Detection of Spliced Image Forensics Using Texture Analysis of Median Filter Residual

In the image forensics, detection of Cut-Paste manipulation is complicated computing. In this paper, the texture analysis of the spliced image is used to detect image forensics. From the local entropy of the median filter residual (MFR) of the forged image, the feature set is extracted for the ground truth mask ‘Find Gray level regional Maxima (FGM),’ and ‘Entropy-based Edge (EbE).’ Also, from the local range, the feature set is extracted for ground truth mask {‘Morphological–Open Image (MOI), and ’Morphological– Erosion Image (MOE)’}. The feature vector in this paper composed of the two MOIs, two MOEs, and one EbE. The defined novel feature vector trained on a cubic support vector machine (SVM) classifier for only the performance evaluation of the proposed scheme. The performance of the proposed image forensics detection (IFD) scheme was measured with the five transformed types of image: median filtered (window size: {<inline-formula> <tex-math notation="LaTeX">$3\times 3$ </tex-math></inline-formula>, <inline-formula> <tex-math notation="LaTeX">$5\times 5$ </tex-math></inline-formula>}), JPEG compressed (quality factor: {90, 70}) and average filtered (window size: <inline-formula> <tex-math notation="LaTeX">$3\times 3$ </tex-math></inline-formula>). For the detection of the spliced image forensics, the region of <italic>Cut-Paste</italic> is classified by an input image only to the proposed scheme without the need for the trained SVM classifier. Throughout the experiment, the accuracy of median filtering detection was 98% over. Also, The area under the curve by sensitivity (TP: true positive rate) and 1–specificity (FP: false positive rate) results of the proposed IFD scheme approached to ‘1’ with the trained cubic SVM classifier. Experimental results show high efficiency and performance to the spliced image. Therefore, the grade evaluation of the proposed scheme is “<italic>Excellent</italic> (<inline-formula> <tex-math notation="LaTeX">$A$ </tex-math></inline-formula>).”


I. INTRODUCTION
In the current media society, a large amount of multimedia content is distributed. Accordingly, copyright protection of contents has emerged as an essential issue. A malicious dealer manipulates the image by the method of ingeniously avoiding copyright. In the infringement of copyright, there are several image manipulation of the forgery methods, including copymove, cut-paste, and double-compression, etc. [1]- [3]. In particular, some forgers prefer the Cut-Paste method because it quickly makes a new composite image with multiple different images. In the Cut and Paste region, one of them uses median filtering (MF) that has the property of preserving edges within an image [4], [5]. For this reason, MF is frequently used in the operation of forgery images; thus, median filtering The associate editor coordinating the review of this manuscript and approving it for publication was Wenming Cao . detection (MFD) is a necessity in image forensics [6]. In the typical image forensics detection (IFD), the relationship between image pixels is statistically processed, or the frequency and spatial domains of an image are analyzed.
The main words of IFD from state of the art are shown in the word cloud in Fig. 1. To summarize with the words, the median filtering is much manipulation in image forensics, and feature definitions are needed to detect a spliced region. For IFD, feature vectors are classified into two main types. One uses a single property like the autoregressive (AR) model [7], [8], and the other one has a combination of various properties [2], [9]. In [2], Yuan invented the median filtering forensics (MFF) 44-dim. feature vector which is combined into one feature set with the five kinds: 'the distribution of the block median,' 'the occurrence of the block-center gray level,' 'the number of gray levels in a block,' 'the distribution of the block-center gray level in the sorted gray levels,' and 'the first occurrence of the block-center gray level in the sorted gray levels' for MF images. Rhee [9] proposed an ensemble 15-dim. feature vector with the three characteristics of the feature set: 'the Canny edge' [10], 'the Prewitt gradient' [11], and the 'Hu invariant moments' [12] for MFD too.
In the image forensics detection (IFD), the median filter residual (MFR) is mainly used as a preprocessing step [5]- [7], [9], [12], [13] of the suspicion image. For median filtering forensics, Chen et al. [5] proposed the framework based on CNN (Convolutional Neural Network), in which the first layer is a filter layer as the MFR. Also, Gupta et al. [13], the authors exploited the statistics of the Pearson parameter to capture fingerprints κ of the MF image, where the κ is determined for the MFR. Meanwhile, Kang et al. [7] obtained the autoregressive (AR) coefficients as the 10-dim. feature vectors for MFD using the AR model to analyze the MFR (the scheme called MFR AR), which is the difference between the values of the original image and those of the MF image. The authors analyzed an image's MFR AR and found that it could suppress image content that may interfere with the MFD. Later, J. Yang et al. defined the 2-D ARMA coefficients of MFR [8] as a 27-dim. feature vector (the scheme called MFR 2D-AR).
In this paper, a proposed IFD scheme to detect the spliced image forensics by using texture analysis of the image itself for outgrowing conventional methods: the MFR AR and the MFR 2D-AR, which simply depend on statistical processing. Also, the combination or ensemble feature vector extends the feature-length for the performance betterment, which methods only cause the cost of forensic detection.
Be comprehended the main contribution of this paper is as follows: 1) For detecting an unknown state of the spliced image, its MFR is decomposed to obtain the local entropy and the local range, and then their texture is analyzed. 2) In the texture analysis, a local entropy generates the GTM (Ground Truth Mask) using the FGM (Find Gray level regional Maxima of closing by image reconstruction), and also the entropy-based edge for the border generated between Cut-Paste region of a spliced image. 3) A local range generates the GTM using a morphological open/erosion for the separation of the Cut-Paste region in a spliced image. 4) Furthermore, the implemented detector of image forensics does not need a trained classifier when testing a spliced image. 5) When any part of the image itself is manipulated, the part can be classified with the proposed detector. In this paper, for the spliced image forensics, a new IFD scheme is proposed, in which the feature vector extracted from the texture analysis of MFR. Thus, the proposed algorithm has the characteristics of image filtering process and texture analysis.
The rest of this paper is organized as follows: Section 2 briefly introduces related theoretical methods in the field of MFR, AR, texture analysis, spliced image, and cubic SVM. In Section 3, the proposed IFD scheme is presented, which includes the theoretical properties introduced in Section 2. The experimental results of the proposed IFD scheme are discussed in Section 4, including performance evaluation compared with prior related works. Finally, the conclusion is drawn, and future research possibilities in the area of image forensics, are presented in Section 5.

