Keywords: Digital image forensics, image integrity, authenticity, flatbed scanners, falsification, digitized documents, security mechanism. Résumé Forensiques des images numériques, intégrité de l'image, authenticité, scanners à plat, falsification, documents numérisés, mécanisme de sécurité

Aucune méthode universelle de détection des contrefaçons d'images n'existe. Plusieurs techniques ont été proposées mais chacune a ses limites. Parmi celles-ci, les techniques dites "forensiques des images numériques" offrent une solution intéressante. Elles visent soit à vérifier l'intégrité de l'image, soit à apporter la preuve de son authenticité en identifiant le système qui l'a acquise. Pour ce faire, elles tirent avantage de la manière dont les systèmes d'acquisition produisent leurs données. Dans cette thèse, nous nous intéressons en particulier aux scanners à plat comme système d'acquisition et nous proposons d'étudier et de développer des techniques de "forensiques des images numériques" pour des documents multi-type scannés et suggérer, sur la base de ces outils, un environnement sécurisé et adapté pour la lutte contre tout type de falsification de documents d'importance numérisés ; un environnement flexible proposant des services de transactions de confiance à des personnes ou des entités morales.

Le premier pas consiste à identifier des caractéristiques extraites des images, ou une combinaison d'entre elles, qui offre un bon compromis en termes de capacité à discriminer un scanner et aussi de robustesse, tout en étant le plus générique possible, c'est-à-dire transposable d'un scanner à un autre. Nous avons, tout d'abord, proposé une technique permettant d'identifier la marque du scanner à l'origine d'un document scanné JPEG à partir de son entête. Ensuite, nous nous sommes intéressés à des images TIFF. Un premier type d'approches a été développé sur la base d'un ensemble de signatures extrait des images et caractéristique d'un scanner. Le principe de la première méthode est fondé sur les propriétés statistiques des coefficients des sous-bandes de hautes fréquences de la transformée en ondelettes. Dans le cas de papiers administratifs et où le document de référence est accessible, nous offrons une autre méthode qui, profitant de cette connaissance a priori, permet de supprimer le maximum du contenu non pertinent et mieux isoler le bruit propre à un scanner. Ce bruit, une fois moyenné selon la direction de numérisation, servira comme signature d'un document numérisé. Le deuxième type d'approches a focalisé sur l'extraction automatique des signatures des scanners à travers des réseaux de neurones 1D et 2D. Ces approches se sont avérées plus efficaces dans la distinction des scanners de même modèles et ne nécessitent pas des images numérisées de grand nombre pour l'apprentissage.

Ensuite, nous proposons une nouvelle approche, appelée "Device Linking", qui détermine si deux images ont été acquises par le même scanner ou non. Cette approche est différente des autres approches forensiques vu que son but n'est pas d'identifier la marque ou le modèle du scanner source, mais plutôt déterminer si les bruits résiduels dans les deux images sont similaires. L'un des avantages de cette approche est que la connaissance des modèles de scanner des images étudiées n'est pas requise.

Enfin, dans la continuité de ces travaux, nous fournissons deux mécanismes de sécurité capable de détecter les manipulations du contenu des données numérisées avec un minimum de taux d'erreur en se basant sur certaines approches d'identification du scanner source proposées précédemment. Dans le but de valider les solutions proposées dans des situations réelles et réaliser des comparaisons entre elles, nous avons construit une base de données de documents scannés que nous avons rendue publique.

First and foremost, I'd like to express my heartfelt gratitude to my supervisors Prof. Gouenou Coatrieux and Prof. Riadh Abdelfattah, who have been constantly supportive and inspiring during my Ph.D. studies. Their great personality, guidance, unlimited patience, and tolerance have educated me a lot more than scientific research. They transmitted to me the high motivation and the commitment to work. I owe them my eternal thankfulness. I am extremely thankful to Prof. Imed Riadh Farah, and Prof. Olivier Strauss, for taking their precious time to review my thesis manuscript. I also would like to gratefully thank Prof. Laurent Nana, Prof. Sadok El Asmi, and Dr. Johanne Vincent, for being examiners on my Ph.D. defense committee. Valuable remarks provided by respectful experts in this field like them would improve the thesis's quality.

To the person who contributed directly to the completion of my thesis, foremost, I would like to express my deepest gratitude to Prof. Basel Solaiman for his valuable support. He believed in me and pointed me in the right direction. I would not have been able to complete this Ph.D. without his devoted and precious guidance. I am greatly indebted to Dr. Wajih Ben Abdallah who has assisted me with high efficiency and availability and has accompanied me during my first year of Ph.D. A warm thank goes to Prof. Sofiane Cherif, Prof. Fethi Tlili, and all the other SUPCOM members for supporting me in difficult moments and enjoying the good ones. I would like to deeply thank Prof. Fatma Abdelkafi and all my teachers Prof. Amel Ben Azza, Prof. Sofia Ben Jbara, Prof. Rached Hamza, Prof. Nabile Tabbane, M. Slah Bouhari, Dr. Asma Ben Ltaifa.. for their unwavering support which pushed me to achieve what I never thought possible. I want to thank my colleagues at SUPCOM, Yosra, Emna, and Olfa for creating such a crazy and funny work atmosphere. It was the best I could hope for, especially given the stressful circumstances. I want also to thank the members of the ITI department, Corinne, Sahar, Kamilia, Yutong, Zahran, David, and Anas for the friendly and adorable environment they offered to me every time I stayed in Brest. The work presented in this thesis is supported by the CMCU project number 17G1405, which is funded by the French Ministry of Foreign Affairs and Ministry of Higher Education and Research, as well as the Tunisian Ministry of Higher Education and Scientific Research. Thus, I would like to express my gratitude to them for the financial support, without which the SUPATLANTIQUE dataset would not exist. I am indebted also to my friend Khaled El Hmedi for designing its logo. Finally, I would like to eternally thank my family. I owe them my endless love and gratitude. Their support, understanding, and encouragement in every single moment of my life have been and always will be the most important thing which gives me the strength to chase whatever I want. To my husband, Mr. Jabrane Ben Othman for being by my side, and for all the inspirations and love he brings to my life. Last but not least, to my daughter, Amel, for making my graduate life more bearable and full of fun.

Abstract

There is no universal method for detecting counterfeit images. Several techniques have been proposed but each has its limits. Among these methods, the so-called "digital image forensics" techniques offer an interesting solution. They aim either to verify image integrity or to provide proof of its authenticity by identifying the system which acquired it. To do this, they take advantage of how the acquisition systems generate their output.

In this thesis, we are particularly interested in flatbed scanners as an acquisition system and we propose to study and develop "digital image Forensics" techniques for multi-type scanned documents and suggest, based on these tools, a secure and suitable environment for fighting against any type of falsification of important digitized documents; a flexible environment offering trusted transaction services to individuals or legal entities.

The first step is to identify characteristics extracted from images, or a combination of them, which offers a good compromise in terms of ability to discriminate a scanner and also of robustness while being as generic as possible, that is to say, transposable from one scanner to another. We first proposed a technique to identify the brand of the scanner that is at the origin of a scanned JPEG document from its header. Next, we were interested in TIFF images. A first type of approach was developed on the basis of a set of signatures extracted from images and characteristic of a scanner. The principle of the first method is based on the statistical properties of the coefficients of the high frequency sub-bands of the wavelet transform. In the case of administrative papers and where the reference document is accessible, we offer another method which, taking advantage of this a priori knowledge, makes it possible to remove as much of the irrelevant content as possible and better isolate the noise specific to a scanner. This noise, when averaged according to the scanning direction, will serve as the signature of a scanned document. The second type of approach has focused on the automatic extraction of the scanners' fingerprints through 1D and 2D neural networks. These approaches have been shown to be more effective in distinguishing scanners of the same model and do not require large numbers of scanned images for training.

