# Perceptual Hashing-Based Image Copy-Move Forgery Detection

Authors: Huan Wang; Hongxia Wang
Journal: Security and Communication Networks
 (2018)

---

## Abstract

This paper proposes a blind authentication scheme to identify duplicated regions for copy-move forgery based on perceptual hashing and package clustering algorithms. For all fixed-size image blocks in suspicious images, discrete cosine transform (DCT) is used to obtain their DCT coefficient matrixes. Their perceptual hash matrixes and perceptual hash feature vectors are orderly addressed. Moreover, a package clustering algorithm is proposed to replace traditional lexicographic order algorithms for improving the detection precision. Similar blocks can be identified by matching the perceptual hash feature vectors in each package and its adjacent package. The experimental results show that the proposed scheme can locate irregular tampered regions and multiple duplicated regions in suspicious images although they are distorted by some hybrid trace hiding operations, such as adding white Gaussian noise and Gaussian blurring, adjusting contrast ratio, luminance, and hue, and their hybrid operations.


---

## Body

## 1. Introduction

Copy-move forgery as a popular digital image tampering technology is extensively used by forgers. In a digital image, some regions are copied and then pasted into other regions in this same image to achieve the purpose of hiding some targets or emphasizing some important objects [1]. Its authenticity is broken. Since the original regions and the duplicated regions come from the same image, their most important characteristics, such as the color palettes, noises, and dynamic ranges, are compatible with the remainder of the image [2]. One may neglect this malicious operation if forgers deliberately hide the tampering traces. A typical copy-move forgery example is shown in Figure 1, where the traffic flow is exaggerated by tampering cars. It is urgent to propose effective copy-move forgery detection methods to detect and locate the tampered regions for digital images. Blind authentication for copy-move forgery mainly focuses on the identifying of tampered regions in digital images without any additional information except for themselves. Based on this advantage, it becomes to a valuable research in image authentication fields [3].Figure 1
An example of copy-move forgery: (a) an original image and (b) a copy-move forgery image.
(a) (b)Block-based methods and keypoint-based methods are the common techniques for copy-move forgery detection. Block-based methods indicate that a suspicious image is divided into overlapped and fix-sized blocks. The tampered regions can be identified by matching the similar feature vectors that are extracted from the blocks. Fridrich et al. in [1] first proposed a block-based detection scheme using quantized discrete cosine transform (DCT) coefficients, which is one of the landmark methods for copy-move forgery detection. Popscu and Farid in [4] presented a novel method that use principal component analysis (PCA) to derive an alternative representation for each image block. However, it cannot resist other robustness attacks and identify some little tampered regions. Babak and Stanislav in [5] presented a copy-move forgery detection scheme to extract image features for overlapped blocks based on blur moment invariants. Cao et al. in [6] exploited the mean of DCT coefficients to propose their algorithm that not only can resist the attacks of blurring and additive noise operations, but also considers the detection accuracy rate (DAR) and false positive rate (FPR). However, it is weak to resist the attack of hue or contrast ratio adjustments. Thajeel and Sulong in [7] presented an approach to improve the detection precision based on completed robust local binary pattern. Wang et al. in [8] proposed a copy-move forgery detection scheme to improve the detection precision based on DCT and package clustering algorithms. However, the robustness of feature vectors has been concentrated less. Zhong et al. in [9] presented a scheme that divides the tampered image into overlapped circular blocks. The features of circular blocks are extracted by the discrete radial harmonic Fourier moments. This method obtains outstanding performance under image geometrical distortions. Dixit et al. in [10] proposed a method for detecting copy-move forgery using stationary wavelet transform. The detection accuracy of the proposed method is also considered. Bi and Pun in [11] presented a fast reflective offset guided searching method for image copy-move forgery detection. It aims to reduce the computational complexity. The block-based methods mentioned above need to divide the image into overlapped and fix-sized blocks and then handle each of them. These algorithms can resist some plain postprocessing operations, such as JPEG compression, blurring, and noise interference. However, they did not achieve satisfactory results to resolve a common problem of reducing similar region matching times.Keypoint-based methods rely on the identification of high-entropy image regions [12]. A feature vector can be extracted for each keypoint. Fewer feature vectors are estimated since the number of keypoints is reduced. Therefore, keypoint-based methods theoretically have lower computational costs for feature vectors matching and postprocessing. Amerini et al. in [12, 13] presented scale invariant feature transform (SIFT) to filter, sort, and classify the keypoint pairs for copy-move forgery detection. Li et al. in [14] try to reduce the similar region matching times and improve the DAR and FPR by segmenting a suspicious image into nonoverlapped patches. Wang et al. in [15] introduced a keypoints-based image passive detecting method based on Harris detector and region growth technology. It is robust for JPEG compression, gamma adjustment, and luminance enhancement. Li et al. in [16] proposed a hierarchical cluster algorithm based on maximally stable color region detector and Zernike moments to extract all keypoint features. Wang et al. in [17] presented a method to segment a suspicious image into irregular superpixels that are classified into smooth, texture, and strong texture. The stable image keypoints can be extracted from each superpixel. The above-mentioned algorithms have moved the copy-move forgery detection field ahead rapidly. However, they did not achieve satisfactory results on the improving of DAR and FPR in order to reduce the matching times. The resistance for other postprocessing operations is less considered, such as adjusting contrast ratio, luminance, hue, and their hybrid operations.Perceptual hashing [18] is a class of one-way mappings from multimedia presentations to perceptual hash values in terms of the perceptual content. It is widely applied to perform multimedia content identification, retrieval, and authentication. In similar image searching and target tracking, perceptual hash algorithms are applied to generate fingerprints for digital images and then are used to compare them with each other. In addition, perceptual hash values are robust to take into account transformations or “attacks” on a given input and, yet, flexible enough to distinguish between dissimilar files. Such attacks include skew, contrast adjustment and different compression. Perceptual hash values are analogous if features are similar [19]. In a copy-move forgery image, the copy regions are similar with their paste regions. Therefore, perceptual hash algorithms can also be used to generate robust features for detecting the tampered regions.In this study, a passive authentication scheme is proposed to perform authenticating for copy-move forgery based on perceptual hashing. The novelty of the proposed scheme includes the following:(1) Using perceptual hashing algorithms, the feature vectors of image blocks are robust for improving the DAR and FPR. (2) A package clustering algorithm is used to replace traditional lexicographic order methods to reduce the block matching times, where each package is used to represent a cluster. (3) Using perceptual hash algorithms, the proposed method can effectively identify and locate multiple duplicated regions in digital images that may be distorted by adding white Gaussian noise and Gaussian blurring, adjusting contrast ratio, luminance, hue, and their hybrid operations.The rest of this paper is organized as follows. Section2 introduces the proposed method. Section 3 shows the performance of the proposed scheme with a series of experiments. Finally, this paper is concluded in Section 4.


