The amount of multimedia content shared everyday, combined with the level of realism reached by recent fake-generating technologies, threatens to impair the trustworthiness of online information sources. The process of uploading and sharing data tends to hinder standard media forensic analyses, since multiple re-sharing steps progressively hide the traces of past manipulations. At the same time though, new traces are introduced by the platforms themselves, enabling the reconstruction of the sharing history of digital objects, with possible applications in information flow monitoring and source identification. In this work, we propose a supervised framework for the reconstruction of image sharing chains on social media platforms. The system is structured as a cascade of backtracking blocks, each of them tracing back one step of the sharing chain at a time. Blocks are designed as ensembles of classifiers trained to analyse the input image independently from one another by leveraging different feature representations that describe both content and container of the media object. Individual decisions are then properly combined by a late fusion strategy. Results highlight the advantages of employing multiple clues, which allow accurately tracing back up to three steps along the sharing chain.

With today's technologies, the possibility to generate highly realistic visual fakes is within everyone's reach, leading to major threats in terms of misinformation and data trustworthiness. This holds in particular for synthetically generated faces, which are able to deceive even the most experienced observers, and can be exploited to create fake digital identities with synthetic facial attributes, to be used on social networks and online services. In response to this threat, researchers have employed artificial intelligence to detect synthetic images by analysing patterns and artifacts introduced by the generative models. However, most online images are subject to repeated sharing operations by social media platforms. Said platforms process uploaded images by applying operations (like compression) that progressively degrade those useful forensic traces, compromising the effectiveness of the developed detectors. To solve the synthetic-vs-real problem “in the wild”, more realistic image databases are needed to train specialised detectors. In this work, we present TrueFace, a first dataset of social-media-processed real and synthetic faces, obtained by the successful StyleGAN generative models, and shared on Facebook, Twitter and Telegram. The dataset is used to validate a ResNet-based image classification model addressing the discrimination of synthetic-vs-real faces in both presocial and post-social scenarios. The results demonstrate that even detectors with extremely high performance on non-shared images struggle to retain their accuracy on images from social media, while fine-tuning with shared images strongly mitigates such performance issues.

With social networks reaching unprecedented numbers of active users and data traffic worldwide, forensic scientists have been working to secure the trustworthiness of online information against the threat of misinformation. Several works have already investigated the possibility to trace malicious contents back to its perpetrators by following the chain of sharing operations. In real-world scenarios, however, users also have the chance to upload images in multiple ways, such as via smartphone apps or desktop browsers. Being able to detect different sharing modalities may represent a valuable and still unexplored insight for forensic purposes. Following this line, in this work we present SHADE, a first collection of real-world images shared from different devices, operating systems, and user interfaces. This database provides the forensic community with a new asset for investigating the peculiar artifacts introduced by different sharing modes, and for validating detection algorithms. The dataset was evaluated by applying a set of feature descriptors borrowed from platform provenance analysis, allowing us to reach promising results in the classification of sharing modalities.

Nowadays living environments are characterized by networks of inter-connected sensing devices that accomplish different tasks, e.g., video surveillance of an environment by a network of CCTV cameras. A malicious user could gather sensitive details on people’s activities by eavesdropping the exchanged data packets. To overcome this problem, video streams are protected by encryption systems, but even secured channels may still leak some information. In this paper, we show that it is possible to infer visual data by intercepting the encrypted video stream of a surveillance system, and how this may be leveraged to track the movements of a person inside the secured area. We trained an automatic classifier on a computer graphic simulator and tested it on real videos, with standard encryption protocols. Experiments proved the transferability of the classifier trained on synthetic sequences, succeeding in the detection of up to four different walking directions on real videos, with a limited amount of intercepted traffic.

The capability of associating an image to its geographical location is a significant concern in journalism and digital forensics. Given the availability of geo-tagged satellite imagery for most of the Earth's surface, retrieving the location of a generic picture can be addressed as a cross-view image matching between aerial and ground views. In this paper, we outline some initial steps toward the development of a fully-unsupervised algorithm for ground-to-aerial image matching, exploiting the view-invariant adjacency relationships of the landmarks appearing in both views. We introduce a graph-based strategy that, given a set of pre-extracted landmarks, localizes the viewpoint of a ground-level 360-degree image within a broad aerial view of the same area, by matching the respective landmark graphs according to a specifically designed likelihood model.

While the phylogenetic analysis of multimedia documents keeps being investigated, some recent studies have shown the possibility of re-using the same strategies to analyze the evolution of computer programs (Software Phylogeny), considering its many applications spanning from copyright enforcement to malware detection. This paper presents a solution for reconstructing the phylogenetic dependencies of different releases of a given program. The proposed method collects cache miss statistics during the program execution, builds a dissimilarity matrix from the results, and then estimates the corresponding Software Phylogenetic Tree (SPT) using a minimum spanning tree algorithm.

The recent development of multimedia has made video editing accessible to everyone. Unfortunately, forensic analysis tools capable of detecting traces left by video processing operations in a blind fashion are still at their beginnings. One of the reasons is that videos are customary stored and distributed in a compressed format, and codec-related traces tends to mask previous processing operations. In this paper, we propose to capture video codec traces through convolutional neural networks (CNNs) and exploit them as an asset. Specifically, we train two CNN s to extract information about the used video codec and coding quality, respectively. Building upon these CNN s, we propose a system to detect and localize temporal splicing for video sequences generated from the concatenation of different video segments, which are characterized by inconsistent coding schemes and/or parameters (e.g., video compilations from different sources or broadcasting channels). The proposed solution is validated using videos at different resolutions (i.e., CIF, 4CIF, PAL and 720p) encoded with four common codecs (i.e., MPEG2, MPEG4, H264 and H265) at different qualities (i.e., different constant and variable bitrates, as well as constant quantization parameters).