2008 prst, jpeg quantization tables - p21-kornblum_pres

7/27/2019 2008 Prst, JPEG Quantization Tables - p21-Kornblum_pres

1/35

DC3DC3

JPEG Quantization TablesJPEG Quantization Tables

Jesse KornblumJesse Kornblum


2/35

DC3DC3

OverviewOverview

!! MotivationMotivation

!! Everything You Always Wanted to Know aboutEverything You Always Wanted to Know about

JPEGs But Were Afraid to AskJPEGs But Were Afraid to Ask

!! Quantization TablesQuantization Tables!! Types of TablesTypes of Tables

!! CalvinCalvin

!! Future WorkFuture Work


3/35

DC3DC3

MotivationMotivation

!! Ashcroft v. Free Speech CoalitionAshcroft v. Free Speech Coalition, 2002, 2002

!! Cases now have hundreds of thousands of imagesCases now have hundreds of thousands of images

!! Only a few needed to convictOnly a few needed to convict

Must be real picturesMust be real pictures

!! Need to find the real picturesNeed to find the real pictures

Not as easy as youNot as easy as youd thinkd think


4/35

DC3DC3

Real PictureReal Picture

WARNING:WARNING:

EXPLICIT IMAGERYEXPLICIT IMAGERY

LAW ENFORCEMENT SENSITIVELAW ENFORCEMENT SENSITIVE DO NOT DUPLICATEDO NOT DUPLICATE


5/35

DC3DC3


LAW ENFORCEMENT SENSITIVELAW ENFORCEMENT SENSITIVE DO NOT DUPLICATEDO NOT DUPLICATE


6/35

DC3DC3


Image

Copy

rightPisanKaewma2006


7/35

DC3DC3

Computer Generated ImageComputer Generated Image


8/35

DC3DC3

All About JPEGsAll About JPEGs

!! JPEG CompressionJPEG Compression

LossyLossy compressioncompression

!! Six step processSix step process

Color space transform RGB toColor space transform RGB toYCbCrYCbCr DownsamplingDownsampling

Block SplittingBlock Splitting

Discrete Cosine TransformDiscrete Cosine Transform

Quantization (where the magic happens)Quantization (where the magic happens)

Encoding (lossless compression)Encoding (lossless compression)


9/35

DC3DC3

Quantization TablesQuantization Tables

!! Table used to controlTable used to control lossylossy compressioncompression

!! Up to four sets of tablesUp to four sets of tables

64 values in each table64 values in each table

!! Value for each pixel is divided by a table valueValue for each pixel is divided by a table value Decimals thrown awayDecimals thrown away

Decimal loss leads to image quality lossDecimal loss leads to image quality loss

!! 124 / 50 --> 2124 / 50 --> 2

!! When decompressed 2*50 = 100When decompressed 2*50 = 100


10/35

DC3DC3


2 1 1 1 1 1 2 12 1 1 1 1 1 2 1

1 1 2 2 2 2 2 41 1 2 2 2 2 2 4

3 2 2 2 2 5 4 43 2 2 2 2 5 4 4

3 4 6 5 6 6 6 53 4 6 5 6 6 6 5

6 6 6 7 9 8 6 76 6 6 7 9 8 6 7

9 7 6 6 8 11 8 99 7 6 6 8 11 8 9

10 10 10 10 10 6 8 1110 10 10 10 10 6 8 11

12 11 10 12 9 10 10 1012 11 10 12 9 10 10 10


11/35

DC3DC3


!! Higher numbers mean lower quality imageHigher numbers mean lower quality image

!! Lower numbers mean higher quality imageLower numbers mean higher quality image

!! Best images have tables of all onesBest images have tables of all ones

No compressionNo compression


12/35

DC3DC3

Quantization CalculationsQuantization Calculations

!! Original value =Original value = 124124

!! Table value of 1 -->Table value of 1 --> 124 -->124 --> 124124



!! Table value of 50 -->Table value of 50 --> 2 --> 1002 --> 100

!! Table value of 75 --> 1 --> 75Table value of 75 --> 1 --> 75


13/35

DC3DC3

Making TablesMaking Tables

!! Independent JPEG Group (IJG) TablesIndependent JPEG Group (IJG) Tables

Last updated 1998Last updated 1998

!! Scaling method uses quality factor QScaling method uses quality factor Q

!! Q can be between 1 and 100Q can be between 1 and 100!! S = (Q < 50) ? 5000/Q : 200S = (Q < 50) ? 5000/Q : 200 2Q2Q

