Blog

Amped Authenticate Update 19348: PRNU Camera Identification and Tampering Detection for Video, and Much More!

Reading time: 8 min
prnu camera identification and tampering detection for video

Dear Amped friends, did you notice that small box under the tree? Santa brought a gift for you: a brand new update of Amped Authenticate! For the second time in a row, we’re adding something big to our software such as PRNU camera identification and tampering detection for video. Keep reading to find out what!

Since its initial release, Amped Authenticate has been the most complete product for authenticating and attributing digital images. We’ve constantly been adding tools, filters, and even filter categories (we just introduced the Geometric Analysis category in the last update). There was just one tile missing from a perfect mosaic: being able to handle video as well. Ladies and gentlemen, we’re super excited to announce that, with this update, we start introducing Video Tools in Amped Authenticate! This is just the beginning of a journey that will make Amped Authenticate even more important for the everyday challenges of a video analyst.

Although videos are often regarded as “sequences of still images”, those working in the field know it’s not that simple. Videos are compressed in a very different way, they carry an enormous amount of data, they come in a wide variety of codecs and containers. When it turns to authentication, the distance gets even larger, to the point that image and video forensics are almost separate research branches.

However, there are some things that images and videos share. For example, geometric features: once you have a tool for detecting inconsistencies in the shadows of an image, you can safely apply it to single frames of a video. And you indeed have the Shadows filter in Authenticate to do that. Another very important shared footprint is PRNU noise: regardless if you’re capturing a still image or a video, the camera sensor noise will be there.

The loyal followers of this blog know that we’ve shown, this summer, how you could compare the PRNU in images and videos, extracting frames from the video with another software (Amped FIVE, to cite one) and treating them as still images. Doable, but impractical, we know. Now, this is no longer needed: you’re just one click away!

video tools option in amped authenticate

The Video Tools menu will complement Amped Authenticate from now on. In this release, it features one important tool, PRNU, which in turn contains three tools:

prnu

Let’s explain briefly what each of these tools does:

Create CRP

As you probably know, the first step in PRNU analysis is to use pictures captured from a known camera to estimate that camera’s sensor noise. The result of this stage is what we call a Camera Reference Pattern (CRP).  At a common 25 fps framerate, one minute of video contains 1.500 still pictures, so one single video can be enough to create a good CRP. As usual, if you have the camera in your hands and you can capture the video, there is some good advice to follow:

  • Capture very uniform content (e.g., a blank wall or bright sky)
  • Avoid dark or saturated regions (e.g., keep the sun out of the picture)
  • Turn off digital stabilization or, when this is not possible, use a tripod to hold the device in a fixed position
  • When the device is placed on a tripod, it is mandatory that the recorded scene is flat, to avoid polluting the CRP with content from a fixed scene
  • The minimum recommended length is 45 seconds (approximately 1000 frames)

Now that you know the rules, let’s open the Create CRP tool:

create crp tool

The first two inputs are quite self-explanatory. The third and fourth lines allow you to limit the range of frames (e.g. if the video is excessively long). The Mode input lets you choose how to process frames for estimating the CRP: you can either extract and accumulate the noise from each frame separately (Use All Frames mode), or divide the frames into groups (Group Frames), average each group, and accumulate the noise extracted from each average frame. The first method is more accurate but takes a longer time, while the second method is faster and was shown to retain good performance. You can customize the size of the frame group in the Frame Group Size input.

Finally, the last input, Digitally Stabilized Video, is very important: you should not create a CRP from a stabilized video (we explained why in this post). If you set the input to Yes, Amped Authenticate will tell you that the video can’t be used. If you set it to No, the CRP will be created. But if you don’t know the case you’re in, choose Autodetect and our software will analyze the video to detect the presence of digital stabilization.

You’ll notice there’s also a Batch Processing button. Imagine a case where you have several possible source devices, and you need to test your evidence against all of them: you’ll need to create a CRP for each possible source. All you need to do is: place all videos in the same folder, set any of them in the Reference Video input, choose an output folder where CRPs should be created, configure the parameters as you would do for a single video, and click the Batch Processing button. Amped Authenticate will iterate the CRP creation on all videos in the folder for you, while you grab a coffee (or go for lunch, depending on the number/size of videos and on your settings 😉 ).

