VIDEO FORGERY DETECTION USING HOGFEATURES AND COMPRESSION PROPERTIES

A.V. Subramanyam, Sabu Emmanuel

School of Computer Engineering, Nanyang Technological UniversitySingapore

subr0021@e.ntu.edu.sgasemmanuel@e.ntu.edu.sg

Abstract—In this paper, we propose a novel video forgerydetection technique to detect the spatial and temporal copypaste tampering. It is a challenge to detect the spatial andtemporal copy-paste tampering in videos as the forged patchmay drastically vary in terms of size, compression rate andcompression type (I, B or P) or other changes such as scalingand filtering. In our proposed algorithm, the copy-paste forgerydetection is based on Histogram of Oriented Gradients (HOG)feature matching and video compression properties. The benefitof using HOG features is that they are robust against varioussignal processing manipulations. The experimental results showthat the forgery detection performance is very effective. Wealso compare our results against a popular copy-paste forgerydetection algorithm. In addition, we analyze the experimentalresults for different forged patch sizes under varying degree ofmodifications such as compression, scaling and filtering.

Index Terms—Video forgery detection, Copy-paste tampering,HOG features

I. INTRODUCTION

The intelligent use of digital video editing techniques isconstantly increasing the difficulty in distinguishing the au-thentic video from the tampered one. For example, in [1] theauthors refer to the forgery created in a popular film Speedby duplicating the frames thereby hiding any activity actuallygoing on. The copy-paste tampering can be performed in aconvincing manner without much of difficulty. And copy-pastetampering can be practically difficult to detect. Therefore, it islikely that copy-paste tampering can be often applied to forgea video. However, in order to detect such forgeries, intrinsicproperties of captured media can be used [2]. In this paper,we use the intrinsic properties of the captured media to detectthe copy-paste tampering in a video.

The copy-paste video forgeries can be classified into twodifferent categories - spatial tampering and temporal tamper-ing. In spatial tampering, a region may be copied from alocation in a frame and pasted to a different location on thesame frame or other frames possibly after some modification.For example, the trash bin in Figure 1-a has been enlarged andpasted in Figure 1-d. While in temporal tampering, a completeframe may be duplicated. In addition, a region may also beduplicated across the frames at the same spatial location. Sincean action or object may be occurring in multiple frames, inorder to create a convincing forgery the temporal tampering

Fig. 1: (a - c) Sequence from original video (d - f) Sequencefrom forged video

may stretch over multiple frames. For example, the enlargedtrash bin has been pasted across multiple frames as shown infigures 1-d to 1-f. In our case, to reliably detect a temporaltampering, we assume that a frame or a region is duplicatedat least throughout a GOP (Group of Pictures). The forgedregions may come from different videos as well. In both thespatial or temporal tampering, the motive may be to hideunfavorable actions or objects in a scene by pasting otherobjects or background, or to implant false evidences. FromFigure 1-f it is not clear if the person is keeping the bag orstealing it away, although in Figure 1-c the person is keepingthe bag.

Several forgery detection techniques related to image havebeen proposed till date, however, there are only few videoforgery detection works. Among the image copy-paste forgerydetection techniques, some of the promising algorithms are[3], [4], [5]. The techniques proposed in [3], [4], are based onScale Invariant Feature Transform (SIFT) features matching.In [5] the authors use Fourier-Mellin Transform (FMT) toachieve robustness against geometric transformations. Someother forgery detection techniques can be found in [6]. Al-though the techniques [3] - [5] can be used for spatial copy-paste forgery detection, they cannot be easily extended fordetecting temporal copy-paste forgery. This is because, thealgorithms [3] - [5] assume that the tampered region is at adifferent spatial location than the source region from whichit is copied. However, in temporal tampering the copy-pasteregions are spatially colocated.