II. THEORETICAL BACKGROUND
The theoretical backgrounds in this Section, describe median filter residual (MFD) autoregressive, texture analysis, spliced image, and cubic SVM.

A. MEDIAN FILTER RESIDUAL AND AUTOREGRESSIVE
In the detection of median filtering, MFR is most frequently used as a pretreatment. Fig. 2, suspicion image y (a), its median filtering image z (b), and the difference image d (c) between y and z are depicted. Any part of the image (a) is manipulated. In Fig. 2 (c), the MFR d is formulated as Eq. (1),: where med is median filtering, (i, j) is a pixel coordinate, and w is the MF window size.
The AR model is used to extract the feature vector for MFD in image forensics because of its performance. To compute the AR coefficients of MFR [7], [9] in Fig. 2 (c), the MFR AR is formally defined as a (r) where r and c are the row and column directions, respectively; k is the AR order number, 1 ≤ k ≤ p, and p is the maximum order number. Similarly, the 2D-AR model [8] of MFR is formally defined as where (i, j) is the neighboring range of (m, n), and (p, q) is the maximum order number in the horizontal and the vertical direction, respectively.

B. TEXTURE ANALYSIS
Texture analysis refers to the characterization of regions in an image by their texture content. It attempts to compute intuitive qualities described by terms such as rough, smooth, silky, or bumpy as a function of the space-variant in pixel intensities. From this point of view, a bump and rough mean to variance in the gray levels.
Texture analysis is used in several applications, including remote sensing, automated inspection, and medical image processing, etc., also can be used to find the texture border edges, which is a texture segmentation. Texture analysis can be helpful when objects in an image are more portrayed by their texture than by the luminosity because of the existing threshold techniques cannot be efficaciously used.
Texture analysis uses statistical measures to classify textures. It can detect the object borders that are presented more by texture than by the luminosity.
The entropy filtering operation, which computes the entropy of the neighborhood around the correlated pixel in the grayscale image, and allots that value to the output pixel of regard. Furthermore, the range filtering operation, which detects regions of texture in an image. The pixel of the texture contains the range value (maximum value -minimum value) of the neighborhood around the corresponding pixel in an image.
As mentioned above, the operations in a similar way: they define a neighborhood around the interest pixel, calculate the statistic for that neighborhood, and use that value as the value of the interest pixel in a texture image.
Entropy [14], [15] is computed based on the below: where, p(l) is normalized by obtaining a luminosity histogram H (l) for the image area. And whose properties to be measured. If a luminosity value is L (l = 0,1,2, . . . , L − 1), followed by dividing the frequency of each luminosity value by the total frequency (a pixel number of the image area) and then normalizing to compose the total pixel number. A transformed image (ex: median filtering, average filtering, JPEG compression) is to be smooth, which is little variation in the gray-level values compared to an unaltered image.
Therefore, an unaltered image exhibits more texture, and pixels have more variability and higher range values.
For texture analysis, statistical measurements are used. In this method, it is possible to detect reliably the border of an object with a texture rather than the contrast of an image.
In this paper, texture analysis would be used because the difference of the entropy can be classified as the Cut-Paste region in spliced images.

