Image Splicing Detection Based on Discrete Wavelet Transform and co-occurrence Matrix

In this paper a method to determine whether an image is forged (spliced) or not is presented. The proposed method is based on a classification model to determine the authenticity of a tested image. Image splicing causes many sharp edges (high frequencies) and discontinuities to appear in the spliced image. Capturing these high frequencies in the wavelet domain rather than in the spatial domain is investigated in this paper. Correlation between high-frequency sub-bands coefficients of Discrete Wavelet Transform (DWT) is also described using co-occurrence matrix. This matrix was an input feature vector to a classifier. The best accuracy of 92.79% and 94.56% on Casia v1.0 and Casia v2.0 datasets respectively was achieved. This performance is reached when Cb and Cr channels in YCbCr color space only are utilized to form this feature vector. The outcomes of the experiments showed that the proposed method achieved very good results in comparison with existing splicing detection approaches


Introduction
There are many benefits of digital images, including, but not limited to: recording historical and personal events, digitizing books and documents, and the electronic transmission of medical images to consultants and dentists.However, easy usage of photo-editing software tools such as Adobe Photoshop, which enables ordinary people with no experience to manipulate images without any noticeable effect is a problem.Furthermore, another issue to be considered is copyright.These problems are some of the negative consequences of using digital images [1].
The usage of digital images in many applications, such as in courtrooms and journals, requires forgery detection techniques to determine whether an image is authentic or not, and if so techniques to determine the forged region in the image are needed.
The easiest and most familiar digital image forgery method is a copy-move forgery, where a portion from an image is copied and pasted into the same image (duplicated regions).The other type is called image splicing (image composites) when more than one image is used to form a final image.Due to the cut-and-paste operations, the aforementioned forgery methods introduce many changes in the original image that enables tracking the traces of tampering that would not be noticed by human eyes.Some of these changes are abrupt and sharp edges and corners in addition to light, noise, and statistical inconsistencies in the forged image [2].
Digital image forgery can be detected using either active or passive (blind) approaches.Active forgery detection approaches work with the existence of an authentication inserted piece of information (watermark) to the image before distribution.When the image is altered, the watermark is altered consequently so that we can verify the authenticity of an image by comparing it with the authentic one.In contrast, passive (blind) forgery detection approaches work with the absence of any prior information regarding the tested image [3,4].Accordingly, passive approaches are more popular or practical.Since image forgery detection is a two-class classification task that distinguishes between authentic and unauthentic images, passive forgery detection approaches are founded on supervised learning.The effectiveness of using a residual image rather than the pixel values and describing dependencies between pixels by co-occurrence matrix was explored to detect image splicing [5].This was demonstrated in steganalysis (detection of hidden messages) as well [6][7][8] and inspired researchers in image forgery detection.The residual image was obtained using a simple highpass filter to suppress the image contents and emphasize the details such as edges, which is the natural result of image splicing [9,10].
In this paper, a classifier model is established to differentiate the authentic image from the spliced one.The required steps of this classification model are shown in Figure 1.

Figure 1: Image Forgery Detection Classification System
Encouraging results were obtained when the residual image is obtained using Discrete Wavelet Transform (DWT) coefficients in YCbCr color space rather than in spatial domain using simple edge detectors.With a combination of second-order statistics represented by a local feature descriptor, co-occurrence matrix, low dimensionality, and reduction of computational complexity were achieved as well.The paper is arranged as follows: previous work is presented in Section 2. A description of the proposed splicing detection method is provided in Sections 3 and 4. The assessment of the offered method and comparisons with existing approaches are then reported in Section 5.The conclusion is given in Section 6, along with an overview of the essential findings and some suggested directions for future work.