Next, we propose a new approach, called "Device Linking", which determines whether two images were acquired by the same scanner or not. This approach is different from other forensic approaches in that its purpose is not to identify the make or model of the source scanner, but rather to determine if the residual noises in the two images are similar. One of the advantages of this approach is that knowledge of the scanner models of the investigated images is not required.

Finally, as a continuation of these works, we provide two security mechanisms capable of detecting content manipulation of scanned data with a minimum error rate, based on certain approaches of source scanner identification proposed previously. In order to validate the solutions proposed in real situations and make comparisons between them, we have built a database of scanned documents that we have made public. compared to an approach adapted from Guru et al. [START_REF] Swaroop | Device-based image matching with similarity learning by convolutional neural networks that exploit the underlying camera sensor pattern noise[END_REF] . . . . . . 5.9 Accuracy results of our DLK system when applied to full images.

Each block from the diagonal corresponds to the rate of correctly identifying a pair of images as sourced from the same scanner. The remaining blocks are the result of two images acquired by different scanners. The column on the right refers to the average accuracy for each scanner . the manipulated regions marked by orange rectangles (c) binary mask100 6. [START_REF] Kumar | A Review on Implementation of Digital Image Watermarking Techniques Using LSB and DWT[END_REF] The general pipeline of the proposed schemes . . . . . . . . . . . . . 6.8 Forgery detection process using the proposed approach (i=1..K, K is the number of images acquired by the scanner) . . . . . . . . . . 6.9 An illustration of a pair of histograms (a) [START_REF] Choi | Scanner identification using spectral noise in the frequency domain[END_REF] method (in %) -TIFF images 3.9 Confusion matrix for the proposed method (in %) -JPEG (QF=75) images . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.10 Scanners used in experiments . . . . . . . . . . . . . . . . . . . . . 3.11 Confusion matrix for the method in [START_REF] Gloe | Forensics for flatbed scanners[END_REF] (in%) -TIFF images . . . 3.12 Overall identification accuracy for spectral methods [START_REF] Choi | Scanner identification using spectral noise in the frequency domain[END_REF] and wavelet method [START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF]

List of Tables

General context and problem statement

The evolution of information and communications technologies are at the origin of major societal changes such as the dematerialization of many services and administrative documents (state -civil status, banking -account statements, notarial acts etc.). However, this transition to a fully digital world did not completely suppressed the use of paper documents: those that are/were processed in paper form before dematerialization such as the medical records of a health establishment or documents for which the regulations require passing through a paper version subsequently scanned once completed such as notarial acts. Thus, interfacing these new and old worlds involves the digitization of documents that can then be easily distributed, exchanged, collected and processed, speeding up procedures while reducing costs. Several countries have even archived their commercial, administrative and political documents in order to preserve their heritage and restore important documents. That is the case of France which has created a diplomatic archive which has nearly 180,000 documents [START_REF]Victoires des Acteurs publics[END_REF]. That is also the case of Tunisia which is putting plans and strategies related to the digital transformation with the aim of modernizing the administration and guaranteeing citizens online services in line with their needs. However, while this development makes it easier to access and process information, it also raises many security questions. For example, one might question the origin of a scanned document as well as its integrity, our interest in this thesis lie in these aspects. They are critical since documents in paper form do not include security elements (watermarks, hologram etc.) as there are for banknotes or passports.

1 2 1.

General context and problem statement

Indeed, today, a malicious third party can quite simply falsify the content of a scanned document to his advantage using image editing software without leaving visually detectable traces [START_REF] Farid | Digital doctoring: how to tell the real from the fake[END_REF]. This fact is causing a serious dilemma in countries like the United Kingdom (UK) which rely on importing foreign workers. According to a 2015 Guardian study on foreign labor, doctors from at least 27 nations were hired in 32 of England's 160 hospital trusts [START_REF] Mayce | Document Forgery in Healthcare: The Integral Role of Primary Source Verification as a Solution[END_REF]. But, given the current global prevalence of document forgery (2.32% as of April 2016), it appears quite plausible that there are a considerable number of unqualified healthcare professionals working in the UK. Note that in 2020, the ministry of public health in Qatar has blacklisted 23 health practitioners: 17 doctors, two nurses, and four allied healthcare workers after it was discovered that they had provided forged certificates [START_REF]Certificate Forgery: QATAR Blacklists 17 Doctors, 2 Nurses and 4 Allied Health Workers[END_REF]. In fact, hundreds of fake diplomas, medical insurances and working certificates are invading daily and no industry is safe from this menace which affect not only the employment market but also the people's safety. Different solutions and approaches have been proposed for protecting multimedia data, in terms of content. These ones can be classified into two categories: active and passive (see Fig. 1.1).

Figure 1.1: Classification of digital data protection approaches

Active techniques generally require a preprocessing step. These are cryptographic mechanisms (e.g. encryption [START_REF] Chen | Blockchain based searchable encryption for electronic health record sharing[END_REF], digital signatures [START_REF] Triand | Digital Document Security on Legalize Higher Education Diplomas with Digital Signature and SHA-1 Algorithm[END_REF]), watermarking [START_REF] Kumar | A Review on Implementation of Digital Image Watermarking Techniques Using LSB and DWT[END_REF] or cryptowatermarking [START_REF] Borra | Crypto-watermarking scheme for tamper detection of medical images[END_REF]. Encryption consists of converting a clear plaintext data into a non-interpretable cipher-text data using an encryption method parameterized by encryption keys, as shown in Fig. 1.2. While encryption is helpful for maintaining confidentiality, digital signatures will help with stored data integrity. However, those cryptographic solutions offer an a priori protection. In another word, the data is protected as long as it is encrypted or as long as its signature has not been deleted. Moreover, they constrain the data format and raise questions about sharing keys. Herein lies the value of an a posteriori protection which is provided by watermarking. By definition, watermarking allows inserting into a document (e.g. image, video, signals, databases . . . ) a message, or equivalently a watermark, by means of imperceptible modifications of this latter. Taking an image as example, the watermarking process will modify the gray values of some pixels so as to encode a message. Moreover; depending on the relationship between the watermarked message and the host document, it becomes possible to know the origin of the document and/or if it has not been falsified, to embed some access right and/or granted access duration [START_REF] Kumar | Joint encryption and compression-based watermarking technique for security of digital documents[END_REF]. As defined, the message being inserted directly into the document, such a protection is independent of the format of storage of the data. Nevertheless, deploying this technology implies being able to watermark a document as soon as it is produced. In our context, this requires that a watermarking module is integrated as a security component into all scanners. This is practically not feasible given the manufacturing cost and the design complexity increase of a scanner. Moreover, this operation may affect the visual quality of the digitized image while imperceptibility is an important requirement in all watermarking applications, particularly in the case of medical images. Let us recall that a watermarking system must handle the trade-off between the capacity, robustness and imperceptibility requirements. In these perspectives, it is of paramount importance to develop solutions to ensure authenticity and integrity of digital images without relying on pre-registration or pre-embedded information. Let us recall that the authenticity brings a proof that a document is acquired by the correct source, while the purpose of integrity is to find out whether or not a document has been manipulated. An interesting alternative is offered by the passive techniques known as "digital content forensics (DCF)" [START_REF] William | A review of digital image forensics[END_REF]. These techniques aim at verifying if an image has been modified or at providing a proof of its origin, that is to say: identifying the scanner that acquired the image. These methods work in a blind way in the sense that they do not rely on some a priori information on the data (e.g. a data signature or any other ancillary information) shared with the data to protect. When applied to images, the basic concept on which relies digital content forensics stands on the extraction of some image characteristics or features coupled or not with machine learning processes in order to constitute an image imprint that can be used by a verification process either to identify the image origins or to detect image modifications. In the last 15 years, the number of works in the field of digital image forensics (DIF), the field of DCF devoted to digitized images, has increased considerably. However, the effectiveness of the proposed approaches remains relative and are mostly dedicated to digital cameras. On the other side, the ever-growing number of digital documents acquired every day and shared through unsecured public networks increases dramatically the number of threats. Thus, it is important to provide adequate and reliable solutions to respond to multimedia content protection issues in the digital transition and the dematerialization of data and services. The objective of this thesis is to provide a secure and suitable environment for verifying the authenticity and detecting the falsification of important digitized documents; a flexible environment offering trusted transaction services to individuals or legal entities.

