International Journal of Advances in Electronics and Computer Science, ISSN: 2393-2835 Volume-3, Issue-6, Jun.

-2016

IMAGE FORGERY DETECTION ON CUT-PASTE AND COPY-MOVE

FORGERIES
1
GARGI RATHOD, 2SHRUTI CHODANKAR, 3RUPALI DESHMUKH, 4PRIYANKA SHINDE,
5
S. P. PATTANAIK
1,2,3,4,5
Computer Engineering Department, RSCOE,
Rajarshi Shahu College of Engineering, Pune
E-mail: [email protected], [email protected], [email protected],
4
[email protected], [email protected].

Abstract— Now-a-days, it is possible to manipulate an image by removing or adding important features from it without
leaving any clue of editing the original image. One can use advanced tools to digitally manipulate images to create non-
existing situations which leads to discarding the originality of images. These modifications are not visible to the naked eye.
Cut-paste and Copy-move forgeries are common image manipulations. In cut-paste forgery, a portion of another image is cut
and pasted on another image. Whereas in copy-move, part/portion of the same image is copied and moved onto the same
image. As devices like cameras are getting more and more digitized, there is an increase in the need for digital image
authentication, validation and forgery detection. To detect cut-paste forgery, we use histogram equalization detection
technique. It Detects whether the image’s contrast has been enhanced or not. For copy-move detection, up till the useful
techniques was block matching technique and key point based forgery detection method. These techniques are integrated
along with adaptive over segmentation algorithm. The adaptive over segmentation algorithm divides the image into non-
irregular blocks adaptively. Forgery regions are then detected using the forgery region extraction algorithm. Finally merged
regions are detected by applying morphological operations.

Keywords— Copy-Move, Cut-Paste, Histogram Equalization, Adaptive Over-Segmentation, Block Matching, Forgery
Region Extraction.

I. INTRODUCTION case. In previous years, many forgery detection

methods have been proposed for copy-move forgery
The availability of powerful digital image processing detection. According to the existing methods, the
programs, such as PhotoShop, makes it relatively copy-move forgery detection methods can be
easy to create digital forgeries from one or multiple categorized into two main categories: block based
images. Due to the development of computer algorithms and feature key point based algorithms.
technology and image processing software, digital The existing block based forgery detection methods
image forgery has been increasingly easy to perform. divide the input images into overlapping and regular
However, digital images are a popular source of image blocks then, the tampered region can be
information, and the reliability of digital images is obtained by matching blocks of image pixels or
thus becoming an important issue. In recent years, transform coefficients. As an alternative to the block
more and more researchers have begun to focus on based methods, key point based forgery detection
the problem of digital image tampering. Of the methods were proposed, where image key points are
existing types of image tampering, a common extracted and matched over the whole image to resist
manipulations of a digital image are cut-paste and some image transformations while identifying
copy-move forgeries, which is to paste one or several duplicated regions. An adaptive over segmentation
copied region of an image onto other parts of the method is proposed to segment the host image into
same image or on another image. To hide cut-paste non overlapping and irregular blocks called Image
forgery, forgers usually enhance the contrast of the Blocks (IB).Then, we apply the Scale Invariant
image. This enhancement can be detected by using Feature Transform (SIFT) in each block to extract the
Histogram Equalization Detection. In this technique, SIFT feature points as Block Features (BF).
pf-cdf calculation is performed. In the end, plotting Subsequently, the block features are matched with
the cumulative graph shows whether the image is cut- one another, and the feature points that are
paste forged or not. During the copy and move successfully matched to one another are determined
operations, some image processing methods such as to be Labelled Feature Points (LFP), which can
rotation, scaling, blurring, compression, and noise approximately indicate the suspected forgery regions.
addition are occasionally applied to make convincing Finally, we propose the Forgery Region Extraction
forgeries. Because the copy and move parts are method to detect the forgery region from the host
copied from the same image, the noise component, image according to the extracted LFP.
color character and other important properties are
compatible with the remainder of the image some of II. DETAILS EXPERIMENTAL
the forgery detection methods that are based on the
related image properties are not applicable in this 2.1. Cut-Paste Forgery

Image Forgery Detection on Cut-Paste and Copy-Move Forgeries

13
International Journal of Advances in Electronics and Computer Science, ISSN: 2393-2835 Volume-3, Issue-6, Jun.-2016

values—that is, divide the entire range of values into

a series of intervals—and then count how many
values fall into each interval. The bins are usually
specified as consecutive, non-overlapping intervals of
a variable. The bins (intervals) must be adjacent, and
are usually equal size.