## 2. The Proposed Scheme

It is impossible in general that there are two identical regions in a naturally formed picture unless it contains large area smooth regions, such as a blackboard or a piece of blue sky [20]. In this study, we suppose that all images do not contain large area smooth regions.It is an incontestable fact that each suspicious image contains at least two similar regions, that is, an original region and a copy-move forgery region, if the suspicious image is tampered with copy-move forgery. By concluding many existing schemes, the task of passive authentication for copy-move forgery is to detect and locate tampered regions for suspicious images. In our proposed method, two main steps, that is, feature extraction and feature matching, are separately introduced. In the feature extraction step, perceptual hashing algorithms are extended to generate perceptual hash feature vectors that can be used to represent the image blocks in a suspicious image. In feature matching step, the idea of a package clustering algorithm is used to replace general lexicographically sorting algorithms to improve the detection precision and reduce the feature vector comparing times. Figure2 shows the framework of the proposed scheme.Figure 2
The framework of the proposed copy-move forgery scheme.


### 2.1. Preprocessing Operation

LetA be a suspicious image. It should be converted into a gray-scale image by I=0.299R+0.587G+0.114B if it is a color image, where R, G, and B represent the red, green, and blue components of A, respectively, and I represents the pixel value of gray-scale image.


### 2.2. Feature Extraction Using Perceptual Hashing

In this step, suspicious imageA is divided into different image blocks. DCT is applied to generate the DCT coefficient matrix for each image block. Finally, perceptual hashing is used to extract a perceptual hash feature vector for each image block according to its generated DCT coefficient matrix. The details of the feature extracting algorithm are shown in Algorithm 1.Algorithm 1:Feature extraction.
Input: A suspicious gray-scale image A. Output: All perceptual hash feature vectors for image blocks in A. Step   1. Suspicious image A is divided into ( W - b + 1 ) × ( H - b + 1 ) overlapping blocks, denoted as Bij, where 0<b≪W, 0 < b ≪ H, 1≤i≤(W-b+1), and 1 ≤ j ≤ ( H - b + 1 ). Step   2. For each block Bij Step   3. The pixel mean of Bij, denoted as Pij, is computed. Step   4. DCT is applied to generate the coefficient matrix for block Bij, denoted as Cij. Step   5. The coefficient matrix Cij is divided into four sub-blocks, denoted as Cij1, Cij2, Cij3, and Cij4, respectively. Step   6. The mean of the first sub-block Cij1 is calculated, denoted as mij. Step   7. The perceptual hashing matrix for each sub-block Cijk is computed, denoted as H i j k, where k∈1,2,3,4. Step   8. Each perceptual hashing matrix Hijk is converted into a decimal number, denoted as dijk, to represent feature value for block B i j, where k∈1,2,3,4. Step   9. The feature vector of block Bij is created, denoted as Fij=(Pij,dij1,dij2,dij3,dij4), according to its pixel mean and four feature values. Step   10. End ForIn Step1, suspicious image A with the size of H×W pixels is divided into (H-b+1)×(W-b+1) overlapping blocks by sliding a square window with the size of b×b pixels along with image A from the upper-left corner right down to the lower-right corner; that is, the adjacent overlapping blocks only have one different row or column. Each block is denoted as Bij, where 1≤i≤(H-b+1), 1≤j≤(W-b+1), i and j indicate the starting point of the block’s row and column, respectively. Therefore, the original regions and their copy-move forgery regions are also divided into different blocks in which there is at least a pair of identical or similar blocks. The main task of the proposed scheme is to detect and locate these identical or similar blocks in pairs.In Steps  2–10, the feature vector of each block is computed using DCT and perceptual hashing algorithms. It is unideal to directly use pixel values to match similar blocks in suspicious images since the forgers may distort the content of the tampered images. An ideal method is extracting robust features to represent blocks and then the similar blocks can be diagnosed by matching these robust features. The purpose is to strengthen the robustness and improve the detection accuracy of the proposed scheme. In this algorithm, perceptual hash features play this role, which are used to represent image blocks.In Step3, the pixel mean of image block Bij, denoted as Pij, is calculated as follows:(1)Pij=∑x=1b∑y=1bfijx,yb2,where fij(x,y) represents the pixel value of xth row and yth column in Bij. For the pair of two identical or similar image blocks, their pixel means are also identical or similar.In Step4, DCT is applied to exploit the DCT coefficient matrix for each block Bij, denoted as Cij, where the DCT coefficient matrix has the same size with block Bij, 1≤i≤(H-b+1), and 1≤j≤(W-b+1).In Step5, coefficient matrix Cij is divided into four subblocks. A typical characteristic of DCT is that the energy of an image focuses on the low frequency part and the high frequency coefficients play insignificant roles. This means that not all elements are equally important in Cij and the top-left part of Cij represents most features of block Bij. In the proposed method, each DCT coefficient matrix Cij will be equally divided into four subblocks, denoted as Cij1, Cij2, Cij3, and Cij4, as shown in Figure 3.Figure 3
The method of dividing a block into four subblocks.In Steps  6–9, the feature vector of blockBij is created using perceptual hashing algorithm. According to the typical characteristic of DCT, the energy of the first subblock can be used to approximately represent the energy of whole block Bij. This means that the average energy of block Bij can be approximately represented by the energy of first subblock Cij1. In Step 6, the average energy of subblock Cij1, denoted as mij1, is calculated as follows:(2)mij1=∑x=1b/2∑y=1b/2cij1x,yb/22,where cij1(x,y) indicates the element of xth row and yth column in subblock Cij1.In Step7, the perceptual hash matrixes of the four subblocks Cij1, Cij2, Cij3, and Cij4, denoted as Hij1, Hij2, Hij3, and Hij4, respectively, are generated according to the average energy of subblock Cij1,that is, mij1. Therefore, ∀hijk(x,y)∈Hijk is calculated as follows:(3)hijkx,y=1,cijkx,y∈Cijk,cijkx,y≥mij10,cijkx,y∈Cijk,cijkx,y<mij1,where 1≤x≤b/2, 1≤y≤b/2, and k∈{1,2,3,4}. Obviously, perceptual hash matrix Hijk can be considered as a perceptual digest from an image block to a binary matrix. It is used to represent the image block.In Step8, perceptual hash matrixes are converted into decimal numbers. In practical application, it is easier to calculate and store decimal numbers than binary matrixes. The four perceptual hash matrixes Hij1, Hij2, Hij3, and Hij4 are converted into four decimal numbers, denoted as dij1, dij2, dij3, and dij4, respectively, along with their rows.In Step9, the perceptual hash feature vector of block Bij is created. For block Bij, it has five special values that are considered as above, that is, the pixel mean Pij and the four decimal numbers dij1, dij2, dij3, and dij4. In order to more accurately represent block Bij, its perceptual hash feature vector, denoted as Fij, is constructed as follows:(4)Fij=Pij,dij1,dij2,dij3,dij4.Obviously, perceptual hash feature vector Fij has the properties of simpleness and robustness. Therefore, it can be considered as the feature vector for image block Bij.