Specific objectives

Specific objectives

Due to COVID-19 pandemic, millions of employees had to work from home for the first time which makes them an easy target for cyber criminals. Moreover, the demand for proofs of document authenticity and integrity especially in e-commerce and e-government applications has been rising faster than expected. Indeed, number of cyber-attacks has increased in the recent years leaving disastrous effects on companies and institutions as well as persons' emotional, financial, and professional life.

To counter-fight these threats, several protection and verification mechanisms have been deployed. Among them, digital image forensics has become a common practice to address data security problems. In many countries, it is used as part of the measures taken by the defense and security forces to protect their data against cyber-attacks [START_REF] Srinivas | Government regulations in cyber security: Framework, standards and recommendations[END_REF]. Their strategy consists in answering a twofold question:

• Which device is at the origin of a digitized/scanned image?

• Has the content of the image been manipulated?

The first question is related to the problem of image source identification which is one of the primary goals of DIF. In fact, knowing the device that have acquired the questioned image may help verifying its integrity as well as to trace the device owner. The second question is about image integrity. The fundamental tasks of forensic analysts in this case are to detect existence of forgeries, determining the manipulation that have been performed and localizing the tampered regions within the questioned image. Most of the research conducted in this area are not adopted to document scanners, while thousands of digitized documents are processed on a daily basis and are in danger of being stolen or forged. At the same time, existing solutions cannot claim to be successful as we will see in the following chapter. Therefore, in this thesis, we are interested in developing efficient forensics solutions to overcome information security challenges related to flatbed scanners. More specifically, the problems of source identification and forgery detection are investigated.

Contributions

To solve the first problem, we initially choose to conduct our research on documents scanned and compressed in Joint Photographic Experts Group (JPEG) owing to the fact that this format is widely used in the Internet thanks to its capability to compress images and thus saves in term of transmission and storage. We demonstrate that it is possible to use the JPEG image header for SSI. In fact, and as we will see, the scanner's fingerprint is obtained from the quantization table since we found that each scanner uses its own customized quantization matrices. JPEG, however, is not the best choice for scanning important document such as official documents, scientific and medical images as it involves lossy and irreversible compression [START_REF] Sakariya | DIGITAL PRESERVATION: PROCESS AND STANDARDS[END_REF]. Moreover, once the header information got altered or lost, this solution becomes no more effective. Thus, in the rest of the thesis, we focus on the Tagged Image File Format (TIFF), a raw or lossless image format which not only preserves the quality and the clarity of the images content but also allows us to address the issues raised in this thesis by going back to the scanner acquisition chain and extracting identifiable characteristics specific to the scanner components serving as forensic evidence. From this standpoint, we went further proposing handcrafted solutions [START_REF] Ben | Identification de l'Origine d'un Document Numérisé sur la Base d'une Empreinte de Scanner Dans le Domaine des Ondelettes[END_REF][START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF][START_REF] Ben Rabah | Semi-Blind Source Scanner Identification[END_REF] that can give access to the scanners traces left in the acquired images: i) In the first solution, original handcrafted features are extracted in the wavelet domain (see appendix B) using the Discrete Wavelet Transform (DWT). In order to identify the source scanner, the Kullback-Leibler Divergence (KLD) between the features extracted from one image and those designed for each scanner is measured and the scanner that presents the lowest measure is selected. Experimental results have shown that our method offers better performance compared to the recent stateof-art method [START_REF] Choi | Scanner identification using spectral noise in the frequency domain[END_REF]. Nevertheless, giving the similarities between the manufacturing processes of scanners of the same model, it is difficult to detect near-perfect features to identify them as different sources. Indeed, one limitation of this approach is that it fails when scanners of the same make and model are used; ii) In some cases, the original reference document (e.g. form and agreement before being filled and scanned...) is already known. For example, we may analyse a school registration form or a rental agreement. In those cases, the investigated images are scanned copies of these documents after being printed, filled and signed by someone. Considering this a priori knowledge, the second solution successfully achieved effective scanning noise extraction by employing a kind of a background subtraction to remove the maximum of image details which are at the origin of source scanner misclassification. The performance of this solution was verified along with its ability to discern similar scanners (same model). However, this can be only achieved when the reference document is available. Due to the shortcomings of the handcrafted features extraction based solutions, we decided to work on automating the features extraction process, an original topic in scanned images forensics research. In this thesis, two following approaches [START_REF] Ben Rabah | Automatic source scanner identification using 1D convolutional neural network[END_REF][START_REF] Ben Rabah | Boosting up Source Scanner Identification Using Wavelets and Convolutional Neural Networks[END_REF] are developed based on convolutional neural networks (CNN) that outperform the previous traditional approaches: i) Firstly, a two dimensional CNN (2D-CNN) architecture is proposed to classify images according to their sources. In order to ensure better scanner features detection and alleviate the limitations of the DWT, the Stationary Wavelet Transform (SWT) is applied to give access to its HH subband which will serve as an entry to our network and therefore reduce the effect on image content when learning features representations; ii) A more sophisticated method is proposed based on the fact that scanning is realized line by line and, thus, its noise is repeated over the rows of the digitized document. Therefore, a one dimensional CNN (1D-CNN) combined with a support vector machine (SVM) is adopted to perform an automatic learning of the scanning noise related to each scanner. In order to validate the efficiency of these methods, large-scale experiments were carried-out. The main weaknesses of all the above mentioned methods is that they rely on the availability of the source scanner fingerprints. More clearly, if the investigated image was acquired by non-accessible scanner, it will lead to false matches. Furthermore, one may just need to compare the source similarity of a pair of images. To this end, the 2D-CNN approach proposed earlier is expanded together with a similarity score generator to check if two documents were acquired by the same scanner or not without requiring physical access to that scanner, a challenging issue known as device linking (DLK). Furthermore, it is worth noticing that DLK is a versatile strategy that can be used in a variety of practical situations such as database inconsistency verification and editing operation comparison. In addition, we built a large-scale image dataset [START_REF] Ben Rabah | The SUPATLANTIQUE scanned document database for digital image forensics purposes[END_REF] to foster the research on scanned documents in the field of DIF and to be able to share our findings without worrying about the threat of copyright infringement. We expect that this publicly available1 database will become a reference in this field. In order to solve the image forgery detection (IFD) problem, the second part of this Ph.D. thesis work, we introduce two novel techniques that can not only determine if the image has been digitally forged or not, but also find the region that has been altered; the first is proposed based on a perceptual blocks' histogram comparison

Contributions

and is inspired by the wavelet-based method introduced in Chapter 2. The second applies our 2D-CNN model to identify which blocks of the investigated image are not matching the same source of the remaining ones. Their performances are evaluated on a dozen of forged images from our public dataset. All those goals and the techniques we developed so as to reach them are illustrated in the flowchart given in Fig. 1.3 (Please refer to the Abbreviation section for acronyms). We mentioned in purple color the chapters where each question has been answered and in blue color references to our works that have been valued via scientific publications. Our contributions are numbered in red color and we highlighted in green the systems that we developed.

