1. USING BENFORD’S LAW TO DETECT JPEG
BIOMETRIC DATA TAMPERING
Supervisor: Prof. Anthony TS Ho
Co-Supervisor: Dr. Norman Poh
Aamo Iorliam
PhD Student
University of Surrey

2.  Introduction
 Motivation
 Inspiration of Research
 Benford’s Law Overview
 Block-DCT Coefficients, JPEG coefficients and Experiments
 Data Sets
 Benford’s Law and Separability
 Tamper Detection using Benford’s Law Features with SVM
 Results for Performance Evaluation
 Conclusion
Overview

3.  Digital tampering of images has recently increased [1].
Digital Image Forensic Techniques
 Passive detection methods are applied to biometric data for analysis in
our research
Introduction
Digital Image Forensic
Techniques
Passive (blind) detection
Active detection
[1] A. Iorliam, A.T.S. Ho, N. Poh, and Y.Q. Shi, “Do Biometric Images Follow Benford’s Law?”
2nd International Workshop on Biometrics and Forensics (IWBF2014), Malta, 27-28th March, pp. 1-6, 2014

4. Motivation
 To detect insider attackers/hackers digital tampering of biometric
data when they have illegal/legal access to this sensitive data
 Differentiate between artificially printed fingerprints, optically
sensor generated fingerprints and synthetically generated
fingerprints.
 Hence protecting the integrity of stored biometric data (e.g.
fingerprint images and face images)

5. Inspiration of Research
InspirationofResearch
JPEG is the most widely used image format
Digital tampering of stored biometric samples is
becoming an important security concern
Possibility of intentional or accidental use of
particular fingerprints instead of another
fingerprints
Use Benford’s law divergence metric to differentiate
between different types of fingerprints
Use Benford’s law features with SVM to assist in
detection of tampered biometric fingerprint images
and face images

6. Benford’s Law Overview
Shortcoming
Could not prove why this
theory and formula
worked
Benford’s Law was discovered by
Simon Newcomb in 1881

7. Benford’s Law Overview Cont.
Why Benford Succeeded?
Analysed 20,229 observations.
. including surface of 335 rivers,
the size of 3259 US population etc
Frank Benford (1938) [2]
[2] F. Benford, “The law of anomalous numbers,” Proc. of the American Philosophical Society,
vol.78, pp. 551-572, 1938.

8. Benford’s Conclusion & Its Application
 Multi digit numbers beginning with 1, 2 or 3 appear more frequently than multi
digit numbers beginning with 4, 5, 6, 7, 8, and 9
 Therefore, he published the frequency in “The Law of Anomalous Numbers” [2]
 Application:
 Accounting fraud detection- Mark Nigrini, 1996 [3]
 Legal Status- used in the United States
Election Data- 2009 Iranian elections
Images processing- Jolion in 2001 [4], and several others
[2] F. Benford, “The law of anomalous numbers,” Proc. of the American Philosophical Society,
vol.78, pp. 551-572, 1938.
[3] M. Nigrini, A taxpayer compliance application of benford’s Law,
Journal of the American Taxation Association, vol. 1, pp.72–91, 1996.
[4] J.M. Jolion, Images and benford’s law, Journal of Mathematical Imaging and Vision,
14(1), pp. 73–81, 2001.

9. What Exactly is Benford’s Law?
 The probability of any number “𝑥𝑥”
from 1 through 9 being the first digit is
expressed as [5]:
 Generalised Benford’s Law: An
extension of Benford’s law
N is a normalization factor, s and q are
model parameters [6].
Probability distribution of Benford’s law
[5] T.P. Hill, “A statistical derivation of the significant-digit law,” Statistical Science papers (10), pp. 354-363, 1996.
[6] D. Fu, Y. Q. Shi, and W. Su, “A generalized Benford’s Law for JPEG coefficients and its applications in image forensics,” Proc. SPIE 6506,
1L1-1L11, 2007.