In this paper, we focus on copy-paste forgery detection invideos. The video copy-paste forgery has been addressed in

��������������������� ��������������� ���������

[1], [2]. In [1], the authors use temporal and spatial correlationin order to detect duplications. A temporal correlation matrixis computed between all frames in a given sub-sequence offrames and, spatial correlation matrix is computed for eachframe in a given sub-sequence. The temporal and spatialcorrelation matrices are then used to detect the duplicatedframes or regions. Although the detection performance is goodwhile detecting a frame duplication, the region duplicationdetection efficiency is very low for small forged regions suchas 64x64. In addition, this technique assumes that the forgedregions belong to the same video sequence which may be alimitation when considering forged patches from other videos.However, the authors of [1] proposed another forgery detectionscheme [7] which can detect forged regions belonging todifferent videos. However, this algorithm detects forgery onlyin interlaced or deinterlaced videos. In [2], the authors proposethe detection of forged regions based on the inconsistencies ofnoise characteristics, which occurs due to the forged patchesfrom different videos. However, as the noise characteristicsdepend on the intrinsic properties of the camera, the noisecharacteristics are not useful when the forged patch comesfrom the same video. In addition, the noise characteristics maynot be estimated correctly under low compression rates. Antiforensic techniques have also been reported in [8] against someof the existing forensic techniques.

In [9], the authors propose a forgery detection algorithm forthe video in-painting tampering. The idea is to use the noisecorrelation properties between spatially colocated blocks to de-tect the forgery. Some other forgery detection techniques havealso been proposed such as [10], [11]. In these techniques,the basic idea is that a forged video will be recompressed andthe artifacts owing to double quantization of coefficients canbe used to detect forgery. However, the techniques [9] - [11]suffer from the limitation that they are robust for a limitedrange of compression rates only.

One of the challenges in detecting video copy-paste forgeryis to find the robust representations for the video frame blocks,so that the duplicated blocks can be identified even aftermodifications. In image forgery detection [3] - [5] featuressuch as SIFT, transforms such as FMT have been used.While in video forgery detection normalized correlation [1],noise characteristics [2], [9], or quantization parameters [10],[11] have been used. Although features such as SIFT givegood forgery detection performance [3], [4] owing to thererobustness, other features such as SURF [12] or HoG [13]can also be used for detection purpose.

Second challenge is that, when a region is copy-pastedacross the frames in a spatially colocated area, it may be verydifficult to distinguish the forged regions and the authenticregions. This is because, in a video captured from a staticcamera, a sequence of frames may be highly correlated. Andboth the forged and authentic spatially colocated regions showa high correlation. For example, in a CCTV footage, anevidence might be implanted which need not be moving butjust stay there such as a weapon in case of a crime. In thiscase the forged as well as non-forged parts will show a highcorrelation making it difficult to detect the tampering. Anotherchallenge is the ability of detecting forgeries of small patchsize such as a macroblock or of the order of few macroblocks.

Although, features such as SIFT are highly robust, they maygive less accurate forgery detection for small patch size suchas macroblock when such a forged patch may have undergonetransformations such as scaling [4]. This is because, SIFTalgorithm may generate less robust keypoints in such a smallarea and the detection may not be effective. Therefore, featuressuch as HoG which are dense image or blockwise descriptorsare useful in detecting such form of tampering.

In this paper, we propose to use HOG features [13] extractedfrom the blocks of the frames for detection purpose. The HOGfeatures are robust to scaling, compression, translation andother signal processing operations such as filtering etc. Due tothe robustness and distinctiveness, the HOG features are aptfor identifying the possibly modified duplicated regions withhigh accuracy. Further, the false positive (detecting authenticas forged) rates may be significantly lower for the dense gridapproach such as HOG than keypoint based approaches suchas SIFT [13]. Figures 2-a and 2-b shows the pipeline of theproposed algorithm. The HOG features extracted from blocksare matched against the HOG features extracted from therest of the blocks in both the spatial and temporal domainsfor detecting spatial and temporal forgery respectively. Incase of spatial forgery detection, the parameter cell size forHOG feature generation is set adaptively (Section III-A). Theidentification of the best match for each block is based on anearest neighbor criteria for spatial forgery detection (SectionIII-A) or threshold criteria for temporal forgery detection(Section III-B). If the best match satisfies the nearest neighboror threshold criteria, it is counted for forgery detection onlywhen the nearest surrounding neighbors also fulfill the nearestneighbor or threshold criteria for spatial or temporal forgerydetection respectively.

