Detecting Doubly Compressed JPEG Images by Factor Histogram

Transcription

1 APSIPA ASC 2 Xi an Detecting Doubly Compressed JPEG Images by Factor Histogram Jianquan Yang a, Guopu Zhu a, and Jiwu Huang b a Shenzhen Institutes o Advanced Technology, Chinese Academy o Sciences, Shenzhen, GD 5855 b School o Inormation Science and Technology, Sun Yat-sen University, Guangzhou, GD jq.yang@siat.ac.cn, guopu_zhu@yahoo.com, isshjw@mail.sysu.edu.cn Abstract The detection o double compression plays an important role in JPEG image orensics and steganalysis. This paper introduces a new statistic called actor histogram, which describes the distribution o the actors being related to the quantized discrete cosine transorm coeicients o JPEG image. Then, two concrete schemes based on actor histogram are presented or detecting doubly compressed images and identiying primary quality actor, respectively. Our experimental results demonstrate that both o the proposed schemes perorm well, which validates the applicability o actor histogram in the detection o double compression and the estimation o primary quantization parameter. I. INTRODUCTION JPEG is one o the most widely used standards or compressing image data. Most image acquisition devices and processing sotwares output JPEG iles, and the digital images on the web are oten transmitted in this ormat. So JPEG images are playing an increasingly important role in our daily lives. However, with the development o image processing techniques, it is now easier than ever to tamper with digital images and the tampered images are usually stored in JPEG ormat or distribution. Furthermore, many steganography algorithms (such as F5 [], Outguess [2], Yass [3], etc.) store stego images also in JPEG ormat. In some scenarios, ake or stego images may cause serious harms i it is ailed to detect them. Thereore, the authentication o JPEG images and the detection o the secret messages in JPEG images have become important issues. And many orensics and steganalysis techniques have been developed to address these issues in recent years. The detection o double compression (DC) and the estimation o the primary quantization matrix (PQM) o doubly compressed images are hot topics in the ield o JPEG image orensics and steganalysis. Double compression reers to the procedure that a natural image is compressed irstly, then the compressed image is decompressed into spatial domain and recompressed with a dierent quantization matrix. DC detection is usually the irst step to detect orged or stego JPEG images, while PQM estimation may help to urther reveal more details, such as the location o tampered areas or the length estimation o the secret message embedded in stego images. DC detection and PQM estimation have been addressed by This work was supported by the 973 Program (No. 2CB3224) and the National Natural Science Foundation o China (No ). * Corresponding author. many researchers, who have also proposed a plenty o algorithms. And these algorithms could be roughly classiied into two categories: the spatial-domain-based algorithms [4] [6] and the requency-domain-based algorithms [7] [4]. Among the spatial-domain-based algorithms, Luo et al. [4] proposed a characteristic matrix or blocking artiacts to detect cropped and recompressed images. Based on the work o [4], Barni et al. [5] recently proposed two algorithms to identiy cut and paste tampering in orged JPEG images. Chen and Hsu [6] proposed a blocking periodicity model to analyze blocking artiacts. The idea o the spatial-domain-based algorithms is based on detecting the abnormal blocking artiacts o intra blocks. However, i there is no shit between the JPEG grids o the two sequential compressions (i.e., recompress with aligned 8 8 grids), these algorithms will ail to detect DC. The requency-domain-based algorithms apply the statistics o quantized discrete cosine transorm (DCT) coeicients to detect DC and/or estimate PQM, requiring that the two sequential compressions are with aligned 8 8 grids. Lukas and Fridrich [7] studied the histogram shape o the quantized DCT coeicients in doubly compressed image and proposed three schemes or estimating primary quantization step (PQS). The irst two o their schemes are non-training-based, and the last one is a training-based scheme that adopts neural network. Pevny and Fridrich [8] trained a SVM with 44-D eatures or DC detection, and designed several SVM-based multi-classiiers or PQS estimation. Popescu and Farid [9] observed that the histogram o quantized DCT coeicients in doubly compressed image appears periodic artiacts, so they proposed a measure to evaluate the periodicity in histogram and applied it or DC detection. Fu et al. [] presented a novel statistical model called generalized Benord s law to study JPEG compression. They reported that the distribution o the irst digits o the quantized DCT coeicients in doubly compressed image no longer ollows the generalized Benord s law, which could be used as a clue to detect DC. Li et al. [] improved and extended the work in [] by proposing mode based irst digit eatures or DC detection and the estimation o primary quality actor (PQF). Chen and Hsu [2] combined the eatures in requency domain with that in spatial domain or DC detection, which makes their proposed scheme work well in both JPEG grids aligned and non-aligned situations. Besides, several techniques have been developed to locate the tampered regions in orged JPEG images via DCT coeicient analysis [3], [4]. Since requency-domain-based algorithms