### 2.3. Similar Region Matching

In the matching stage of the existing methods, their feature vectors are sorted first by some sorting algorithms, such as traditional lexicographic order algorithms, and then used to detect and locate the similar blocks using block matching methods. However, two kinds of issues in these existing methods should be improved to achieve better matching results. One is the block matching times, it will cause that the proposed matching algorithm has higher time complexity. Another is the precision of locating duplicated regions, which is dissatisfactory. In our proposed scheme, a package clustering algorithm is proposed to detect and locate the tampered regions with the purpose of improving the detection precision. The details of the proposed similar region matching algorithm are described in Algorithm2.Algorithm 2:Similar region matching.
Input: All perceptual hash feature vectors Fij=(Pij, d i j 1 , d i j 2 , d i j 3 , d i j 4 ), where 1≤i≤(H-b+1) and 1≤j≤(W-b+1), which are the output of Algorithm 1. Output: A map that includes the detection results. Step   1. Creating ξ packages, denoted as PA1, P A 2 , …, and PAξ, where ξ=256/n +  1 and n is a preset threshold. Step   2. All perceptual hash feature vectors Fij= ( P i j , d i j 1 , d i j 2 , d i j 3 , d i j 4 ) are stored into the ξ packages, respectively, according to the value of Pij. Step   3. A map is created with the same size of suspicious image and all its initial pixel values are set to zero. Step   4. For each package PAθ  (1≤θ≤ξ) Step   5. The block pairs contained in PAθ will be matched according to their perceptual hash feature vectors and coordinate positions. The values of the corresponding coordinate positions in the map will be set to a same pixel value “255” according to the coordinates of the suspicious image if the block pairs are diagnosed as similar. Step   6. For each block contained in package PAθ, it will be matched with all blocks contained in package PAθ+1 if 1 ≤ θ ≤ ξ - 1 with the same method of Step  5. Step   7. End For Step   8. Outputting the map.In Algorithm2, Steps  1 and 2 construct a package clustering algorithm that stores all perceptual hash feature vectors into the prepared packages according to the pixel means of blocks. Steps  4–7 compare all perceptual hash feature vectors to detect and locate the similar blocks according to the proposed package matching rule.In Step1, a set of packages is created. Let n be a preset threshold that represents the maximum capacity of all packages. Therefore, ξ=(⌊256/n⌋+1) packages are created, denoted as PA1,PA2,…, and PAξ, since the suspicious image is a gray-scale image (its pixel range is zero to 255), where  is a floor function.In Step2, all perceptual hash feature vectors are stored into the ξ packages. Let Bij be a block and Fij=(Pij,dij1,dij2,dij3,dij4) be the perceptual hash feature vector of block Bij. Then, block Bij will be put into package PAθ, where θ=(⌊Pij/n⌋+1). For example, assume i=6, j=5, n=4, and P65=129. Block B65 will be put into package PA33, where (⌊P65/n⌋+1)=(⌊129/4⌋+1)=33. This indicates that the pixel mean range of package PA33 is {128,129,130,131}.For any two image blocksBij and Bmn, their pixel values are similar if the two image blocks are duplicated. Naturally, their average pixel values Pij and Pmn are also similar, where Pij=Pmn or Pij≈Pmn. Therefore, the perceptual hash feature vectors of blocks Bij and Bmn will be stored into the same package PAθ or two adjacent packages PAθ and PAθ+1, where θ=(⌊Pij/n⌋+1) and 1≤θ≤ξ-1. Let the average pixel values of blocks Bij and Bmn be Pij=131 and Pmn=132, respectively. We have that the pixel mean range of package PA33 is {128,129,130,131} and the pixel mean range of package PA34 is {132,133,134,135}. The two perceptual hash feature vectors of blocks Bij and Bmn will be stored into the two adjacent packages. We need to match the perceptual hash feature vectors to diagnose the similar blocks in the same package and the adjacent package in the proposed similar region matching algorithm.In Step3, a map is created to mark the coordinate positions of all duplicated regions. It is the output in Algorithm 2. At the initial state, all of its values are set to zero. This means that there is no duplicated region at the initial state.In Step5, the similar image blocks that belong to the same package will be located according to their perceptual hash feature vectors and their actual coordinate distance. ∀θ∈{1,2,…,ξ}, all perceptual hash feature vectors contained in package PAθ will be compared with each other. Let Bij and Bmn be two image blocks such that Bij≠Bmn, Fij=(Pij,dij1,dij2,dij3,dij4), and Fmn=(Pmn,dmn1,dmn2,dmn3,dmn4) be their perceptual hash feature vectors, respectively, and N≥0 be a preset threshold. Blocks Bij and Bmn can be considered as similar blocks if ∀k∈{1,2,3,4} such that S(dijk⊕dmnk)≤N, where ⊕ is an exclusive-OR operation for binary strings dijk and dmnk and S is a function that is used to count the number of “1” in dijk⊕dmnk.Specially, blocksBij and Bmn that are diagnosed as similar blocks should be excluded if their coordinate positions are adjacent in a suspicious image since the adjacent pixels of the suspicious image are generally smooth. Therefore, the coordinate distance of the two similar blocks Bij and Bmn should be considered. Let (xij,yij) and (xmn,ymn) be the coordinates of blocks Bij and Bmn, respectively. Their actual coordinate distance, denoted as α, can be calculated as follows:(5)α=xij-xmn2+yij-ymn2.If α>M, similar blocks Bij and Bmn are considered as actual similar blocks, where M is a preset threshold. If blocks Bij and Bmn are diagnosed as actual similar blocks, the values of the coordinate positions (xij,yij) and (xmn,ymn), which are also the coordinate positions of similar blocks Bij and Bmn in the suspicious image, should be marked with the same value, such as 255.In Step6, each block that belongs to package PAθ will be matched with all blocks that belong to package PAθ+1 with the same method of Step 5 if 1≤θ≤ξ-1.LetBij and Bmn be two image blocks and Fij=(Pij,dij1,dij2,dij3,dij4) and Fmn=(Pmn,dmn1,dmn2,dmn3,dmn4) be the perceptual hash feature vectors of Bij and Bmn, respectively. We have Fij≈Fmn if Bij≈Bmn, where Fij=Fmn is a particular case of Fij≈Fmn. It can be explained as follows. For blocks Bij and Bmn, ∀fij(x,y)∈Bij and ∀fmn(x,y)∈Bmn such that fij(x,y)≈fmn(x,y) if Bij≈Bmn, where fij(x,y) (resp., fmn(x,y)) represents the pixel of xth row and yth column in Bij (resp., Bmn), we have Pij≈Pmn since they are the pixel means of Bij and Bmn, respectively.LetCij and Cmn be the DCT coefficient matrixes of Bij and Bmn, respectively. According to the independence and stability characteristics of DCT [21], we have Cij≈Cmn if Bij≈Bmn. Naturally, we also have Cijk≈Cmnk, where Cijk and Cmnk are the four subblocks of Cij and Cmn, respectively, and k∈{1,2,3,4}. Let mij and mmn be the mean values of Cij1 and Cmn1, respectively. We have mij≈mmn since Cij1≈Cmn1. Therefore, we have Hijk≈Hmnk according to (3), where Hijk and Hmnk are the perceptual hash matrixes of subblocks Cijk and Cmnk, respectively. Note that Hijk and Hmnk are two binary matrixes, which contain only “1” or “0.” Automatically, we have dijk≈dmnk since the decimal numbers dijk and dmnk are uniquely computed from the two binary matrixes Hijk and Hmnk, respectively. Therefore, we have Fij≈Fmn since Pij≈Pmn and dijk≈dmnk, where k∈{1,2,3,4}. It indicates that image blocks Bij and Bmn may be a similar block pair if their perceptual hash feature vectors Fij and Fmn are similar. In order to authenticate a suspicious image, we should detect all blocks of the suspicious image by comparing the perceptual hash feature vectors of these blocks.