The rest of the paper is organized as follows. In SectionII, we give a brief summary of the HOG features. In SectionIII, we explain the proposed detection scheme. We discuss theeffect of different parameter settings on detection performanceas well as the time complexity of the algorithm in Section IV.The experimental results are given in Section V and SectionVI concludes the paper.

II. HISTOGRAM OF ORIENTED GRADIENTS

In this section, we briefly describe the extraction of HOGfeatures from a given image or frame. In [13], Dalal et. al.represented the image or frame by a set of local histograms.These histograms count the number of occurrences of gradientorientation in a local spatial region of the image known ascell. Typically, a cellsize may vary as 4x4, 6x6 or 8x8 pixels.In order to extract the HOG features, first the gradients ofthe image are computed followed by building a histogram oforientation at each cell. Finally the histogram obtained fromeach cell in a block is normalized which gives the HOGdescriptor of that block, where a block may comprise of 2x2or 3x3 cells. In the following we explain the sequence of stepsin HOG feature extraction.

First the RGB frame is converted to gray-scale followedby gradient computation by convolving the image with thehorizontal and vertical masks [-1 0 1] and [-1 0 1]T respec-tively. The horizontal and vertical gradients of an image Ican be represented as Gx(x, y) = [−1 0 1] ∗ I(x, y) andGy(x, y) = [−1 0 1]T ∗I(x, y) respectively, where ′∗′ denotes

��

convolution. Then the orientation Θ at each pixel is computedusing the ratio of gradients in vertical and horizontal directionsΘ(x, y) = arctan(Gy(x, y)/Gx(x, y)). In the next step, theframe is divided into overlapping blocks of size NxN . Further,each block is divided into MxM cells, where M ≤ N . Foreach cell, each pixel calculates a weighted vote which isusually the gradient magnitude at that pixel and the votesare accumulated into orientation bins. In practice, the numberof orientation bins L are evenly spaced over 0◦ - 180◦ forunsigned gradients or 0◦ - 360◦ for signed gradients and thevalue of lth bin is updated as,

Ωl(x, y) =

{G(x, y) if Θ(x, y) ∈ binl,

0 otherwise(1)

where, G(x, y) =√Gx(x, y)2 +Gy(x, y)2 is the gradient

magnitude at pixel (x, y). HOG features are extracted fromeach cell and the number of features generated from each cellis equal to the number of orientation bins. The features fromall the cells in a block are normalized as,

fCell =

∑(x,y)∈Cell Ωl(x, y) + ε∑(x,y)∈Block G(x, y) + ε

(2)

where ε is an infinitesimally small quantity. The normalizedfeatures from all the cells in a block form a vector d ofdimension equal to the product of number of orientation binsand the number of cells in the block, which is the finalHOG descriptor for that block. Next, we discuss the proposedscheme.

III. PROPOSED SCHEME

In this section we describe the proposed copy-paste forgerydetection scheme in detail. We first discuss the spatial forgerydetection. First of all, we apply an image thresholding mecha-nism which is used to set the cell size as shown in Figure2-a. Then the HOG features are generated for each blockand subsequently search for matches for individual blockdescriptors. Then we present the temporal forgery detection.Here, the frames in a GOP are selected based on compressionproperties. Then the HOG features are generated blockwise.Finally, the block descriptors are compared with the spatiallycolocated block descriptors to find if a match exists as shownin Figure 2-b.