2 have potentials to detect DC as well as estimate PQS/PQF, they seem to attract more attentions in recent years. This paper introduces a new statistic called actor histogram by analyzing the procedure o double quantization. Factor histogram describes the distribution o the actors being related to quantized DCT coeicients. By theoretically analyzing its characteristics, we ind that actor histogram can be applied to DC detection and PQM estimation, and then design two schemes to urther investigate the advantages and drawbacks o actor histogram. Our experimental results show that the proposed schemes can achieve satisactory perormance even when the tested image is quite small or is compressed by multiple times, which indicates that actor histogram can be used as a easible and eective technique or JPEG DC detection and PQM estimation. The rest o the paper is organized as ollows. Section II derives the concept o actor histogram by analyzing the procedure o the double quantization in JPEG DC, and Section III describes the details o the proposed DC detection and PQM estimation schemes. Experimental results are presented in Section IV. Finally, we conclude our work in Section V. II. FACTOR HISTOGRAM JPEG DC makes the DCT coeicients undergo double quantization. In this section, we derive the concept o actor histogram by theoretically analyzing the procedure o double quantization. Fig. shows the procedure o JPEG DC. In order to highlight double quantization in JPEG DC, some operations, such as entropy encoding and decoding, and etc., are omitted. As shown in Fig., the original coeicient c is quantized by the step size q to generate c, then the quantized coeicient c undergoes a series o operations, which include dequantization, inverse DCT, rounding and/or truncating, DCT, and then becomes into c q + e, where the term e denotes the error due to the rounding and/or truncating operations. Finally, the whole term c q + e is quantized again by the step size q 2 to orm the coeicient c 2. Note that the input and output data in Fig. are in orm o matrix in practice, but or clearly describing and analyzing the procedure o double quantization, we adopt the above-mentioned scalar notations. According to the DC procedure shown in Fig., the quantized coeicient c 2 can be expressed as [ ] c q + e c 2 = () where [ ] denotes the round operator, and the quantization step size q and q 2 are positive integers. In order to derive a clear relationship among c, q, c 2 and q 2, we ignore the error term e. According to the rule o round operator, it can be obtained that [3], c 2.5 c q /q 2 < c (2) From (2), we can urther get the value range o c q : q 2 (c 2.5)q 2 c q < (c 2 +.5)q 2 (3) c c c q c 2 Quantization (q ) Quantization (q 2 ) c q +e Dequantization (q ) DCT Pixel Value IDCT Rounding and/or truncating Fig.. Procedure o JPEG double compression. Some operations are omitted in order to highlight double quantization. The above range o c q includes q 2 consecutive integers, which can be collected to orm a set D(c 2,q 2 ). The set D(c 2,q 2 ) is determined by c 2 and q 2, and can be described by D(c 2,q 2 ) = { (c 2.5)q 2 + x x =,,,q 2 } (4) where denotes the ceiling operator. Then, according to (3) and (4), we have c q D(c 2,q 2 ) (5) Observing that q is one o the positive actors o the term c q, we actorize each integer in D(c 2,q 2 ), and collect all o the positive actors to orm the actor set F(c 2,q 2 ), which is given by F(c 2,q 2 ) = {x mod(y,x) =,y D(c 2,q 2 ),x > } (6) where mod(, ) denotes the modulo operator. Then we can obtain that q F(c 2,q 2 ) (7) Note that the set F(c 2,q 2 ) can be regarded as a constraint or the value range o the step size q. I c 2 =, according to (4), we have D(,q 2 ), then, according to (6), we urther have F(,q 2 ) = Z +, which means that i c 2 =, F(,q 2 ) does not provide any constraint on q. Thereore, the case that c 2 = is omitted in our ollowing analysis. As mentioned above, D(c 2,q 2 ) consists o q 2 consecutive integers, thereore, it is obvious that {,2,,q 2 } F(c 2,q 2 ) (8) Especially, when q > q 2, according to (7) and (8), we urther have {,2,,q 2,q } F(c 2,q 2 ) (9) Here we give a concrete example to show the actor set property described by (9). Given that c =, q = 8, and q 2 = 3, according to (), we obtain c 2 = [c q /q 2 ] = 3. Further, according to (4) and (6), we have D(c 2,q 2 ) = {8,9,} and F(c 2,q 2 ) = {,2,3,4,5,8,9,}, respectively. So it is obvious that {,2,,q 2,q } = {,2,3,8} F(c 2,q 2 ). We have analyzed double quantization or a single quantized coeicient above, and some conclusions (i.e., (8) and (9)) are drawn. In the ollowing, we consider the case o a quantized coeicient sequence. Let c 2 = [ c 2,c2 2,,cn 2] denote a nonzero coeicient sequence o length n, in which each component has been doubly quantized with step size q and q 2. For each component c i 2 (i =,2,,n) o c 2, we calculate F(c i 2,q 2) according to (6), thus we can get n actor sets totally. All

