Increasing complexity of image forgery methods is an actual problnemowadays. This problem rises due to the expansionof fields that use digitalimages in their work. Image time series show the dynamics of the scene and allow itto be compared over time. This paper proposes a new algorithm for detecting forgeries of the single digitailmage in an image time series described a scene. This algorithm uses analysis of errors set that were computed during reconstruction of the analyzed image using other images of series. The first part of the paper describes the proposed algorithm consisted of three stages. The second part of the paper describes forgery detection using morphological image filtering based on guidceodntrasting. The third part of the papecrontains comparison of considered algorithms andinvestigation results of intra-image copy-move and inter-image copy-move detection.
Image time series describe dynamic of an scene. Analysis of an image time series lets modeling
an image that can be next in the image time series. Also, it allows deciding authenticity of
the image. There are several approaches to image forgery detection. These approaches may
use unique artifacts left by the camera, unique artifacts arising after compression and, nally,
temporal and spatial correlations [
Forgeries may be created to add a new object to the scene or to hide any existing. Image time series forgery detection has its distinctive features compared to image matching. Every image of an image time series is obtained at di erent moments of time. Two adjacent images of an image time series can be captured under di erent conditions of illumination, weather or seasonal conditions. In this paper, the algorithm invariant to the conditions for obtaining images of the series is proposed.
The proposed algorithm uses a correlation between corresponding fragments of neighboring
images in the series. In this paper, the concept of anomaly applies for image series forgery
detection. In the global sense, an anomaly is a fragment of data that does not correspond to the
precisely de ned concept of normal behavior [
This work consists of three parts. In the rst part, an algorithm for image time series forgery
detection based on the anomalies detection are presented. An algorithm of forgery detection
using morphological image ltering based on guided contrasting [
Let there is an image time series It (n1; n2), t - image number in time series (t = 0; T , T 1). Every image has the same size N1 N2 (n1 2 [0; N1], n2 2 [0; N2]) and captures the same scene at di erent moments of time.
For de niteness, it is assumed that the image I0(n1; n2) is checked for forgeries although it may be located in the image time series anywhere. The fragments It(m1; m2) of all images are analyzed in the sliding window D(n1; n2) 0; N1 1 0; N2 1, (m1; m2) 2 D(n1; n2).
The fragments It(m1; m2) are described in k steps, k = 2p, p > 2.
On the k = 1 step, the fragment I0(m1; m2) is reconstructed by linear combination of corresponding fragments I1(m1; m2); :::IT (m1; m2) for all possible positions of sliding window D:
I0(m1; m2)
T X tIt(m1; m2) t=1 using mean squared deviation "21 minimization: The last action on this step is calculating both types of errors the mean squared deviation and the normalized mean squared deviation that de ned by: (1) (2) (3) (4) i=0 j=0 I0
T k 1 X X On the k = 2p step, every fragment It(m1; m2); t = 1; T corresponding to window D location is splitted into k fragments using k-means clusterization (by brightness) as shown in the Figure 1. New fragments that was constructed after clusterization can be denoted by Itj (n1; n2), j = 0; k 1. Then fragment I0(m1; m2) is reconstructed by linear combination of fragments Itj (m1; m2): using mean squared deviation "2k minimization: "2k = 1
X jDj (m1;m2)2D 0
X
X 1 t T 0 j k 1
12 tj Itj (m1; m2)A ! min 01;:::; 1k 1;:::; 0T ;:::; kT 1 : (5) Then we calculate both types of errors the mean squared deviation and the normalized mean squared deviation similar to (3): "2k "~2k = N1 1 N2 1
X X I0(i; j)2
: In the paper, this procedure performs for k = 4; 8; 16, so there is a set of three mean squared deviation values and three normalized mean squared deviation values for every position of the window D. Calculated values presents as x(n1; n2) as follows: to form the image fragments feature vector. Mean squared deviation values "2k are not deliberately taken into account because they are directly used in the calculation of "~2. k
The obtained vectors x(n1; n2) set represents in the coordinate system "~42"~82"~216. This set locates in the three-dimensional cube with sides equal to 1 as shown in Figure 2: (6) (7)
There are no absolute static objects on images obtained in real conditions. This is due both to noises of real cameras and the image compression on the path from the camera to the processing system. It often leads to additional system distortions. Moreover, a scene may contain objects that have speci c dynamic characteristics although they are static in the global sense. For example, it may be trees swaying in the wind.
As described above, it can be concluded that it is impossible to obtain a feature vector with coordinates (0; 0; 0) after authentic image fragment representation by described above method. It lets de ne a rule for assigning fragments corresponding to feature vectors (0; 0; 0) to anomalies. This type of anomalies refers to fragments that were copied from one or several images of the image time series.
On the other hand, the errors "~2, "~2, "~216 of an authentic fragment representation must have 4 8 values that do not exceed a certain threshold. Feature vectors not corresponded to this condition are considered anomalies. This type of anomalies refers to fragments that were copied from the same image or image not included in the image time series.
It is obvious the error value of the same fragment representation decreases with the clusters number increasing. Therefore, it is justi ed to use di erent thresholds for "~42, "~28 and "~126. The following relation should meet:
T 2 "~4
T 2 "~8
The cube with the feature vectors x(n1; n2) set (2) is divided into three areas: 1) Origin of the coordinate system; 2) A parallelepiped that is adjacent to the origin; 3) Rest area of the cube.
Per the above, feature vectors from the rst area correspond to fragments that were copied from one or several images of the image time series. Feature vectors from the second area refer to authentic image regions. Feature vectors from the third area correspond to fragments that were copied within one image or from an image not included in the image time series. This splitting is shown in Figure 4.