## 2.1. Preprocessing Operation

LetA be a suspicious image. It should be converted into a gray-scale image by I=0.299R+0.587G+0.114B if it is a color image, where R, G, and B represent the red, green, and blue components of A, respectively, and I represents the pixel value of gray-scale image.


## 2.2. Feature Extraction Using Perceptual Hashing

In this step, suspicious imageA is divided into different image blocks. DCT is applied to generate the DCT coefficient matrix for each image block. Finally, perceptual hashing is used to extract a perceptual hash feature vector for each image block according to its generated DCT coefficient matrix. The details of the feature extracting algorithm are shown in Algorithm 1.Algorithm 1:Feature extraction.
Input: A suspicious gray-scale image A. Output: All perceptual hash feature vectors for image blocks in A. Step   1. Suspicious image A is divided into ( W - b + 1 ) × ( H - b + 1 ) overlapping blocks, denoted as Bij, where 0<b≪W, 0 < b ≪ H, 1≤i≤(W-b+1), and 1 ≤ j ≤ ( H - b + 1 ). Step   2. For each block Bij Step   3. The pixel mean of Bij, denoted as Pij, is computed. Step   4. DCT is applied to generate the coefficient matrix for block Bij, denoted as Cij. Step   5. The coefficient matrix Cij is divided into four sub-blocks, denoted as Cij1, Cij2, Cij3, and Cij4, respectively. Step   6. The mean of the first sub-block Cij1 is calculated, denoted as mij. Step   7. The perceptual hashing matrix for each sub-block Cijk is computed, denoted as H i j k, where k∈1,2,3,4. Step   8. Each perceptual hashing matrix Hijk is converted into a decimal number, denoted as dijk, to represent feature value for block B i j, where k∈1,2,3,4. Step   9. The feature vector of block Bij is created, denoted as Fij=(Pij,dij1,dij2,dij3,dij4), according to its pixel mean and four feature values. Step   10. End ForIn Step1, suspicious image A with the size of H×W pixels is divided into (H-b+1)×(W-b+1) overlapping blocks by sliding a square window with the size of b×b pixels along with image A from the upper-left corner right down to the lower-right corner; that is, the adjacent overlapping blocks only have one different row or column. Each block is denoted as Bij, where 1≤i≤(H-b+1), 1≤j≤(W-b+1), i and j indicate the starting point of the block’s row and column, respectively. Therefore, the original regions and their copy-move forgery regions are also divided into different blocks in which there is at least a pair of identical or similar blocks. The main task of the proposed scheme is to detect and locate these identical or similar blocks in pairs.In Steps  2–10, the feature vector of each block is computed using DCT and perceptual hashing algorithms. It is unideal to directly use pixel values to match similar blocks in suspicious images since the forgers may distort the content of the tampered images. An ideal method is extracting robust features to represent blocks and then the similar blocks can be diagnosed by matching these robust features. The purpose is to strengthen the robustness and improve the detection accuracy of the proposed scheme. In this algorithm, perceptual hash features play this role, which are used to represent image blocks.In Step3, the pixel mean of image block Bij, denoted as Pij, is calculated as follows:(1)Pij=∑x=1b∑y=1bfijx,yb2,where fij(x,y) represents the pixel value of xth row and yth column in Bij. For the pair of two identical or similar image blocks, their pixel means are also identical or similar.In Step4, DCT is applied to exploit the DCT coefficient matrix for each block Bij, denoted as Cij, where the DCT coefficient matrix has the same size with block Bij, 1≤i≤(H-b+1), and 1≤j≤(W-b+1).In Step5, coefficient matrix Cij is divided into four subblocks. A typical characteristic of DCT is that the energy of an image focuses on the low frequency part and the high frequency coefficients play insignificant roles. This means that not all elements are equally important in Cij and the top-left part of Cij represents most features of block Bij. In the proposed method, each DCT coefficient matrix Cij will be equally divided into four subblocks, denoted as Cij1, Cij2, Cij3, and Cij4, as shown in Figure 3.Figure 3
The method of dividing a block into four subblocks.In Steps  6–9, the feature vector of blockBij is created using perceptual hashing algorithm. According to the typical characteristic of DCT, the energy of the first subblock can be used to approximately represent the energy of whole block Bij. This means that the average energy of block Bij can be approximately represented by the energy of first subblock Cij1. In Step 6, the average energy of subblock Cij1, denoted as mij1, is calculated as follows:(2)mij1=∑x=1b/2∑y=1b/2cij1x,yb/22,where cij1(x,y) indicates the element of xth row and yth column in subblock Cij1.In Step7, the perceptual hash matrixes of the four subblocks Cij1, Cij2, Cij3, and Cij4, denoted as Hij1, Hij2, Hij3, and Hij4, respectively, are generated according to the average energy of subblock Cij1,that is, mij1. Therefore, ∀hijk(x,y)∈Hijk is calculated as follows:(3)hijkx,y=1,cijkx,y∈Cijk,cijkx,y≥mij10,cijkx,y∈Cijk,cijkx,y<mij1,where 1≤x≤b/2, 1≤y≤b/2, and k∈{1,2,3,4}. Obviously, perceptual hash matrix Hijk can be considered as a perceptual digest from an image block to a binary matrix. It is used to represent the image block.In Step8, perceptual hash matrixes are converted into decimal numbers. In practical application, it is easier to calculate and store decimal numbers than binary matrixes. The four perceptual hash matrixes Hij1, Hij2, Hij3, and Hij4 are converted into four decimal numbers, denoted as dij1, dij2, dij3, and dij4, respectively, along with their rows.In Step9, the perceptual hash feature vector of block Bij is created. For block Bij, it has five special values that are considered as above, that is, the pixel mean Pij and the four decimal numbers dij1, dij2, dij3, and dij4. In order to more accurately represent block Bij, its perceptual hash feature vector, denoted as Fij, is constructed as follows:(4)Fij=Pij,dij1,dij2,dij3,dij4.Obviously, perceptual hash feature vector Fij has the properties of simpleness and robustness. Therefore, it can be considered as the feature vector for image block Bij.