3 elements o these actor sets are collected to orm a actor sequence. Then we calculate the histogram o the actor sequence, and denote the resulting histogram by h. Since h describes the distribution o the elements in the actor sequence, we call it actor histogram. We also denote the histogram o the quantized coeicient sequence c 2 by h c, and call it quantized coeicient histogram. It is interesting that h can be computed based on h c, and h can be expressed by h (u) = b x=a h c (x)s(u,x,q 2 ), u r () where a and b denote the minimum and maximum in c 2, respectively, and r is a parameter that controls the interested range, and s(u,x,q 2 ) is given by {, u F(x,q2 ) s(u,x,q 2 ) = (), u / F(x,q 2 ) Then, according to the deinition o h described by () and (), we have h (u) n (2) where n = b x=a h c (x) is the length o the nonzero coeicient sequence c 2. Up to now, we have derived the concept o actor histogram. According to () and (), it can be ound that the calculation o actor histogram just depends on the quantized coeicient sequence c 2 and its current quantization step size q 2. Thereore, as long as the quantized coeicient sequence and its current quantization step size are available, the actor histogram o the sequence can be calculated in practice, no matter the sequence has been singly quantized, doubly quantized or repeatedly quantized. For the images being saved in JPEG ormat, its quantized coeicients and the quantization step size can be read rom the image ile directly; while or the images that have been JPEG compressed and then been resaved in other ormat, such as BMP ormat, its quantization step size can be estimated by some existing algorithms [5], [6], and its quantized coeicients can also be calculated ater knowing the quantization step size. In the ollowing we analyze some characteristics o the actor histogram h. According to (8), (), and (), we have h (u) = n,u {,2,,q 2 } (3) Especially, when q > q 2, according to (9), () and (), we have h (u) = n,u {,2,,q 2,q } (4) Eq. (3) means that actor histogram will reach its maxima at positions,2,,q 2, which has nothing to do with how many times the coeicient sequence have been quantized, and thus is an inherent characteristic o actor histogram. Furhtermore, or the doubly quantized sequence with q > q 2, the actor histogram will achieve its maximum at q in addition. It is worth noting that (4) describes a quite important characteristic or DC detection and PQM estimation. Here is an example to intuitively illustrate the conclusions mentioned above. Let c denote a coeicient sequence generated by a Gaussian process with mean and standard deviation 25. Then, we quantize the sequence c in three dierent manners, which are single quantization with step size q a = 3, double quantization with step size pair (q b,q b) = (5,3), and double quantization with (q c,q c ) = (3,5), then denote the three quantized coeicient sequences by c a, c b and c c, respectively. Factor histograms o the three quantization versions o c are shown in Fig. 2. The three actor histograms achieve their maxima at positions,2, q a, positions,2,,q b and positions,2,,q c, respectively, which validates (3). Since q b > q b, Fig. 2(b) shows that the actor histogram o c b also reaches its maximum at q b, which validates (4). Although c c has also gone through double quantization, there is no additional maximum in its actor histogram due to that q c < q c. III. PROPOSED SCHEMES In practice, many camera manuacturers and image sotware developers have designed their own JPEG quantization matrixes [7], which may have some dierences rom each other. But, the JPEG quantization matrixes provided by the same company are usually very similar, thus can be regarded as the same quantization matrix system (QMS). In some scenarios, the knowledge o primary QMS (i.e., the QMS used in the primary JPEG compression) can be used as auxiliary inormation to detect DC and estimate PQM. According to whether the knowledge o primary QMS is available or not, the problems o DC detection and PQM estimation could be classiied into two categories. The irst category is to detect DC and estimate PQM with the knowledge o primary QMS. Whereas the second one is to detect DC and estimate PQM without any primary QMS