!! TTss[i] = (S * T[i] = (S * Tbb[i] + 50) / 100[i] + 50) / 100

!! Integer mathInteger math

No decimals, information lostNo decimals, information lost!! Scaling with Q=50 means no changeScaling with Q=50 means no change


14/35

DC3DC3

IJG Standard TableIJG Standard Table

16 11 10 16 24 40 51 6116 11 10 16 24 40 51 61

12 12 14 19 26 58 60 5512 12 14 19 26 58 60 55

14 13 16 24 40 57 69 5614 13 16 24 40 57 69 56

14 17 22 29 51 87 80 6214 17 22 29 51 87 80 62

18 22 37 56 68 109 103 7718 22 37 56 68 109 103 77

24 35 55 64 81 104 113 9224 35 55 64 81 104 113 92

49 64 78 87 103 121 120 10149 64 78 87 103 121 120 101

72 92 95 98 112 100 103 9972 92 95 98 112 100 103 99


15/35

DC3DC3

IJG Standard Table, Q=80IJG Standard Table, Q=80

6 4 4 6 10 16 20 246 4 4 6 10 16 20 24

5 5 6 8 10 23 24 225 5 6 8 10 23 24 22

6 5 6 10 16 23 28 226 5 6 10 16 23 28 22

6 7 9 12 20 35 32 256 7 9 12 20 35 32 25

7 9 15 22 27 44 41 317 9 15 22 27 44 41 31

10 14 22 26 32 42 45 3710 14 22 26 32 42 45 37

20 26 31 35 41 48 48 4020 26 31 35 41 48 48 40

29 37 38 39 45 40 41 4029 37 38 39 45 40 41 40


16/35

DC3DC3

IJG Standard TablesIJG Standard Tables

!! Most software uses IJG Standard TablesMost software uses IJG Standard Tables

!! libjpeglibjpeg is free and easy to useis free and easy to use

Programmers are lazyProgrammers are lazy

!! Allows user to specify quality setting QAllows user to specify quality setting Q!! Examples:Examples:

The GimpThe Gimp

Microsoft PaintMicrosoft Paint

InfranviewInfranview

Some camera phonesSome camera phones


17/35

DC3DC3

Extended IJG TablesExtended IJG Tables

!! Three tables instead of twoThree tables instead of two

!! The third is a duplicate of theThe third is a duplicate of the secondsecond

A BA B

A B BA B B


18/35

DC3DC3

Adobe PhotoshopAdobe Photoshop

!! Adobe Photoshop uses its ownAdobe Photoshop uses its own

quantization tablesquantization tables

!! Users select one ofUsers select one of12 quality settings12 quality settings

!!

Table depends only on quality settingTable depends only on quality setting Does not consider imageDoes not consider image


19/35

DC3DC3

CategorizingCategorizing


!! AllAll onesones

No dataNo data

!! Standard TablesStandard Tables

!!

Two IJGTwo IJG!! Extended Standard TablesExtended Standard Tables

!! Three IJGThree IJG

!! Custom Fixed TablesCustom Fixed Tables

!! Adobe PhotoshopAdobe Photoshop

!! Custom Adaptive TablesCustom Adaptive Tables


20/35

DC3DC3

Custom Adaptive TablesCustom Adaptive Tables

!! Table is computedTable is computed

on the flyon the fly

!! Usually based onUsually based on

image beingimage beingprocessedprocessed

!! Most cameras do thisMost cameras do this

Most vendors haveMost vendors have

patents onpatents on

quantization tablequantization tableconstructionconstruction


21/35


22/35

DC3DC3

Digital BallisticsDigital Ballistics

!! Match to individual devicesMatch to individual devices

Depends on smallDepends on small imperfections in lens, sensorimperfections in lens, sensor

RequiresRequires lotslots of images from each cameraof images from each camera

Beyond the scope of this presentationBeyond the scope of this presentation


23/35

DC3DC3


!! Match to type ofMatch to type ofdevicedevice

Possible to identify IJG tablesPossible to identify IJG tables

Except when adaptive makes these by accidentExcept when adaptive makes these by accident

Possible to identify PhotoshopPossible to identify Photoshop tablestables

But could, in theory, be adaptive tablesBut could, in theory, be adaptive tables

Possible to identify adaptive tablesPossible to identify adaptive tables

ButBut could be either hardware or softwarecould be either hardware or software

!! In all cases, may only be last device toIn all cases, may only be last device to processprocess


