Detecting anti-forensic attacks on demosaicing-based camera model identification

Many forensic algorithms have been developed to determine the model of an image's source camera by examining traces left by the camera's demosaicing algorithm. An anti-forensic attacker, however, can falsify these traces by maliciously using existing forensic techniques to estimate one camera's demosaicing filter, then use these estimates to re-demosaic an image captured by a different camera. Currently, there is no known defense against this attack, which is capable of fooling existing camera model identification algorithms. In this paper, we propose a new method to detect if an image's source camera model has been anti-forensically falsified. Our algorithm operates by characterizing the different content-independent local pixel relationships that are introduced by both authentic demosaicing algorithms and anti-forensic attacks. Experimental results show that our algorithm can detect an anti-forensic attack with over 99% accuracy, is robust to JPEG compression, and can even identify the true source camera model in certain circumstances.