knowledge. I the inormation o the quantized coeicients in dierent requencies can be integrated together by utilizing the knowledge o primary QMS appropriately, then better perormance should be achieved. In this paper, we ocus on solving the irst category o the problems (i.e. detecting DC and estimating PQM with the knowledge o primary QMS) by using actor histogram. For simplicity, standard QMS, which is recommended by JPEG compression standard, is adopted in our analysis and experiments. And we also assume that the primary and current JPEG compression use the same QMS. The quality actor ranging rom ~ is used to represent the compression quality. User can adjust quality actor to make a tradeo between idelity and compression rate. In the ollowing, we will describe our proposed schemes in detail. A. Detecting JPEG Double Compression [ Let F denote the quality actor in standard QMS, and Q = q i j ] denote the quantization matrix corresponding to F. 8 8 For a given JPEG image, we irst extract the quantized DCT coeicients and quantization matrix rom the image ile, and calculate the actor histogram or each requency according to () and (). We denote the actor histogram o the requency (i, j) by h i j. Then, we deine the ollowing statistic or DC detection M(F) = (i, j) L h i j (qi j ) (i, j) L h i j,f =,2,, (5) ()

4 2.5 x x x (a) (b) (c) Fig. 2. Factor histogram o dierent quantized sequences (a) singly quantized with step size 3 (b) doubly quantized with step size pair (5,3) (c) doubly quantized with step size pair (3,5) where L denotes the set o the interested requencies. Through (5), we uniy the inormation o the actor histograms o dierent requencies together to calculate the statistic M(F). We name the statistic M(F) as the actor matching degree (FMD) o F or F =,2,,, and name the curve ormed by the value o M(F) at each position F as FMD curve, due to M(F) has the ollowing characteristics: ) Since h i j (qi j ) h i j () or i, j 8, according to (5), we have M(F). 2) Let F c denote the quality actor o current compression, and Q c denote its corresponding quantization matrix. According to (3), it is obtained that h i j (u) = ni j, u {,2,,q i c j }, i, j 8, where n i j denotes the number o nonzero coeicients at requency (i, j). And we also notice that or standard QMS, when F c F, q i c j q i j. Thus, or F c F, we have M(F) = (i, j) L h i j (qi j ) (i, j) L h i j () = (i, j) L ni j (i, j) L n i j = (6) which means that FMD curve reaches its maxima at positions F c,f c +,,. 3) I the detected image is doubly compressed with quality actor pair (F p,f c ), and F p < F c. In this case, we have q i j p q i j h i j (qi j c or i, j 8. Then, according to (4), p ) = n i j. Thus we have M(F p ) = (i, j) L h i j (qi j p ) (i, j) L h i j () = (i, j) L ni j (i, j) L n i j = (7) which means that the FMD curve o a doubly compressed image with F p < F c also reaches its maximum at F p. In summary, i a given image is doubly compressed with quality actor pair (F p,f c ), and F p < F c, the FMD curve o the given image reaches its maxima at positions F p,f c,f c +,,. We have observed rom a lot o experiments that the FMD curves o doubly compressed images show two dierent characteristics, which are determined by the relationship between F p and F c. I F p < F c, the FMD curve will have a local peak at F p, and is quite distinct rom the FMD curve o singly compressed image. However, i F p > F c, the FMD curve is similar to that o singly compressed image. For instance, given an uncompressed image, let it undergo a single compression with quality actor F c = 8, a double compression with quality actor pair (F p,f c ) = (7,8), and a double compression with quality actor pair (F p,f c ) = (8,7), respectively, then we get three compressed images. The FMD curves corresponding to the three compressed images are shown in Fig. 3. All o the three FMD curves reach the maxima at their positions F c,f c +,,. Particularly, the FMD curve corresponding to the double compression with F p < F c (as shown in Fig. 3(b)) has a local peak at position F p. According to (7), the FMD curve should reach its maximum at this position. But, in practice, M(F p ) suers a slight decrease inevitably due to the rounding and truncating errors. However, the FMD curve corresponding to the double compression with F p > F c (as shown in Fig. 3(c)) not only has no obvious local peak, but also is very similar to that corresponding to the single compression (as shown in Fig. 3(a)), which indicates that FMD curve is not suitable or distinguishing double compression with F p > F c rom single compression. In the ollowing, we will calculate the height o the abovementioned local peak to measure the smoothness o FMD curve. We irst deine a statistic as ollows S(F) = M(F) min{m(i) i = F +,F + 2,,} (8) Then, the height o local peak can be calculated by S p = max{s(f)} (9) F Because that the FMD curve o singly compressed images decrease rom right to let (as shown in Fig. 3(a)), thus S p is usually zero or singly compressed image; while S p takes positive value (as shown in Fig. 3(b)) or doubly compressed image, especially or the case that F p < F c. Then, we choose a threshold t to make a binary decision or DC detection. That is, i S p > t, the detected image will be regarded as a doubly compressed image; otherwise, it will be regarded as a singly compressed one. Based on the above descriptions, the proposed DC detection scheme can be summarized by the ollowing steps:

5 S(7) (a) (b) (c) Fig. 3. FMD curves o three compressed versions (a) single compression with quality actor 8 (b) double compression with quality actor pair (7,8) (c) double compression with quality actor pair (8,7) ) For a given JPEG image to be detected, extract its quantized DCT coeicients and current quantization matrix to calculate the actor histogram h i j or each requency (i, j) L; 2) According to (5), calculate the actor matching degree M(F) or F =,2,,, then according to (8) and (9), calculate S p ; 3) I S p > t, the detected image is classiied as a doubly compressed image; otherwise, it is classiied as a singly compressed one. B. Estimating Primary Quality Factor We have explained in section III-A that the FMD curve corresponding to the doubly compression with F p < F c usually has a local peak at position F p. By detecting the position o the local peak, we can estimate F p by Fˆ p = argmax F F c,s(f)> M(F) (2) Note that ˆF p can be used as the estimation o F p only when F p < F c. In practice, we may need to conirm whether the condition F p < F c is satisied or not when we use the proposed scheme to estimate PQF. This can be perormed by checking whether M( ˆF p ) is close to or not. For simpliying our analysis and description, we have assumed that the primary and current JPEG compression adopt the same QMS. However, the proposed schemes with minor modiications can also perorm well even i the two consequent compressions adopt dierent QMS. IV. EXPERIMENTAL RESULTS In order to test the perormances o the proposed schemes, we setup several image sets or our experiments. First, 2 color images are randomly selected rom COREL and NRCS image sets. Then these color images are converted to grayscale, and center-cropped into smaller images o sizes 52 52, ,, 8 8. Thus, there are totally 7 natural image sets with dierent sizes. In our experiments, we adopt Matlab image processing toolbox to implement JPEG compression, and use JPEG toolbox [8] to extract the quantized DCT coeicients and the quantization matrix or calculating actor histogram. And the parameters o the proposed schemes are set as a = 28, b = 28, r = 5, and L takes the irst 3 requencies in Zigzag order. The irst scheme proposed by Lukas and Fridrich in [7] is used or comparison. Lukas and Fridrich s (shortened as L&F s) scheme estimates primary quantization steps by producing a bench image with the cropping and recompressing operations and then perorming compatibility test. As the authors o [7] said, it can be easily extended to detect DC and estimate PQM with the knowledge o primary QMS. A. Experimental Results on DC Detection We irst compare the perormance between the proposed and L&F s schemes on DC detection. For obtaining appropriate thresholds or the proposed scheme, each o the 7 natural image sets is divided into two image subsets o the same number (i.e., each subset has images). The irst image subset is used to determine the threshold t, while the second one is used to test the perormances o the two compared schemes. For each image in the irst image subset, we randomly selected two quality actors F p and F c rom {5,5,,95} with the constraint F p F c 5, then compress the image by a double compression with quality actor pair (F p,f c ) and a single compression with quality actor F c, respectively. Ater the eature S p o the proposed DC detection scheme is extracted rom each image o the irst image subset, we then determine the thresholds by minimizing the classiication error. Finally, we get 7 thresholds corresponding to the 7 dierent image sizes. In the test stage, each image in the second image subset is singly compressed with quality actor F c and doubly compressed with quality actor pair (F p,f c ), respectively. (F p,f c ) is randomly selected rom {5,5,,95}with the restriction Fp F c 5. We classiy the eature Sp o these singly and doubly compressed images by the determined thresholds and then calculate the accuracy o classiication. For showing the perormance o the two compared schemes in more detail, we present the experimental results, respectively, or the two cases that F p < F c and F p > F c. It is clearly shown rom Table I that the proposed scheme perorms quite well in the case that F p < F c. When the size o the test image is relatively small, the proposed scheme can obtain higher detection accuracy than L&F s scheme.

