Forensic science currently faces a variety of challenges. Statistically suitable reference databases need to be developed and maintained. Subjective methods that can introduce bias need to be replaced by objective methods. Highly technical forensic methods need to be clearly and accurately communicated to juries. Juries should also be given information about the strength of the forensic evidence.
Many traditional blind steganalysis frameworks require training examples from all potential steganographic embedding algorithms, but creating a representative stego image database becomes increasingly more difficult as the number and availability of embedding algorithm grows. We introduce a straight-forward, non-data-intensive framework for blind steganalysis that only requires examples of cover images and a single embedding algorithm for training. Our framework addresses the case of algorithm mismatch, where a classifier is trained on one algorithm and tested on another. Our experiments use RAW image data from the BOSSbase Database and six iPhone devices from the StegoAppDB project. We use four spatial embedding algorithms: LSB matching, MiPOD, S-UNIWARD, and WOW. We train Ensemble Classifiers with Spatial Rich Model features on a single embedding algorithm and tested on each of the four algorithms. Classifiers trained on the MiPOD, S-UNIWARD and WOW embedding algorithms achieve decent detection rates when testing on all four spatial embedding algorithms. Most notably, an Ensemble Classifier with an adjusted decision threshold trained on LSB matching data achieves decent detection rates on the three more advanced, content-adaptive algorithms: MiPOD, S-UNIWARD and WOW.
Score-based likelihood ratios (SLR) have been employed in various areas of forensics when likelihood ratios (LR) are unavailable. SLRs, like LRs, quantify the strength of evidence in support of two mutually exclusive but non-exhaustive hypotheses. LRs and SLRs have both been used for camera device identification, but the full framework for source-anchored, trace-anchored, and general match SLRs has not been investigated. In this work, we present a framework for all three types of SLRs for camera device identification. We use photo-response non-uniformity (PRNU) estimates as camera fingerprints and correlation distance as a similarity score. We calculate source-anchored, trace-anchored, and general match SLRs for 48 camera devices from four publicly available image databases: ALASKA, BOSSbase, Dresden, and StegoAppDB. Our experiments establish that all three types of SLRs are capable of distinguishing between devices of the same model and between devices from different models. The false positive and false negative rates for all three types of SLRs are low, and can be lowered further still by adding an inconclusive class.