Multimedia Security & Forensics (CY-702 (D)) - Unit 4 Short Notes

UNIT 4: MULTIMEDIA SECURITY & FORENSICS

Based on the NOV 2023 examination paper for CY-702(D).

I. MULTIMEDIA FUNDAMENTALS & SYSTEMS

Discrete Cosine Transform (DCT) in Compression

• Role: Core transformation in lossy compression standards like JPEG (images) and MPEG (video).

• Principle: Converts a signal from spatial domain (pixel values) to frequency domain.

  • Low-frequency components represent coarse, smooth areas (important for visual perception).

  • High-frequency components represent fine details, edges, and noise (less critical for perception).

• Why "Lossy"? The quantization step that follows DCT is irreversible.

  • Quantization rounds frequency coefficients to a limited set of values, discarding less important high-frequency data.

  • This discarding of data is the source of compression loss; original data cannot be perfectly reconstructed.

  • Formula (1D DCT for a sequence x[n]):

$$X[k] = \alpha(k) \sum_{n=0}^{N-1} x[n] \cos\left( \frac{\pi (2n+1)k}{2N} \right), \quad k = 0, 1, ..., N-1$$

    where $$\displaystyle \alpha(k) = \sqrt{\frac{1}{N}} $$ for $$\displaystyle k=0 $$, else $$\displaystyle \sqrt{\frac{2}{N}} $$.

[!TIP] Exam Focus: Be ready to contrast DCT's frequency transformation with the irreversible quantization step that causes data loss.

Multimedia Industry & Applications: Convergence & VR

• Interdisciplinary Vendor Convergence: Modern multimedia products/services result from mergers between traditionally separate industries.

  • Examples: Telecom + Media (streaming services), Hardware + Software + Content (smartphones/gaming consoles), Social Platforms + E-commerce + Advertising.

• Virtual Reality (VR) as a Multimedia Application:

  • Components: Head-Mounted Display (HMD), motion/position trackers, input devices, powerful rendering computer/engine.

  • Immersive Characteristics: Presence (feeling of "being there"), Interactivity (real-time response to user action), Computer-Generated 3D Environment.

  • Technical Requirements: Very high bandwidth & low latency (<20ms) to prevent motion sickness; high frame rates (90+ FPS); stereoscopic rendering.

Operating System Layers & Resource Management

• Layered Architecture: Simplifies design and enhances security/isolation.

  • Typical Layers (Bottom-Up):

    1. Hardware: Physical CPU, memory, I/O devices.

    2. Hardware Abstraction Layer (HAL): Provides uniform interface to diverse hardware.

    3. Kernel: Core OS; manages CPU scheduling, memory, processes, I/O.

    4. System Libraries/APIs: e.g., POSIX, Win32; provide services to applications.

    5. Shell/GUI: User interface layer.

• Resource Management for QoS: OS must allocate scarce resources to meet multimedia demands.

  • Managed Resources: CPU time (scheduling), main memory (buffering), disk I/O (streaming), network bandwidth, GPU access.

Quality of Service (QoS) in Multimedia Delivery

• Definition: Measurable service levels (e.g., delay, throughput, reliability) guaranteed by a network/system for a multimedia flow.

• Critical Factors Affecting QoS:

  | Factor | Impact on Multimedia | | :--- | :--- | | Bandwidth | Insufficient bandwidth causes buffering, low resolution. | | Latency | End-to-end delay; high latency disrupts interactivity (e.g., video calls). | | Jitter | Variation in packet delay; causes uneven playback, requires large buffers. | | Packet Loss | Causes audio clicks, video artifacts/freezes. | | Synchronization | Lip-sync errors (audio-video offset) degrade experience. |

[!TIP] Common Pitfall: Do not confuse Latency (fixed delay) with Jitter (variable delay). Both harm real-time apps but require different mitigation (buffering for jitter, path optimization for latency).

II. SECURITY IN MULTIMEDIA SYSTEMS

Taxonomy of Security Attacks

Multimedia Authentication & Integrity

• Purpose:

  • Authentication: Verify the source/creator of content.

  • Integrity: Ensure content has not been altered since creation.

• Mechanisms:

  • Digital Signatures: Asymmetric crypto (e.g., RSA) signs a hash of the content. Provides non-repudiation.

  • Cryptographic Hashes (MACs/Hashes): e.g., SHA-256. Detects any change (even 1 bit). Requires secure channel for hash exchange.

  • Watermarking-Based Authentication: Embeds an imperceptible signal (watermark) carrying authentication data. Can be fragile (breaks on modification) or robust (surives benign processing).

Digital Watermarking: Scenario-Based Decision Framework

• Visible Watermark: Semi-transparent logo/text overlaid on image.

  • Purpose: Deterrent copyright notice, branding, immediate identification.

  • Impact: Degrades perceptual quality; not suitable for high-quality display/sale.

• Invisible Watermark: Embedded in pixel/coefficient data; imperceptible to human eye.

  • Types:

    • Robust: Survives compression, resizing, format conversion. Used for copyright proof (forensic tracking).

    • Fragile: Breaks easily on any modification. Used for tamper detection and integrity checking.

• Decision Matrix for Image Handling:

  | Scenario | Recommended Watermark | Key Influencing Factors | | :--- | :--- | :--- | | Professional Portfolio (High-quality display) | None or Very Subtle Invisible | Purpose: Showcase quality. Quality Requirement: Maximum. Robustness Need: Low. | | Stock Photography Platform (For sale & protection) | Robust Invisible | Purpose: Copyright proof, tracking sales. Legal Evidence: Must survive processing. Robustness Need: Very High. | | Low-Resolution Client Preview (Review & potential sale) | Visible | Purpose: Deter unauthorized use, clearly mark "preview". Quality: Low-res acceptable. Robustness: Moderate (visible already deters). |

[!TIP] Exam Trick: For watermarking scenarios, always start by identifying the primary purpose (display vs. protection vs. deterrence). This dictates the quality-robustness trade-off.