24/35

DC3DC3


!! Set of known quantization tablesSet of known quantization tables

99 Standard Tables99 Standard Tables

99 Extended Standard Tables99 Extended Standard Tables

Tables from Adobe PhotoshopTables from Adobe Photoshop

!! Compare each unknown images to set of knownCompare each unknown images to set of known

Matches areMatches are most likely last processed bymost likely last processed bysoftwaresoftware


25/35

DC3DC3

CalvinCalvin

!! Col. Calvin Goddard, 1891-1955Col. Calvin Goddard, 1891-1955

Founded firearms identificationFounded firearms identification

Identified weapons used by AlIdentified weapons used by Al

Capone in St. Valentine's DayCapone in St. Valentine's DayMassacreMassacre

Picture courtesy FBI, http://www.fbi.gov/hq/lab/labdedication/labstory.htm


26/35

DC3DC3

CalvinCalvin

!! By default, displays filenames not matched (e.g.By default, displays filenames not matched (e.g.

possible photographs)possible photographs)

C:\>C:\> calvincalvin *.jpg*.jpgC:\kitty-pr0n.jpgC:\kitty-pr0n.jpg


27/35

DC3DC3

CalvinCalvin

!! Can display results for all filesCan display results for all files

C:\>C:\> calvincalvin -vv *.jpg-vv *.jpg

C:\from-gimp.jpg: Standard Tables, Q=80C:\from-gimp.jpg: Standard Tables, Q=80C:\kitty-pr0n.jpg: possible hardwareC:\kitty-pr0n.jpg: possible hardware


28/35

DC3DC3

CalvinCalvin

!! Can dump tables from an imageCan dump tables from an image

C:\>C:\> calvincalvin -g kitty-pr0n.jpg-g kitty-pr0n.jpg

C:\kitty-pr0n.jpgC:\kitty-pr0n.jpg5,4,2,6,7,2,4,5,2,10,3,6,3,6,4,2,2,11,7,3,9,6,4,6,7,4,5,65,4,2,6,7,2,4,5,2,10,3,6,3,6,4,2,2,11,7,3,9,6,4,6,7,4,5,6

6,3,6,4,2,3,5,10,4,6,9,7,5,3,8,6,4,6,3,1,6,8,5,3,3,6,8,4,1,6,3,6,4,2,3,5,10,4,6,9,7,5,3,8,6,4,6,3,1,6,8,5,3,3,6,8,4,1,

0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,

0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,00,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0


29/35

DC3DC3

CalvinCalvin

!! Can use signatures on next runCan use signatures on next run

C:\>C:\> calvincalvin -g kitty-pr0n.jpg >-g kitty-pr0n.jpg > sigssigs.txt.txt

C:\>C:\> calvincalvin -a-a sigssigs.txt -vv d:\unknown\*.jpg.txt -vv d:\unknown\*.jpgD:\unknown\also-kitty-pr0n.jpg: kitty-pr0n.jpgD:\unknown\also-kitty-pr0n.jpg: kitty-pr0n.jpg


30/35

DC3DC3


!! This is just one step in the processThis is just one step in the process

!! Image from camera processed in PhotoshopImage from camera processed in Photoshop

According to Calvin, is from PhotoshopAccording to Calvin, is from Photoshop

But image contains EXIF and other metadataBut image contains EXIF and other metadata Clues in the image itself (e.g. presence of skin tones)Clues in the image itself (e.g. presence of skin tones)


31/35

DC3DC3


Processed with the Gimp

Standard Tables, Q=80


32/35

DC3DC3


But contains skin tones, EXIF data

Konica Minolta


33/35

DC3DC3


!! Best used as part of a larger systemBest used as part of a larger system

!! DC3 VISION systemDC3 VISION system


34/35

DC3DC3

AcknowledgementsAcknowledgements

!! Imagery provided by FBI,Imagery provided by FBI, Pisan KaewmaPisan Kaewma

!! libjpeglibjpeg: http://www.: http://www.ijgijg.org/.org/

!! No animals were harmed in the making of thisNo animals were harmed in the making of this

presentationpresentation


35/35

DC3DC3

Department of DefenseDepartment of Defense

Cyber Crime CenterCyber Crime Center

Jesse KornblumJesse Kornblum

2008 prst, jpeg quantization tables - p21-kornblum_pres

Documents