Conference PaperPDF Available

Large scale test of sensor fingerprint camera identification

Authors:

Abstract

This paper presents a large scale test of camera identification from sensor fingerprints. To overcome the problem of acquiring a large number of cameras and taking the images, we utilized Flickr, an existing on-line image sharing site. In our experiment, we tested over one million images spanning 6896 individual cameras covering 150 models. The gathered data provides practical estimates of false acceptance and false rejection rates, giving us the opportunity to compare the experimental data with theoretical estimates. We also test images against a database of fingerprints, simulating thus the situation when a forensic analyst wants to find if a given image belongs to a database of already known cameras. The experimental results set a lower bound on the performance and reveal several interesting new facts about camera fingerprints and their impact on error analysis in practice. We believe that this study will be a valuable reference for forensic investigators in their effort to use this method in court.
A preview of the PDF is not available
... We apply bilinear filtering (low-pass filtering) to downsample each image to 224 × 224 pixels with three color channels. To ensure effective PRNU removal, we evaluate the similarity between the noise residual extracted from the PRNU-free image and the reference PRNU of its source camera using the widely adopted Peak-to-Correlation Energy (PCE) [11], as depicted in Figure 1. The experiments in [11] suggested a PCE detection threshold of 50 to determine whether two images are from the same source device. ...
... To ensure effective PRNU removal, we evaluate the similarity between the noise residual extracted from the PRNU-free image and the reference PRNU of its source camera using the widely adopted Peak-to-Correlation Energy (PCE) [11], as depicted in Figure 1. The experiments in [11] suggested a PCE detection threshold of 50 to determine whether two images are from the same source device. The greater the PCE value is, the higher the likelihood that the two images are of the same origin. ...
... PCE evaluation requires the noise residual that serves as the PRNU fingerprint of the image (I D ) and the reference PRNU fingerprint of its source device (D). We use wavelet-based denoising [11] for noise-residual extraction and construct the reference PRNU (F nat ) from the noise residuals extracted from 50 natural images captured by the same device. To calculate the PCE value, we upsample the downsampled PRNU-free images to the same size as the reference PRNU. ...
Article
Full-text available
Source-camera identification tools assist image forensics investigators to associate an image with a camera. The Photo Response Non-Uniformity (PRNU) noise pattern caused by sensor imperfections has been proven to be an effective way to identify the source camera. However, the PRNU is susceptible to camera settings, scene details, image processing operations (e.g., simple low-pass filtering or JPEG compression), and counter-forensic attacks. A forensic investigator unaware of malicious counter-forensic attacks or incidental image manipulation is at risk of being misled. The spatial synchronization requirement during the matching of two PRNUs also represents a major limitation of the PRNU. To address the PRNU’s fragility issue, in recent years, deep learning-based data-driven approaches have been developed to identify source-camera models. However, the source information learned by existing deep learning models is not able to distinguish individual cameras of the same model. In light of the vulnerabilities of the PRNU fingerprint and data-driven techniques, in this paper, we bring to light the existence of a new robust data-driven device-specific fingerprint in digital images that is capable of identifying individual cameras of the same model in practical forensic scenarios. We discover that the new device fingerprint is location-independent, stochastic, and globally available, which resolves the spatial synchronization issue. Unlike the PRNU, which resides in the high-frequency band, the new device fingerprint is extracted from the low- and mid-frequency bands, which resolves the fragility issue that the PRNU is unable to contend with. Our experiments on various datasets also demonstrate that the new fingerprint is highly resilient to image manipulations such as rotation, gamma correction, and aggressive JPEG compression.
... erefore, a PRNU-based forensic method has been developed to identify the source camera for a digital image using a comparing strategy that applies the JSD to the PRNU-based statistical fingerprint extracted from each eligible source camera and the PDF computed for the PRNUbased residual noise extracted from a disputed image. Each PRNU-based statistical fingerprint for a source camera is computed by averaging the PDF of the PRNU extracted from the reference images shot using that eligible source camera, assuming that the PRNU of each digital image was extracted using the algorithm proposed in 2009 by Goljan et al. [25]. In contrast to other works based on peak-to-correlation energy (PCE) ratio [25] or normalized cross-correlation (NCC) [26] to identify a source digital camera for some disputed images, in this work, a statistical criterion based on JSD and PRNU signals was used. ...
... Each PRNU-based statistical fingerprint for a source camera is computed by averaging the PDF of the PRNU extracted from the reference images shot using that eligible source camera, assuming that the PRNU of each digital image was extracted using the algorithm proposed in 2009 by Goljan et al. [25]. In contrast to other works based on peak-to-correlation energy (PCE) ratio [25] or normalized cross-correlation (NCC) [26] to identify a source digital camera for some disputed images, in this work, a statistical criterion based on JSD and PRNU signals was used. In order to show the effectiveness of the proposed method, two case studies were prepared from a set of digital images obtained from the HDR database provided in 2018 by Shaya et al. [27], which is available at https://lesc. ...
