-images and clustered them using K-means clustering algorithm. The application of K-means clustering algorithm does not require compression quality knowledge. This makes our approach more practical as compared to the other first digit probability distribution-based algorithms. The proposed algorithm gives compatible performance with the other approaches, based on different JPEG fingerprints.