【作者】 陈帆；

【导师】 王宏霞；

【作者基本信息】 西南交通大学 ， 信息安全， 2013， 博士

【摘要】 数字图像取证(Digital Image Forensic)是通过对数字图像的篡改、伪造和隐写进行分析、鉴别和认证,判断数字图像的来源、原始性、完整性和真实性,分为主动取证和被动取证两类。本论文研究内容是基于数字水印的数字图像真实性主动取证技术,保证数字图像一定视觉质量的前提下,将认证信息嵌入数字图像自身以记录图像所经历的变化,通过篡改检测鉴别数字图像的真实性,并利用篡改恢复提供篡改证据。本论文以数字图像为研究对象,以提高篡改检测性能与恢复质量为目标,从恢复数据编码、篡改检测和“同步篡改”三个关键问题,展开基于数字水印的数字图像真实性主动取证技术研究。具体工作如下。一、分析和研究了现有数字图像主动技术,综述了基于数字水印的数字图像真实性主动取证技术的研究现状和常用评价指标,分析指出各种伪造攻击(如拼贴攻击、恒特征攻击等)是数字图像真实性主动取证技术最大安全威胁,恢复数据编码、篡改检测和同步篡改是提高图像恢复质量要解决的关键问题。二、针对现有单像素主动取证算法漏警率高、嵌入容量大的问题,提出一种基于邻域阈值比较单像素主动取证算法。将基于像素生成的认证数据置乱加密后嵌入图像的最低有效位,设计“邻域阈值比较”的篡改检测策略来判定每个像素的真实性。推导给出了阈值动态选取,分析了邻域大小不同时算法虚／漏警率与篡改比例的关系。理论分析和实验结果表明,在不增加水印嵌入容量情况下,“邻域阈值比较”有效提高了不同篡改条件下单像素主动取证算法的篡改检测性能。同时,实验验证了“邻域阈值比较”在一维信号上的可行性。三、在分析研究现有基于DCT的自嵌入主动取证算法的基础上,提出一种“基于多链阈值”DCT变容量主动取证算法。将图像块变长恢复数据分段嵌入在不同图像块以建立多个图像块间的相关性,设计一种适用于多相关嵌入的多链阈值检测方法。讨论了变长恢复数据的分段原则,推导给出多链阈值检测的篡改检测性能和阈值动态选取。变容量嵌入策略有效缓解了恢复数据编码质量与嵌入容量之间的矛盾,“多链阈值检测”不仅提高了算法抵抗拼贴、恒特征等伪造攻击的能力,还能通过阈值选取有效降低算法漏警率,为提高篡改图像恢复质量奠定了基础。四、为提高大图像比例篡改下的恢复质量,提出一种结合基编码和同步修复的数字图像主动取证算法。为解决数字图像主动取证中“同步篡改”问题,该算法依次采用两个策略：(1)同时嵌入基编码和变长编码,在嵌入容量不显著增加条件下降低同步篡改率；(2)分别采用邻域修复和图像修复两种方法恢复同步篡改块。实验结果表明,该算法在不显著增加水印容量前提下,不仅能抵抗已知的伪造攻击,而且有效提高大比例篡改图像的恢复质量。五、兼顾算法嵌入容量、定位精度、篡改恢复质量和安全性,提出一种基于变长均值编码和邻域预测的图像真实性主动取证算法。该算法将2×2图像块进行变长均值编码,生成不等长恢复数据——平滑块6比特,纹理块12比特。设计邻域预测修复方法来兼顾恢复图像的真实性和质量。变长恢复数据用较少比特保存丰富的图像块信息,仅被嵌入一次且同时用于篡改检测与恢复,在降低嵌入容量同时,可有效提高算法定位精度和抵抗恒均值、拼贴等已知伪造攻击能力,同时,通过邻域预测修复策略有效提高了算法的篡改恢复质量。更多还原