Fig.3. Histogram of fig.1.b

Display Cumulative Graph A cumulative frequency

graph is a visual representation of ranked categorical
data. An example is grouping people by height
categories: under five feet, five feet to six feet, and
Fig.1. (a & b) Original image (a) has been contrastly enhanced above six feet. The number of people in each
to hide the pasted part (b). category is the frequency. To find the cumulative
frequency, add to each successive category the totals
2.1.a. Cut-Paste Forgery Detection of the lower categories. Graphing a normally
distributed variable such as height will result in an s
shape, with x as the height and y as the frequency.
The cumulative frequency graph is useful in
calculating the median and quartiles. The median is
the x value when y is halfway up the y axis, or half of
the total frequency. The quartiles are at 25% and 75%
Fig.2. Detection of Cut-Paste Forgery
of the y axis.

Grey Scale Conversion

In photography and computing, a grayscale or
greyscale digital image is an image in which the
value of each pixel is a single sample, that is, it
carries only intensity information. Images of this sort,
also known as black and white, are composed
exclusively of shades of grey, varying from black at
the weakest intensity to white at the strongest.
Grayscale images are distinct from one-bit bi-tonal
black-and-white images, which in the context of
computer imaging are images with only the two
Fig.4.Example
colours, black and white. Grayscale images are often
the result of measuring the intensity of light at each
pixel in a single band of the electromagnetic spectrum
(e.g. Infrared, visible light, ultraviolet, etc.), and in
such cases they are monochromatic proper when only
a given frequency is captured. But also they can be
synthesized from a full color image.
Display Histogram A histogram is a graphical
representation of the distribution of numerical data. It
is an estimate of the probability distribution of a
continuous variables (quantitative variable) and was
first introduced by Karl Pearson. To construct a
histogram, the first step is to "bin" the range of
Fig.5.Cumulative Graph of fig.1.b

Image Forgery Detection on Cut-Paste and Copy-Move Forgeries

14
International Journal of Advances in Electronics and Computer Science, ISSN: 2393-2835 Volume-3, Issue-6, Jun.-2016

A smooth curve indicates that the digital image has 1. Adaptive Over-Segmentation Algorithm
undergone cut-paste forgery. In our copy-move forgery detection scheme, we first
propose the Adaptive Over-Segmentation algorithm,
2.2. Copy-Move Forgery Detection which is similar to the traditional block-based forgery
detection methods and can divide the host image into
blocks. In previous years, a large amount of block-
based forgery detection algorithms have been
proposed. Of the existing block-based forgery
detection schemes, the host image was usually
divided into overlapping regular blocks, with the
block size being defined and fixed beforehand. Then,
the forgery regions were detected by matching those
blocks. In this way, the detected regions are always
composed of regular blocks, which cannot represent
the accurate forgery region well; as a consequence,
the recall rate of the block-based methods is always
very low. Moreover, when the size of the host images
increases, the matching computation of the
overlapping blocks will be much more expensive. To
address these problems, we proposed the Adaptive
Over-segmentation method, which can segment the
host image into non-overlapping regions of irregular
shape as image blocks; afterward, the forgery regions
can be detected by matching those non-overlapping
and irregular regions. Because we must divide the
host image into non overlapping regions of irregular
shape and because the superpixels are perceptually
meaningful atomic regions that can be obtained by
Fig.6. (a & b) Original image (a) over-segmentation, we employed the simple linear
Forged image (b). iterative clustering (SLIC) algorithm to segment the
host image into meaningful irregular superpixels, as
Copy-move forgery is common image manipulating individual blocks. The SLIC algorithm adapts a k-
where a part of the image is copied and pasted on means clustering approach to efficiently generate the
another parts. Copy-move forgery detection is used to superpixels, and it adheres to the boundaries very
search the copied regions and their pasted ones. Up to well. The different blocking/segmentation methods,
now the useful way to detect copy-move forgeries is where the overlapping and rectangular blocking,
block matching technique and key point based shows the overlapping and circular blocking, and the
forgery detection method. The project integrates both non-overlapping and irregular blocking with the SLIC
these techniques along with adaptive over segmentation method. Using the SLIC segmentation
segmentation algorithm. The adaptive over method, the non-overlapping segmentation can
segmentation algorithm divides the image in irregular decrease the computational expenses compared with
blocks adaptively. Forgery regions are then detected the overlapping blocking; furthermore, in most cases,
using the forgery region extraction algorithm. Finally the irregular and meaningful regions can represent the
merged regions are detected by applying forgery region better than the regular blocks.
morphological operations. The method may However, the initial size of the superpixels in SLIC is
successfully detect the forged part even when the difficult to decide. In practical applications of copy-
forged area is enhanced to merge it with the move forgery detection, the host images and the
background. copy-move regions are of different sizes and have
different content, and in our forgery detection
method, different initial sizes of the superpixels can
produce different forgery detection results;
consequently, different host images should be
blocked into superpixels of different initial sizes,
which is highly related to the forgery detection
results. In general, when the initial size of the
superpixels is too small, the result will be a large
computational expense; otherwise, when it is too
large, the result will be that the forgery detection
results are not sufficiently accurate. Therefore, a
Fig.7.System Working of Copy-Move.
balance between the computational expense and the

