Efficient Forgery Detection Approaches for Digital Color Images

: This paper is concerned with a vital topic in image processing: color image forgery detection. The development of computing capabilities has led to a breakthrough in hacking and forgery attacks on signal, image, and data communicated over networks. Hence, there is an urgent need for developing efficient image forgery detection algorithms. Two main types of forgery are considered in this paper: splicing and copy-move. Splicing is performed by inserting a part of an image into another image. On the other hand, copy-move forgery is performed by copying a part of the image into another position in the same image. The proposed approach for splicing detection is based on the assumption that illumination between the original and tampered images is different. To detect the difference between the original and tampered images, the homomorphic transform separates the illumination component from the reflectance component. The illumination histogram derivative is used for detecting the difference in illumination, and hence forgery detection is accomplished. Prior to performing the forgery detection process, some pre-processing techniques, including histogram equalization, histogram matching, high-pass filtering, homomorphic enhancement, and single image super-resolution, are introduced to reinforce the details and changes between the original and embedded sections. The proposed approach for copy-move forgery detection is performed with the Speeded Up Robust Features (SURF) algorithm, which extracts feature points and feature vectors. Searching for the copied partition is accomplished through matching with Euclidian distance and hierarchical clustering. In addition, some preprocessing methods are used with the SURF algorithm, such as histogram equalization and single-mage super-resolution. Simulation results proved the feasibility and the robustness of the pre-processing step in homomorphic detection and SURF detection algorithms for splicing and copy-move forgery detection, respectively.


Introduction
Security of the image content in the modern multimedia system is an issue of the primary concern of researchers in the last decade. Security of image content can be accomplished through several strategies such as watermarking, encryption, steganography, and image forgery detection. The basic idea of watermarking [1,2] and steganography [3,4] is to hide a secret message, signal, or image; in a cover image for conveying valuable information or owner copyright protection. The recent forgery detection algorithms [5][6][7][8] can be classified according to the types of image forgery. The most common algorithms are splicing algorithms and copy-move algorithms. These algorithms depend on different approaches such as Discrete Wavelet Transform (DWT), Local Binary Pattern (LBP), and Scale Invariant Feature Transform (SIFT).
The main contribution of the paper is to apply the pre-processing techniques on the images before extracting the features and develop robust forgery detection methods for splicing and copy-move forgery attacks based on simple signal processing tools. The remainder of this paper is organized as follows. Section 2 introduces a related work to review the types of forgery and technologies used in image forgery detection. Section 3 illustrates the proposed pre-processing algorithms that are used to enhance the image and detection accuracy. Section 4 presents an efficient blind technique based on homomorphic transform for splicing forgery detection and a robust method to identify the forged regions in copy-move images using SURF key-point extraction. Section 5 presents the experimental results and performance evaluation. Finally, Section 6 introduces the concluding remarks and future works.

