UNIT 5: MULTIMEDIA SECURITY AND FORENSICS

I. MULTIMEDIA FUNDAMENTALS AND QUALITY OF SERVICE (QoS)

A. Compression Techniques

• Discrete Cosine Transform (DCT) in Multimedia Compression

  • Definition: Mathematical transform that converts a signal (e.g., image block) from spatial domain to frequency domain.

  • Process in JPEG/MPEG:

    1. Image divided into 8x8 pixel blocks.

    2. DCT applied to each block → yields frequency coefficients.

    3. Quantization: Coefficients divided by quantization table values and rounded → lossy step (irreversible data loss).

    4. Entropy coding (e.g., Huffman) on quantized coefficients.

  • Why Lossy? Human visual system less sensitive to high-frequency details; quantization discards perceptually less important information.

  • Implication: Artifacts (blocking, blurring) at high compression ratios; not suitable for lossless archival.

[!TIP] Exam Focus: DCT is foundational for JPEG/MPEG. Remember the sequence: Block → DCT → Quantization (lossy) → Entropy Coding.

B. Interdisciplinary Nature of Multimedia

• Industry Mergers & Interdisciplinary Vendors

  • Concept: Convergence of telecom, computing, entertainment, and consumer electronics industries to create integrated multimedia solutions.

  • Examples:

    • Sony: Electronics (hardware) + Music/Film Studios (content).

    • Apple: Hardware (iPhone) + Software (iOS) + Content (iTunes/Apple Music).

    • Microsoft: OS/Software (Windows) + Gaming (Xbox) + Cloud (Azure Media Services).

    • AT&T/Time Warner Merger: Telecom + Media Content distribution.

[!TIP] Use real-world merger examples to illustrate the trend toward "one-stop" multimedia ecosystems.

C. Virtual Reality (VR) as a Multimedia Application

• Key Aspects & Characteristics:

  • Immersion: Sensory engagement via Head-Mounted Display (HMD), spatial audio.

  • Interactivity: Real-time response to user movement/actions.

  • 3D Audio: Sound localization for realism.

  • Hardware Dependency: Requires high refresh rates (>90 Hz), low latency (<20 ms) to prevent motion sickness.

  • Applications: Gaming, training simulations, virtual tours, telepresence.

D. Operating System Resource Management

• Layered Architecture for Efficient Hardware Management

  • Principle: Abstract hardware complexity via layers; each layer provides services to the layer above, uses services of layer below.

  • Modern OS Layers (Simplified):

    | Layer | Function | Examples | |-------|----------|----------| | Hardware | Physical components | CPU, Memory, I/O Devices | | Kernel | Core OS, direct hardware control | Process scheduling, memory management | | System Libraries/APIs | Interface for applications | POSIX, Windows API | | Shell/UI | User interaction | Command line, GUI (Desktop) | | Applications | End-user software | Browser, Media Player |

[!TIP] Link layers to QoS: Kernel manages CPU/memory allocation for multimedia apps.

E. Quality of Service (QoS) in Multimedia Delivery

• Resource Management for Ensuring QoS

  • Managed Resources:

    • Bandwidth: Network capacity for data flow.

    • CPU: Processing for encoding/decoding.

    • Memory: Buffering for smooth playback.

    • Storage: I/O throughput for media files.

• Factors Affecting QoS:

  | Factor | Impact on QoS | |--------|--------------| | Network Conditions | Latency (delay), jitter (variation in delay), packet loss → causes buffering, artifacts. | | Hardware Limitations | Slow CPU → dropped frames; insufficient RAM → stuttering. | | Application Design | Efficient codecs, adaptive bitrate streaming (e.g., DASH) mitigate network issues. | | User Expectations | Real-time apps (video call) require low latency; streaming (Netflix) prioritizes smoothness. |

[!TIP] QoS is a trade-off: Latency vs. Quality (e.g., live stream vs. download).

II. SECURITY IN MULTIMEDIA SYSTEMS

A. Classification of Security Attacks

[!TIP] Active = Change; Passive = Observe.

B. Multimedia Authentication

• Importance: Ensures integrity (content unaltered) and authenticity (source genuine) – critical for legal evidence, news, medical imaging.

• Common Mechanisms:

  • Digital Watermarking: Embed imperceptible data (owner ID, hash) into media.

  • Digital Signatures: Hash of content encrypted with sender’s private key.

  • Hash Functions: One-way digest (SHA-256) – any change alters hash.

C. Digital Watermarking

• Visible vs. Invisible Watermarks:

  | Feature | Visible Watermark | Invisible Watermark | |---------|-------------------|---------------------| | Perceptibility | Obvious (logo, text overlay) | Imperceptible to human senses | | Primary Use | Deterrence, branding | Copyright proof, tracing, authentication | | Robustness | Often fragile (easily cropped) | Designed to be robust against processing | | Impact on UX | Negative (obstructs view) | Neutral (no visual impact) |

• Scenario-Based Selection & Factors:

  Scenario 1: Professional Portfolio Website (High-Quality Photos)

  • Choice: Visible watermark (e.g., subtle logo in corner).