A. Spatial Forgery detectionFigure 2-a gives the block diagram for spatial forgery. In

the first step, we find a suitable cell size for HOG featuregeneration for each individual video frame. This is necessarybecause some videos or frames may have poor localized edgesnaturally or due to application of some signal processingtechniques. As a result local intensity gradients or edgedirections may not be captured well with the same parametersettings - number of orientation bins, cellsize, blocksize andblock overlap percentage for HOG feature extraction. And thefeatures may either be not very distinctive or may not be robustagainst different signal processing operations such as scaling.Therefore, we need an adaptive mechanism which can tune theparameters such as cell size for HOG feature generation basedon the frame’s statistical properties. We use the mean thresholdsurface value of the image, which is computed using [14] to

Fig. 2: (a) Spatial forgery detection (b) Temporal forgerydetection

decide the cellsize for HOG feature extraction. In practice,if the mean threshold surface value is lesser than Tmean,a large cellsize may not generate robust HOG features. Onthe other hand, if the mean threshold surface value is greaterthan Tmean, a small cellsize may give rise to false positives(detecting authentic as forged). Here, the value of Tmean isobtained experimentally and we set cell size MxM as givenin equation (3).

M =

{8 if, Mean threshold surface > Tmean,

6 if, Mean threshold surface < Tmean,(3)

Once the cellsize is set according to equation (3), the HOGdescriptors are generated as given in Section II. In the nextstep, the generated descriptors from the blocks are tentativelymatched against the rest of the blocks’ HOG features of theframe. Let i denote the spatial index of the block and N denotethe total number blocks in a given frame. In order to selectthe best match for a block bi ∀ i = 1, 2, .., N , we first find theangles between the HOG descriptor di of the block bi and thedescriptors dj of the blocks bj ∀ j as given in equation (4).Here, j ∈ C where C is a set whose elements lie outside 5x5window centered at block bi. Here j|j �∈ C′ because the blockslocated nearby bi may be highly correlated with bi which maygive rise to false positives.

θi = arccos(∑k

di(k)dj(k)) ∀j ∈ C (4)

where di(k) indicates the kth element of the row vector di.Then, θi which is a 1-D vector is sorted in ascending order.We select the match θi(1) for bi only if it follows a nearestneighbor criteria given in equation (5).

θi(1) < τspatialθi(2) (5)

where τspatial ∈ [0, 1] and is obtained experimentally. How-ever, if we count the best match for the block bi based solelyon the best match of bi, the false positives may be high. In

��

order to reduce the false positives, we count the best matchfor bi only when bi follows equation (5) and the m nearestsurrounding neighbors in the positive and negative X-axisand Y-axis directions satisfy the respective nearest neighborcriteria. Similarly, we find the matches for all the blocks andwe can also search for the matches between a pair of frames.

In order to detect if a frame contains a forged region, wefirst define a matrix DS of the same dimensions of the frameand initialize it with zeros. At each index i where we get amatch we update the matrix as,

DS(xi, yi) = (DS(xi, yi) + 1)⋃

(DS(xj , yj) + 1) (6)

where (xi, yi) and (xj , yj) are the starting co-ordinates ofblocks bi and bj respectively. We slide a window of size Wx xWy by a pixel rowwise and then columnwise along the matrixDS , and count the number of matches in each such window.If the number of matches in any such window is higher thana preset threshold Tspatial, then we declare the region to beforged.

B. Temporal Forgery detectionFigure 2-b gives the block diagram for temporal forgery

detection. Here, we detect the forgery in a GOP, the sizeof which is set to 12 frames. Since the forgery occurs in aspatially colocated area, we cannot apply the technique givenin Section III-A. In order to detect the forgery, we make useof the compression properties of the video coding. In videocoding such as MPEG-2 [15], a video is divided into GOPs andeach GOP is coded independently. A typical GOP comprisesof 1 I frame, 3 P frames and 8 B frames. A typical GOPstructure is I1 B2 B3 P4 B5 B6 P7 B8 B9 P10 B11 B12