6 TABLE I DETECTION ACCURACY (%) OF DOUBLE COMPRESSION (THE BETTER RESULTS ARE HIGHLIGHTED BY RED AND BOLD FONT) Size o image L&F s F p < F c scheme F p > F c Proposed F p < F c scheme F p > F c TABLE II ESTIMATING ACCURACY (%) OF THE PRIMARY QUALITY FACTOR OF DOUBLE COMPRESSION (THE BETTER RESULTS ARE HIGHLIGHTED BY RED AND BOLD FONT) Size o image L&F s A(±) scheme A(±) Proposed A(±) scheme A(±) TABLE III ESTIMATION ACCURACY (%) OF THE SECONDARY QUALITY FACTOR OF TRIPLE COMPRESSION (THE BETTER RESULTS ARE HIGHLIGHTED BY RED AND BOLD FONT) Size o image L&F s A(±) scheme A(±) Proposed A(±) scheme A(±) Especially, when the size o the test image decreases to 8 8, L&F s scheme ails to work because that the cropping and recompressing operations cannot be applied to a single 8 8 image block, but the detection accuracy o the proposed scheme is up to 76%. As mentioned in section III-A, the proposed scheme is likely unable to detect DC or the case that F p > F c. But we can ound rom Table I that the proposed scheme can also detect the doubly compressed image with F p > F c to some extent. In summary, the proposed DC detection scheme is eective in distinguishing double compression with F p < F c rom single compression, even when the size o the detected image is very small. B. Experimental Results on PQF Estimation In this sub-section, we evaluate the perormance o the proposed scheme on PQF estimation. For each image in our image sets, we doubly compress it by (F p,f c ), where F p and F c are randomly selected rom {5,5,,95} with the constriction o F c F p 5. In order to make a air comparison, we modiy L&F s scheme to make it use the prior knowledge o F p < F c. Here, A(±) and A(±) are introduced to measure the accuracy in estimating PQF. A(±) denotes the percentage o the cases that the estimated PQF is equal to the true PQF, while A(±) denotes the percentage o the cases that the absolute dierence between the estimated PQF and the true PQF is not greater than. As shown in Table II, when the size o the detected image is relatively large, the two compared schemes have almost the same perormance on estimating PQF. With the size o the detected image decreases, the proposed PQF estimation scheme obtains higher estimation accuracy than L&F s. Especially, or the images o size 6 6, the A(±) o L&F s scheme is only 36.3%, while the A(±) o the proposed scheme is 79%, and or the images o size 8 8, L&F s scheme ails to work, but the proposed scheme can still work and its A(±) reaches 56.4%. These experimental results show that the local peak o FMD curve is a quite robust eature or the PQF estimation in the case that F p < F c. To urther show the good perormance o the proposed PQF estimation scheme, we set up 7 image sets consisting o triply compressed images, and then attempt to estimate the secondary quality actors o the triply compressed images. It should be pointed out that, or a triple compression, i we regard the irst compression as a disturbing operation, then the last two compressions can be regarded as a double compression disturbed by the irst compression, and thus the quality actor using in the second compression can be also regarded as the PQF o the disturbed double compression. In this experiment, we irst randomly select a pair o quality actor (F p,f c ) rom {5,5,,95} with the constraint F c F p 5 and a parameter d rom {,2,,2}, then let F p = F p d, inally we compress each image in our testing image sets triply with quality actor group (F p,f p,f c ). Note that the quality actor group (F p,f p,f c ) in this experiment satisies the condition that F p < F p < F c. By comparing the experimental results in Table III with