Related Work
Forensics is the science of discovering any attempts to change some sort of original data or images. Image forensics, which is the topic of our interest, includes changing the contents of digital images in an unauthorized manner. Image forensics analysis aims at discovering some forgeries in images, such as splicing forgery, copy-move forgery, and retouching forgery. So, forgery detection techniques aim to discover the existence of forgery manipulations. Different approaches have been adopted for forgery detection, such as passive and active approaches [8][9][10]. Active forgery detection techniques work on the principles of embedding external information in the image, such as a watermark [11][12][13] or a digital signature [14][15][16]. Verification is performed through the detection of the watermark or signature.
The technique presented in [11] inserts the Computer-Generated Hologram (CGH) from the marked image into the host image. The CGH is defined as a numerical simulation of the natural phenomena of light interference and diffraction. Resizing operation is performed on the mark image according to two steps. First, the mark image is resized by a factor (1/64), then it is magnified to the size of the host image by adding zeros. Then, the Fourier transform is applied to the resized mark image to get the CGH.
The algorithm in [12] decomposes the image into RGB components and applies 2-DWT for each component in the original image and mark image. The watermarked component is produced from the low-frequency components for the original image and mark image. Then inverse wavelet transform is used to produce the watermarked image. The watermark in [13] is obtained from the halftone model of the original image, and then it is inserted in the transform domain of the original image. Both DWT and Discrete Cosine Transform (DCT) are used to generate the watermarked image.
As mentioned before, the second type of active technique depends on a digital signature. The technique in [14] produces a hash image with a Secure Hashing Algorithm (SHA-1) applied to the original image. Then, the hash image is encrypted by the Reed-Solomon Algorithm (RSA), a publickey algorithm, to get the signature. The length of the signature word equals 64 bytes. In parallel with the previous steps, the original image is encoded by Reed-Solomon (RS) code, and the signature is added to the encoded image to produce the encrypted image. Moreover, the technique enhances the randomness of the encrypted image using a chaotic logistic map.
The algorithm in [15] divides the image into a fixed number of blocks equal to 32 blocks for a row and 32 blocks for a column. For any image, the length of blocks is changed, but the number is fixed. Next, a matrix of means for all blocks is calculated in a row direction and column direction. Then, the final signature is created from the XOR function applied to the two matrixes. The method in [16] extracts the low-frequency wavelet component from the image, and then an adaptive Harris corner detector is applied to get the feature points. For each feature point, the mean and variance are calculated from its neighborhood, and the signature matrix is composed of the point feature coordinates and their mean and variance.
Passive forgery detection techniques depend on the signal or image itself for the detection of forgery. Similarity tools in statistics can be utilized with these techniques. Several studies have introduced a general survey [17][18][19][20][21][22][23][24][25] for different types of forgery techniques. In the copy-move technique [26][27][28][29][30][31][32][33][34], the copied parts share characteristics such as lighting conditions, background, and dynamic range with the rest of the images. So, forgery detection becomes more difficult. Several techniques have been investigated to detect the copy-move forgery. These techniques are classified into blockbased techniques or key-point-based techniques [19]. Several algorithms start with preprocessing steps such as conversion between color systems, image enhancement, or noise removal. The feature extraction technique is the only difference between all approaches. The feature vectors should ensure a good representation of the images without losing any data. Then, matching is performed to get the duplication region by finding a high similarity between feature vectors.
The key-points-based techniques such as SIFT [26][27][28] and SURF [29,30] are used to reduce the computational complexity. These techniques are not affected by scaling, rotation transformations and are robust to noise. SIFT key-point descriptors are used in [26] as feature vectors. Copy-move detection is improved in [27] by using local phase quantization to extract the texture information from the image before applying the SIFT. The DyWT decomposes the image, and then SIFT transform is applied on the LL sub-band to extract the feature descriptors [28].
The dimension of the SIFT key-point feature vector is (1 × 128). So, the computational cost is slow. The use of integral images with a SURF key-point descriptor makes the computation of the descriptor faster than SIFT descriptor only, and the dimensions of the feature vector become (1 × 64). So, modern researches are directed to the use of SURF key points. SURF key points features are extracted, and their descriptors are matched with each other.
Many matching techniques have been investigated in the literature, such as Euclidean distance [31], KD tree, and nearest neighbor. An agglomerative hierarchical clustering [32] is applied to the spatial locations of the matched points. The splicing forgery detection techniques aim at discovering the sudden changes between image parts. The algorithm in [33] has been presented to identify the change in the illuminant colors. A grey-world algorithm is used to estimate illuminant sub-bands, and a comparison is performed between them to locate the forged regions. The image [34] is converted from RGB to YCbCr components, and the chrominance component is divided into overlapping blocks. An LBP is calculated for each block, and then the DCT transform is applied on the resulting LBP blocks. Finally, the standard deviations are calculated for each block to build the feature vector.

The Proposed Pre-Processing Techniques for Image Enhancement
Image enhancement techniques are used in a pre-processing step in many applications such as medical and satellite image processing [35][36][37]. Also, image enhancement can be used for forgery detection. It is used to increase the contrast between original and copied parts in any section of the image. The assumption upon which the enhancement is used in forgery detection is that any copied section in the image has a different illumination for that of the background.
Image enhancement methods can be classified into spatial-domain and transform-domain methods [35][36][37][38]. Spatial-domain methods depend on the direct manipulation of the pixels in the image. Transform-domain methods are used to enhance an image by processing in the selected transform domain. Spatial domain techniques are superior from the ease of implementation and speed perspectives. Therefore, only spatial-domain processing techniques will be discussed in this paper. Spatialdomain processing [35] is classified into point processing and mask processing. Point processing deals with the individual pixels only. It does not utilize the relation between pixels in the image. Unlike point processing, mask processing estimates the new pixel value from its original and neighborhood pixels.
This section is devoted to the pre-processing techniques applied to the images before extracting the features to improve the forgery detection algorithms. As mentioned in the literature review, preprocessing is necessary for image forgery detection because it enhances the contrast between original and forged sections. We will develop efficient pre-processing techniques for forgery detection. These techniques include the utilization of high-pass filtering with histogram equalization, the combination between single image super-resolution and histogram equalization, and the decomposition with additive wavelet transform (AWT) and homomorphic image enhancement.

