# Analyzing Benford's Law's Powerful Applications in Image Forensics
## 2 Materials and Methods  
In general, when the NBL is used to detect various types of data tampering, the following assumption is made and then tested: the real data will follow the distribution given by this law, while the altered data will not. Our research too has considered this concept as the starting point. However, in the case of JPEG compression, the following problem arises immediately: what data need to be considered and compared to the Benford distribution? What numbers need to be extracted and analyzed? So far in the literature, both the DCT and JPEG coefficients have been compared to [PERSON]'s law [9; 12]. However, the algorithm that we have implemented uses the JPEG coefficients, obtained from the luminance channel. The next parts describe the logic behind our decision as well as the outcomes. Since at first glance this law appears to be counterintuitive, and since it is not the purpose of this article to examine the deep mathematical theories behind this subject, we considered it to be worth mentioning that there are several opinions regarding when the law applies. For instance, [PERSON] himself wrote that \"the logarithmic law applies particularly to those outlaw numbers that are without known relationship rather than to those that individually follow an orderly course\" [3]. A popular claim states that to follow the NBL, a distribution must extend over several orders of magnitude [24; 25; 26]. However, this was pointed out as a widely spread misconception, by [PERSON] [27]. Going back to the subject of JPEG compression, the numbers that provide valuable information related to our research are the discrete cosine transform coefficients after quantization. The reason for choosing them is not based on a mathematical proof, but rather on previous work, such as [9; 28], and experimental tests [29]. For comparison, the discrete cosine transform coefficients before quantization will also be analyzed. The steps used to obtain these coefficients are thoroughly discussed in the following section. Regarding the study sample on which we have conducted our research, it contains images from the Uncompressed Color Image Database (UCID). In our research, the color spaces which were used are RGB and \(\mathrm{YC_{B}C_{R}}\). Consequently, the experiments were conducted on the channels R (red), G (green), B (blue), Y (luma component), \(\mathrm{C_{B}}\) (blue-difference chroma component) and \(\mathrm{C_{R}}\) (red-difference chroma component). Therefore, the first step when considering an input image is to decide which channel will be used further. In what follows, the algorithm of obtaining the discrete cosine transform coefficients is discussed. As a starting point, we consider the main steps of JPEG compression represented in Figure 2.  
Figure 2: Obtaining a JPEG compressed image. The terminology of \"JPEG coefficients\" [28] will be used from now on to describe the discrete cosine transform (DCT) coefficients after quantization. As it was previously stated, in our research, both DCT coefficients and JPEG coefficients are analyzed. However, before studying them using the NBL, we provide our readers with an exemplified explanation of the DCT and the quantization. To begin with, one channel is selected, for instance, the luminance. Then, the image is divided into blocks of 8 by 8 pixels. Such an example is represented in Figure 3.  
If representing graphically the luminance values, a histogram is obtained, shown in Figure 4.  
Since the range of values is 0-255, by subtracting 128 from each value, a range centered around 0 is obtained, shown in Figure 5.  
Figure 4: The luminance histogram for a block of 8 by 8 pixels. Figure 3: Luminance values for an 8 by 8 block of pixels. Then, for each block, the two-dimensional discrete cosine transform is applied. This transformation is a sum of cosines, a sum in which the terms' coefficients are in decreasing order.