## 2.3. Similar Region Matching

In the matching stage of the existing methods, their feature vectors are sorted first by some sorting algorithms, such as traditional lexicographic order algorithms, and then used to detect and locate the similar blocks using block matching methods. However, two kinds of issues in these existing methods should be improved to achieve better matching results. One is the block matching times, it will cause that the proposed matching algorithm has higher time complexity. Another is the precision of locating duplicated regions, which is dissatisfactory. In our proposed scheme, a package clustering algorithm is proposed to detect and locate the tampered regions with the purpose of improving the detection precision. The details of the proposed similar region matching algorithm are described in Algorithm2.Algorithm 2:Similar region matching.
Input: All perceptual hash feature vectors Fij=(Pij, d i j 1 , d i j 2 , d i j 3 , d i j 4 ), where 1≤i≤(H-b+1) and 1≤j≤(W-b+1), which are the output of Algorithm 1. Output: A map that includes the detection results. Step   1. Creating ξ packages, denoted as PA1, P A 2 , …, and PAξ, where ξ=256/n +  1 and n is a preset threshold. Step   2. All perceptual hash feature vectors Fij= ( P i j , d i j 1 , d i j 2 , d i j 3 , d i j 4 ) are stored into the ξ packages, respectively, according to the value of Pij. Step   3. A map is created with the same size of suspicious image and all its initial pixel values are set to zero. Step   4. For each package PAθ  (1≤θ≤ξ) Step   5. The block pairs contained in PAθ will be matched according to their perceptual hash feature vectors and coordinate positions. The values of the corresponding coordinate positions in the map will be set to a same pixel value “255” according to the coordinates of the suspicious image if the block pairs are diagnosed as similar. Step   6. For each block contained in package PAθ, it will be matched with all blocks contained in package PAθ+1 if 1 ≤ θ ≤ ξ - 1 with the same method of Step  5. Step   7. End For Step   8. Outputting the map.In Algorithm2, Steps  1 and 2 construct a package clustering algorithm that stores all perceptual hash feature vectors into the prepared packages according to the pixel means of blocks. Steps  4–7 compare all perceptual hash feature vectors to detect and locate the similar blocks according to the proposed package matching rule.In Step1, a set of packages is created. Let n be a preset threshold that represents the maximum capacity of all packages. Therefore, ξ=(⌊256/n⌋+1) packages are created, denoted as PA1,PA2,…, and PAξ, since the suspicious image is a gray-scale image (its pixel range is zero to 255), where  is a floor function.In Step2, all perceptual hash feature vectors are stored into the ξ packages. Let Bij be a block and Fij=(Pij,dij1,dij2,dij3,dij4) be the perceptual hash feature vector of block Bij. Then, block Bij will be put into package PAθ, where θ=(⌊Pij/n⌋+1). For example, assume i=6, j=5, n=4, and P65=129. Block B65 will be put into package PA33, where (⌊P65/n⌋+1)=(⌊129/4⌋+1)=33. This indicates that the pixel mean range of package PA33 is {128,129,130,131}.For any two image blocksBij and Bmn, their pixel values are similar if the two image blocks are duplicated. Naturally, their average pixel values Pij and Pmn are also similar, where Pij=Pmn or Pij≈Pmn. Therefore, the perceptual hash feature vectors of blocks Bij and Bmn will be stored into the same package PAθ or two adjacent packages PAθ and PAθ+1, where θ=(⌊Pij/n⌋+1) and 1≤θ≤ξ-1. Let the average pixel values of blocks Bij and Bmn be Pij=131 and Pmn=132, respectively. We have that the pixel mean range of package PA33 is {128,129,130,131} and the pixel mean range of package PA34 is {132,133,134,135}. The two perceptual hash feature vectors of blocks Bij and Bmn will be stored into the two adjacent packages. We need to match the perceptual hash feature vectors to diagnose the similar blocks in the same package and the adjacent package in the proposed similar region matching algorithm.In Step3, a map is created to mark the coordinate positions of all duplicated regions. It is the output in Algorithm 2. At the initial state, all of its values are set to zero. This means that there is no duplicated region at the initial state.In Step5, the similar image blocks that belong to the same package will be located according to their perceptual hash feature vectors and their actual coordinate distance. ∀θ∈{1,2,…,ξ}, all perceptual hash feature vectors contained in package PAθ will be compared with each other. Let Bij and Bmn be two image blocks such that Bij≠Bmn, Fij=(Pij,dij1,dij2,dij3,dij4), and Fmn=(Pmn,dmn1,dmn2,dmn3,dmn4) be their perceptual hash feature vectors, respectively, and N≥0 be a preset threshold. Blocks Bij and Bmn can be considered as similar blocks if ∀k∈{1,2,3,4} such that S(dijk⊕dmnk)≤N, where ⊕ is an exclusive-OR operation for binary strings dijk and dmnk and S is a function that is used to count the number of “1” in dijk⊕dmnk.Specially, blocksBij and Bmn that are diagnosed as similar blocks should be excluded if their coordinate positions are adjacent in a suspicious image since the adjacent pixels of the suspicious image are generally smooth. Therefore, the coordinate distance of the two similar blocks Bij and Bmn should be considered. Let (xij,yij) and (xmn,ymn) be the coordinates of blocks Bij and Bmn, respectively. Their actual coordinate distance, denoted as α, can be calculated as follows:(5)α=xij-xmn2+yij-ymn2.If α>M, similar blocks Bij and Bmn are considered as actual similar blocks, where M is a preset threshold. If blocks Bij and Bmn are diagnosed as actual similar blocks, the values of the coordinate positions (xij,yij) and (xmn,ymn), which are also the coordinate positions of similar blocks Bij and Bmn in the suspicious image, should be marked with the same value, such as 255.In Step6, each block that belongs to package PAθ will be matched with all blocks that belong to package PAθ+1 with the same method of Step 5 if 1≤θ≤ξ-1.LetBij and Bmn be two image blocks and Fij=(Pij,dij1,dij2,dij3,dij4) and Fmn=(Pmn,dmn1,dmn2,dmn3,dmn4) be the perceptual hash feature vectors of Bij and Bmn, respectively. We have Fij≈Fmn if Bij≈Bmn, where Fij=Fmn is a particular case of Fij≈Fmn. It can be explained as follows. For blocks Bij and Bmn, ∀fij(x,y)∈Bij and ∀fmn(x,y)∈Bmn such that fij(x,y)≈fmn(x,y) if Bij≈Bmn, where fij(x,y) (resp., fmn(x,y)) represents the pixel of xth row and yth column in Bij (resp., Bmn), we have Pij≈Pmn since they are the pixel means of Bij and Bmn, respectively.LetCij and Cmn be the DCT coefficient matrixes of Bij and Bmn, respectively. According to the independence and stability characteristics of DCT [21], we have Cij≈Cmn if Bij≈Bmn. Naturally, we also have Cijk≈Cmnk, where Cijk and Cmnk are the four subblocks of Cij and Cmn, respectively, and k∈{1,2,3,4}. Let mij and mmn be the mean values of Cij1 and Cmn1, respectively. We have mij≈mmn since Cij1≈Cmn1. Therefore, we have Hijk≈Hmnk according to (3), where Hijk and Hmnk are the perceptual hash matrixes of subblocks Cijk and Cmnk, respectively. Note that Hijk and Hmnk are two binary matrixes, which contain only “1” or “0.” Automatically, we have dijk≈dmnk since the decimal numbers dijk and dmnk are uniquely computed from the two binary matrixes Hijk and Hmnk, respectively. Therefore, we have Fij≈Fmn since Pij≈Pmn and dijk≈dmnk, where k∈{1,2,3,4}. It indicates that image blocks Bij and Bmn may be a similar block pair if their perceptual hash feature vectors Fij and Fmn are similar. In order to authenticate a suspicious image, we should detect all blocks of the suspicious image by comparing the perceptual hash feature vectors of these blocks.