Related Work
Researchers have proposed many passive methods for image splicing detection.Shi et al. [11] adopted an algorithm to detect image splicing that extracted statistical features from both a given tested image and 2-D arrays generated by applying multi-size block Discrete Cosine Transform (DCT) for the same image.These statistical features were moments and Markov features.The obtained detection accuracy was 92%.
Since image splicing produces more edges and corners.Dong et al. [12] utilized a combination of an image run-length and edge moments.A run is a series of adjacent pixels with the same grey level intensity along a particular direction, often in the 0º, 45º, 90º, and 135º.A smooth image usually has long runs, unlike a spliced image.The results showed accuracy of 84.36%.Additionally, a method for detecting image splicing based on luminance was proposed by Fang et al. [13].This method demonstrates that, in the HSV colour space, the hue histograms of manipulated boundaries include separated double peaks as opposed to the saturation histograms.Tampering borders are identified using the hue histogram entropy.Li et al. [14] extracted two groups of features to distinguish between authentic and spliced images.First group was extracted from DWT coefficients' moments while the second group was extracted using Hilbert-Huang Transform.Their proposed method showed accuracy of 85.86%.On the other hand, Kakar et al. [15] proposed an approach that is based on estimating the motion blur of the image to recognise the spliced regions.This is done by dividing the image into overlapping blocks, then for each block the motion blur is estimated using a blur estimate measure BEM.Accordingly, the image is segmented to low motion blur regions for authentic regions and high motion blur regions for spliced regions.
He et al. [16] proposed an approach that extracted Markov features from the transition probability matrices in both DCT and DWT domains to capture the intra-block and the interblock correlation between DCT coefficients and dependency among wavelet DWT coefficients.While for Muhammed et al. in [17], first an image was converted to YCbCr color space then the Steerable Pyramid Transform (SPT) was applied to the chrominance channel.Afterward, Local Binary Pattern (LBP) features were constructed for each produced sub-band.Finally, all LBP histograms were concatenated to compose the input vector to the classifier.The results showed accuracy of 93.22%.
Han et al. [18] provided a new algorithm to construct Markov features in DCT domain.This algorithm assumed the maximum difference of DCT coefficients' value of d direction (horizontal, vertical, diagonal) was crucial.The experiments showed accuracy of 92%.Additionally, to detect image splicing, Park et al. [19] used DWT coefficients' difference to generate co-occurrence matrix.Later this matrix was used to calculate characteristic function moments.These moments are features to identify image splicing using a classifier.The given accuracy of the proposed approach was 95.6%.
Noise estimation was used by Julliand et al. [20] to detect image splicing.They assumed that noise in any image should follow Poisson-Gauss probability distribution with standard deviation depending on a pixel intensity.Each pixel is represented by a pair of values (vd, vn) that represent a pixel denoised and noised values respectively.Distribution can be represented by a table; each entry in this table is a Poisson-Gauss probability function.This table is treated as 2D-histogram.The results showed detection accuracy of 86% for authentic images.Li et al. [21] used the Quaternion Discrete Cosine Transform (QDCT) domain, which is an extension of DCT to generate transitions probability matrices.These matrices were used to capture the correlation between QDCT coefficients.The results showed a detection accuracy of 92.5%.Also, Jalab et al. [22] proposed a method that converts the tested image to YCbCr color space.DWT is applied to each channel and then each channel is divided to 8x8 nonoverlapped blocks.The fractional entropy is calculated for each block to be used as an input vector to the classifier.In addition, Siddiqi et al. [23] proposed a method of applying DWT to non-overlapping blocks.Then, weighted local binary patterns were extracted for each pixel using a 3x3 window to capture the local alterations.The histograms of these binary patterns were concatenated to form the input feature vector to the classifier.Best achieved accuracy was 98.9% The proposed method in this paper utilized co-occurrence matrix as a local texture descriptor to capture local alterations.This concept was applied by researchers in [5] and [9,10] to detect image forgery as well.These approaches are used later for proposed detection method evaluation.Wang et al. [5] proposed method that first transformed the image to YCbCr color space.Then edges horizontally, vertically, diagonally, and minor diagonally respectively are caught by applying four edge detectors.These residuals are adjusted according to an adopted threshold.Four co-occurrence matrices are then obtained and cascaded to form the input feature vector.Achieved accuracy was 90.5%.Additionally, Gossilino et al. [9] utilized simple horizontal linear high pass filter in the spatial domain to capture edges while Verdoliva et al. in [10] used third order high pass filter for the same purpose.The best obtained accuracy by [9] was 94% and best achieved AUC by [10] was 0.98.