Thesis outline

Literary forensics works which focused mainly on flatbed scanners are very few. Hence, the main purpose of this thesis is to find new and more performant forensics solutions to solve security issues related to source scanner identification and tampering detection in scanned documents.This manuscript is structured in six main chapters:

The second Chapter provides a general overview on the field of digital image forensics and reviews the state-of-art forensics methods that have been proposed to solve the device identification problem as well as forgery detection problems with a focus on those related to flatbed scanners. For that, we start by describing the scanning process to better understand how those methods were derived. In Chapter 3, we study handcrafted features and propose different solutions to identify the scanner at the origin of a questioned image for different identification levels (brand-model-device). As we will see, one of the most challenging problems in the field is distinguishing between scanners of the same model. Performance of these solutions are experimentally validated showing identification accuracies that outperforms existing schemes. In Chapter 4, we propose an amelioration of the handcrafted features extraction based techniques presented in the chapter 3 by exploring NN approaches. The proposed schemes originality stands on the fact that it allows identifying image source scanner using features learn automatically from input images. Those features demonstrated improving capabilities to discriminate between scanners. In Chapter 5, a DLK scheme for matching image sources is considered. Its goal is to know whether two images were acquired by the same scanner or not which is a valuable forensic investigation tool. We demonstrated that our scheme achieved promising results. Chapter 6 is devoted to image forgery detection. We start by presenting a novel dataset that we have created using 11 scanners as benchmark for image forensic tasks. Then, we propose two approaches to detect splicing forgery in scanned documents based on solutions proposed in Chapter 3 and 4. Performances evaluation of our approaches using the forged image contained in our dataset concludes this chapter. Finally, Chapter 7 gives a general conclusion and discusses some perspectives for future work. Scanners serve as a link between the physical and digital worlds, making document storage and sharing easier and faster. It lowers expenses, saves spaces and reduces the risk to lose critical documents. Companies, banks, and many other organizations use digitization to save hundreds of thousands of dollars in printing, shipping, and storing documents each year. Access to information, on the other hand, is made easier, which raises security concerns. It is obvious that our trust in images has degraded even when published in popular newspapers and official 10 2.1. Image acquisition pipeline of a flatbed scanner websites as anyone can now capture, store, and process digital images due to the availability of various image editing tools that allow the manipulation of the content of digital images in an easy and unnoticeable way. Thus, the need to argue about the authenticity and integrity of those images. Image security is a long-standing issue in the field of Digital image forensics (DIF). In recent years, this field has shown an important progress and experienced new devices such as scanners. It is derived from existing domains relating to multimedia security such as digital watermarking and steganography. As stated, image forensics relies on the intrinsic features of the "noises" embedded in the digital image by the device that has acquired it. It, then, uses those artifacts to identify the source device and detect manipulations of the digital images. It is thus mandatory to have an adequate understanding of the basic working principles of a flatbed scanner, so as to understand how are noises introduced in the final image. This is the objective of the first part of this chapter: presents how a scanner works. In the second part, we outline the basics of the emerging field of DIF related to this device by reviewing the solutions proposed in literature to solve the problem of source scanner identification. We introduce the problem of forgery detection in the third part and how the previous techniques proposed to associate the source device can serve to solve this problem. We go also through the limitations as well as the contributions of those methods.

Image acquisition pipeline of a flatbed scanner

Understanding how a scanner works is a mandatory knowledge to get in order to develop efficient passive image forensics techniques.

The basic concept of a document scanner is to convert paper items into a digital format. We distinguish different categories of scanners depending on their intended use. The most common document scanner types are:

• Flatbed scanners (Fig. 2.1.a). They are the best-known used scanners. Such a device simply uses a glass surface over which the item to scan is placed and digitized. Most large-selling flatbed scanners are designed for A4 and letter paper. Nevertheless, there are various flatbed scanners that can handle other paper sizes such as A1, A2...

• Sheet-fed scanners (Fig. 2.1.b). They differ from flatbed scanners in terms of the format and weight of the items that they can handle. It is specifically limited to papers. It cannot be used to digitize thick objects like books and ID cards. The scan is realized by moving papers across a stationary scanning unit.

• Handheld scanners (Fig. 2.1.c). They are specifically designed to quick scanning applications like barcode reading. A data is captured by moving the handheld scanner across the surface of the item to scan. They are accurate and reliable but cannot offer good scanning quality, especially due to the operator movements.

• Drum scanners (Fig. 2.1.d). They are used to scan materials with an extremely high resolution that may exceed 10000dpi while, for the other scanners, the resolution cannot surpass 9600 dpi. During the scanning operation, a document is mounted in a glass cylinder and sent to a drum called drum scanner's photomultiplier tube (PMT) rotating at a very high speed. Regardless of their high price, drum scanners are still the ultimate solution to produce posters and other large images. In this work, our interest has been given to flatbed scanners due to their availability and to the fact that they are the most used, by professionals as well as by individuals.

DIGITAL IMAGE FORENSICS: SOURCE SCANNER IDENTIFICATION AND FORGERY DETECTION 11

They also have a substantial advantage over other types of scanners as they are well known for their high quality scans.

A typical scanner imaging pipeline is illustrated in Fig. 2.2. As it can be seen, the document is in a first time placed on the glass plate under a closed lid to ensure that the external light does not enter the device and to prevent the document from moving. Next, a pass is realized by a motor slowly moving a scanning unit across the scanner's glass. The scanning unit is usually composed of a light source, mirrors, lens, and a charge Coupled Device (CCD) array. In order to ensure a constant pass without any wobble or deviation, this unit is attached to a stabilizer bar. Real photos of the scan head moving along the scanner glass are shown in Fig. 2.3. Over the last 10 years, scanner manufacturers have delivered inexpensive scanners using a new technology called Contact Image Sensor (CIS) which differs a bit from the CCD. As shown in Fig. 2.5, the main difference between CCD and CIS lies in the fact that the light reflected from the document in a CIS architecture is sent directly through an array of fiber optic lenses to the image sensors instead of using mirrors and a standard lens. Although this fact makes CIS-based scanners thinner and more energy efficient than a traditional CCD-based scanners, it prevents it from producing high quality results. In another word, the brighter the region of the image, the more transmitted light, which results in a higher voltage. This analogue-to-digital conversion process is a very sensitive step that may cause noise and electrical interference. Finally, the driver, a software adapted to communicate with the scanner, works on delivering a full-color image in the desired format. One of the main characteristics of scanners is the resolution mainly expressed in DETECTION 13 dots per inch (dpi) or pixels per inch (ppi), where 1 inch is equivalent to 2,54 cm. It is a representation of a scanner's enlargement capability. The scanners differ in their resolution and, therefore, in their cost. The higher the resolution, the more expensive the scanner is. The resolution of a scanner is measured by the number of a single row sensors in a CCD or CIS array and by the precision of the stepper motor. We distinguish the native or hardware resolution which is the maximum number of pixels per square inch a scanner can capture.