High-Pass Filtering and Histogram Equalization
This technique combines two stages: the high-pass filter and the histogram equalization [39]. First, the image passes through the 2-D high-pass filter. Then, the high-pass filter detects the new highcontrast pixel values by processing the incoming image with a 3 × 3 convolution mask. The resulting images are sharper and contain more details. Eq. (1) shows the mask of the high-pass filter used in the proposed algorithm. The sum of the coefficients in a sharpening operator is also commonly taken to preserve amplitudes in regions of constant gray levels.
After that, the histogram of the resulting image from the first stage is stretched through the spectrum (0 -255) to increase the contrast of the images and provide more details. The normalized histogram can be estimated by the probability density function PDF mentioned in [39].

Single Image Super-Resolution and Histogram Equalization
The undesired motion may occur on the medium between the imaging system and the scene in many cases. This motion produces shifts between pixels and generates a low-resolution image. The missing information can be obtained from the generation of a high-resolution image. Also, several techniques are based on the assumption that the available low-resolution input images are produced by warping, blurring, or down-sampling of the high-resolution scene. High-resolution images are used in several applications such as medical image processing, satellite, and aerial imaging, fingerprint image enhancement, iris recognition, and text image enhancement.
Super-resolution techniques are classified into two categories: multiple image super-resolution and example-based super-resolution. Multiple image super-resolution techniques depend on combining several images, and each image has different information of the same scene. Example-based superresolution techniques have databases formed by the correspondence between low-and high-resolution image patches. These techniques apply the learning rules between patches to find the missing data. The scaling up of the images leads to more image details by adding more pixels predicted by their neighbors.
The main idea adopted in the Single Image Super-Resolution (SISR) algorithms is to use only the low-resolution images available [40,41]. This means that the algorithm can generate a high-resolution image without the need for an external database. Super-resolution [40] needs only the original lowresolution image and its blurred versions. In this type of algorithm, first the image is up-sampled with bicubic interpolation, the algorithms depend on the down-sampled version and the deblurred version to obtain the required high-resolution image. Finally, Gaussian Process Regression (GPR) is used as a predictor for the new high-resolution image. The choice of the proper covariance function provides soft clustering of pixels for improvement of the edge recovery. The details of the single-image super-resolution technique are indicated in [40]. It aims to increase the number of extracted features in test images. Increasing the resolution of an image gives more key points. So, the small-size forged regions can be detected. Also, good descriptors are obtained to improve the matching process. The block diagram of the proposed model is illustrated in Fig. 1. It combines histogram equalization and SISR in the pre-processing step.

Homomorphic Enhancement with Additive Wavelet Transform
A pre-processing technique based on the AWT is proposed for image enhancement. This technique begins with the decomposition of images by the AWT and then applies the homomorphic transform on each sub-band, as shown in Fig. 2. Next, the AWT decomposes the image into different subbands, and each sub-band is enhanced with the homomorphic algorithm [42]. In the final step, these homomorphic enhanced sub-bands are subjected to an inverse additive wavelet transform to get an image with better visual details. The homomorphic filtering technique is one of the most common ways used to improve the quality of digital images. It has been used in many imaging applications such as medical applications and robotic vision [39,42,43]. The steps of the enhancement method are shown in Fig. 3 and can be explained as follows [44]: 1) The images are decomposed into R, G, B color channels.
2) For each channel, the wavelet sub-bands w 1 , w 2 , w 3 , . . . , w n contain the detailed high-frequency components, and the approximation low-frequency component I N is generated. 3) For each wavelet sub-band, the illumination and reflectance components are separated using a logarithmic operation. 4) The reflectance and the illumination components are multiplied with α, and β, respectively, where α > 1 and β<1. 5) An exponential function is applied to reconstruct each sub-band and then reconstruct the enhanced image.

