Presence Of Tampering Research Articles

Detection and localization of forgery using statistics of DCT and Fourier components

In this paper, we present a comprehensive approach for investigating JPEG compressed test images, suspected of being tampered either by splicing or copy-move forgery (cmf). In JPEG compression, the image plane is divided into non-overlapping blocks of size 8 × 8 pixels. A unified approach based on block-processing of JPEG image is proposed to identify whether the image is authentic/forged and subsequently localize the tampered region in forged images. In the initial step, doubly stochastic model (dsm) of block-wise quantized discrete cosine transform (DCT) coefficients is exploited to segregate authentic and forged JPEG images from a standard dataset (CASIA). The scheme is capable of identifying both the types of forged images, spliced as well as copy-moved. Once the presence of tampering is detected, the next step is to localize the forged region according to the type of forgery. In case of spliced JPEG images, the tampered region is localized using block-wise correlation maps of dequantized DCT coefficients and its recompressed version at different quality factors. The scheme is able to identify the spliced region in images tampered by pasting uncompressed or JPEG image patch on a JPEG image or vice versa, with all possible combinations of quality factors. Alternatively, in the case of copy-move forgery, the duplication regions are identified using highly localized phase congruency features of each block. Experimental results are presented to consolidate the theoretical concept of the proposed technique and the performance is compared with the already existing state of art methods.

ESPRIT-Hilbert-Based Audio Tampering Detection With SVM Classifier for Forensic Analysis via Electrical Network Frequency

Audio authentication is a critical task in multimedia forensics demanding robust methods to detect and identify tampered audio recordings. In this paper, a new technique to detect adulterations in audio recordings is proposed by exploiting abnormal variations in the electrical network frequency (ENF) signal eventually embedded in a questioned audio recording. These abnormal variations are caused by abrupt phase discontinuities due to insertions and suppressions of audio snippets during the tampering task. First, we propose an ESPRIT-Hilbert ENF estimator in conjunction with an outlier detector based on the sample kurtosis of the estimated ENF. Next, we use the computed kurtosis as an input for a support vector machine classifier to indicate the presence of tampering. The proposed scheme, herein designated as SPHINS, significantly outperforms related previous tampering detection approaches in the conducted tests. We validate our results using the Carioca 1 corpus with 100 unedited authorized audio recordings of phone calls.

SUSPEND: Determining software suspiciousness by non-stationary time series modeling of entropy signals

Commercial anti-virus software traditionally memorizes specific byte sequences (known as “signatures”) in the file contents of previously encountered malware. However, malware authors can evade signature-based detection in many ways; for instance, by using obfuscation techniques such as “packing” (encryption or compression) to hide snippets of malicious code; by writing metamorphic malware; or by tampering with existing malware. We hypothesize that certain evasion techniques can leave traces in the file’s entropy signal, revealing either similarities to known malware or the presence of tampering per se. To this end, we present SUSPEND (SUSPicious ENtropy signal Detector), an expert system which evaluates the suspiciousness of an executable file’s entropy signal in order to subserve malware classification. Whereas traditionally, entropy analysis has been used for the goal of packer detection (and therefore entropy-based features often merely comprise mean entropy or the entropy of a few file subcomponents), SUSPEND applies non-stationary time series modeling to aid in malware detection. In particular, SUSPEND (a) quantifies the “amount of structure” in the entropy signal (through detrended fluctuation analysis), (b) finds the location and size of sudden jumps in entropy (through mean change point modeling), and (c) computes the distribution of entropic variation across multiple spatial scales (through wavelet decomposition). In addition, SUSPEND (d) summarizes the entropy signal’s empirical probability distribution. Because SUSPEND’s run time can be made to scale linearly in file size, it is well-suited for large-scale malware analysis. We apply SUSPEND to a large-scale malware detection task with 500,000 heterogeneous real-world samples and over 1 million features. We find that SUSPEND boosts the predictive performance of traditional entropy analysis (as found in packer detectors) from 77.02% to 96.62%. Moreover, SUSPEND’s focus on entropy signals makes it a natural candidate for combining with other types of features; for instance, combining SUSPEND with a strings-based feature set boosts predictive accuracy from 97.18% to 98.62%. Thus, whereas traditionally, entropy analysis has focused on detecting that a file is packed, SUSPEND’s more comprehensive representation of the entropy signal helps to determine that a file is malicious. We illustrate the application of SUSPEND by studying 18 pieces of VirRansom, a family of viral ransomware which could cost millions to large organizations. SUSPEND is able to detect 100% of the studied files with over 99% confidence, whereas a more traditional strings-based model was very close to undecided and represents the entire family with a single string.

Evaluation of Distributed File Integrity Analyzers in the Presence of Tampering

In this paper, the Collaborative Object Notification Framework for Insider Defense using Autonomous Network Transactions (CONFIDANT) is evaluated in the presence of tampering. CONFIDANT’s mitigation capabilities are assessed and compared with conventional file integrity analyzers such as AIDE and tripwire. The potential of distributed techniques to address certain tampering modes such as Pacing, Altering Internal Data, and File Juggling are discussed. To assess capabilities, a variably-weighted tampering mode exposure metric scheme is developed and utilized. Results indicate a range of vulnerabilities for which mitigation techniques such as Encapsulation, Redundancy, Scrambling, and mandatory obsolescence can increase robustness against challenging exposures, including various insider tampering risks.