DIGITAL IMAGE FORENSICS: SOURCE SCANNER IDENTIFICATION AND FORGERY

Comparison to digital cameras

Digital cameras may sometimes serve as scanners. However, despite their speed and their portability, they are not well adapted for document scanning especially when a high resolution is required. In fact, the image acquired by a camera will be affected by distortion, reflections, shadows, and blur due to the problem of stabilization of the camera during exposure. Since scanners use similar technologies as digital cameras, it is interesting to consider those similarities for forensic applications. Overall, they both shared the same fundamental components for capturing the object's color values. Both also use similar analog-to-digital converters (ADCs) and conduct similar post-processing operations such as edge enhancement and colors adjustment. The objective of the post-processing is to reduce noises and artifacts produced in the previous stages and to enhance the final image appearance. However, it is important to notice that, compared to digital camera, flatbed scanners present distinct imaging sensors geometries as illustrated in Fig. 2.6. In fact, scanners use trilinear CCDs corresponding to the red, green and blue color channels, whereas digital cameras use 2-D periodic arrays. The scanners can directly capture all the three-color components of each raster line through the trilinear CCD array along with the line-by-line mode allowed by the motion system. Digital cameras instead use a 2-D CCD array to take one shot of the whole 2-D scene. As only the value of a single color component can be calculated by each CCD sensor, color interpolation is required for two remaining color components to be obtained. Serving as a crucial step in the imaging process of digital cameras, the coefficients of color interpolation have been used in the literature to distinguish different camera models.

Scanned image origin identification

The common idea of passive approaches for SSI is that a scanner leaves an inherent intrinsic pattern in the image it acquires [START_REF] Gloe | Forensics for flatbed scanners[END_REF]. This pattern, if correctly extracted, can help discriminating between different scanner brands, models, and even between scanners of the same model. In fact, every step in the image acquisition pipeline adds some noise to the final image that can contribute to the elaboration of a unique scanner pattern. The choice of noise characteristics is the clue to an accurate and efficient SSI.

The features selected should meet the following conditions:

• Authenticate each scanner independently of document type and content.

• Enable to discriminate between different scanners whatever their make and model.

• Remain the same whatever the scanning area selected Even though there are several approaches for SSI, the forensic investigation process, illustrated in Fig. 2 We come back on the details of these main approaches in the following.

DIGITAL IMAGE FORENSICS: SOURCE SCANNER IDENTIFICATION AND FORGERY DETECTION 15

Spatial domain features

For documents analysis, some digital investigators relied to an inherent mark of scanning: the noise effect which is due to its materials and components the manufacturing processes of which are imperfect.

During the scan, color sensors capture light reflected from the original paper and then translate it into digital values. Reflected light is equal to the number of photoelectrons recorded by the color sensor over each time span, which is then converted to analog signals such as voltages. Because of the random nature of photoemission, many forms of noise occur [START_REF] Gerald | CCD arrays, cameras, and displays[END_REF]:

• Shot noise: It is common when the charge carriers (for example electrons) pass through a gap resulting in random statistical changes of the electric current.

If electrons flow across a barrier, their arrival times are discrete. Shot noise can be seen in those separate arrivals.

• Quantization noise: It is a quantization error model introduced by the quantization in the ADC. It is a rounding error between the ADC's analog input voltage and the digitized output value. The noise is nonlinear and dependent on the signal.

• Reset noise: It occurs when the reset of the capacitor happens before the charge accumulation cycle. In an imaging system, it might be the dominant noise source but can be fully removed by the Correlated Double Sampling (CDS) technique [START_REF] Marvin | Characterization of surface channel CCD image arrays at low light levels[END_REF].

• 1 / f noise: It depends on the frequency of the detected signal. The higher the noise, the lower the frequency. It is typically very low in comparison to the other noises mentioned above. It may found in amplification systems as well as some passive elements.

• Fixed pattern noise (FPN): It refers to the spatial variation in pixel output values caused by device and interconnect parameter variations across the sensor which occur due to manufacturing imperfections.

As the shot noise and the quantization noise vary from one image to another, they cannot be used for scanners' identification. That is not the case of the FPN. It is fixed for a given sensor but varies from one to another and, consequently, is a good source of features for identifying the scanner. If we go more into the details of FPN, it typically refers to two types of noise that are of concern for use in forensic classification; the dark signal non-uniformity (DSNU) and the photo response non-uniformity (PRNU) [START_REF] Gerald | CCD arrays, cameras, and displays[END_REF]. Together, they introduce a structured noise pattern over the scanned image that can be later explored for SSI. When the sensor is not illuminated, the DSNU creates pixel-to-pixel variations among pixels in the analog voltage. In contrast, the PRNU causes variations when the sensor is illuminated under a fixed-intensity light. It is important to know that, by device calibration and offset correction, DSNU and PRNU can be compensated to some degree. Even though noises compensation and reduction methods are used, it has been shown that scanned images still maintain a certain amount of noise that can serve for identifying the scanner at the origin of an image. Such a method basically relies on extracting some of its statistical features. Generally, the first step to generate the scanner's pattern is to extract the noise I n of each image acquired using a denoising filter F :

I n = F (I) = I -I d
(2.1) where I and I d denote the scanned image and its denoised version, respectively. I is of size N x M (N rows and M columns). Note that since the PRNU noise κ is modeled as a multiplicative noise-like signal, I may be expressed by

I = I 0 d + κ.I 0 d + ξ = (1 + κ).I 0 d + ξ (2.2)
where I 0 d is a zero-noised version of I and ξ is the sum of independent random noises which may contain other image content details, given the fact that F cannot adequately remove them. Next, the expression of I n is rewritten as follows

I n = (1 + κ).I 0 d + ξ -I d = (1 + κ).I 0 d + ξ -I d + κ.I -κ.I = κ.I + I 0 d -I d + κ.(I 0 d -I) + ξ = κ.I + ψ (2.3)
where ψ is the overall combination of ξ with additional weak signals added by the denoising filter. Working on I n helps improving the signal to noise ratio (SNR) for the signal of interest κ.I, thus improving the reliability of the SSI techniques. The choice of the denoising filter is very important in order to accurately extract the fingerprint for source identification and thus to achieve high performance. First methods in the literature adopted the same techniques already used for SCI. In [START_REF] Gloe | Forensics for flatbed scanners[END_REF], for example, a direct extension of the PRNU-based SCI identification algorithm [START_REF] Lukas | Determining digital image origin using sensor imperfections[END_REF] was used for scanner model identification. The reference pattern of each scanner was generated by averaging noise patterns from 100 training images obtained from five different scanners. The images reference patterns are obtained by applying the Mihcak filter proposed in [START_REF] Kivanc Mihcak | Spatially adaptive statistical modeling of wavelet image coefficients and its application to denoising[END_REF] on each image to suppress the image content. The task of SSI is then achieved by measuring ρ S i ,the normalized cross correlation (NCC), between the noise residue R of the questioned image and each of the scanners' reference patterns S i

ρ S i = corr(R, S i ) = (R -R).(S i -Si ) R -R . S i -Si (2.4)
where the bar " . " denotes the mean value and " . " stands for the L2 norm.

The source scanner will be the one that maximize this measure. All tests conducted in this work revealed a lower classification quality relative to related studies for SCI. It has also been found that the use of a 1-dimensional reference pattern provides greater classification accuracy when images are scanned at non-native resolution, whereas the 2-dimensional reference pattern gives better results when images are scanned at the scanner 's native resolution. Besides, another approach [START_REF] Gou | Robust scanner identification based on noise features[END_REF] for scanner model identification based on sensor pattern noise uses three sets of features that are extracted from each digitized image. It obtains the statistical features of the sensor noise estimates through the use of different denoising filters (averaging filter, Gaussian filter, median filtering, and Wiener adaptive image denoising algorithm), high-frequency wavelet coefficients, and neighborhood prediction errors. More investigations and analysis of this approach have been made in [START_REF] Gou | Intrinsic sensor noise features for forensic analysis on scanners and scanned images[END_REF].

Authors in [START_REF] Khanna | Scanner identification using sensor pattern noise[END_REF][START_REF] Khanna | Scanner identification with extension to forgery detection[END_REF][START_REF] Khanna | Scanner identification using feature-based processing and analysis[END_REF] proposed to use the statistical features of the sensor noise along with machine-learning classification such as the Linear Discriminant Analysis (LDA) and Support Vector Machine (SVM). For that, the average row R r and the average column R c of the noise residue are calculated

R r (1, j) = 1 N N j=1 R(k, j) , 1 ≤ j ≤ M (2.5) R c (i, 1) = 1 M M j=1 R(i, k) , 1 ≤ i ≤ N (2.6)
where N is the total number of rows and M is the total number of columns.