Proposed Splicing Forgery Detection with Homomorphic Technique
The proposed technique aims at discriminating between the original and forgery images. It extracts the features from the histogram derivative for the illumination components. The homomorphic filtering separates the low-frequency illumination components from the high-frequency reflectance components of the image. This filtering technique can be implemented by applying a logarithm operation on the image to change the multiplication relation of illumination and reflectance to a sum relation.
The illumination components can be separated using a low-pass filter applied on the logarithm of the image intensity as indicated in [39,42]. On the other hand, the reflectance components can be produced using a high-pass filter. Firstly, the illumination histogram for authentic and forged images is differentiated, and then the Probability Density Functions (PDFs) are estimated for peaks of histogram derivatives for a set of images. Finally, the threshold is determined based on the PDFs for the histogram derivative peak distributions in the presence and absence of forgeries. The proposed technique relies heavily on determining the PDFs for each separated channel in two color models: IHS and RGB, and specifies the most sensitive channel for forgeries. The proposed model is implemented in two phases: the training phase and the testing phase.
The proposed model can be implemented through the following steps.

Proposed Copy-Move Forgery Detection with Pre-Processing and Speeded Up Robust Features Key-Points
In this section, the SURF key points are utilized for the copy-move forgery detection. In addition, the Histogram equalization (HE) and SISR are applied as pre-processing techniques to improve the images before extracting the SURF key points to improve the copy-move forgery detection.
SIFT is used for extracting the distinguishing invariant features from the images. The SIFT features present a powerful tool in many applications, such as reliable matching between different views of a 3-D scene and object recognition in computer vision. Furthermore, SIFT transform provides robust, reliable features to photometric changes such as scaling, rotation, distortion, and addition of noise. There are four main steps for extracting SIFT features: scale-space extrema detection, key-point localization, orientation assignment, and key-point descriptor. In this paper, the SURF technique is used for reducing the time cost of computations and feature matching, which is the main advantage of using it. More explanation of the SURF is provided in [29]. Fig. 4 introduced the block diagram of the proposed model that aims to increase the number of extracted features in test images. Increasing the resolution of an image gives more key points. So, the small-size forged regions can be detected. Also, good descriptors are obtained to improve the matching process.

Figure 4: The proposed SURF-based technique for forgery detection
The matching process for a test image is performed as follows; a set of key-points S={s 1 , s 2 , s 3 , . . . , s n } with their corresponding SURF descriptors F{f 1 , f 2 , f 3 , . . . , f n } is extracted. Then, a matching process is performed in the SURF space among the vectors F of each key-point to identify similar local patches in the test image.
Euclidean distance [44] is proposed to find the best candidate match for each key point. Similar local patches are determined with minimum Euclidean distance and minimum threshold (th 1 ) [45]. The threshold (th 1 ) lies between 0 and 1. If th 1 is set to a value closer to 0, the results will be highly corrected but with fewer matches. If th 1 is set to a value closer to 1, the results will have more matches, but they will be lower correct, increasing the number of false matches. The Euclidean distance is defined by: So, agglomerative hierarchical clustering is used to neglect the false matches and find the matched descriptors. Then, groups of close descriptors are combined together. The hierarchical clustering (HC) algorithm [46] starts by assigning each key point to a cluster; then, it computes all the reciprocal spatial distances among clusters, finds the closest pair of clusters, and finally merges them into a single cluster. Such computation is repeated until a final merging scenario is achieved. Then, the matching process is performed on clusters.

Simulation Setup
Two datasets have been used to test the proposed homomorphic algorithm. The first is a realistic database composed of 70 original images and 70 tampered images. Images are subdivided into the training data consisting of 15 original images and 15 tampered images. The testing data contains 55 original images and 55 tampered images. The Photoshop program has been used to generate the tampered images. The tampered images have been generated by tacking a copy of an image part from an image and pasting this part into another image.
The second database is CASIA 2.0 v2 [47]. This database contains samples of spliced color images of different sizes. It comprises 120 original images and 120 tampered images sub-divided into 20 original images and 20 tampered images for training and 100 original images and 100 tampered images for testing.