Image Splicing Detection Methodology
As an outcome of an image splicing, more sharp edges, corners, and discontinuities appear.This helps extract features to distinguish between authentic and spliced image.In this section, the required tools and procedures to extract features to detect image splicing using suggested method are presented.Definitions and characteristics of YCbCr color space, DWT coefficients and co-occurrence matrix are given below.

YCbCr Color Space
The proposed method begins with the conversion of a tested image to YCbCr color Space.In this color space, Y represents the luminance channel that preserves most of the image content while Cb and Cr are the chroma channels having little image content.Human eyes are quite sensitive to luminance channel (Y) compared to chroma channel (Cb and Cr).Therefore, even if the image looks natural there still some modifications that can be tracked in chroma channel (Cb and Cr).It is observed in the results that using combined chroma components Cb and Cr are useful to detect image splicing.As shown in Figure 2, the ladybug part is spliced into the authentic image and the outer edge of this region is sharper in Cb, Cr, and Y .

High-frequency Residuals
Instead of using simple edge detectors in spatial domain to acquire the residuals that represents edges, an image is passed through high and low filters in DWT.Four sub-bands are obtained from one-level Haar wavelet (first hierarchy): LL represents the approximation subband that includes low frequencies and can be further decomposed to more hierarchies.LH, HL, and HH represent high frequencies of horizontal, vertical, and diagonal edges respectively.Figure 3 shows an example of 2-level DWT.Because of DWT capabilities of multiresolution decomposition and coefficients decorrelation, the different high-frequency sub-bands of one-level are uncorrelated, so that extracted features from one sub-band are uncorrelated to that obtained from another high-frequency sub-band from the same level.Using DWT gives a representation of a signal in both time and frequency domains simultaneously.Few decompositions of DWT coefficients, helps represent the signal energy [24].

Co-occurrence Matrix
This matrix represents a statistical method that determines how frequently pairs of pixels with specific values and in a particular spatial relationship occur in an image.For example, how frequently a pixel with the value i of the intensity (gray-level) appears in a particular spatial relationship (vertical, horizontal, and diagonal) to a pixel with the value j.It is often used for texture analysis to capture local modifications.Therefore, it is useful for image splicing detection [25].

The Proposed Method
It is observed that once splicing is carried out the distribution of DWT high-frequency coefficients for the spliced image is no longer the same as the authentic image, as it is shown in Figure 4.In Figure 4 (a,b,c,d), the distribution of DWT coefficients of high-frequency subbands LH and HL of channel Cb is given, while Figure 4 (e,f,g,h) shows the same distribution for channel Cr.The left side of this figure is for an authentic image while the right side is for a spliced image.In Figure 4, the X-axis represents the absolute value of DWT coefficients, while the Y-axis represents the number of these coefficients.Since more edges appear in a spliced image, more DWT high-frequency coefficients can be obtained as it is shown on the right side (spliced image) in the figure.This best appears in LH and HL sub-bands for Cb and Cr channels.Based on these findings and aforementioned concepts in the previous section, we can determine if the tested image is spliced or not.This is shown in Algorithm 1.This detection algorithm consists of three main steps: 1) pre-processing, 2) features extraction and 3) making a decision whether an image is spliced or not.Algorithm 1 Splicing Detection Input: a colored image Output: decision//an image is either spliced or not Step 1: converting the image matrix to YCbCr color space preprocessing Step 2: applying DWT level-1 to Y, Cb, and Cr channels of the image to obtain highfrequency residuals.
Step 3: adjusting DWT coefficients according to Eq. (1): Where |DWT (m, n) | is the absolute value of DWT coefficient; and T is the threshold that defines the matrix size and reduces the complexity.

feature extraction
Step 4: describing the output of DWT coefficients using co-occurrence matrix.
Steps 5: passing the aforementioned co-occurrence matrix as an input feature vector to a classifier to decide whether the image is spliced or not.
Decide whether an image is spliced or not