## 3. Experiment and Analysis

In this section, the performance of the proposed scheme is tested and analyzed with many suspicious images that are involved in three image databases. The first one is the Columbia photographic images and photorealistic computer graphics database [22], which is made open for passive-blind image authentication research communities. In this database, about 1200 images are involved. We used Photoshop 8.0 to tamper images. All tampered suspicious images form the first experiment database. The second database contains two datasets MICC-F2000 and MICC-F220 that are introduced by Serra in [23]. The two datasets provide 1110 original images and 1110 tampered suspicious images with copy-move forgery. The original images contain animals, plants, men, artifacts, and natural environment. Moreover, to further evaluate the performance of the proposed scheme, 200 supplemented images are downloaded from the Internet and tampered with copy-move forgery to form the third database.


### 3.1. Evaluation Criteria Introduction

To evaluate the performance of copy-move forgery detection methods, researchers usually consider their test results at two different levels, that is, image level and pixel level [3]. At image level, it mainly focuses on the detection of whether an image is tampered or not. Let Tc be the number of tampered images that are correctly detected, Fc be the number of images that are erroneously detected to be the tampered images, and Fm be the number of falsely missed forgery images. The precision ratio p and recall ratio r [3] can be calculated by the following formulas:(6)p=TcTc+Fc×100%,r=TcTc+Fm×100%,where the precision ratio p denotes the probability of a detected forgery being truly a forgery and the recall ratio r denotes the probability of a forgery being not missed.At pixel level, it is used to evaluate the accuracy of duplicated regions. Letωs and ωt be the pixels of an original region and a copy-move region in a suspicious image, respectively, and ω~s and ω~t be the pixels of an original region and a copy-move region in a detected result image, respectively. The detection accuracy rate (DAR) and false positive rate (FPR) are calculated as follows:(7)DAR=ωs∩ω~s+ωt∩ω~tωs+ωt×100%,FPR=ω~s-ωs+ω~t-ωtω~s+ω~t×100%,where “” means the area of region, “∩” means the intersection of two regions, and “−” means the difference of two regions. In this sense, the DAR shows the proportion of identified pixels that simultaneously belong to the really duplicated regions and all really duplicated pixels in all suspicious images. The FPR shows the ratio of some identified pixels that actually do not belong to the really duplicated regions and all identified pixels in all suspicious images. The four criteria indicate how precisely the proposed schemes can locate copy-move regions. Then, we can analyze the performance of the proposed scheme at the image level and the pixel level with the four criteria.


### 3.2. Effectiveness and Accuracy

In this experiment, 400 color images are selected to test the effectiveness and accuracy of the proposed scheme, including 100 original images, 100 forgery images, and other 200 images that are tampered with Photoshop 8.0. All tampered images do not suffer any postprocessing operation. Owing to space constrains, just a part of experimental results is shown in Figure4. The DAR and FPR are calculated to illustrate the performance of the proposed scheme. In Figure 4, the DAR is generally greater than 0.85 and the FPR is also smaller. It indicates that the duplicated regions can be detected using the proposed scheme even though the duplicated regions are nonregular. Table 1 shows the comparison result of the proposed scheme and other existing schemes that are presented in [6, 7, 9]. It indicates that the p and r in the proposed scheme are better.Table 1
Comparison of precision ratiop and recall ratio r.
Methods [6] [7] [9] [ P ] Precision ratio (p) 0.865 0.896 0.822 0.902 Recall ratio (r) 0.900 0.850 0.864 0.910Figure 4
A part of experimental results for the proposed scheme. From top to bottom, the first row (a1)–(d1) shows the original images, the second row (a2)–(d2) shows the tampered images, and the last row (a3)–(d3) shows the detection results.