Performance Evaluation for Image Splicing Forgery Detection Algorithm
In the first simulation experiment, each RGB and IHS system have examined the proposed detection algorithm. The performance of the proposed model has been determined by the calculation of the True Positive Rate (TPR), which is defined as the sensitivity, the True Negative Rate (TNR), which is defined as the specificity, the False Positive Rate (FPR), and the Accuracy. These metrics are estimated with Eqs. (3)- (6). Sensitivity is related to the ability of the algorithm to detect a tampered image correctly as being tampered. Specificity is associated with the ability of the algorithm to identify an authentic image correctly as authentic. Hence, high values of sensitivity and specificity imply the better performance of the system, where: •

of original images)
A comparison among red, green, blue, and intensity channels for the manually obtained dataset is shown in Tab. 1. The red channel gives the highest accuracy, equals 90. A comparison among red, green, blue channels for the CASIA dataset is shown in Tab. 2. Blue channel achieves the highest accuracy of 74.5%.  In the second simulation experiment, the effect of pre-processing on the proposed detection algorithm is tested. Pre-processing techniques are utilized to enhance the visual quality of the image. In addition, it helps in forgery detection as the details of tampered regions in the images are reinforced. The pre-processing operations applied with the proposed model are High pass filter (HPF), HE, Histogram Matching (HM), and SISR.
The proposed enhancement approach for forgery detection has been tested on the CASIA dataset [47], and each channel of the RGB system has been used. A comparison between pre-processing techniques for forgery detection on the different channels is given in Tabs. 3-5. The feasibility of using different pre-processing techniques is illustrated in the results. The accuracy is increased with all pre-processing techniques except the high-pass filtering. The specificity with a blue channel is increased from 71% to 76%. This may be attributed to the smaller wavelength range of the green channel compared to the red and green channels, as shown in Fig. 5. This performance of the forgery detection process with high-pass filtering can be explained based on the idea of the operation of the high-pass filtering process. The high-pass filter can be used to make the image sharper and emphasize fine details in the image, but it attenuates the low-frequency components of the image, and it also amplifies noise. It is obvious to note that HE gives the highest accuracy from all tested techniques. The accuracy on the red channel is increased from 68% to 83%. The accuracy on the green channel is increased from 68.5% to 82.5%, and on the blue channel, from 74.5% to 82%. The reason is that the histogram equalization stretches the dynamic range of the image, and hence all details of forgery can be enlarged.
The high-pass filter and histogram equalization are combined together for the enhancement of the forgery detection process. Tab. 6 shows the effect of HPF with HE on red, green, blue channels for the second dataset [47]. The accuracy on the red channel is increased from 68% to 85.5%. All channels achieve close values of accuracy.   SISR is combined with HE as a pre-processing technique to enhance the forgery detection results. A comparison of forgery detection performance with and without pre-processing on red, green, and blue channels is given in Tab. 7. The accuracy of forgery detection on red, green, and blue channels indicates the effect of pre-processing; therefore, clear discrimination between the tampered and original images is provided. In addition, the combination between resolution enhancement and histogram equalization increased the accuracy of forgery detection from green, blue, and red channels to 79.5%, 80.5%, and 78.5% from 68.5%, 74.5%, and 68%, respectively.

Figure 5:
The wavelength range of red, green, and blue channels in the RGB color system   Finally, the homomorphic enhancement is tested in the AWT Domain for forgery detection. The simulation experiments have been performed on the blue channels with variable values of α and β as weighing factors of the enhancement process to test the performance of the proposed enhancement algorithm. The results of the experiments are given in Tab. 8. The range of β is started from 0.8 to 0.99, and the range of α starts from 1.2 to 2. Both sensitivity and specificity vary with the change of α and β. The accuracy is increased from 77% to 83.5%. The best results are obtained with β set to 0.99 and α set to 2.
After applying homomorphic enhancement in the AWT domain on each sub-band performance for red, green, and blue channels on the second dataset, the simulation results are given in Tab. 9. The accuracy results on the green, blue, and red channels indicate the proposed pre-processing benefit. The combination between AWT and homomorphic transform increases the accuracy values on red, green, and blue channels to 73.5%, 79%, and 83.5% from 68%, 68.5%, and 74.5%.