  • Reasoning: High-value images; watermark deters outright theft while allowing full appreciation of quality. Purpose: branding & deterrence. Threat: casual image saving.

  Scenario 2: Stock Photography Platform (Image Sales)

  • Choice: Invisible robust watermark.

  • Reasoning: Must protect copyright without degrading sale version. Watermark survives compression/cropping; enables traceability if illegally used. Purpose: forensic tracking.

  Scenario 3: Client Preview (Low-Resolution Images)

  • Choice: Visible watermark (large, semi-transparent).

  • Reasoning: Low-res previews are for evaluation; watermark clearly marks as not for use, preventing misuse as final product. UX impact acceptable.

  • Factors Influencing Choice:

    1. Purpose: Protection vs. branding vs. traceability.

    2. User Experience: Visible harms aesthetics; invisible preserves it.

    3. Distribution Channel & Threat Model: Public web (visible deterrence) vs. controlled sale (invisible tracking).

[!TIP] Rule of Thumb: If content is displayed publicly for marketing → visible. If content is distributed for sale/tracking → invisible.

III. MULTIMEDIA FORENSICS

A. Digital Evidence Extraction

• Process & Steps:

  1. Identification: Recognize potential evidence (e.g., security camera video, audio recording).

  2. Preservation: Create forensic image (bit-for-bit copy); hash (SHA-256) to verify integrity.

  3. Collection: Seize media using write-blockers; document chain of custody.

  4. Analysis: Examine content, metadata, artifacts using forensic tools.

  5. Presentation: Report findings in court-admissible format.

• Tools: EnCase, FTK, Autopsy, Wireshark (network), Audio spectrogram tools (e.g., Adobe Audition).

B. Metadata in Forensic Analysis

• Significance: "Data about data" embedded in files (EXIF for images, ID3 for audio).

  • Provenance: Camera model, GPS coordinates, timestamps → establish origin.

  • Timeline Reconstruction: File creation/modification times.

  • Authentication: Consistency of metadata with claimed source/time.

  • Integrity Check: Metadata hashes; anomalies suggest tampering (e.g., edited EXIF).

• Caution: Metadata is easily alterable; must be corroborated with content analysis.

C. Device Forensics: Printers and Scanners

• Role in Risk Identification & Mitigation:

  • Printer/Scanner Signatures: Unique noise patterns, banding, dot placement (printer steganography).

  • Document Authentication: Identify specific device used to print a forged document.

  • Mitigation: Secure disposal of printers (hard drive wiping), tracking printed documents.

• Case Study Illustration:

  Counterfeit Currency Investigation: Forensic experts analyze a suspect bill. They detect microscopic printer-specific dot patterns (e.g., from a特定 HP LaserJet model) embedded by the printer's serial number encoding. This links the counterfeit to a specific seized printer, providing strong evidence.

D. Audio Forensics

• Authentication & Validation:

  • Spectral Analysis: Check for inconsistencies in frequency profile (e.g., noise floor changes indicate splicing).

  • Waveform Examination: Visual inspection for discontinuities, DC offset.

  • Contextual Analysis: Background sounds, acoustic environment consistency.

  • Enhancement: Filtering to clarify speech without altering content.

• Legal Admissibility Considerations:

  • Chain of Custody: Unbroken record of handling.

  • Validation Methods: Peer-reviewed, scientifically accepted (Daubert standard).

  • Expert Testimony: Clear explanation of techniques and error rates.

E. Foundations of Computer Forensics

• Need & Scope in Multimedia Context:

  • Need: Rising cybercrime involving multimedia (deepfakes, child exploitation media, IP theft).

  • Scope: Recovery, analysis, and presentation of digital multimedia evidence (images, video, audio) from storage/media devices. Includes:

    • File system analysis (NTFS, FAT, ext4).

    • Recovery of deleted/encrypted media files.

    • Analysis of multimedia-specific formats and codecs.

F. Forensic Protocols

• Standard Operating Procedures (SOPs):

  • Documented, repeatable methods for evidence handling to ensure consistency and legal compliance.

• Chain of Custody:

  • Chronological documentation of evidence control: Who collected? When? Where? How stored? Transferred to whom? Must be continuous, unbroken.

• Analysis & Reporting Protocols:

  • Analysis: Work on forensic image, not original; document all steps/tools.

  • Reporting: Clear, objective report with findings, limitations, and conclusions; include hashes of evidence.

G. Multimedia Content Forensics

• Techniques for Tampering Detection & Source Identification:

  • Tampering Detection:

    • Error Level Analysis (ELA): JPEG compression artifacts reveal edited regions.

    • Copy-Move Forgery Detection: Identify duplicated image regions.

    • Video Frame Inconsistency: Lighting, shadows, motion vectors across frames.

  • Source Identification:

    • Sensor Pattern Noise (SPN): Unique noise fingerprint of camera sensor.

    • Lens Aberration Analysis: Radial distortion patterns.

    • Codec Artifacts: Specific to encoder/software used.

[!TIP] Key Insight: Forensic analysis often looks for statistical inconsistencies that arise from manipulation.

\boxed{\text{End of Unit 5 Notes}}
Based on RGPV D Multimidia Security & Forensics syllabus and past paper analysis (Nov 2023).