### 3.3. Robustness Test

In addition to the plain copy-move forgery, the detection for tampered images that are attacked by some postprocessing operations is also considered in the proposed scheme. Therefore, a series of experiments have been done to overall analyze the performance of the proposed scheme. It involves 1000 different suspicious images that come from the three databases. In this experiment, five kinds of attacks are considered, that is, adding white Gaussian noises (AWGN), adjusting contrast ratio (ACR), luminance (AL), hue (AH), and Gaussian blurring (GB), and their hybrid operations. Table2 presents the parameters for the five kinds of attacks and Figure 5 shows a part of experimental results for the proposed scheme.Table 2
Parameters for the five kinds of attacks.
Attacks Parameters AWGN SNR (10, 20, 30, 40, 50) GB ω (0.5, 1, 1.5, 2, 2.5) ACR gain(G) (0.3, 0.6, 0.9, 1.2, 1,5) AL bias(b) (3, 6, 9, 12, 15) AH H (5, 10, 15, 20, 25)Figure 5
A part of the experimental results for the proposed scheme. From top to bottom, the first row (a1)–(e1) shows the five original images; the second row (a2)–(e2) shows the tampered images that are attacked with adding white Gaussian noises and Gaussian blurring, adjusting contrast ratio, luminance, and hue; the last row (a3)–(e3) shows the detection results of the proposed method.In this experiment, the proposed scheme is evaluated by DAR and FPR at the pixel level. The results indicate that the proposed scheme can locate multiple duplication regions although the suspicious images are attacked with different postprocessing operations.In order to quantitatively evaluate the robustness of the proposed algorithm and analyze its ability to resist different image distortions, 100 tampered images are selected from the three databases. These tampered images are distorted by five kinds of attacks that are shown in Table2. Then, there are 500 tampered images that will be detected in this experiment. For each kind of attacks, 100 tampered images are selected to be detected. Tables 3–7 show the detection results with the overall averages of p, r, DAR, and FPR. The robustness of the proposed scheme is evaluated at image level and pixel level.Table 3
Detection results for adding white Gaussian noise.
SNR = 25 SNR = 35 SNR = 45 P 0.980 0.970 0.970 r 0.980 0.970 0.990 DAR 0.910 0.846 0.823 FPR 0.123 0.137 0.125Table 4
Detection results for Gaussian blurring.
ω = 1 ω = 3 ω = 5 P 0.990 0.980 0.990 r 0.960 0.950 0.990 DAR 0.847 0.894 0.906 FPR 0.112 0.132 0.116Table 5
Detection results for adjusting contrast ratio.
G = 0.9 G = 1.1 G = 1.4 P 0.970 0.980 0.990 r 0.940 0.990 0.960 DAR 0.749 0.802 0.896 FPR 0.163 0.174 0.184Table 6
Detection results for adjusting luminance.
b = - 3 b = 3 b = 10 P 0.960 0.980 0.990 r 0.980 0.960 0.990 DAR 0.902 0.876 0.868 FPR 0.168 0.182 0.191Table 7
Detection results for adjusting hue.
H = 10 H = 20 H = 30 P 0.980 0.990 0.990 r 0.990 0.990 0.970 DAR 0.759 0.782 0.826 FPR 0.145 0.139 0.136Tables3 and 4 show that the detection results of the proposed scheme are satisfactory for suspicious images that are attacked by adding white Gaussian noises and Gaussian blurring although the suspicious images have poor quality (SNR = 45 or ω=5). Only 14 images in all 600 tampered images are failed to be detected (r=0.9767). The detection results of tampered images that are distorted by adjusting contrast ratio, luminance, and hue with different parameters are shown in Tables 5, 6, and 7, respectively. We can draw a conclusion from the three tables that the proposed scheme performs well also for attacks of adjusting contrast ratio, luminance, and hue.


### 3.4. Performances Comparison

In the last experiment, the performance of the proposed scheme is compared with other schemes presented in [6, 7, 9]. In this experiment, 400 tampered images are randomly selected from the three databases. They are tested by the proposed scheme and other schemes provided in [6, 7, 9], respectively. Figure 6 shows the performance comparison of these schemes with the overall averages of DAR and FPR for the 400 tampered images. We can see that the scheme proposed in [9] has the best detection results for the two kinds of attacks by adding white Gaussian noises and Gaussian blurring. However, its performance clearly drops down if the intensity of these attacks is gradually increased. Conversely, the proposed scheme is more robust for resisting various attacks. In most cases, the proposed scheme can also achieve better results for other three kinds of attacks with adjusting contrast ratio, luminance, and hue. Moreover, the proposed scheme has the lowest FPR results, which means that the proposed scheme can detect most duplicated regions in the selected suspicious images. The precision of the proposed scheme is higher than that obtained in [6, 7, 9].Figure 6
Comparison of different copy-move forgery schemes with 5 kinds of attacks. The two columns represent the result of DAR and FPR, respectively. (a), (b) Adding white Gaussian noise. (c), (d) Gaussian blurring. (e), (f) Adjusting contrast ratio. (g), (h) Adjusting luminance. (i), (j) Adjusting hue.
(a) (b) (c) (d) (e) (f) (g) (h)  (i) (j)The experimental results show that the proposed method can locate the tampered regions in a tampered image although it is distorted by some hybrid trace hiding operations, such as adding white Gaussian noise, Gaussian blurring, adjusting contrast ratio, luminance, and hue, and their hybrid operations. The proposed forensic technique can be used in politics, military, jurisprudence, and academic research. For example, a journalist takes a photo for a traffic accident. However, the journalist finds that the influence will be better if some crowds appear in this photo. Therefore, he can use image processing tools to copy some people from the other side of this photo and paste them into the scene and use white Gaussian noise to conceal all tampering traces. Therefore, the authenticity of this traffic accident is broken. The news organization can detect this photo by using the proposed scheme to ensure its authenticity before this news is reported.


## 3.1. Evaluation Criteria Introduction

To evaluate the performance of copy-move forgery detection methods, researchers usually consider their test results at two different levels, that is, image level and pixel level [3]. At image level, it mainly focuses on the detection of whether an image is tampered or not. Let Tc be the number of tampered images that are correctly detected, Fc be the number of images that are erroneously detected to be the tampered images, and Fm be the number of falsely missed forgery images. The precision ratio p and recall ratio r [3] can be calculated by the following formulas:(6)p=TcTc+Fc×100%,r=TcTc+Fm×100%,where the precision ratio p denotes the probability of a detected forgery being truly a forgery and the recall ratio r denotes the probability of a forgery being not missed.At pixel level, it is used to evaluate the accuracy of duplicated regions. Letωs and ωt be the pixels of an original region and a copy-move region in a suspicious image, respectively, and ω~s and ω~t be the pixels of an original region and a copy-move region in a detected result image, respectively. The detection accuracy rate (DAR) and false positive rate (FPR) are calculated as follows:(7)DAR=ωs∩ω~s+ωt∩ω~tωs+ωt×100%,FPR=ω~s-ωs+ω~t-ωtω~s+ω~t×100%,where “” means the area of region, “∩” means the intersection of two regions, and “−” means the difference of two regions. In this sense, the DAR shows the proportion of identified pixels that simultaneously belong to the really duplicated regions and all really duplicated pixels in all suspicious images. The FPR shows the ratio of some identified pixels that actually do not belong to the really duplicated regions and all identified pixels in all suspicious images. The four criteria indicate how precisely the proposed schemes can locate copy-move regions. Then, we can analyze the performance of the proposed scheme at the image level and the pixel level with the four criteria.


## 3.2. Effectiveness and Accuracy

In this experiment, 400 color images are selected to test the effectiveness and accuracy of the proposed scheme, including 100 original images, 100 forgery images, and other 200 images that are tampered with Photoshop 8.0. All tampered images do not suffer any postprocessing operation. Owing to space constrains, just a part of experimental results is shown in Figure4. The DAR and FPR are calculated to illustrate the performance of the proposed scheme. In Figure 4, the DAR is generally greater than 0.85 and the FPR is also smaller. It indicates that the duplicated regions can be detected using the proposed scheme even though the duplicated regions are nonregular. Table 1 shows the comparison result of the proposed scheme and other existing schemes that are presented in [6, 7, 9]. It indicates that the p and r in the proposed scheme are better.Table 1
Comparison of precision ratiop and recall ratio r.
Methods [6] [7] [9] [ P ] Precision ratio (p) 0.865 0.896 0.822 0.902 Recall ratio (r) 0.900 0.850 0.864 0.910Figure 4
A part of experimental results for the proposed scheme. From top to bottom, the first row (a1)–(d1) shows the original images, the second row (a2)–(d2) shows the tampered images, and the last row (a3)–(d3) shows the detection results.