... us, this paper is organized as follows: in the Materials and Methods section, based on the noise model used by Chen et al. [22] and Python-implemented PRNU extractor on digital images [25], a description is given to estimate the camera fingerprint and the JSD is presented as a tool to statistically discriminate the source digital camera from disputed digital images; in the Results and Discussion section, the proposed method is presented and applied considering two case studies, one of them when the disputed images are flat images and the other one when they are natural images. In this section, the effectiveness of the proposed method is also evaluated. ...
Article
Full-text available
Regarding the problem of digital camera identification, many methods have been proposed, and for several of them, their effectiveness has been verified on the basis of disputed flat images. However, in real cases the disputed images are natural images, rather than flat images. In that case, several of the already proposed methods are not effective. Hence, in this paper, a method is proposed for the digital camera identification from natural images based on the statistical comparison between the residual noise in the natural disputed images and the fingerprint defined for the eligible digital cameras. In the reported case studies, the HDR database provided by the Communications and Signal Processing Laboratory of University of Florence is used to select a set of eligible digital cameras, and from this image database, for each digital camera, a set of disputed flat images, a set of disputed natural images, and a set of flat reference images were selected. Thus, the fingerprint of each digital camera was calculated from the probability density function (PDF) of the photo-response nonuniformity (PRNU) extracted from its reference images. Therefore, in order to identify the source digital camera of a natural disputed image, the Jensen–Shannon divergence (JSD) was implemented to statistically compare the PRNU-based fingerprint of each eligible source camera against the noise residual of that disputed image. The proposed method has a similar effectiveness to methods based on the peak-to-correlation energy or the Kullback–Leibler divergence when the disputed images are flat images and the PRNU is considered, but it is significantly more effective than those methods when the disputed images are natural images.
... Dizzy uses PRNU hashing because each camera creates a highly characteristic pattern caused by differences in material properties and proximity effects during the production process of the camera's image sensor [8]. Specifically, Dizzy uses a camera classifier that identifies whether an image was captured by the same camera used to capture another image using AHC across all pairs of images, where peak to correlation energy (PCE) is used as a similarity measure [15]. ...
... The size of the wallets is highly skewed ( =5.1k, =200k, 3 =1), where the top 10% contained 99.9% of the addresses. We manually inspected the top-5 wallets in terms of their size and total deposits in US dollar (USD), and found that they belonged to popular exchanges, namely Bitfinex, 15 Poloneix, 16 and Binance, 17 and have sent and received trillions of dollars through millions of transactions. As expected, Dizzy filters out such wallets using its outlier wallet classifier, ending up with 41.7k addresses that belonged to 30.4k wallets. ...
Preprint
With nearly 2.5m users, onion services have become the prominent part of the darkweb. Over the last five years alone, the number of onion domains has increased 20x, reaching more than 700k unique domains in January 2022. As onion services host various types of illicit content, they have become a valuable resource for darkweb research and an integral part of e-crime investigation and threat intelligence. However, this content is largely un-indexed by today's search engines and researchers have to rely on outdated or manually-collected datasets that are limited in scale, scope, or both. To tackle this problem, we built Dizzy: An open-source crawling and analysis system for onion services. Dizzy implements novel techniques to explore, update, check, and classify hidden services at scale, without overwhelming the Tor network. We deployed Dizzy in April 2021 and used it to analyze more than 63.3m crawled onion webpages, focusing on domain operations, web content, cryptocurrency usage, and web graph. Our main findings show that onion services are unreliable due to their high churn rate, have a relatively small number of reachable domains that are often similar and illicit, enjoy a growing underground cryptocurrency economy, and have a topologically different graph structure than the regular web.
... Fingerprint matching [11] is silent a demanding crisis for consistent person substantiation since of the compound distortions concerned in two impressions of the similar finger. In order to compact with inferior fingerprint images, which commence considerable occlusion and encumber of finer points features [10], we plan a fitness purpose supported on the confined properties of each triplet of finer points. ...
Article
Source detection of digital images and videos is essential to multimedia security forensics research. Due to the defects of the manufacturing process, the optical sensor generates a photo response non-uniformity noise attached to it when generating multimedia content. This noise is widely regarded as the inherent fingerprint of multimedia due to its uniqueness and can be used for multimedia source detection. However, videos shared on social networking sites will be further compressed. It is difficult for existing methods to extract enough PRNU noise from such compressed videos for source identification, especially short compressed videos. Considering the effect of compression on PRNU noise, a weighted PRNU extraction model based on variance-stabilized transformed multi-scale iterative least-squares filtering is proposed. First, the video’s decoder needs to be reconstructed. When the decoder’s loop filter is removed, more PRNU noise is retained in the video frame. Secondly, a multi-scale iterative least-squares filtering algorithm based on the variance stabilized transform (VST) is proposed, which can extract more PRNU noise from the video frames. Finally, maximum likelihood estimation using quantization parameter (QP) weighting enables a better estimate of the PRNU and suppression of other noise. Experiments on the public VISION database show that the proposed PRNU extraction model improves the recognition performance by about 20% on average over existing models.