D. CUBIC SVM
A support vector machine (SVM) finds a hyperplane in multidimensional space for the classification of input vector x, which is a feature of the class label. A cubic SVM has a classification of higher accuracy and its less computing time [16], [17]. The best classifier model is cubic SVM [18] which kernel function presented inner product as follows: where kernel function that maps input vector x, and d is the degree of a polynomial, by d value, class 1 and 2 is classified in Fig. 4.

III. PROPOSED IMAGE FORENSICS DETECTION (IFD) SCHEME
Image forensics detection (IFD) should classify the Cut-Paste region of a spliced image; each region does not have the same properties as the correlation, attributes, or validation, between the neighboring pixels. In the specific area of image, texture analysis, meaning an alignment of Hue change and frequency. In this respect, the texture analysis adopted to classify the Cut-Paste region in the proposed IFD scheme. Texture analysis of a spliced image takes apart into the images that have different properties: the local entropy and the local range of a grayscale image. An unaltered (in Fig. 3(c): Cut region) and transformed region (in Fig. 3(d): Paste region) could be classified respectively by the texture analysis of the MFR (Eq.1). This method adopted in the proposed IFD scheme, which implemented with the characteristics of the image filtering process and texture analysis, and is shown in Fig. 5.
The proposed scheme consists of five steps, as follows: Step 1: Input a spliced image (a), which has the Cut-Paste region both as in Fig. 3 (e).
Step 4: Le (d) and Lr (e) images in this sub-step, there are five ground truth masks (GTM), which masks classify the Cut-Paste region in the spliced image.
where reg_max: regional maxima. Then, entropy-based edge EbE defined by the black dash line (g), which is the border to classify the different properties of texture.
2) 2 nd ∼ 5 th features: two morphological-open images (MOI) and two morphological-erosion images (MEI) are extracted repeatedly with a mo and mi, too, then the four kinds of the morphological-based GTM formed (h, i: blue dash lines). Two MOI and MEI are formulated as Eq. (12) and (13) Step 5: Lastly, the forgery image detection block (red dash line) takes five elements (a, f, h, and i) as input, and classifies the Cut-Paste region (j) of the spliced image (a), respectively. The detection image (j) includes a Cut region (blue color), a Paste region (the grayscale image itself), and a Cut-Paste border edge (thick black line).