III. MULTIMEDIA FORENSICS & EVIDENCE HANDLING

Digital Evidence Extraction Process

A strict, forensically sound lifecycle:

1. Identification: Recognize potential evidence source (device, file, network).

2. Preservation:

   • Isolation: Prevent remote wiping/alteration (e.g., airplane mode).

   • Imaging/Hashing: Create a bit-for-bit forensic image (e.g., .E01, .AFF). Compute cryptographic hash (SHA-256) before & after to verify integrity.

3. Analysis: Examine image using forensic tools. Work on the image copy only.

4. Documentation: Record every action (tools, commands, timestamps) in a chain of custody log.

5. Presentation: Prepare clear, understandable reports/expert testimony.

• Tools:

  • Forensic Suites: EnCase, FTK (Forensic Toolkit) – comprehensive analysis.

  • Format-Specific: exiftool (metadata), ffmpeg (video/audio analysis), PhotoRec (file carving).

  • Metadata Extraction: Built-in OS tools (stat), or specialized libraries.

Significance of Metadata in Forensics

• Types:

  • EXIF (Images): Camera model, date/time, GPS coordinates, software settings.

  • ID3 (Audio/MP3): Artist, album, track, comments, sometimes recording device.

  • File System Metadata: MAC times (Modified, Accessed, Created), file owner, permissions.

• Roles:

  • Authentication: Verify if file's claimed origin (camera model, software) matches metadata. Check for inconsistencies in timestamps.

  • Analysis & Reconstruction: Build timeline of events (creation -> modification -> access). Geolocate photos. Identify software chain (e.g., "edited with Photoshop CS6").

[!TIP] Critical Concept: Metadata is easily alterable. It is supporting evidence, not proof. Always correlate with content-level analysis (e.g., JPEG quantization tables, noise patterns).

Specialized Device Forensics

• Printer/Scanner Forensics:

  • Principle: Every device introduces unique, microscopic banding patterns or sensor noise (like a "fingerprint").

  • Application: Link a printed/scanned document to a specific printer model or even unit by analyzing these artifacts.

  • Case Study Illustration: A questioned ransom note is printed. Forensic analysis reveals a unique stripe pattern consistent with a specific model of HP LaserJet. Seizing that printer from a suspect's premises and performing a known-source print confirms the match, placing the suspect's device at the scene.

• Audio Forensics:

  • Authentication Techniques:

    • Spectral Analysis: Visualize frequency components. Inconsistencies suggest splicing or generation.

    • Noise Profile Examination: Background noise (AC hum, room tone) should be continuous. Abrupt changes indicate editing.

    • Compression Artifact Analysis: Inconsistent coding artifacts across a file suggest segments from different sources/recordings.

  • Legal Validation: Must establish chain of custody, prove integrity (hash of original file), and have the expert's methodology accepted as reliable (Daubert standard).

Multimedia Content Forensics

• Goal: Detect manipulation without relying on external metadata or signatures.

• Detection Techniques by Media Type:

  • Images: Cloning detection (duplicate regions), splicing (inconsistent lighting/noise/compression), resampling artifacts, inpainting detection.

  • Video: Frame duplication/insertion/deletion, temporal inconsistency (motion vectors), compression history analysis (multiple encoding layers).

  • Audio: Voice conversion artifacts, cut-and-paste (discontinuities in phase/spectrum).

• Inherent Forensic Signatures: Exploit physical/sensor-based traces:

  • Sensor Pattern Noise (SPN): Unique pixel-level noise of a camera's CCD/CMOS sensor. Used for source camera identification.

  • Compression History: Different codecs/quality factors leave distinct traces in DCT coefficients (JPEG) or transform blocks.

IV. FOUNDATIONS & PROTOCOLS

The Need for Computer/Multimedia Forensics

• Rise in Digital Crime: Pervasive use of multimedia (smartphones, CCTV, social media) as evidence and tool for crime (extortion, disinformation, IP theft).

• Legal/Investigative Requirement: Law enforcement & courts require scientifically valid, admissible methods to collect and analyze digital evidence.

• Difference from Traditional Forensics:

  • Volume: Massive amounts of data (terabytes).

  • Volatility: Easy to alter/delete.

  • Tangibility: No physical "scene" in the same sense; evidence is abstract bits.

  • Formats: Diverse, proprietary, constantly evolving.

Relevant Protocols & Standards

• Role: Ensure interoperability (tools can read evidence) and forensic soundness (methods are repeatable, validated).

• Key Standards:

  • File Format Standards: JPEG, MPEG-4, WAV – define structure, allowing parsers to locate data/metadata correctly.

  • Metadata Standards: EXIF, XMP, ID3 – standardized tags ensure consistent interpretation.

  • Evidence Format Standards: AFF (Advanced Forensic Format), E01 – preserve bit-stream, allow hashing, metadata, and compression without loss.

  • Network/Storage Protocols: Understanding TCP/IP, HTTP, NFS/SMB is crucial for acquiring volatile network evidence and interpreting file system timestamps.

[!TIP] Final Exam Synthesis: In forensics, standards are your best friend. They provide the accepted, court-defensible methodology. Always mention adherence to standards (like using a validated tool that reads EXIF properly) when discussing evidence handling.