T16
After extraction of feature vectors from the relevant area and labeling them as suspicious, the corresponded binary mask is created. Then the mask is processed with a noise lter that removes regions with square less than some value. After this, only feature vectors that correspond to forgery regions are kept in the set of suspicious feature vectors.
Morphological image ltering technique based on guided contrasting was proposed in [
An image forgery detection algorithm based on guided contrasting can be performed in two stages: 1. Background normalization based on guided contrasting; 2. Image forgery detection using normalized background image processing.
Let f - standard image and g - test image. Proposed in [
Background normalization based on guided contrasting is as follows: 1. Construction of the pyramid representation f t = (f 0; :::f t 1) and gt = (g0; :::gt 1) where f 0 = f; g0 = g and size(f i) = size(2fi 1) ; size(gi) = size(2gi 1) ; i = 1; t 1.
2. Calculation of the lter (9) response i(f i; gi)(x; y) for every pyramid level: (f; g)(x; y) = g0D(x;y)(x; y)+ j K(f D(x;y); gD(x;y)) j (g(x; y) gD(x;y)(x; y)); 0 (9) where gD(x;y)(u; v) = g(x; y); if (u; v) 2 D(x; y); 0; otherwise, g0D(x;y)(x; y) = mean(gD(x;y)(x; y)) and K(f D(x;y); gD(x;y)) is the local normalized correlation coe cient de ned by (10).
K(f; g) =
(f D(x;y) k f D(x;y) f D(x;y); gD(x;y)
0 f0D(x;y) kk gD(x;y) gD(x;y)) 0 gD(x;y) 0 k 3. Calculation of absolute di erence i(f i; gi)(x; y) for i = 1; t 1.
4. Reconstruction of a di erence image from the pyramid. It is performed from level t with averaging on every level by following: gfi between gi and corresponding lter response 1 mif (x; y) = fgfi (x; y); if i = t
1; max(gfi (x; y); hif+1(x; y)); otherwiseg where hif - twofold spatial increased image gfi .
Image mf0 is the normalized background of the image g with considering the shape of the image f .
Image g forgery detection performs by normalized background image mf0 processing. This processing carries out as following:
1. Image mf0 binarization. For this procedure, thresholding an image with an opportunity to set a threshold by the user was chosen.
2. Morphological ltering of the binary image from step 1 such as erosion and dilation in the square window 3 3.
3. Segmentation and enumeration of all non-zero fragments.
4. Computation of an minimal convex hull of every suspicious segment and ll it.
5. Calculation of the local morphological correlation coe cient (MCC) KMn [
k g k gFn = (g; n) k n k2 where n is the number of an analyzed suspicious fragment, n is the indicator function that has value "1" for pixels from analyzed suspicious fragment and "0" otherwise and gFn de ned by: 6. Creating global mask with all forgery fragments which correspond to segments with MCC greater than the threshold.
The experiments were carried out on a desktop PC with Intel Core i5-4460 processor and 16 GB RAM.
Five image time series were obtained using the same camera. The camera was still all the time. It has captured the scene and token image every 10 sec. As result of this procedure, there are ve image time series with six images in every series. Obtained images have 920 1380 dimension. Next, every image has been transformed to gray-scale. These time series were chosen as the objects of experiments.
Series consisted of six images were used for image forgery detection through the algorithm based on anomaly detection. The algorithm based on guided contrasting used series from two images that are rst and last.
Copy-move various type embedding procedure was developed for forgeries generation. Experiments of two type forgeries detection were carried out: 1. Copy-move within one image - intra-image copy-move.
2. Copy-move from another image of the image time series - inter-image copy-move.
The experiment results with duplicate taken from the same image are shown in the tables 1 and 2. Example of detection using these algorithms is shown in the Figure 5.
As shown in the tables 1 and 2, both algorithms give about the same results of F1 ( 0.66 is mean F1 for the algorithm based on anomalies detection, and 0.59 is mean F1 for the algorithm based on guided contracting). However, these algorithms reach these values on account of di erent components as so as Precision and Recall. So, the algorithm based on anomalies detection has high values of Recall. It means a greater portion of forgery pixels are detected using the algorithm based on anomaly detection than using the algorithm based on guided Figure 5. Example of intra-image forgery detection: a - forgery image; b - result of detection using the algorithm based on anomalies detection; c - result of detection using the algorithm based on guided contrasting. contrasting. On another hand, the algorithm based on guided contrasting has high values of Precision. It means this algorithm has less false detection than the algorithm based on anomalies detection.
The experiment results that were carried out on all image series with duplicate taken from another image of the image series are shown in the tables 3 and 4. Example of detection using these algorithms is shown in the Figure 6.
As shown in the tables 3 and 4, the algorithm based on guided contrasting doesn't give opportunity detecting inter-image copy-move forgeries while the algorithm based on anomalies detection does it and give high values of F1.
The algorithm for image time series forgery detection based on anomaly detection was proposed in this paper. Also, comparison of the proposed algorithm and the algorithm for image forgery detection based on guided contrasting carried out. Experiments showed that both algorithms have about the same quality of detection intra-image copy-move in the sense of metric F1 (0.66 and 0.59 respectively). On another hand, experiments let to conclude that the algorithm of image forgery detection based on guided contrasting doesn't give opportunity detecting inter-image copy-move, unlike proposed algorithm. Figure 6. Example of inter-image forgery detection: a - forgery image; b - result of detection using the algorithm based on anomalies detection; c - result of detection using the algorithm based on guided contrasting. Acknowledgments The reported study was funded by RFBR according to the research project 17-29-03190, research project 18-01-00748 and by the Federal Agency of scientific organization (Agreement 007Γ3/43363/26).