Image Forgery Detection on Cut-Paste and Copy-Move Forgeries

15
International Journal of Advances in Electronics and Computer Science, ISSN: 2393-2835 Volume-3, Issue-6, Jun.-2016

detection accuracy must be obtained when employing same length as the block features or directly used the
the SLIC segmentation method for image blocking. In pixels of the image block as the block features;
general, the proper initial size of the superpixels is however, those features mainly reflect the content of
very important to obtain good forgery detection the image blocks, leaving out the location
results for different types of forgery regions. information. In addition, the features are not resistant
However, currently, there is no good solution to to various image transformations. Therefore, in this
determine the initial size of the superpixels in the paper, we extract feature points from each image
existing over-segmentation algorithms. In this paper, block as block features, and the feature points should
we propose a novel Adaptive Over-Segmentation be robust to various distortions, such as image
method that can determine the initial size of the scaling, rotation, and JPEG compression. In recent
superpixels adaptively based on the texture of the years, the feature points extraction methods SIFT [20]
host image. When the texture of the host image is and SURF [21] have been widely used in the field of
smooth, the initial size of the superpixels can be set to computer vision. The feature points extracted by
be relatively large, which can ensure not only that the SIFT and SURF were proven to be robust against
superpixels can get close to the edges but also that the common image processing operations such as
superpixels will contain sufficient feature points to be rotation, scale, blurring, and compression;
used for forgery detection; furthermore, larger consequently, SIFT and SURF were often used as
superpixels imply a smaller number of blocks, which feature point extraction methods in the existing key
can reduce the computational expense when the point-based copy-move forgery detection methods.
blocks are matched with one another. In contrast, Christlein et al. [22] showed that the SIFT possessed
when the texture of the host image has more detail, more constant and better performance compared with
then the initial size of the superpixels can be set to be the other 13 image feature extraction methods in
relatively small, to ensure good forgery detection comparative experiments. As a result, in our proposed
results. In the proposed method, the Discrete Wavelet algorithm, we chose SIFT as the feature point
Transform (DWT) is employed to analyze the extraction method to extract the feature points from
frequency distribution of the host image. Roughly, each image block, and each block is characterized by
when the low-frequency energy accounts for the the SIFT feature points that were extracted in the
majority of the frequency energy, the host image will corresponding block. Therefore, each block feature
appear to be a smooth image; otherwise, if the low- contains irregular block region information and the
frequency energy accounts for only a minority of the extracted SIFT feature points.
frequency energy, the host image appears to be a
detailed image. We have performed a large number of 3. Block Feature Matching Algorithm
experiments to seek the relationship between the After we have obtained the block features (BF), we
frequency distribution of the host images and the must locate the matched blocks through the block
initial size of the superpixels to obtain good forgery features. In most of the existing block-based methods,
detection results. We performed a four-level DWT, the block matching process outputs a specific block
using the ‘Haar’ wavelet, on the host image; then, the pair only if there are many other matching pairs in the
low-frequency energy ELF and high-frequency energy same mutual position, assuming that they have the
EHF can be calculated using (1) and (2), respectively. same shift vector. When the shift vector exceeds a
With the low-frequency energy ELF and high- user-specified threshold, the matched blocks that
frequency energy EHF, we can calculate the contributed to that specific shift vector are identified
percentage of the low-frequency distribution PLF as regions that might have been copied and moved. In
using (3), according to which the initial size S of the our algorithm, because the block feature is composed
superpixels can be defined as in (4). of a set of feature points, we proposed a different
method to locate the matched blocks. The block is
calculated adaptively; with the result, the matched
block pairs are located; and finally, the matched
feature points in the matched block pairs are extracted
and labeled to locate the position of the suspected
forgery region. The detailed steps are explained as
follows.

