Digital Forensic Source Camera Identification with Efficient Feature Selection Using Filter, Wrapper and Hybrid Approaches

Abstract

Digital Forensics is the branch of science dealing with investigation of evidences recovered from digital devices, to safeguard against rapidly increasing cyber crimes in today’s digital world. The Source Camera Identification (SCI) problem is to map an image under question correctly to its source device. Following a Digital Forensic approach, the source of an image is detected by post–priori investigation of traces left behind in the image, by the camera. Such traces are generated due to the post–processing operations an image undergoes inside a digital camera, after being captured. In this paper, we model the SCI problem as a machine learning classification problem and focus on the most crucial component of a learning model, i.e. feature selection. We propose three different techniques for feature selection: Filter based approach, Wrapper based approach using Genetic Algorithm (GA), and also a hybrid approach with both Filter and Wrapper methods combined together. We investigate the source detection accuracy that each technique succeeds to achieve. Our experimental results suggest that the proposed methods produced a much compact feature set, hence considerably improve the source detection accuracy and minimize the training time of the learning model, as compared to the state–of–the–art.

A Appendix: Statistical Measures Used as Feature Filters

• The Chi Squared is a statistical method that measures independence of two variables. In feature selection, chi-square used to check whether the class variable is independent of a feature. Consider $O_ij$ is the observed frequency and $E_ij$ is the expected frequency, then chi-squared [19, 20] is defined as

  $$\begin{aligned} \chi ^2 = \sum \frac{(O_{ij} - E_{ij})^2}{E_{ij}} \end{aligned}$$

  (5)
  $$\begin{aligned} E_{ij} = \frac{(R_{T_i})(C_{T_j})}{N} \end{aligned}$$

  (6)

  where $R_{T_i}$ is number of samples in the ith value, $C_{T_j}$ is number of samples in the class j, N is total number of samples.

• The Mutual Information [15] method measures the dependency of a variable towards reducing the uncertainty about the target variable (class). It maximizes the mutual information between joint distribution and target class variables in the datasets with many features.

• The Fisher Score measures the variance between the expected value of the information and the observed value. The information is maximized when variance is minimized. Consider dataset with c classes, $n_j$ samples for class j, $\mu _j$ mean value of class j, $\mu$ mean value of whole class and $\sigma _j^2$ variance of class j. Then fisher score [21,22,23] $S_k$ for feature $F_k$ is defined as

  $$\begin{aligned} S_k = \frac{\sum _{j=1}^{c}n_j(\mu _j-\mu )^2}{\sum _{j=1}^{k}n_j\sigma _j^2} \end{aligned}$$

  (7)

• The Pearson Correlation Coefficient is a statistical model which finds the strength of the correlation between two variables. It is computed by covariance of two variables dividing by the product of their standard deviations. The Pearson correlation coefficient [14] is defined as

  $$\begin{aligned} R = \frac{cov(X,Y)}{ \sqrt{var(X) var(Y)}} \end{aligned}$$

  (8)

  where cov denotes the covariance and var the variance. Therefore,

  $$\begin{aligned} R = \frac{\sum _{k=1}^{m}(x_k-\bar{x})(y_k-\bar{y})}{\sqrt{\sum _{k=1}^{m}(x_k-\bar{x})^{2} \sum _{k=1}^{m}(y_k-\bar{y})^{2}}} \end{aligned}$$

  (9)

• The Kendall’s Tau rank correlation [16] is a statistical measure which measures the degree of similarity between the ranking of two variables. Consider n number of samples, $n_c$ number of concordant (ordered in the same way) and $n_d$ number of discordant (ordered differently). The kendall’s Tau is defined as

  $$\begin{aligned} \tau = \frac{n_c-n_d}{\frac{n(n-1)}{2}} \end{aligned}$$

  (10)

• The Spearman Correlation is a statistical measure expresses the degree of how two variables are monotonically related. Consider we have n samples and $x_i$ is sample values of X and $r(x_i)$ is the rank of $x_i$ and $y_i$ is values of Y (class) and $r(y_i)$ is the rank of $y_i$. The Spearman coefficient [17, 18] is calculated as

  $$\begin{aligned} s(X,Y) = 1-\frac{6\sum _{i=1}^{n}(r(x_i)-r(y_i))^2}{n(n^2-1)} \end{aligned}$$

  (11)

  The above filters are applied in this paper on a feature set of 598 features, as discussed in Sect. 3.2. The Tables 1 and 2 show the performance of the above filters with respect to accuracy and F–Score.