Conference Paper
Full-text available
Digital images can be captured or generated by a variety of sources including digital cameras and scanners. In many cases it is important to be able to determine the source of a digital image. This paper presents methods for authenticating images that have been acquired using flatbed desktop scanners. The method is based on using the pattern noise of the imaging sensor as a fingerprint for the scanner, similar to methods that have been reported for identifying digital cameras. To identify the source scanner of an image a reference pattern is estimated for each scanner and is treated as a unique fingerprint of the scanner. An anisotropic local polynomial estimator is used for obtaining the reference patterns. To further improve the classification accuracy a feature vector based approach using an SVM classifier is used to classify the pattern noise. This feature vector based approach is shown to achieve a high classification accuracy.
Article
Full-text available
In this paper, we extend our camera identification technology based on sensor noise to a more general setting when the image under investigation has been simultaneously cropped and scaled. The sensor fingerprint detection is formulated using hypothesis testing as a two-channel problem and a detector is derived using the generalized likelihood ratio test. A brute force search is proposed to find the scaling factor which is then refined in a detailed search. The cropping parameters are determined from the maximum of the normalized cross-correlation between two signals. The accuracy and limitations of the proposed technique are tested on images that underwent a wide range of cropping and scaling, including images that were acquired by digital zoom. Additionally, we demonstrate that sensor noise can be used as a template to reverse-engineer in-camera geometrical processing as well as recover from later geometrical transformations, thus offering a possible application for re-synchronizing in digital watermark detection.
Article
Full-text available
In this paper, we revisit the problem of digital camera sensor identification using photo-response non-uniformity noise (PRNU). Considering the identification task as a joint estimation and detection problem, we use a simplified model for the sensor output and then derive a Maximum Likelihood estimator of the PRNU. The model is also used to design optimal test statistics for detection of PRNU in a specific image. To estimate unknown shaping factors and determine the distribution of the test statistics for the image-camera match, we construct a predictor of the test statistics on small image blocks. This enables us to obtain conservative estimates of false rejection rates for each image under Neyman-Pearson testing. We also point out a few pitfalls in camera identification using PRNU and ways to overcome them by preprocessing the estimated PRNU before identification.
Conference Paper
Full-text available
Photo-response non-uniformity noise present in output signals of CCD and CMOS sensors has been used as fingerprint to uniquely identify the source digital camera that took the image. The same fingerprint can establish a link between images according to their common source. In this paper, we re- view the state-of-the-art identification method and discuss its practical issues. In the camera identification task, when formulated as a binary hypothesis test, a decision threshold is set on correlation between image noise and modulated fingerprint. The threshold determines the probability of two kinds of possible errors: false acceptance and missed detection. We will focus on estimation of the false acceptance probability that we wish to keep very low. A straightfor- ward approach involves testing a large number of different camera fingerprints against one image or one camera fingerprint against many images from differ- ent sources. Such sampling of the correlation probability distribution is time consuming and expensive while extrapolation of the tails of the distribution is still not reliable. A novel approach is based on cross-correlation analysis and peak-to-correlation-energy ratio.
Article
The charge-coupled device dominates an ever-increasing variety of scientific imaging and spectroscopy applications. Recent experience indicates, however, that the full potential of CCD performance lies well beyond that realized in devices currently available. Test data suggest that major improvements are feasible in spectral response, charge collection, charge transfer, and readout noise. These properties, their measurement in existing CCDs, and their potential for future improvement are discussed in this paper.
Article
Within this article, we investigate possibilities for identifying the origin of images acquired with flatbed scanners. A current method for the identification of digital cameras takes advantage of image sensor noise, strictly speaking, the spatial noise. Since flatbed scanners and digital cameras use similar technologies, the utilization of image sensor noise for identifying the origin of scanned images seems to be possible. As characterization of flatbed scanner noise, we considered array reference patterns and sensor line reference patterns. However, there are particularities of flatbed scanners which we expect to influence the identification. This was confirmed by extensive tests: Identification was possible to a certain degree, but less reliable than digital camera identification. In additional tests, we simulated the influence of flatfielding and down scaling as examples for such particularities of flatbed scanners on digital camera identification. One can conclude from the results achieved so far that identifying flatbed scanners is possible. However, since the analyzed methods are not able to determine the image origin in all cases, further investigations are necessary.
Conference Paper
Sensor photo-response non-uniformity (PRMJ) was introduced by Lukas et al. [1] to solve the problem of digital camera sensor identification. The PRNU is the main component of a camera fingerprint that can reliably identify a specific camera. This fingerprint can be estimated from multiple images taken by the camera. In this paper, we demonstrate that the same fingerprint can be used for identification of camera brand and model. This is possible due to the fact that fingerprints estimated from images in the TIFF/JPEG format contain local structure due to various in-camera processing that can be detected by extracting a set of numerical features from the fingerprints and classifying them using pattern classification methods. We estimate and classify fingerprints for more than 4500 digital cameras spanning 8 different brands and 17 models. The average probability of correctly classified camera brand was 90.8%.