where the subscripts indicate the order of frames. Here, the Iframe is encoded independently. P frames are encoded usingthe previous I or P frame as reference. B frames are encodedusing previous and next I or P frames as references. Whena region is copy-pasted across the frames in a GOP in aspatially colocated area, then the macroblocks belonging tothis region show a high correlation as compared to the rest ofthe macroblocks. This is due to the fact that when a region iscopy-pasted across the frames it contains the same amount ofnoise induced by the camera at the time of capture whereasthe noise in the rest of the blocks may remain uncorrelated.Further, in case of B frames, when macroblocks are nearlyidentical to the macroblocks of reference frames, the decodedmacroblocks of the reference frames are directly used for Bframes i.e. encoding and decoding for B frame macroblocksis skipped. Therefore, the correlation between the duplicatedblocks is particularly high in the frame pairs I1B2, P4B5,P7B8 and P10B11. Thus, these set of frames can be used todetect if a given region is forged or not.

Now that the frames in a GOP are selected, the HOGfeatures are generated. In the following step, we compute thenormalized correlation C(., .) between the descriptors di ∀ iof frame I1 to the spatially co-located descriptors dj ∀ j ofthe consecutive frame B2.

C(di, dj) =∑

k(di(k)− μdi)(dj(k)− μdj )√∑k(di(k)− μdi)

2√∑

k(dj(k)− μdj )2

∀ i = j

We select the match for a block bi ∀ i only if C(di, dj) >τtemporal, where τtemporal and is obtained experimentally.Here again, as mentioned in Section III-A, we count thebest match for bi only when bi follows a threshold criteriaC(di, dj) > τtemporal and the m nearest surrounding neigh-bors in the positive and negative X-axis and Y-axis directionssatisfy the respective threshold criteria.

In order to detect if a frame contains a forged region, wedefine a matrix DT as in Section III-A of the same dimensionsof the frame and initialize it with zeros. At each index i wherewe get a match as discussed above, we update the matrix as

DT (xi, yi) = DT (xi, yi) + 1 (7)

where (xi, yi) are the starting co-ordinates of block bi.Similarly, the matrix DT is updated according to equation (7)for all the other three frame pairs P4B5, P7B8 and P10B11

with respect to the same spatial axes. After the matrix updatestep is complete, we perform

DT (xi, yi) =

{1 if DT (xi, yi) = 4 ∀ i,

0 otherwise(8)

In equation (8), if a match is counted for a block with indexi for all the four set of frames, then only we count that blockfor forgery detection. To detect the forgery, we slide a windowof size W ′

x x W ′y by a pixel rowwise and then columnwise

along the matrix DT , and count the number of matches ineach such window. The number of matches is compared to apreset threshold Ttemporal. If in any such window the numberof matches is higher than Ttemporal, then we declare the regionto be forged.

IV. DISCUSSION

In this Section we discuss the effect of cell size, thedimensionality of descriptors, the number of neighbors usedfor detection on the forgery detection performance as well asthe time complexity of the algorithm.

A. Spatial Forgery Detection ParametersThe cell size plays a significant role on forgery detection

performance. Experimentally we find that keeping the cell sizeto 6x6 for all the videos increases the false positives for thespatial forgery case by ≈ 22.75% compared to the case whencell size is adaptively set. While, setting cell size to 8x8 forall videos decreases the true negative rate (detecting forged asforged ) by ≈ 9% in case of detecting a forged region of size40x40 scaled by a factor of 1.2 compared to the case whencell size is adaptively set. Therefore, we set cell size based onTmean as discussed in Section III-A.

The number of neighbors chosen for counting the best matchof a block bi also affects the performance to a great extent. Inour experiments we find that, using only two neighbors, thefalse positive rate increases by ≈ 45% compared to the casewhen decision is based on four neighbors.

