Course material 2010–11
Topics in Security: Forensic Signal Analysis
Principal lecturer: Dr Markus Kuhn
Contributing lecturer: Mr Andrew Lewis
Taken by: MPhil ACS
This reading class takes place in room SW01 at 14:00–16:00 on the eight Fridays 2009 October 8 to November 26.
Aims
This course looks at recent research literature on security applications of digital signal processing techniques.
Syllabus
A particular focus will be algorithms for the forensic analysis of digital signals, such as identifying origin, processing history, manipulation, information leakage, or steganographic content in radio signals, images, audio or video recordings. Related topics that may be touched upon include advanced eavesdropping and side-channel analysis techniques that are of concern in the design of secure and privacy-preserving digital devices. Example topics are
- Digital photography: processing pipeline and sensor characteristics, sensor identification.
- Image and video processing: resampling algorithms (rotation, scaling) and their identification via linear dependency patterns among adjacent pixels, compression history identification, super-resolution.
as well as excursions into related areas such as
- Steganography, watermarking, and fingerprinting: algorithms for hiding, recovering, detecting and distorting embedded signals, invariant properties
- Side-channel attacks: timing analysis on cipher implementations, power analysis, electromagnetic analysis, compromising emanations
Objectives
On completion of this module students should:
- have gained an overview of the existing literature in forensic signal analysis and some other security applications of signal processing algorithms,
- appreciate the theoretical fundations, prerequisites and skills needed for doing research in this area,
- have gained experience in critically reviewing papers.
Course work
Each week we discuss a main topic covered by typically 2–4 related papers or book chapters. For each week (except the first meeting)
- one student will prepare a 30 minute talk (with slides) covering the main topic;
- one student will prepare a practical 30 min demonstration of one or more of the algorithms discussed in the covered papers, presenting both the output and the source code (e.g. MATLAB, NumPy);
- all other students will hand in an essay of not more than 2000 words, critically summarizing the core ideas of the papers. (Three essays are required in total.)
The roles of giving a talk and presenting a demonstration will rotate each week and the number of talks and demonstrations to be given by each student will depend on the number of students who take the course.
Essays are due on 12:00 on the Wednesday before the session. (An exception will be made for the second meeting, where essays will be due on 10:00 of the day of the session.) Students who give talks or demonstrations have to hand in copies of their slides or source code and example output by 12:00 of the Monday following their presentation.
Essays should be handed in with the pink cover sheet to Student Administration. Talk slides should be emailed as PDF to [Javascript required], demonstrations as a *.zip or *.tar.gz file.
Where appropriate, students are expected to follow-up on their own necessary references and textbook introductions when preparing their talks.
In addition, there will be a list of secondary topics and papers that each student should also read and that will be discussed or demonstrated briefly by the lecturer(s) at the end of each session, subject to available time.
All students are expected to contribute actively to discussions during the sessions and are expected to be present at each session.
Assessment
The final course grade will be composed of
- 90% average mark of the three best essays handed in (3×18%), the talk given (18%) and the demonstration given (18%)
- 10% contribution to discussions
Schedule
This is a draft and may still change.
- October 8
Introduction and assignment of slots for talks and demos. (Markus Kuhn)
MATLAB and JPEG tutorial (Markus Kuhn, Andrew Lewis)
- using selected slides from the DSP course, more slides, example files
- October 15
Main topic: Colour-filter-array interpolation detectors (Andrew Lewis)
- Popescu, Farid: Exposing digital forgeries in color filter array interpolated images, IEEE Trans. on Signal Processing 53(10), 2005.
- Gallagher, Chen: Image authentication by detecting traces of demosaicing, Proc. CVPR WVU Workshop, 2008.
Additional topic for discussion: Image consistency analysis
- October 22
Main topic: Image-sensor identification (talk: Eireann Leverett, demo: Yang Liu)
- Lukáš, Fridrich, Goljan: Digital camera identification from sensor pattern noise, IEEE Trans. on Information Forensics and Security 1(2), 2006.
- Chen, Fridrich, Goljan: Digital imaging sensor identification
(further study), SPIE 6505, 2007.
or alternatively
Fridrich: Digital image forensics (IEEE Signal Processing Magazine 26(2), 2009) (manuscript) - Goljan, Fridrich, Filler: Large scale test of sensor fingerprint camera identification, SPIE 7254, 2009.