7 that in Table II, it can be ound that the irst compression disturbs the estimation o the secondary quality actor in some degree. The estimation accuracy o L&F s scheme decreases signiicantly, however, that o the proposed scheme does not decrease too much. For the images o size 52 52, the A(±) o L&F s scheme reaches 9.5% in the case o double compression, while is only 65.5% in the case o triple compression, which indicates that L&F s scheme is very sensitive to disturbances, such as a pre-compression beore double compression. The proposed scheme perorms much better than L&F s scheme in the case o triple compression. Even or the images o size 64 64, the A(±) o the proposed scheme also reaches up to 8%, which shows that the eature extracted rom actor histogram is robust to serious disturbances. V. CONCLUSIONS In this paper, we have derived the concept o actor histogram by theoretically analyzing the procedure o the double quantization in JPEG double compression. By investigating the characteristics o actor histogram, we ound that the actor histogram o a doubly quantized sequence with primary quantization step size larger than current quantization step size likely has obvious artiact, which can be used as a clue to detect double quantization and to estimate primary quantization parameter. We have proposed two schemes to validate the applicability o actor histogram. The experimental results show that the proposed schemes have satisactory perormances even when the detected images are o small size and are compressed several times, which means that actor histogram has great potential in detecting double compression and estimating primary quality actor. REFERENCES [] A. Westeld, F5 - a steganographic algorithm: high capacity despite better steganalysis, Inormation Hiding, 4th International Workshop, ser. Lecture Notes Comput. Sci., 2, vol. 237, pp [2] N. Provos, Deending against statistical steganalysis, in Proc. th USENIX Security Symp., 2, pp [3] K. Solanki, A. Sarkar, and B. S. Manjunath, YASS: yet another steganographic scheme that resists blind steganalysis, in Proc. 9th Int. Workshop on Inormation Hiding, Saint Malo, France, 27, vol. 4567, pp [4] W. Luo, Z. Qu, J. Huang, and G. Qiu, A novel method or detecting cropped and recompressed image block, Proc. ICASSP, vol.2, April 27, pp [5] M. Barni, A. Costanzo, and L. Sabatini, Identiication o cut & paste tampering by means o double-jpeg detection and image segmentation, in Proc. o ISCAS 2, 2, pp [6] Y. L. Chen and C. T. Hsu, Image tampering detection by blocking periodicity analysis in JPEG compressed images, Proc. MMSP, 28. [7] J. Lukas and J. Fridrich, Estimation o primary quantization matrix in double compressed JPEG images, in Proc. Digital Forensic Research Workshop, Cleveland, Ohio, August 23. [8] T. Pevny and J. Fridrich, Detection o double-compression in JPEG images or application in steganography, IEEE Trans. In. Forensics Security, June 28, vol. 3, no. 2, pp [9] A. C. Popescu, Statistical tools or digital image orensics, Ph.D. dissertation, Dartmouth College, Hanover, NH, Dec. 24. [] D. Fu, Y.Q. Shi, and W. Su, A generalized benord s law or JPEG coeicients and its applications in image orensics, in Proc. SPIE, Security, Steganography and Watermarking o Multimedia Contents IX, San Jose, USA, January 27. [] B. Li, Y. Q. Shi, and J. Huang, Detecting doubly compressed JPEG images by mode based irst digit eatures, Proc. MMSP, 28. [2] Y. L. Chen and C. T. Hsu, Detecting recompression o JPEG images via periodicity analysis o compression artiacts or tampering detection, IEEE Trans. In. Forensics Security, June 2, vol. 6, no. 2, pp [3] J. He, Z. Lin, L. Wang, and X. Tang, Detecting doctored JPEG images via DCT coeicients analysis, Proc. European Conerence on Computer Vision, Graz, Austria, 26. [4] T. Bianchi, A. D. Rosa, and A. Piva, Improved DCT coeicient analysis or orgery localization in JPEG images, in Proc. o ICASSP 2, May 2, pp [5] W. Luo, J. Huang, and G. Qiu, JPEG error analysis and its applications to digital image orensics, IEEE Trans. In. orensics and security, vol. 5, no. 3, Sep. 2, pp [6] Z. Fan and R. de Queiroz, Identiication o bitmap compression history: JPEG detection and quantizer estimation, IEEE Trans. Image Processing, vol. 2, no. 2, Feb. 23, pp [7] Predeined quantization matrix used in JPEG compression. [Online], Available: html [8] P. Sallee, Matlab JPEG toolbox.4, [online], Available: sallee.com/jpegtbx/index.html.