Now we compute the time complexity of the algorithm.Here, each block’s HOG features are compared against therest of the N - 1 block’s HOG features. Although we do notconsider the surrounding blocks for matching in the proposedscheme, here for simplicity we assume that the matching isdone for N - 1 blocks. For each such matching, m nearest

��

TABLE I: Spatial forgery detection performance

Scale Detection accuracyScalex Scaley 40x40 60x60 80x80

1.1 1.1 93.3 96 961.2 1.2 89.6 96 961.1 1.4 88.6 94.3 961.5 1.25 87.1 91.7 961.3 1.3 80.35 91.7 91.7

TABLE II: Spatial forgery detection performance against com-pression

Bit rate (Mbps) Detection accuracy40x40 60x60 80x80

1 89.7 96 963 89.7 96 966 89.9 96 969 89.9 96 96

neighbors of the source are also matched against the m nearestneighbors of the target. Therefore there are m × (N − 1) byN (or ≈ O(m × N2)) comparisons which can be consideredto be small for the order of few hundreds of N .

B. Temporal Forgery Detection ParametersIn case of temporal forgery detection, as the forged regions

are consistent in shape and size across the frames as theyare temporally colocated, cell size need not be adaptivelyset. However, we find that the dimensionality of descriptorsrequired to distinguish between authentic and forged regionsis high as compared to spatial forgery detection. This is due tothe fact that temporally colocated regions may exhibit a highcorrelation. Therefore, a low dimensional descriptor may notbe able to differentiate between authentic and forged regions.

In terms of neighbors chosen for counting the best match,the false positive rate increases by ≈ 8% when only twoneighbors are used relative to the case when decision is basedon four neighbors.

Here, each block is compared against the spatially co-located block only. So there are N number of comparison forN number of blocks. Further, m nearest neighbors are alsomatched giving ≈ O(m×N) comparisons.

V. EXPERIMENTAL RESULTS

In our experiments, we collected 6000 frames from 15different videos for spatial forgery and 150 GOPs of size 12frames each for temporal forgery. Original video is compressedat 9mbps using MPEG-2 video codec. The frame resolutionis 176x144. Tampering is carried by copying and pastingregions of size 40x40, 60x60 and 80x80 in the same ordifferent frames and videos for spatial forgery and across theframes in spatially colocated regions for temporal forgery. Thecopied regions are chosen randomly over the frame. The falsepositives for spatial forgery detection and temporal forgerydetection are determined using 6000 authentic frames and 150authentic GOPs respectively. For determining true negatives,4320 forged frames for each forged size are generated using360 authentic frames for varying scale factor, compressionrate and filtering. While for temporal forgery detection, anoverall 2700 forged GOPs are generated from 150 authenticGOPs under varying compression rate, filtering and forged

TABLE III: Spatial forgery detection performance againstdifferent signal processing operations

Tampering Detection accuracy40x40 60x60 80x80

Mean filter (3x3) 92.1 96 96Median filter (3x3) 90.9 96 96

Gaussian (3x3, σ = 1) 91.7 96 96

TABLE IV: Comparison with Wang et. al.’s [1] scheme for aspatial forged region size 128x128

Bit rate (Mbps) Detection accuracy False PositivesProposed [1] Proposed [1]

3 99.8 70.4 0.002 0.0066 99.8 80.0 0.002 0.0049 99.8 82.2 0.002 0.002

region size. The parameters for HOG feature generation are- 9 orientation bins evenly spaced over 0◦ - 360◦ for spatialforgery detection, 60 orientation bins evenly spaced over 0◦- 180◦ for temporal forgery detection, cellsize M = 6 or 8as given in Section III-A for spatial forgery and M = 6 fortemporal forgery, number of cells in a block is 3x3, separationbetween two overlapping blocks is 4 pixels, Wx = 176, Wy

= 144, W ′x = W ′

y = 50, τspatial = 0.87, Tspatial = 10,τtemporal = 0.95, Ttemporal = 20, Tmean = 0.28, n = 4.