Identification

No one creates a CRP for the sake of having it. You’ll normally use it for checking whether another “evidence” video comes from the same device. This is what the Identification tool is for. Its interface is quite similar to the previous one:

identification tool

You provide the reference CRP and the path to the evidence video. You can limit the analysis to a range of frames, and choose the PRNU extraction mode just as before. When you click Run, Amped Authenticate will compute the PRNU noise from the evidence video and check its correlation against the CRP.

As in the case of images, we use the Peak to Correlation Energy (PCE) to measure such correlation. The obtained PCE value is then compared to a Threshold, that the user can set in the second-last input line. We provide a default value of 60, which performed well in our validation on the VISION dataset (0.2% false-positive rate and 80% true-positive rate), however, we recommend that you make experiments with the actual device you’re dealing with, so to determine whether a different threshold should be used. We’ll dedicate a blog post to this kind of validation soon.

Once processing has finished, you’re presented with this output table, where rows 0 to 10 provide details about the setup of your test for repeatability, while the remaining rows present the obtained results.

video prnu identification result

As you’ve probably noticed from row 11 in the table above, running a video PRNU identification on a 4k video of 1800 frames can take a while (1h and 30m in the example above). That is why we are providing the Group Frames mode, which for the same CRP and video returns the following result:

video prnu identification result

Although we have a lower PCE compared to the Use All Frames mode, it is still two orders of magnitude larger than the threshold… but time dropped from 1h 30m to 6 minutes!

Just like for other filters in Authenticate, results in the table can be exported to a file, it just takes a right-click.

video prnu identification result

Tampering

The Tampering tool detects whether parts of your evidence video have been acquired with a different device (which means: are you looking at a video montage?).

To achieve this, it splits the evidence video into chunks and compares each chunk against the provided reference CRP. Once finished, it plots the PCE value obtained for each chunk: the “staircase” shape of the plot reflects the fact that a single PCE value is obtained from a group of frames, and it is then assigned to all of them in the plot. For example, this is the result of a 1200 frames video where the central 400 frames were pasted in from another device of the same model.

results of prnu tampering analysis

The red line marks the threshold value, that the user could customize when configuring the analysis. By right-clicking on the plot, the user can save it as an image or export the raw data to a TSV file.

results of prnu tampering analysis

Besides the plot, you obtain a table showing how the analysis was configured and some statistics of the results.

video prnu identification result

Updated JPEG Quantization Table Database

Amped Authenticate users know the potentiality of JPEG Quantization Tables (QT) analysis. Since different camera models tend to use different tables, we can use QTs to cross-check the make and model of the camera as declared in Exif metadata. When metadata are not available, QTs may still provide some advice about the brand/model of the originating device (provided the image has not been compressed). To do all of this, however, you need an extensive database that binds camera devices to the QTs they use.

In this update, we added more than 150 new QTs for many smartphones and cameras that entered the market recently. The number of tables in the database rises to an even more astonishing number, crashing the 16k barrier!

display qt database

Improved performance and stability

We improved the startup performance of Amped Authenticate, so you’ll save a few seconds every time you launch the program. Moreover, the Viewer has been improved to better handle cases where either the evidence image or reference image is not processable by JPEG-based filters.

We removed the possibility to open results directly in Excel when running Authenticate in Japanese language since we could not enforce the proper charset. We’ll work to solve this issue in future releases.

Fixed bugs

We’ve fixed some bugs. If you spot any issue when using Authenticate, please let us know via our support portal, so we can fix it!

  • Fixed a bug that caused Clones Blocks to return, under certain configurations, an error when processing large images with odd sizes.
  • Fixed a bug that caused Histogram Equalization not to update properly when the Selection parameter was changed.
  • Fixed a bug that caused Amped Authenticate to appear still running after being closed from the taskbar thumbnail.
  • Removed unnecessary entries from the contextual menu accessible from the output table generated by the Compare CPR tool.
  • The Histogram Equalization filter was missing in the Program Manual and has been added; the descriptions of the Correlation Map filter and of the Search Images From Same Camera Model tool have been improved.

Don’t Delay – Update Today

If you have an active support plan you can update straight away by going into the menu Help>Check for Updates Online within Amped Authenticate. If you need to renew your SMS plan, please contact us or one of our authorized distributors. And remember that you can always manage your license and requests from the customer support portal.

And before we sign off… Merry Christmas everyone! We hope you enjoy this gift!

merry christmas

Table of Contents

Share on

Subscribe to our Blog

Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Subscribe to our Blog

Related posts