In the first approach [START_REF] Khanna | Scanner identification using sensor pattern noise[END_REF], the noise residue is extracted using the anisotropic local polynomial approximation-intersection of confidence intervals (LPA-ICI) denoising scheme [START_REF] Foi | A novel anisotropic local polynomial estimator based on directional multiscale optimizations[END_REF]. The statistical features such as the mean, the median, the standard deviation, the skewness and the kurtosis of the average row R r and of each correlation between that row and each row of the noise residue R were combined and associated to its corresponding scanner. Later, in [START_REF] Khanna | Scanner identification with extension to forgery detection[END_REF][START_REF] Khanna | Scanner identification using feature-based processing and analysis[END_REF], the average column was also considered as well as correlations between it and all the columns of R for the same features. Another measure corresponding to the relative difference in the sensor noise periodicity was added to the previously listed features. The median filter (size 3x3) and the Wiener adaptive image denoising (sizes 3x3 and 5x5) are applied along with the LPA-ICI denoising filter to extract noise residues in [START_REF] Khanna | Scanner identification using feature-based processing and analysis[END_REF]. These methods have shown promising results for scanned photographs, however, their stability in the case of text documents is still questioned as PRNU is almost absent in dark and saturated regions. Moreover, the process of fingerprints extraction of these models is computationally extensive.

Transform domain features

Choi et al. [START_REF] Choi | Scanner identification using spectral noise in the frequency domain[END_REF] decided to work in the Fourier-transform domain to explore different type of noises. The unsharp filter was chosen to denoise the scanned image with the mask h as follows

h = 1 1 + α     -α α -1 -α α -1 α + 5 α -1 -α α -1 -α     (2.7)
where the parameter α is set to 0.1. The authors decided to work with a onedimensional reference pattern by averaging the noise residue along the scanning direction following the eq. 2.5. Next, a DCT is applied to the average row. Finally, before normalizing the reference pattern, a high-pass filter is applied on the DCT coefficients. It is then possible to identify the source of the scanned image by comparing its fingerprint to the fingerprint of each of the available scanners using the Euclidian distance where a scanner's fingerprint is calculated by averaging fingerprints of images scanned by it. While tests have yielded positive results, only distinct scanner models have been tested for 10 images per model. More tests, including multiple devices per scanner model are thus desirable.

Color features

In [START_REF] Sugawara | Identification of scanner models by comparison of scanned hologram images[END_REF], Sugawara approaches the problem of SSI by suggesting a solution that identifies an image source scanner based on the variation in color features across security holograms (example is shown in Fig. 2.8) usually found in low-level currencies. This method is thus limited by the presence of holograms in the image to be questioned and has been proved efficient only under some specific conditions.

Texture features

Most of the proposed SSI methods focused on scanned photograph versions and not scanned printed text documents. However, in the saturated areas of an image and especially in black and white documents, PRNU is almost absent. Therefore, for scanned text documents, these methods may not work well. In this context, Khanna and Delp [START_REF] Khanna | Source scanner identification for scanned documents[END_REF] proposed a new approach to identify the scanner model through texture analysis, where textures are modeled by the gray level fluctuation

DIGITAL IMAGE FORENSICS: SOURCE SCANNER IDENTIFICATION AND FORGERY DETECTION 19

Figure 2.9: Zoomed letter 'e' from a scanned document at 300dpi resolution in the scanned characters. These fluctuations can be observed in the zoomed letter "e" shown in Fig. 2.9. The first step consists in determining the Gray-Level Co-occurrence Matrix (GLCM), an approximation of the second order probability density of the image pixels. Features to be considered for classification are then based on the GLCM. The isotropic gray-level difference histogram (GLDH) is also used to enhance the scanner's fingerprint. It is easily seen that experimental results heavily depend on font shape and size and the presence of character "e" in the text. In another paper [START_REF] Khanna | Intrinsic signatures for scanned documents forensics: effect of font shape and size[END_REF], authors have only focused on GLDH features to improve the robustness against variations in font sizes. In a recent work, Joshi et al. [START_REF] Joshi | Source classification using document images from smartphones and flatbed scanners[END_REF] further proposed a more powerful approach which performs very well for varying font sizes utilizing local tetra patterns (LTrP) [START_REF] Ojala | Multiresolution gray-scale and rotation invariant texture classification with local binary patterns[END_REF] based features. However, its performance is not totally independent from the font shapes/sizes and is affected when blurring regions are present in the digital document. Further, these methods work well only on plain text documents containing a certain amount of characters.

Dust and scratches positions

Due to the imperfection of the design and manufacturing process, the scanner's glass creates undesired effects in the acquired images such as dust and scratches. The position of these defects has been explored for scanner identification [START_REF] Dirik | Flatbed scanner identification based on dust and scratches over scanner platen[END_REF][START_REF] Zeinab | Identifying Unique Flatbed Scanner Characteristics for Matching a Scanned Image to its Source[END_REF]. Indeed, the plate got contaminated by dirt particles and paper debris after using the scanner for a while. Dust and scratches, when accumulated, may cause located defects in the form of white or black spots over the scanned image. Although dust particles appear in the picture as dark spots, glass scratches typically lead to light-reflections that are bright and white. In The idea is that the positions of the glass defects and scratches are strongly adhered to the scanner platen and do not change, even when the platen is manually cleaned. Thus, those positions can represent a unique scanner pattern. However, defects may be introduced when the scanner is extensively used leading to misclassification and thus a drop in the performances. Furthermore, new scanners are equipped with filters that delete most of these defects.

Discussion

To provide key information that can identify or narrow the possible sources of the document, several methods have been proposed. Experiments conducted on these methods, however, did not take into account all types of documents and generally failed to properly classify scanners when there is more than one instance of the same model. The increase of the number of scanners and the decrease of the number of training images may also lead to a decline in performances. Therefore, the work of Forensic Document Examiners on this task still needs more investigation. In this thesis, we worked on developing SSI methods which extract more trustful scanners fingerprints with a better forensic traceability compared with the state-of-the-art methods.

Image forgery detection 2.3.1 Introduction

Nowadays, a digital document may be presented as a proof in court of law1 or used in a forensic investigation. If its content is manipulated, it will lead to controversial, and often tragic decisions that put authorities at risk and harm the reputation of individuals. That's why it's necessary to verify and validate the integrity of the digital document before it is used. With the emerging image editing software like Adobe Photoshop, seashore, GIMP and Coral Draw, it has become very easy for professionals and even for amateurs to forge digital documents and hence the trust in these documents has been corroded. Digital forgery is present in many areas of everyday life (e.g. fake images of politicians, celebrities and news) for years now. For instance, in a photograph published in a Tunisian newspaper "Le Maghreb" in January 29, 2012, the number of protesters was increased by duplicating a section of the crowd (see Fig. 2.11). In fact, the significant number of forged images shared in social networks and messaging applications is the principal source of fake news propagation.

Nevertheless, image manipulations are not applied only on photographs, scanned documents are also concerned. It includes, for example, copying a person's name on a document, copying and pasting a signature, or altering information on a document without its author's consent.