A. Spatial forgery detection performanceTable I gives the detection performance results when the du-

plicated region is scaled before pasting at a different location.The false positive rate is 0.08. From Table I, it is evident thatthe detection accuracy increases with the forged region size.This is because, with increased forged patch size, more numberof forged blocks are present which increases the number ofmatches. The detection accuracy (DA) is measured as

DA = (TP + TN)/(TP + TN + FP + FN) (9)

where, TP refers to detecting authentic as authentic, TNrefers to detecting forged as forged, FP refers to detectingauthentic as forged and FN refers to detecting forged asauthentic. For a 60x60 and 80x80 size forged patch, themaximum detection accuracy is 96% for Scalex = Scaley= 1.1 while minimum is 91.7% for Scalex = Scaley = 1.3.Also, we find that a forged region as small as 40x40 can bedetected with as high as 93.3% accuracy for Scalex = Scaley= 1.1 and as low as 80.35% accuracy for Scalex = Scaley =1.3. Table II, gives the detection performance under varyingcompression rate. Here, we find that the compression rate has avery mild effect on detection performance as the HOG featuresare robust against compression. The detection accuracy is ≈96% for both 60x60 and 80x80 forge regions while > 89% for40x40 forged region. Table III gives the detection accuraciesfor filtering operations such as mean, Gaussian and medianin presence of 10% scaling. We can see that the detectionaccuracy is only slightly affected for 40x40 forged region sizeas compared to the detection accuracy when only scaling ispresent.

We give a comparison of our results against the resultsreported in [1] for region duplication keeping the forgedregion size same in Table IV. We find that our algorithm

�

TABLE V: Comparison of spatial forgery detection perfor-mance under scaling modification

Scheme Detection accuracy (%)40x40 60x60 80x80

Proposed 87.79 93.7 93.85[4] 61.2 88.2 90.4

TABLE VI: Temporal forgery detection performance againstcompression

Bit rate (Mbps) Detection accuracy False Positives60x60 80x80

3 83.6 98.15 .0376 84.5 99.05 .0199 85.05 99.5 .009

performs better against the scheme given in [1] in terms ofboth detection accuracy and false positives. This increasedperformance is due to the reason that HOG features are robustagainst compression as well as generates distinct features fordissimilar objects.

Table V gives a comparison of the spatial forgery detectionof the proposed scheme and the results reported in [4]. In [4],the forgery detection is performed using SIFT features. FromTable V we find that small forged patch size such as 40x40 cannot be detected with high accuracy using the algorithm given in[4]. While for a higher forged patch size the detection accuracyis slightly better for the proposed scheme. And therefore,HOG features based detection gives better performance underscaling modification.

B. Temporal forgery detection performanceTable VI gives the detection performance of temporal

forgery under varying compression rate. The false positiverates respective to the three bit rates 3, 6 and 9 mbps are0.037, 0.019 and 0.009. Here, we find that false positivesdiffer for different bit rates as the dimensionality of HOGdescriptors is high and HOG descriptors are not as robust insuch a case as compared to low dimensional HOG descriptors.It is clear from Table VI that with the increasing forgedregion size the detection performance also increases. And thedetection performance is slightly affected by the compressionrate. The detection accuracy is ≈ 84.5% for 60x60 forgedregion while ≈ 99% for 80x80 forged region. Table VII showsthat the detection performance is good under different filteringoperations - mean, Gaussian and median.

We compare the results against [1] for frame duplicationkeeping the false positive rate similar in Table VIII. FromTable VIII we can say that our algorithm performs betteragainst the scheme given in [1]. In addition, the proposedalgorithm detects the frame duplication using only the framesin a GOP whereas the algorithm given in [1] needs 30 framesto detect frame duplication.