IV. PERFORMANCE EVALUATION AND EXPERIMENTAL RESULTS
This Section first describes the experimental methodology. Second, the experimental results of the proposed IFD scheme are presented with the four test items: 'Classification accuracy,' 'Area under the ROC curve (AUC),' 'P TP at P FP = 0.01', and 'Pe.' Also, the experimental results are compared to those of [7], [8] to verify the performance, where P TP (True Positive rate: Sensitivity), P FP (False Positive rate: 1-Specificity), P FN (False Negative rate). The higher value of 'P TP at P FP = 0.01,' which has the better of the detection ability between the Cut-Paste classification, and a minimum average decision error Pe, which has lower, then the reliability of the IFD is to be higher. Also, this means an equal probability of the positive and negative data (i.e., the positive: Cut region and the negative: Paste region).
Pe= min( A. EXPERIMENTAL METHODOLOGY The BOWS2 (10,000 images) and the UCID (1,338 images) databases [19], [20] are used in the experiment of the proposed scheme.
In the experiments, the images converted to 8-bit grayscale images by the necessity for use. From the image databases, VOLUME 8, 2020 the five types of the feature were extracted by the proposed IFD scheme, which implemented in cubic SVM [18] classifier with five-folder cross-validation. For training the classifier, the prepared p-Data, and n-Data, which are composed as follows: p-Data: Cut region (unaltered).
• Spliced image. n-Data: Paste region (transformed). Where w is the window size, and QF is the quality factor.
In each image format, 11,338 images (BOWSE2 + UCIDver.2) prepared, and randomly selected images 9,070 (80%) were used for training, and the remaining images 2,268 (20%) were used for testing. Now use one element and five features needed for IFD.
The defined EbE, which is in the proposed scheme, depicted in Fig. 6 (f), along with the existing edges, and compared to the existing edge (a∼e), where the border edge is classifying the transformed (Paste), and the unaltered (Cut) region is evident. Also, the transformed region is almost pure, while the unaltered region represented by its texture.
For the Cut-Paste classification of the forgery image, The unaltered vs. {MF3, MF5, JPG90, JPG70, and AVE3} were     27-dim. [8], respectively. In Fig. 8 (a), according to the high 'P TP at P FP = 0.01' of the proposed scheme, the ROC curves (a) is rapidly increased compared to (b) and (c), reaching '1' on the y-axis (True positive rate). Therefore, the proposed feature set has a higher classification performance than [7] and [8].
In Table 1, the results of the proposed scheme, the AR, and the 2D-AR are inclusively shown to compare each method.
For the performance measurement of the classification: the Cut (Unaltered) vs. Paste {MF3, MF5, JPG90, JPG70, and AVE3}. Use the four test items described at the beginning of Section 4, and the best results are highlighted in gray.
The proposed IFD scheme classifies a nonlinear (Median filtering) and linear (Averaging filter) transformed images well. Still, the performance of the compressed JPEG image in the frequency domain is somewhat lower. However, 'PTP at PFP = 0.01' showed that the proposed IFD scheme was excellent in all domains. Also, since the AUC of the proposed scheme is all 0.9 higher, the evaluation grade [21] is ''Excellent (A).'' In the proposed IFD scheme, the BOWS2 image No. 6221 tested by the spliced ways in Fig. 3.
The Cut-Paste classification results of the spliced images are shown in Fig. 9 On each spliced way, the classification results of 'Excellent' and 'Good' are shown by which feature selected in Fig. 10, also here the detection ratio of the Cut and Paste region, those average are computed too.
The detection ratio of the {JPG90 and JPG70} transforms slightly lower than {MF3, MF5, and AVE3} among

C. PROPOSED IFD SCHEME APPLIED TO CUT-PASTE IMAGE
The proposed IFD scheme is now applied to detect a Cut-Paste region of the real spliced image, which presents in Fig. 11. This spliced image has forged in a similar way in [12]. The proposed IFD scheme, the AR [7], and the 2D-AR [8] methods applied to Fig. 11 (b), and the classification result of the Cut-Paste region is presented in Fig. 12. The proposed scheme (a, d) compared with the AR (b, e) and the 2D-AR (c, f), respectively. In Fig. 12, the proposed scheme (a, d) shows the analyzed texture (Local entropy and range) of the spliced images. The extracted feature set becomes GTM directly for the Cut-Paste classification, but the AR and 2D-AR methods should process the block by block (b, c: in here 32 × 32 pixels) in the spliced image. Besides, these methods require the learned SVM classifier, and the score value for each block is calculated. The Cut-Paste classification is determined (e, f) with the score patterns (b, c: brightness levels of blocks), which formed by the threshold of the score value. Fig. 12 (a) shows the GTM of the proposed IFD scheme, which generated from texture-based on the forgery image, thus has the unit value about the predicted region of Cut (blue color) or Paste (white color), one of the two. Fig. 12 (b) and (c) show the score patterns, which have the grading rules for each block to examine. In the proposed scheme the GTM, which gives good enough to submit as digital evidence without ambiguity in the image forensics detection.
However, the proposed 5-dim. feature vector has improved compared with the 10-dim. AR [7] and 27-dim. 2-D AR [8]. In Fig. 12, the results (d, e, and, f) confirm that the classification of the proposed IFD scheme is rated as ''Excellent.''

V. CONCLUSION
The Cut-Paste spliced image forensics is a standard method of image tampering because of the simplicity of its operation. Accurate and robust detection is the aim of every forgery detection algorithm.
This paper implemented an algorithm that classifies the Cut-Paste region in a spliced image with texture analysis of image filtering process (MFR).
The performance of the improved feature vector from the proposed IFD scheme has an excellent detection ability to classify the Cut-Paste region with the specially generated mask pattern (Ground Truth Mask) and the border edge (Entropy-based Edge). In forensic detection of Cut-Paste classification, the texture-based processing method of this paper has a higher classification than the conventional blockby-block processing method. This approach furthers the research area for a variety of detection of image forensics.