DIGITAL IMAGE FORENSICS: SOURCE SCANNER IDENTIFICATION AND FORGERY DETECTION 21

Recently, in March 2020, a digital document has been circulated on social media saying that travelers arriving from Egypt, Oman and Kuwait are prohibited to enter the state of Qatar and persons holding a Turkish or Iranian nationalities are exempted from this decision. In the original document, only the entrance of passengers coming from Egypt is restricted and the exception is made only for Qatari citizens. The malicious purpose of manipulating such document is probably to increase the crisis between Qatar and Egypt that has already began in 2017. Both documents are shown in Fig. 2.12. It can be seen that it is almost impossible to differentiate between them and that there are no visual clues indicating fraudulence. Therefore, image forgery detection (IFD) schemes [START_REF] Zankhana | Image Forgery Detection using Deep Learning: A Survey[END_REF] are required to protect copyright and prevent malicious alteration of digital images. There are a plenty of approaches proposed in the literature to fight against different types of forgeries. These approaches can be mainly divided into two classes: active (non blind) approaches and passive (blind) approaches as depicted in Fig. 2.13. Approaches belonging to the first category require the insertion or the association of additional information to the digital document to be secured. Existing techniques are based on digital signature [START_REF] Singh | Digital signature verification scheme for image authentication[END_REF][START_REF] Khan | Forgery Detection and Localization of Modifications at the Pixel Level[END_REF] and watermarking [START_REF] Benrhouma | Chaotic watermark for blind forgery detection in images[END_REF][START_REF] Hu | Effective image forgery detection of tampered foreground or background image based on image watermarking and alpha mattes[END_REF][START_REF] Ovidiu Preda | Active image forgery detection scheme based on semi-fragile watermarking[END_REF][START_REF] Lazarov | A fragile watermarking algorithm for image tamper detection based on chaotic maps[END_REF][START_REF] Zhang | Fragile Watermarking Based on LBP for Blind Tamper Detection in Images[END_REF][START_REF] Peng | Image authentication scheme based on reversible fragile watermarking with two images[END_REF][START_REF] Gul | A novel hash function based fragile watermarking method for image integrity[END_REF][START_REF] Prasad | Hamming code and logistic-map based pixel-level active forgery detection scheme using fragile watermarking[END_REF][START_REF] Gong | A secure image authentication scheme based on dual fragile watermark[END_REF], and have limited applications since the images need to be secured at their acquisition or at later stages which is no usually the case of images that are subject of forensic investigations. Thus, passive or forensic approaches are proposed to overcome these limitations. They are called blind referred to their ability to detect alterations without any access to the original image. These techniques can be further classified into manipulation and device based methods.

Manipulation based methods

Manipulation based methods are sub-divided into two categories according to the type of tampering performed on the digital image. The first category, called type dependent forgery, includes splicing and copy-move forgeries. On the other hand, the second category includes forgery-type independent methods in which certain properties of the digital image are manipulated such as resampling and retouching. There has been a substantial amount of study in the area of forgery detection in the last ten years. In [START_REF] He | Digital image splicing detection based on Markov features in DCT and DWT domain[END_REF], the authors extracted Markov features, which have been proved to be one of the most powerful tools for image splicing detection, in both DCT and DWT domains and captured intra-block and inter-block correlations between block DCT coefficients. After that, they used the most sensitive features to train an SVM classifier. In [START_REF] Mushtaq | Novel method for image splicing detection[END_REF], Mushtaq et al. proposed a method based on the grey-level run length matrix (GLRLM) texture features. They used the statistical features extracted from the GLRLM to train an SVM classifier. Moreover, there are some splicing detection methods that have used the local binary pattern (LBP) [START_REF] Ojala | A comparative study of texture measures with classification based on featured distributions[END_REF]. For example, Muhammad et al. [START_REF] Muhammad | Image forgery detection using steerable pyramid transform and local binary pattern[END_REF] proposed an algorithm based on the LBP histogram which extracts features from the Cb and Cr color channels yielded by the Steerable Pyramid Transform (SPT). Again, the SVM is used for image classification after features reduction. LBP is combined with DWT in [START_REF] Hakimi | Image splicing forgery detection using local binary pattern and discrete wavelet transform[END_REF] and with DCT in [START_REF] Alahmadi | Passive detection of image forgery using DCT and local binary pattern[END_REF] to detect splicing forgeries. Traditional Markov-based approaches typically considered the image as a 1-D signal and reported the dependency between each node and its neighbor along one direction.

DIGITAL IMAGE FORENSICS: SOURCE SCANNER IDENTIFICATION AND FORGERY DETECTION 23

In [START_REF] Zhao | Passive image-splicing detection by a 2-D noncausal Markov model[END_REF], the authors improved the model in [START_REF] He | Digital image splicing detection based on Markov features in DCT and DWT domain[END_REF] by using a 2-D non-causal Markov model instead of the traditional one and by replacing the DWT transform with the discrete Meyer transform in order to characterize the underlying dependencies of adjacent pixels in all directions. Zhang et al. [START_REF] Zhang | Joint image splicing detection in dct and contourlet transform domain[END_REF], however, introduced the Markov model to DCT and Contourlet transform [START_REF] Minh | The contourlet transform: an efficient directional multiresolution image representation[END_REF] domain and detected the image tampering by the Markov features extracted in both domains. Since the proposed vector is typically of high dimensionality, SVM with an ensemble classifier (EC) [START_REF] Tg Dietterich | Ensemble learning. The handbook of brain theory and neural networks[END_REF] are used for classification to solve the potential problem of overfitting. Similarly, Li et al. [START_REF] Li | Image splicing detection based on Markov features in QDCT domain[END_REF] proposed a Markov based method that make use of the Quaternion Discrete Cosine Transforms (QDCT) when extracting features. Inspired by this technique, a novel image splicing detection scheme based on Markov features in QDCT and quaternion wavelet transform (QWT) is proposed in [START_REF] Wang | Digital image splicing detection based on Markov features in QDCT and QWT domain[END_REF].

In the above-mentioned techniques, achieving high detection rates with relatively small function dimensions cannot be assured. Thus, a method [START_REF] Shen | Splicing image forgery detection using textural features based on the grey level co-occurrence matrices[END_REF] using textural features based on the Block Discrete Cosine Transform (BDCT) arrays and the GLCM, named TF-GLCM, has been proved to better detect textural information with a low computational complexity. Wang et al. [START_REF] Wang | Coarse-to-fine Grained Image Splicing Localization Method Based on Noise Level Inconsistency[END_REF] recently developed a way of detecting and locating the image splicing using a coarse-to-fine grained technology.

Using the Laplace operator, the local noise is captured and the regions are clustered based on connected region expansion/corrosion. Kanwal et al. [START_REF] Kanwal | Digital image splicing detection technique using optimal threshold based local ternary pattern[END_REF] investigated a method that reveals the image splicing in an image based on the local ternary count.

Contrary to handcrafted features-based methods, the latest advances have centered on deep learning based solutions [START_REF] Rao | A deep learning approach to detection of splicing and copy-move forgeries in images[END_REF][START_REF] Bunk | Detection and localization of image forgeries using resampling features and deep learning[END_REF][START_REF] Liu | Locating splicing forgery by fully convolutional networks and conditional random field[END_REF][START_REF] Salloum | Image splicing localization using a multi-task fully convolutional network (MFCN)[END_REF][START_REF] Chen | An improved splicing localization method by fully convolutional networks[END_REF][START_REF] Xiao | Image splicing forgery detection combining coarse to refined convolutional neural network and adaptive clustering[END_REF][START_REF] Rao | Deep learning local descriptor for image splicing detection and localization[END_REF][START_REF] Ahmed | Image splicing detection using mask-RCNN[END_REF][START_REF] Bihari | A Deep Learning based Method for Image Splicing Detection[END_REF] which have become very popular due to their ability to learn more general features from images.

Copy-move

Copy-move, also known as cloning forgery, is a form of image forgery in which a region is copied and pasted onto another region in the same image frame to mask or duplicate an object in the image. Figure 2.16 illustrates an example of copy-move forgery. In image (b), the signature was hidden by copying an empty block from the original image (a) and pasting it over the signature.

