Source device identification is a key task in digital image investigation. The goal is to link a digital image to the specific device that captured it, just like they do with bullets fired by a specific gun (indeed, image source device identification is also known as “image ballistics”).
The analysis of Photo Response Non-Uniformity (PRNU) noise is considered the prominent approach to accomplish this task. PRNU is a specific kind of noise introduced by the CMOS/CCD sensor of the camera and is considered to be unique to each sensor. Being a multiplicative noise, it cannot be effectively eliminated through internal processing, so it remains hidden in pixels, even after JPEG compression.
In order to test if an image comes from a given camera, first, we need to estimate the Camera Reference Pattern (CRP), characterizing the device. This is done by extracting the PRNU noise from many images captured by the camera and “averaging” it (let’s not dive too deep into the details). The reason for using several images is to get a more reliable estimate of the CRP, since separating PRNU noise from image content is not a trivial task, and we want to retain PRNU noise only.
After the CRP is computed and stored, we can extract the PRNU noise from a test image and “compare” it to the CRP: if the resulting value is over a given threshold, we say the image is compatible with the camera.
Camera identification through PRNU analysis has been part of Amped Authenticate for quite some time. However, many of our users told us that the filter was hard to configure, and results were not easy to interpret. So, since the end of last year, a new implementation of the algorithm was added (Authenticate Build 8782). The new features included:
Advanced image pre-processing during training
In order to lower false alarms probability, we implemented new filtering algorithms to remove artifacts that are not discriminative, something that is common with most digital cameras (e.g., artifacts due to Color Filter Array demosaicking interpolation).
Peak-to-Correlation Energy measure for pattern matching
The Peak-to-Correlation Energy (PCE) is a much more robust correlation measure than Pearson Correlation and provides output values spanning a more intuitive range. For non-matching images, the PCE usually takes values in the range [0 25], while for matching images the common range is [45 10^4].
Easier training and automatic reference image triage
In older versions of Amped Authenticate, the user had to specify several folders in order to create a new reference pattern, because the compatibility threshold changed significantly across different cameras. Since PCE values tend to span the same range across all devices, we removed adaptive threshold computation and suggest a fixed threshold (we will see the experimental validation in a future post). Now the user is only asked to specify the name of the CRP file to be created and the folder where reference images are stored. Amped Authenticate will automatically triage images in the folder and choose the best images for computing the CRP (the number of images is limited to 50, which proved to be enough – we’ll also discuss this in a future post).
Interface for creating a new CRP in a previous version of Amped Authenticate
Same task in the current version of Amped Authenticate
Simpler storage of computed CRPs
After computing a new CRP, the new version of the filter stores all information in a single .crp file. In the same folder, a text file (.crp.log) containing information about CRP creation process will also be available (e.g., list of images used for CRP estimation). This favors reproducibility of the process, which is fundamental in every forensic application.
Cropping detection and estimation
The PCE allows matching images even when an arbitrary number of rows and columns have been removed, provided that no resizing occurred before or after cropping. Robustness to cropping and resize has been extended to the case of rigid rotations of the image.
Information on estimated geometric transformation
Amped Authenticate automatically checks whether the evidence image needs to be rotated, resized or cropped, in order to match the CRP. When one or more of these transformations are detected, this is clearly specified in the output. In the case of cropping, the matching sub-region of the CRP is also indicated, thus allowing users to understand which side of the image is missing.
In the next post, we will share results of extensive tests carried out with the implementation of Authenticate’s Camera Identification.