10. Block-DCT Coefficients, JPEG
Coefficients and Experiments
Experiments
 Investigate JPEG coefficients for optical sensor generated fingerprints images,
artificially printed latent fingerprint images and synthetic generated fingerprints
 To determine if they follow the generalised Benford’s law
 The divergence used to separate the different types of fingerprints is given as:
 Detect and localise tampered biometric regions with the help of MBFDF and
SVM [7]
Original
Image
8 X 8
Block-DCT Block-DCT
Coefficients
Quantization
JPEG
Coefficients
Entropy
Coding
JPEG
Bitstream
Block diagram of JPEG Compression
[7] X. H. Li, Y.Q. Zhao, M. Liao, F.Y. Shih, and Y.Q. Shi, Detection of Tampered region for JPEG images by using mode-based first digit features,
EURASIP Journal on Advances in Signal Processing 2012, 2012:190.

11. Data Sets
 80 grayscale fingerprint images from DB1, FVC2000
 80 grayscale synthetic fingerprint images from DB4, FVC2000 [8]
 48 Contact-less acquired latent fingerprints [9]
 Realistic tampering was performed on:
 10 face images from CASIA-FACEV5 [10]
 10 fingerprint images from DB1, FVC2000
[8] FVC2000 (2000), “Fingerprint verification competition databases,”
Available: http://bias.csr.unibo.it/fvc2000/databases.asp.
[9] Hildebrandt M, J. Sturm, J. Dittmann, and C. Vielhauer, “Creation of a
public corpus of contact-less acquired latent fingerprints without privacy
implications,” in Proc. CMS 2013, LNCS 8099, Magdeburg, Germany,
September 2013, 2013, pp. 204–206.
[10] CASIA-FACEV5 (2010), “ Biometric Ideal Test,” Available:
http://www.idealtest.org/dbDetailForUser.do?id=9

12. Benford’s law and Separability Results
Divergence for singly compressed optically captured, synthetically generated fingerprints and contact-less acquired latent fingerprints
a. optically captured fingerprint closely follow generalised Benford’s law at QF=100
b. synthetically generated fingerprints closely follow generalised Benford’s law at QF=100
c. contact-less acquired latent fingerprints follow generalised Benford’s law at QF=100 except at digit 1

13. Tamper Detection Using Benford’s law Features
 The fingerprint images for our experiment are as follows:
(a) (b) (c)
Fingerprint image: (a) JPEG compressed at QF=80, (b) JPEG compressed at QF=50, (c) center portion of (a) replaced with
center portion from (b).
(a) (b) (c)
Fingerprint image: (a) un-tampered; (b) un-tampered; (c) Tampered detection with the help of MBFDF and SVM

14. Tamper Detection Using Benford’s law Features
 The face images for our experiment are as follows:
(a) (b) (c)
Face image: (a) JPEG compressed at QF=100, (b) JPEG compressed at QF=100, (c) Eyes and nose of (a) replaced with eyes and
nose from (b).
(a) (b) (c) (d)
Face image: (a) tampered; (b) detected; (c) tampered; (d) detected.

15. Results for Performance Evaluation
 At the image level an EER of 0.00% was achieved.
 At the block-level an EER of 16.67% was achieved for the fingerprint images
and 1.5% for the face images.
0.10.2 0.5 1 2 5 10 20 40 60
0.1
0.2
0.5
1
2
5
10
20
40
60
FAR [%]
FRR[%]
DET
DET curve of the block-level tampering detection for: (a) 10 fingerprint images ; (b) 10 face images
(a) (b)

16. Conclusion
 The digital tampering of JPEG biometric databases is attracting much attention
from the research community and presents some real challenges in protecting
the authenticity of biometric databases for legal applications
 Digital tampering of biometric fingerprint images and face images was
performed using Photoshop
 Benford’s law divergence metric successfully separated three fingerprint
databases
 Benford’s law features and SVM were successfully used to detect and localise
tampering of fingerprint images and face images.
 This will assist in protecting the integrity of stored biometric data.

17. Thank you very much
For your attention
Questions and comments
are welcome