Algorithm Block Feature Matching Algorithm

Input: Block Features (BF);
Output: Labeled Feature Points (LFP).
STEP-1: Load the Block Features BF = {BF1, BF2, . .
2. Block Feature Extraction Algorithm . ,BFN}, where N means the number of image blocks;
In this section, we extract block features from the and calculate the correlation coefficients CC of the
image blocks (IB). The traditional block-based image blocks.
forgery detection methods extracted features of the

Image Forgery Detection on Cut-Paste and Copy-Move Forgeries

16
International Journal of Advances in Electronics and Computer Science, ISSN: 2393-2835 Volume-3, Issue-6, Jun.-2016

STEP-2: Calculate the block matching threshold T RB below the threshold t. However, according to our
according to the distribution of correlation requirements we are only interested in connected
coefficients. segments of certain minimal size. Thus, the threshold
STEP-3: Locate the matched blocks MB according to difference Δxij is further processed using the
the block matching threshold T RB. morphological opening operation. The image is first
STEP-4: Label the matched feature points in the eroded and then dilated with the neighborhood size
matched blocks MB to indicate the suspected forgery corresponding to the minimal size of the copy-moved
regions. area (in experiments, the 10×10 neighborhood was
used). The opening operation successfully removes
4. Detection of Copy-Move Forgery isolated points. Although this simple exhaustive
Any Copy-Move forgery introduces a correlation search approach is effective, it is also quite
between the original image segment and the pasted computationally expensive. In fact, the computational
one. This correlation can be used as a basis for a complexity of the exhaustive search makes it
successful detection of this type of forgery. Because impractical for practical use even for medium-sized
the forgery will likely be saved in the lossy JPEG images. An estimate of the computational complexity
format and because of a possible use of the retouch of the algorithm is given below.
tool or other localized image processing tools, the During the detection, all possible shifts [k,l] with 1≤
segments may not match exactly but only k, l ≤ M/2 need to be inspected. For each shift, every
approximately. Thus, we can formulate the following pixel pair must be compared, thresholded, and then
requirements for the detection algorithm: the whole image must be eroded and dilated. The
1. The detection algorithm must allow for an comparison and image processing require the order of
approximate match of small image segments MN operations for one shift. Thus, the total
2. It must work in a reasonable time while computational requirements are proportional to
introducing few false positives (i.e., detecting (MN)2. For example, the computational requirements
incorrect matching areas). for an image that is twice as big are 16 times larger.
3. Another natural assumption that should be This makes the exhaustive search a viable option only
accepted is that the forged segment will likely be a for small images.
connected component rather than a collection of very
small patches or individual pixels. 4.2 Autocorrelation
In this section, two algorithms for detection of the The autocorrelation of the image x of the size M×N is
Copy-Move forgery are developed – one that uses an defined by the formula:
exact match for detection and one that is based on an
approximate match. Before describing the best
approach based on approximate block matching that
produced the best balance between performance and
complexity, two other approaches were investigated –
Exhaustive search and Autocorrelation.

4.1 Exhaustive search

This is the simplest and most obvious approach. In
this method, the image and its circularly shifted
version (see Figure 5) are overlaid looking for closely
matching image segments. Let us assume that xij is
the pixel value of a grayscale image of size M×N at The autocorrelation can be efficiently implemented
the position i, j. In the exhaustive search, the using the Fourier transform utilizing the fact that r= x
following differences are examined:

where F denotes the Fourier transform.