## 3.3. Robustness Test

In addition to the plain copy-move forgery, the detection for tampered images that are attacked by some postprocessing operations is also considered in the proposed scheme. Therefore, a series of experiments have been done to overall analyze the performance of the proposed scheme. It involves 1000 different suspicious images that come from the three databases. In this experiment, five kinds of attacks are considered, that is, adding white Gaussian noises (AWGN), adjusting contrast ratio (ACR), luminance (AL), hue (AH), and Gaussian blurring (GB), and their hybrid operations. Table2 presents the parameters for the five kinds of attacks and Figure 5 shows a part of experimental results for the proposed scheme.Table 2
Parameters for the five kinds of attacks.
Attacks Parameters AWGN SNR (10, 20, 30, 40, 50) GB ω (0.5, 1, 1.5, 2, 2.5) ACR gain(G) (0.3, 0.6, 0.9, 1.2, 1,5) AL bias(b) (3, 6, 9, 12, 15) AH H (5, 10, 15, 20, 25)Figure 5
A part of the experimental results for the proposed scheme. From top to bottom, the first row (a1)–(e1) shows the five original images; the second row (a2)–(e2) shows the tampered images that are attacked with adding white Gaussian noises and Gaussian blurring, adjusting contrast ratio, luminance, and hue; the last row (a3)–(e3) shows the detection results of the proposed method.In this experiment, the proposed scheme is evaluated by DAR and FPR at the pixel level. The results indicate that the proposed scheme can locate multiple duplication regions although the suspicious images are attacked with different postprocessing operations.In order to quantitatively evaluate the robustness of the proposed algorithm and analyze its ability to resist different image distortions, 100 tampered images are selected from the three databases. These tampered images are distorted by five kinds of attacks that are shown in Table2. Then, there are 500 tampered images that will be detected in this experiment. For each kind of attacks, 100 tampered images are selected to be detected. Tables 3–7 show the detection results with the overall averages of p, r, DAR, and FPR. The robustness of the proposed scheme is evaluated at image level and pixel level.Table 3
Detection results for adding white Gaussian noise.
SNR = 25 SNR = 35 SNR = 45 P 0.980 0.970 0.970 r 0.980 0.970 0.990 DAR 0.910 0.846 0.823 FPR 0.123 0.137 0.125Table 4
Detection results for Gaussian blurring.
ω = 1 ω = 3 ω = 5 P 0.990 0.980 0.990 r 0.960 0.950 0.990 DAR 0.847 0.894 0.906 FPR 0.112 0.132 0.116Table 5
Detection results for adjusting contrast ratio.
G = 0.9 G = 1.1 G = 1.4 P 0.970 0.980 0.990 r 0.940 0.990 0.960 DAR 0.749 0.802 0.896 FPR 0.163 0.174 0.184Table 6
Detection results for adjusting luminance.
b = - 3 b = 3 b = 10 P 0.960 0.980 0.990 r 0.980 0.960 0.990 DAR 0.902 0.876 0.868 FPR 0.168 0.182 0.191Table 7
Detection results for adjusting hue.
H = 10 H = 20 H = 30 P 0.980 0.990 0.990 r 0.990 0.990 0.970 DAR 0.759 0.782 0.826 FPR 0.145 0.139 0.136Tables3 and 4 show that the detection results of the proposed scheme are satisfactory for suspicious images that are attacked by adding white Gaussian noises and Gaussian blurring although the suspicious images have poor quality (SNR = 45 or ω=5). Only 14 images in all 600 tampered images are failed to be detected (r=0.9767). The detection results of tampered images that are distorted by adjusting contrast ratio, luminance, and hue with different parameters are shown in Tables 5, 6, and 7, respectively. We can draw a conclusion from the three tables that the proposed scheme performs well also for attacks of adjusting contrast ratio, luminance, and hue.


## 3.4. Performances Comparison

In the last experiment, the performance of the proposed scheme is compared with other schemes presented in [6, 7, 9]. In this experiment, 400 tampered images are randomly selected from the three databases. They are tested by the proposed scheme and other schemes provided in [6, 7, 9], respectively. Figure 6 shows the performance comparison of these schemes with the overall averages of DAR and FPR for the 400 tampered images. We can see that the scheme proposed in [9] has the best detection results for the two kinds of attacks by adding white Gaussian noises and Gaussian blurring. However, its performance clearly drops down if the intensity of these attacks is gradually increased. Conversely, the proposed scheme is more robust for resisting various attacks. In most cases, the proposed scheme can also achieve better results for other three kinds of attacks with adjusting contrast ratio, luminance, and hue. Moreover, the proposed scheme has the lowest FPR results, which means that the proposed scheme can detect most duplicated regions in the selected suspicious images. The precision of the proposed scheme is higher than that obtained in [6, 7, 9].Figure 6
Comparison of different copy-move forgery schemes with 5 kinds of attacks. The two columns represent the result of DAR and FPR, respectively. (a), (b) Adding white Gaussian noise. (c), (d) Gaussian blurring. (e), (f) Adjusting contrast ratio. (g), (h) Adjusting luminance. (i), (j) Adjusting hue.
(a) (b) (c) (d) (e) (f) (g) (h)  (i) (j)The experimental results show that the proposed method can locate the tampered regions in a tampered image although it is distorted by some hybrid trace hiding operations, such as adding white Gaussian noise, Gaussian blurring, adjusting contrast ratio, luminance, and hue, and their hybrid operations. The proposed forensic technique can be used in politics, military, jurisprudence, and academic research. For example, a journalist takes a photo for a traffic accident. However, the journalist finds that the influence will be better if some crowds appear in this photo. Therefore, he can use image processing tools to copy some people from the other side of this photo and paste them into the scene and use white Gaussian noise to conceal all tampering traces. Therefore, the authenticity of this traffic accident is broken. The news organization can detect this photo by using the proposed scheme to ensure its authenticity before this news is reported.


## 4. Conclusion

In this study, a passive authentication scheme is proposed based on perceptual hashing and package clustering algorithms to detect and locate the duplicated regions for copy-move forgery. The experiment results show that the proposed scheme based on perceptual hashing algorithms is robust for some special attacks, such as adjusting contrast ratio, luminance, and hue. A technology application of using perceptual hash strings to construct a feature vector to represent an image block can resist some conventional attacks, such as adding white Gaussian noises and Gaussian blurring. The proposed package clustering algorithm that is used to replace traditional lexicographic order algorithms can improve the performance of the proposed scheme. The evaluation criteriap, r, DAR, and FPR from the experiments show that the proposed scheme is better but the proposed scheme also has some weaknesses. For example, the time complexity is still unsatisfactory because of the previous image block dividing. Furthermore, the proposed scheme cannot resist some complex attacks, such as block rotation and scaling. In future work, we will focus on the studies of improving the time complexity and extending the robustness for more kinds of complex attacks, such as the rotation and scaling.



---

*Source: 6853696-2018-01-22.xml*