Performance Evaluation for Copy Move Based on SURF Forgery Detection Algorithm
The SURF-based algorithm has been evaluated on two datasets: MICC_F600 [48] and CoMoFoD [49]. MICC-F220 contains copy-move color images of different sizes. This database is composed of 110 original images and 110 tampered images. The CoMoFoD database consists of 40 original images and 200 tampered images. The size of the images is 512 × 512. This dataset has small size forgeries and multiple forgeries. Fig. 6 shows the effect of different pre-processing techniques on the tampered image 002-F from the CoMoFoD database. The number of key points is increased from 192 using SURF without pre-processing to 6219 after applying histogram equalization and single-image super-resolution. Histogram equalization produces the largest number of discriminative key-points because it increases the contrast between pixels, as shown in Fig. 6c. Tab. 10 introduces a comparison of applying HE, SISR, and a hybrid algorithm of HE and SISR for the number of extracted key points for four images in MICC_F600 datasets. It can be noted that the hybrid algorithm of HE and SISR gives a better investigation of key points. In addition, the performance of the hybrid algorithm has been tested on 40 images selected from the CoMoFoD database. Finally, the TPR is measured as shown in Tab. 11. The results prove that the combination of histogram equalization and single-image super-resolution enhances the TPR from 57.5% to 85%.  The copied part in the image may be rotated, scaled, and modified before being pasted in another region. The SURF algorithm is tested against rotation, scaling, distortion, and combination between these operations, as shown in Fig. 7. It is clear that the pre-processing gives more reliable results with each operation. The overall accuracy is calculated for two datasets, and the results are shown in Fig. 8. The accuracy on the MICC_F220 dataset is 99%, and the accuracy on the CoMoFoD database dataset is 92.5%.    The main motivation behind this research was the enhancement of image forgery detection performance. This paper discussed two types of image forgery algorithms: copy-move forgery and splicing forgery. These algorithms presented effective and robust models to discriminate between tampered images and authentic images. The enhancement based on pre-processing stages is used to reinforce the details of the images before the forgery detection process. The detail reinforcement process can achieve high classification accuracy. In this paper, high-pass filtering, histogram equalization, resolution enhancement, and adaptive wavelet transform are used individually and in combination as pre-processing stages.
For the splicing forgery, image pre-processing and homomorphic enhancement presented an efficient image forgery detection model. The illumination component is semi-constant in normal images, and hence the histogram of the illumination is close to a single-valued histogram. Otherwise, if there is a forgery in the image, it is expected that due to making some mixes with the image, the lighting conditions may differ, and hence the illumination component may have abrupt changes that are reflected in its histogram as an abnormal change. Abnormal changes can be detected through the first-order derivative; however, there is no large effect on the reflectance component.
Different tampered and untampered image sets have been used for the test. The proposed algorithms have been tested using the different channels of the RGB system, and the detection threshold is determined for each. The blue channel gave the maximum detection accuracy of 74.5% for the proposed detection algorithm without pre-processing. Nevertheless, the detection accuracy became 85.5% after high-pass filtering and histogram equalization. High-pass filtering and histogram equalization pre-processing combined significantly affect the red channel results as the detection accuracy changed from 68% to 85.5%. Moreover, homomorphic enhancement in the AWT domain led to an accuracy of 100% from the red channel. The resolution enhancement pre-processing technique gave a small change in the detection accuracy, and the detection accuracy became 78.5%.
Image pre-processing and SURF-based feature extraction constituted a robust and effective image forgery detection model for the copy-move forgery. The HE and SISR are employed before extracting the SURF key-points to improve the accuracy of the copy-move forgery detection process. This strategy aims to increase the number of SURF key points to efficiently discover the copied regions. As a result, the true positive rate is improved from 64% to 85%. The true positive rate with pre-processing and SURF-based detection has been investigated against scaling, rotation, and distortion attacks.
In addition, histogram equalization and single-image super-resolution together with SURF-based detection achieved good results in the presence of copied segment manipulations. In future work, the proposed forgery detection algorithms can be examined for video and other multimedia data formats.