【Abstract】 Digital image forensics is a technology for detecting the source, originality, authenticity and integrity of digital image. It can be divided into two types:active-forensics and passive-forensics. This thesis is concentrating on the active-forensics technology for digital image authentication based on digital watermarking. The active-forensics technology for digital image authentication aims to verify the validity and authenticity of a host image by the pre-embedded authentication information, and provides the tamper proofing by tamper localization and recovery.The research aim of this thesis is to improve the quality of recovered image especially for a larger tamper ratio by improving the performance of tamper detection and the code efficiency of recovery-data. The research achievements on image active-forensics based on digital watermarking are classified into the following five categories.Firstly, a review of active-forensics techniques based on digital watermarking for image authentication is given after studying and analyzing the existing methods. Some evaluation indexes are list to evaluate the performance of the image authentication active-forensics schemes. Based on the analysis, the forged attacks, including the collage attack and the constant feature attack, are considered as the greatest security threat. The recovery data encoding, tamper detection and tampering coincidence are key problems to be resolved for improving the quality of t recovered images.Secondly, a single-pixel active-forensics scheme based on neighborhood-threshold is proposed to address the problems such as high probability of false acceptance (PFA) or large payload in the existing methods. In the proposed scheme, the chaos system is used to generate the binary authentication data according to the content of each pixel in the original image. The improved security binary data by scramble encryption is embedded into the least significant bit of the host image, and the validity of each pixel is determined by the neighborhood-threshold comparison. The dynamic threshold selection and the relationship between the tamper ratio with the PFA and probability of false rejection (PFR) are discussed. Theoretical analysis and simulation results show that the proposed method has a superior performance of tamper detection in the different attacks without adding the embedding payload. At the same time, the neighborhood-threshold detection can be used for one dimensional audio signal by experiments.Thirdly, the existing DCT active-forensics schemes based on digital watermarking are discussed. On that basis, a DCT active-forensics scheme with variable payload based on multi-chain threshold is proposed. For each block, the recovery data with variable length are divided into three parts and embedded in the different blocks based on the secret key. This makes multi-blocks in the image dependent. Based on the adjacent-block statistical detection, the multi-chain threshold method is designed to detect the validity of each block. Analytical expressions of the PFA and PFR for the multi-chains threshold method and the threshold selection have been derived and analyzed. The variable embedding payload preserves the adequate information of image block to as few bits as possible. The multi-chains threshold method not only resists the collage and constant-feature attacks, but also makes the PFA as low as possible by selecting the threshold.Fourthly, an image active-forensic scheme combined basic-code with synchronous-recovery is proposed to improve the quality of recovered images especially for a larger tamper ratio. Two strategies are adopted to resolve the tampering coincidence problem.(1) both total-code and basic-code of each block are embedded to decrease the tampering coincidence ratio without significantly increasing embedding payload;(2) the tamper-coincidence blocks are recovered by its valid neighboring blocks and the image inpainting method, respectively. Simulation results demonstrate that the proposed scheme not only provides security against the known counterfeiting attacks, but also allows image recovery with an acceptable visual quality (PSNR>25dB) up to50%tampering for texture image and about70%tampering for smooth one.At last, an active-forensics scheme combined variable-length average-code with neighborhood prediction is proposed to take into account embedding payload, tamper localization accuracy, recovery quality and security. For each block of size2×2pixels, the average-code is extracted to generate the recovery data with different length----6bits for a plaint block and12bits for a texture block. To improve the recovery quality, the recovery method based on neighborhood prediction is designed to reconstruct the invalid blocks whose recovery watermark embedded in the other block is also destroyed. The variable-capacity recovery data contains the adequate information of image block to as few bits as possible. The recovery data is inserted in the original image only once, and used to both tamper detection and tamper recovery in the proposed scheme. These strategies make the embedding payload as low as possible and the ability against the known forged attacks to be improved. Meanwhile, the proposed scheme has the better quality of recovered images due to the neighborhood prediction recovery.更多还原