Evaluation
In this section, an evaluation of the proposed approach is conducted.Multilayer Perceptron classifier in the Weka machine learning toolkit [26] was utilized in the proposed forgery detection method to distinguish between an authentic image and a spliced image.The effectiveness was measured in terms of accuracy (Acc.) as shown in Eq. ( 2): Where TP: no. of true positive (spliced), TN: no. of true negative (authentic), FP: no. of false positive (incorrectly classified as spliced) and FN: no. of false negative ((incorrectly classified as authentic).Also, the Area Under the receiver operator characteristic Curve (AUC) measure was used as well.AUC has a value between 0 and 1.A classifier with 100% incorrect predictions has an AUC of 0, while a model with 100% correct predictions has an AUC of 1. Two free available datasets were used to evaluate the proposed approach [27].The first was Casia v1.0 dataset that consists of 800 authentic images and 921 spliced images in JPG format of size 384×256 and 256×384.The second was Casia v2.0 dataset that consists of 7942 authentic images and 5124 spliced images JPG, TIF, BMP 240×160 to 900×600. Figure 5 shows samples of authentic and spliced images from Casia v1.0 and Casia v2.0 respectively.To demonstrate the effectiveness of the proposed method two sets of experiments were conducted as follows: 1.
Set 1: to determine if the applied proposed method can effectively distinguish between authentic and spliced images.

2.
Set 2: to compare the proposed method with the existing approaches in [5], [9] and [10].The outcomes of experiments are considered in Subsection 5.1 and Subsection 5.2.respectively.

Performance of the Proposed Method
In the first experiment set, DWT coefficients of each image in the two-image forgery detection evaluation sets (Casia v1.0 and Casia v2.0) were obtained and adjusted according to steps of Algorithm 1.Then, these coefficients would be well described in terms of the cooccurrence matrix.This matrix was computed using two parameters: 1) d=1 (consecutive coefficients) 2) a ϵ {0, π/4, π/2, 3π/4}.The results are presented in Table 1.In table 1 it is shown that the best results (bolded), Acc. and AUC were obtained using features extracted from HL (vertical) high-frequency sub-band of Cb and Cr channels combined.It is shown that for Casia v1.0 dataset, the best results were achieved when T=0.007 with Acc=92.79% and AUC=0.97 while for dataset Casia v2.0 the best results were achieved when T=0.008 with Acc=94.56% and AUC=0.98.The values of Acc. and AUC shown in Table 1 prove the ability of the proposed method to detect image splicing successfully using Cb and Cr channels.

Comparison with Existing Approaches
A comparison between the proposed method and existing approaches was conducted.Three approaches were considered: [5] and [9,10] for comparison.Each one of these approaches was executed according to its procedure.Then, the steps of Algorithm 1 were implemented.The evaluation was conducted using the same two datasets (Casia v1.0 and Casia v2.0) and parameters in subsection 5.1 to generate o-occurrence matrix.The results are shown in Table 2.It can be noticed from the table, the best results (bold font) in terms of accuracy Acc. and AUC were achieved by the proposed method for both evaluation datasets.From Table 2 it can also be noticed that capturing edges in wavelet domain using proposed method can successfully be utilized to detect image splicing rather than in spatial domain.

6.
CONCLUSIONS In this paper, an image splicing detection method is introduced.This method is based on the finding that the splicing process produces sharp edges, corners, and discontinuities.These high frequencies (edges) can be captured as a feature vector to a classification model to distinguish between the authentic and the spliced image.the results showed that good results were obtained if these high frequencies were captured in YCbCr color space after applying DWT to Cb and Cr channels then, the co-occurrence matrix was computed.Two freely available evaluation datasets (Casia v1.0 and Casia v2.0) were used to evaluate the proposed approach.The proposed approach achieved the best accuracy of 92.79% and 94.56% on Casia v1.0 and Casia v2.0 datasets respectively, which outperformed the existing image splicing detection approaches.As a future work, once a spliced image is detected, a localization of a spliced region would be a next step to improve the proposed method.

2 :
A spliced image example (the part of a lady bug is spliced onto the authentic image)

Figure 4 :
Figure 4: The histogram of DWT coefficients sub-bands distribution of Cb and Cr channels of an original image (left) and a spliced image (right)

Table 1 -
Results of the proposed method (Best results in bold font)

Table 2 -
Comparison of a proposed method with other splicing detection approaches (best results in bold font)