VI. CONCLUSIONS

In this paper we propose a novel video forgery detectiontechnique using HOG features and video compression proper-ties. The parameter cellsize of the Hog feature generation isset adaptively to reduce the false positive rate and increase thedetection accuracy for spatial forgery detection. In temporal

TABLE VII: Temporal forgery detection performance againstdifferent signal processing operations

Tampering Detection accuracy60x60 80x80

Mean filter (3x3) 85.01 99.5Median filter (3x3) 83.9 99.5

Gaussian (3x3, σ = 1) 84.6 99.5

TABLE VIII: Comparison with Wang et. al.’s [1] scheme forframe duplication

Bit rate (Mbps) Detection accuracy False PositiveProposed [1] Proposed [1]

3 99.5 87.9 .01 .066 100 84.8 0 09 100 84.4 0 0

forgery detection, the frames with high correlation for dupli-cated regions compared to authentic regions are selected fordetection purpose. Experimental results show that the proposedalgorithm gives good detection accuracy under unfavorableoperations such as compression, scaling and filtering for spatialforgery detection while compression and filtering for temporalforgery detection. Further, the proposed algorithm performsbetter than the popular video forgery detection techniquewhich deals with the copy-paste tampering.

REFERENCES

[1] W. Wang and H. Farid, “Exposing digital forgeries in video by detectingduplication,” in Proc 9th workshop on ACM Multimedia & Security,2007, pp. 35–42.

[2] M. Kobayashi, T. Okabe, and Y. Sato, “Detecting video forgeries basedon noise characteristics,” Lecture Notes in Computer Science, Advancesin Image and Video Technology, vol. 5414, pp. 306–317, 2009.

[3] I. Amerini, L. Ballan, R. Caldelli, A. Del Bimbo, and G. Serra, “Asift-based forensic method for copy-move attack detection and trans-formation recovery,” IEEE Transactions on Information Forensics andSecurity, vol. 6, no. 3, pp. 1099–1110, Sep. 2011.

[4] X. Pan and S. Lyu, “Region duplication detection using image featurematching,” IEEE Transactions on Information Forensics and Security,vol. 5, no. 4, pp. 857–867, Dec. 2010.

[5] W. Li and N. Yu, “Rotation robust detection of copy-move forgery,”in Proc. IEEE International Conference on Image Processing ICIP’10,2010, pp. 2113–2116.

[6] T. Van Lanh, K. Chong, S. Emmanuel, and M. Kankanhalli, “A surveyon digital camera image forensic methods,” in Proc. IEEE InternationalConference on Multimedia and Expo ICME’07, 2007, pp. 16–19.

[7] W. Wang and H. Farid, “Exposing digital forgeries in interlaced anddeinterlaced video,” IEEE Transactions on Information Forensics andSecurity, vol. 2, no. 3, pp. 438–449, Sep. 2007.

[8] M. Stamm and K. Liu, “Anti-forensics of digital image compression,”Information Forensics and Security, IEEE Transactions on, no. 99, pp.1–1, 2011.

[9] C. Hsu, T. Hung, C. Lin, and C. Hsu, “Video forgery detectionusing correlation of noise residue,” in Proc. 10th Workshop on IEEEMultimedia Signal Processing, 2008, pp. 170–174.

[10] W. Wang and H. Farid, “Exposing digital forgeries in video by detectingdouble quantization,” in Proc. 11th ACM workshop on Multimedia andSecurity, 2009, pp. 39–48.

[11] W. Chen and Y. Shi, “Detection of double mpeg compression basedon first digit statistics,” Lecture Notes in Computer Science, DigitalWatermarking, vol. 5450, pp. 16–30, 2009.

[12] H. Bay, T. Tuytelaars, and L. Van Gool, “Surf: Speeded up robustfeatures,” Computer Vision–ECCV 2006, pp. 404–417, 2006.

[13] N. Dalal and B. Triggs, “Histograms of oriented gradients for humandetection,” in Proc. CVPR’05, 2005.

[14] B. Saha and N. Ray, “Image thresholding by variational minimaxoptimization,” Pattern Recognition, vol. 42, no. 5, pp. 843–856, 2009.

[15] B. Haskell, A. Puri, and A. Netravali, Digital video: an introduction toMPEG-2. Kluwer Academic, 1997.

��