# Deterring Deepfake Attacks with an Electrical Network Frequency Fingerprints Approach
## 4 ENF-Based Anomaly Detection Using Singular Spectrum Analysis
### SSA Algorithm  
The correlation coefficient as a similarity measure between the ENF estimated from the multimedia recordings and the ground truth ENF can generate false positives due to the signal noise. We integrated a Singular Spectrum Analysis (SSA) technique to regulate the fluctuations in the correlation coefficient and change-point detection [59; 60]. The correlation coefficient samples are non-periodic in nature, and in order to integrate the SSA algorithm, a larger window size is required. Let \(\rho_{n+1}\), \(\rho_{n+2}\), \(\rho_{n+3}\),..., \(\rho_{n+N}\), \(\rho_{n+N+1}\),..., \(\rho_{n+N+Q}\) be the non-periodic correlation coefficient samples collected from the online ENF comparison and \(N\), \(M\), \(l\), \(p\), and \(q\) be fixed integers, where \(n\) is iterative over new correlation coefficient values, \(N\) is the window size for the base matrix, \(Q\) is the window size for our test matrix with \(Q=q-p\), and \(l<M\leq\frac{N}{2}\). For each \(n=0,1,\ldots\), the following algorithm is executed:  
1. Creating the base matrix of size (\(M\times K\)) using the initial correlation coefficient values and \(K=N-M+1\), \[X_{B}^{n}=\begin{pmatrix}\rho_{n+1}&\rho_{n+2}&\rho_{n+3}&\ldots&\rho_{n+K} \\ \rho_{n+2}&\rho_{n+3}&\rho_{n+4}&\ldots&\rho_{n+K+1}\\ \ldots&\ldots&\ldots&\ldots&\ldots\\ \rho_{n+M}&\rho_{n+M+1}&\rho_{n+M+2}&\ldots&\rho_{n+N}\end{pmatrix}_{M\times K}\]  
Figure 1: Singular Spectrum Analysis (SSA) algorithm using the ENF signal and its correlation coefficient.  
Using the base matrix, also known as the Hankel matrix, we compute \(R=(X_{B}^{n}).(X_{B}^{n})^{T}\), and the Singular-Value Decomposition (SVD) of the matrix \(R\) results in \(M\) eigen vectors and eigen values. Among the \(M\) eigen vectors, \(l<M\) eigen vectors are selected to create a group \(I\). The group \(I\) consists of \(l\)-dimensional vectors in subspace \(\mathcal{L}_{n,l}\) of \(M\)-dimensional space \(\mathcal{R}^{M}\). The eigen values computed from the matrix \(R\) are arranged in descending order, and the top \(l\) values are selected for the matrix \(I\), respectively, such that the subspace \(\mathcal{L}_{n,l}\) consists of the features of \(\mathcal{R}^{M}\).
3. With the base matrix established, next, a test matrix is constructed of size (\(M\times Q\)) with a lag \(p\) from the base matrix and \(Q=q-p\). The resulting matrix is \[X_{T}^{n}=\begin{pmatrix}\rho_{n+p+1}&\rho_{n+p+2}&\rho_{n+p+3}&\ldots&\rho_{n +q}\\ \rho_{n+p+2}&\rho_{n+p+3}&\rho_{n+p+4}&\ldots&\rho_{n+q+1}\\ \ldots&\ldots&\ldots&\ldots&\ldots\\ \rho_{n+p+M}&\rho_{n+p+M+1}&\rho_{n+p+M+2}&\ldots&\rho_{n+q+M-1}\end{pmatrix}_{ M\times Q}\]
4. With the test matrix \(X_{T}^{n}\) and the \(l\)-dimensional subspace \(\mathcal{L}_{n,l}\), the detection statistics of abnormal fluctuations in the input values can be calculated with the sum of the squared Euclidean distance between the column vectors of \(X_{T}^{n}\) and subspace \(\mathcal{L}_{n,l}\). The column vectors of \(\mathcal{L}_{n,l}\) are represented as \(U_{i_{1}}\), \(U_{i_{2}}\),..., \(U_{i_{l}}\). The detection statistics \(\mathcal{D}_{n,l,p,q}\) for \(n\) iterating over \(\{0,1,\ldots\}\) is given as, \[\mathcal{D}_{n,l,p,q}=\sum_{j=p+1}^{q}\left((X_{j}^{(n)})^{T}\cdot X_{j}^{(n) }-(X_{j}^{(n)})^{T}\cdot U\cdot U^{T}.X_{j}^{(n)}\right)\]
5. With the iterating values, the detection scores are normalized and represented as \[S_{n}=\frac{\mathcal{D}_{n,l,p,q}}{\mu_{n,l}}\]
6. The Cumulative Sum of deviations (CUSUM) in the detection statistics are then calculated to eliminate false positives and seek major changes in the input values. A threshold \(h\) is used to detect the fluctuations in the correlation coefficient of the ENF values. The detection score is \[W_{1}=S_{1}\] \[W_{n+1}=(W_{n}+S_{n+1}-S_{n}-\frac{1}{M\cdot Q})^{+},n\geq 1\] \[h=\frac{2t_{n}}{M\cdot Q}\sqrt{\frac{1}{3}\cdot Q\cdot(3 MQ-Q^{2}+1)}\] (3) where \((a)^{+}\) represents \(max(0,a)\).