Additional topic for discussion:
- October 29
Main topic: Resampling detection in images (talk: Stefan Istrate, demo: Georgiana Gane)
- Popescu, Farid: Statistical tools for digital forensics, Information Hiding Workshop 2004. (section 2)
- Kirchner: Fast and reliable resampling detection by spectral analysis of fixed linear predictor residue
Additional topic for discussion:
- November 5
Main topic: Recompression history identification (talk: Yang Liu, demo: Stefan Istrate)
- Neelamani et al.: JPEG compression history estimation for color images, IEEE Trans. on Image Processing 15(6), 2006.
- Popescu, Farid: Statistical tools for digital forensics, Information Hiding Workshop 2004. (section 3)
- Hany Farid: Exposing digital forgeries from JPEG ghosts, IEEE Trans. on Information Forensics and Security 4(1), 2009.
Additional topic for discussion: Electric-network-frequency traces
- Huijbregtse, Geradts: Using the ENF criterion for determining the time of recording of short digital audio recordings (see also media coverage)
- November 12
Main topic: Steganography and Watermarking (talk: Sandro Bauer, demo: Eireann Leverett)
- Cox, Miller, Brown, Fridrich, Kalker: Digital Watermarking and Steganography. 2007. (Chapter 3, CL library: K.6 74)
- Westfeld, Pfitzmann: Attacks on Steganographic Systems . IHW 2000, LNCS 1768.
Additional literature:
- Fridrich: Steganography in digital media. Cambridge University Press, 2010. (CL library: K.6 84)
- Petitcolas, Anderson, Kuhn: Information hiding—a survey, Proc. IEEE 87(7), 1999.
- Cox, Kilian, Leighton, Shamoon: Secure spread spectrum watermarking for multimedia. IEEE Trans. on Image Processing 6(12), 1997
- Linnartz, van Dijk: Analysis of the sensitivity attack against electronic watermarks in images. IHW1998, LNCS 1525.
- Westfeld: A regression-based restoration technique for automated watermark removal. ACM Workshop on Multimedia and Security, 2008.
- November 19
Main topic: Microcontroller power analysis (talk: Georgiana Gane, demo: Sandro Bauer)
- Kocher, Jaffe, Jun: Differential power analysis. CRYPTO ’99, LNCS 1666
- Chari, Rao, Rohatgi: Template attacks. CHES 2002, LNCS 2523
- Brier, Clavier, Olivier: Correlation Power Analysis with a Leakage Model. CHES 2004, LNCS 3156
Additional literature:
- Mangard, Oswald, Popp: Power analysis attacks – revealing the secrets of smart cards. Springer, 2007 (CL library: K.6 72)
- DPA Contest
- November 26
Main topic: Compromising RF emanations (talk + demo: Alan Mujumdar)
- van Eck: Electromagnetic radiation from video display units: an
eavesdropping risk? Computers & Security 4(269–286)
or alternatively
Kuhn: Compromising emanations: eavesdropping risks of computer displays, Chapter 3: Analog video displays. UCAM-CL-TR-577 - Kuhn: Electromagnetic Eavesdropping Risks of Flat-Panel Displays. PET 2004, LNCS 3424
- Vuagnoux, Pasini: Compromising electromagnetic emanations of wired and wireless keyboards. USENIX Security 2009
Additional topic for discussion: Optical eavesdropping
- Kuhn: Optical time-___domain eavesdropping risks of CRT displays. IEEE S&P 2002
- Backes et al.: Tempest in a Teapot: compromising reflections revisited. IEEE S&P 2009
- van Eck: Electromagnetic radiation from video display units: an
eavesdropping risk? Computers & Security 4(269–286)
Related links
- Andrew Lewis: Multimedia forensics bibliography
- Hany Farid: Digital forensics database
- Markus Kuhn: MATLAB slides
- Using Computer Laboratory MATLAB licence servers from home
- Useful Unix tools for image processing experiments:
- MATLAB
- ImageMagick (identify, convert)
- Independent JPEG Group implementation (cjpeg, djpeg)
- dcraw – an open-source RAW converter
- ufraw – GUI for dcraw
- Some example Canon EOS RAW images (*.cr2), taken by Markus Kuhn and available as test data
- Example of an image manipulated by Andrew Lewis
- Dresden Image Database (database web interface)
- Markus Kuhn: Digital Signal Processing. CST Part II lecture course, Michaelmas 2009.