The logic behind the detection based on
autocorrelation is that the original and copied
segments will introduce peaks in the autocorrelation
for the shifts that correspond to the copied-moved
segments. However, because natural images contain
most of their power in low-frequencies, if the
autocorrelation r is computed directly for the image
itself, r would have very large peaks at the image
corners and their neighborhoods. Thus, we compute
the autocorrelation not from the image directly, but
from its high-pass filtered version. Several high-pass
filters were tested: Marr edge detector, Laplacian
Image Forgery Detection on Cut-Paste and Copy-Move Forgeries

17
International Journal of Advances in Electronics and Computer Science, ISSN: 2393-2835 Volume-3, Issue-6, Jun.-2016

edge detector, Sobel edge detector, and noise the blocks from several disconnected pieces instead
extracted using the 3×3 Wiener filter (see, for of one connected segment indicates that the person
example, [ImgProcBook]). The best performance was who did the forgery has probably used a retouch tool
obtained using the 3×3 Marr filter. Assuming the on the pasted segment to cover the traces of the
minimal size of a copied-moved segment is B, the forgery. Note that if the forged image had been saved
autocorrelation copy-move detection method consists as JPEG, vast majority of identical blocks would have
of the following steps: disappeared because the match would become only
1. Apply the Marr high-pass filter to the tested image. approximate and not exact (compare the detection
2. Compute the autocorrelation r of the filtered image. results with the robust match in Figure 8). This also
3. Remove half of the autocorrelation why the exact match analysis of images from Figures
(Autocorrelation is symmetric.). 2 and 4 did not show any exactly matching blocks. In
4. Set r = 0 in the neighborhood of two remaining the next section, the algorithm for the robust match is
corners of the entire autocorrelation. given and its performance evaluated.
5. Find the maximum of r, identify the shift vector,
and examine the shift using the exhaustive method
(this is now computationally efficient because we do
not have to perform the exhaustive search for many
different shift vectors).
6. If the detected area is larger than B, finish, else
repeat Step 5 with the next maximum of r. Although,
this method is simple and does not have a large
computational complexity, it often fails to detect the
forgery unless the size of the forged area is at least ¼
of linear image dimensions (according to our
experiments).
Both the exhaustive search and the autocorrelation
method were abandoned in favor of the third
approach that worked significantly better and faster
than previous approaches.

V. DETECTION OF COPY-MOVE FORGERY

BY BLOCK MATCHING

Exact match
The first algorithm described in this section is for
identifying those segments in the image that match
exactly. Even though the applicability of this tool is
limited, it may still be useful for forensic analysis. It
also forms the basis of the robust match detailed in
the next section.
In the beginning, the user specifies the minimal size Fig.8.Working of Copy-Move Forgery Detection System.
of the segment that should be considered for match.
Let us suppose that this segment is a square with B×B CONCLUSION
pixels. The square is slid by one pixel along the
image from the upper left corner right and down to With the increase in digital image forgery, the need of
the lower right corner. For each position of the B×B forgery detection algorithms has increased. The
block, the pixel values from the block are extracted above mentioned algorithms help in detecting forged
by columns into a row of a two-dimensional array A image regions from an image using Cut-Paste and
with B2 columns and (M–B+1)(N–B+1) rows. Each Copy-Move Forgery Detection System.
row corresponds to one position of the sliding block.
Two identical rows in the matrix A correspond to two REFERENCES
identical B×B blocks. To identify the identical rows,
[1] J. Fridrich, “Methods for "Methods for Tamper Detection
the rows of the matrix A are lexicographically in Digital Images", Proc. ACM Workshop on Multimedia
ordered (as B×B integer tuples). and Security, Orlando, FL, October 30−31, 1999, pp.
This can be done in MNlog2(MN) steps. The 19−23.
matching rows are easily searched by going through [2] S. Saic, J. Flusser, B. Zitová, and J. Lukáš, “Methods for
Detection of Additional Manipulations with Digital
all MN rows of the ordered matrix A and looking for Images”, Research Report, Project RN19992001003
two consecutive rows that are identical. "Detection of Deliberate Changes in Digital Images",
The blocks form an irregular pattern that closely ÚTIAAV ČR, Prague, December 1999 (partially in
matches the copied-and-moved foliage. The fact that Czech).

Image Forgery Detection on Cut-Paste and Copy-Move Forgeries

18
International Journal of Advances in Electronics and Computer Science, ISSN: 2393-2835 Volume-3, Issue-6, Jun.-2016
[3] J. Lukáš, “Digital Image Authentication“, Workshop of Using Adaptive Over segmentation and Feature Point
Czech Technical University 2001, Prague, Czech Matching” IEEE TRANSACTIONS ON INFORMATION
Republic, February 2001. FORENSICS AND SECURITY, VOL. 10, NO. 8,
[4] Chi Man Pun, Senior Member, IEEE, Xiao Chen Yuan, AUGUST 2015 1705.
Member, IEEE, and XiuLiBi “Image Forgery Detection



Image Forgery Detection on Cut-Paste and Copy-Move Forgeries

19