In the last few decades, several copy-move forgery detection (CMFD) methods have been introduced. They can be divided into three categories: keypoint-based, Block-based and hybrid-based methods. The main idea behind the first category is to extract keypoints and their descriptors from the questioned image and then the descriptors are compared to detect forged regions where a keypoint represent a point that does not change even if a geometric transformation is applied to the image Several methods from literature applied the Scale Invariant Feature Transform (SIFT) [START_REF] Chen | Rotational copy-move forgery detection using SIFT and region growing strategies[END_REF][START_REF] Jin | An improved method for SIFT-based copy-move forgery detection using non-maximum value suppression and optimized J-Linkage[END_REF] and Speed Up Robust Feature (SURF) [START_REF] Dhivya | Copy-move forgery detection using SURF feature extraction and SVM supervised learning technique[END_REF][START_REF] Vt Manu | Detection of copy-move forgery in images using segmentation and SURF[END_REF][START_REF] Wang | An Image Copy-Move Forgery Detection Scheme Based on A-KAZE and SURF Features[END_REF][START_REF] Wang | An Image Copy-Move Forgery Detection Method Based on SURF and PCET[END_REF] to extract keypoints. A more computationally expensive technique is developed by Yu et al. [START_REF] Yu | Feature point-based copy-move forgery detection: covering the non-textured areas[END_REF] which combines hue histogram descriptor and the multi-support region order-based gradient histogram (MROGH). Li et al. [START_REF] Li | Keypoint-based copy-move detection scheme by adopting MSCRs and improved feature matching[END_REF] used the Zernike moments [START_REF] Ryu | Detection of Copy-Rotate-Move Forgery Using Zernike Moments[END_REF] to represent the extracted features and the Maximally Stable Color Region (MSCR) as a detector. Another way to extract keypoints based on the Oriented Fast and Robust Brief (ORB) algorithm is proposed in [START_REF] Zhu | Copy-move forgery detection based on scaled ORB[END_REF]. Similarly, the authors in [START_REF] Jin | An improved method for SIFT-based copy-move forgery detection using non-maximum value suppression and optimized J-Linkage[END_REF] proposed to select keypoints by the non-maximum value suppression algorithm. Lin et al. [START_REF] Lin | Region duplication detection based on hybrid feature and evaluative clustering[END_REF] proposed a method based on SIFT features and the generalized 2-nearest neighbor (g2NN) strategy [START_REF] Amerini | A sift-based forensic method for copy-move attack detection and transformation recovery[END_REF] using the Harris-Laplace [START_REF] Mikolajczyk | Indexing based on scale invariant interest points[END_REF] and Hessian-Laplace [START_REF] Mikolajczyk | Scale & affine invariant interest point detectors[END_REF]. Authors in [START_REF] Dixit | Region duplication detection in digital images based on Centroid Linkage Clustering of key-points and graph similarity matching[END_REF] also adopted the SIFT features and the g2NN strategy for the matching process and a different clustering approach for detecting duplicated regions. Keypoint-based approaches are more advantageous when it comes to execution time, but fail to detect keypoints in the presence of low contrast and smooth regions. In the second categories, the suspected image is divided into overlapping blocks and then duplicated regions are located using a matching algorithm. In [START_REF] Bi | Multi-level dense descriptor and hierarchical feature matching for copy-move forgery detection[END_REF], Bi et al. extracted feature vectors from each block using the Multilevel Dense Their approach is also robust against attacks. Additionally, Cozzolino et al. [START_REF] Cozzolino | Efficient dense-field copy-move forgery detection[END_REF] proposed to use a matching algorithm called the Patch Match algorithm [START_REF] Barnes | PatchMatch: A randomized correspondence algorithm for structural image editing[END_REF] to efficiently compute an approximate nearest neighbor field for the suspected image.

DIGITAL IMAGE FORENSICS: SOURCE SCANNER IDENTIFICATION AND FORGERY DETECTION 25

In [START_REF] Hsu | An efficient detection algorithm for copy-move forgery[END_REF], Hsu et al. presented an algorithm based on the Gabor filter. They extracted features from the Histogram of Orientated Gabor Magnitude (HOGM) and calculated the maximum magnitude value of the image. Alternatively, authors in [START_REF] Li | An image copy move forgery detection method using QDCT[END_REF] developed a method based on the QDCT coefficients. Tu Huynh-Kha et al. [START_REF] Huynh-Kha | Improving the computational cost for copied region detection in forensic images[END_REF] proposed a new approach that calculates the modified Zernike moments (MZMs) from the overlapping blocks of the LL subband resulting from the application of one level DWT on the grayscale version of the suspected image. On the other hand, Prakash et al. [START_REF] Prakash | Detection of copy-move image forgery using DCT[END_REF] proposed a new method based on DCT coefficient which works on different block size. Vivek et al. [START_REF] Vivek | Image inconsistency detection using local binary pattern (LBP)[END_REF] proposed to use the local binary pattern to extract features. They, first, transform the input image into a grayscale one and, then, split it into overlapping blocks and compute the LBP histogram for each block. Finally, a Lexicographical sorting is applied for matching. An improved blockbased matching algorithm (IBMA) is proposed in [START_REF] Lai | An improved block-based matching algorithm of copy-move forgery detection[END_REF] to solve classical block based matching algorithm (CBMA). It uses the DCT, the PST (Polar Sine Transform) [START_REF] Yap | Two-dimensional polar harmonic transforms for invariant image representation[END_REF], the brightness, the Hu moments [START_REF] Hu | Visual pattern recognition by moment invariants[END_REF] and the Zernike moments for features extraction.

Because of the high-dimensional feature vectors and a number of overlapping blocks, these block-based approaches suffer from higher computational costs. Thus, to address the limitations of the block-based and keypoints-based methods, hybridbased techniques [START_REF] Zheng | Fusion of block and keypoints based approaches for effective copy-move image forgery detection[END_REF][START_REF] Bihari | A hybrid copy-move image forgery detection technique based on Fourier-Mellin and scale invariant feature transforms[END_REF][START_REF] Tinnathi | An efficient copy move forgery detection using adaptive watershed segmentation with AGSO and hybrid feature extraction[END_REF][START_REF] Niyishaka | Copy-move forgery detection using image blobs and BRISK feature[END_REF] have been proposed.

Resampling

When copy-pasting a region of an image into another image, one may need to resize the pasted region to adapt it to the content of the host image. This operation will unavoidably leave some inconsistencies in the pasted region which helps to detect the tampering. First, it engenders periodic correlations between adjacent pixels which can be estimated using the Expectation Maximization (EM) algorithm. However, these correlations can be confused with the periodic patterns introduced by JPEG blocking artifacts if the image is compressed. In [START_REF] Vázquez-Padın | An SVD approach to forensic image resampling detection[END_REF], the detection of resampling has been performed through the Singular Value Decomposition (SVD). This method was further improved in [START_REF] Vázquez-Padın | A random matrix approach to the forensic analysis of upscaled images[END_REF]. Moreover, resampling can be detected using a blind deconvolution [START_REF] Su | Hierarchical image resampling detection based on blind deconvolution[END_REF], a linear parametric model [START_REF] Qiao | Exposing image resampling forgery by using linear parametric model[END_REF], an interpolation kernel [START_REF] Hilal | Image re-sampling detection through a novel interpolation kernel[END_REF], or texture weight map [START_REF] Qiao | Statistical model-based detector via texture weight map: Application in re-sampling authentication[END_REF].

More resampling detectors based on CNN have been proposed in [START_REF] Bayar | On the robustness of constrained convolutional neural networks to jpeg post-compression for image resampling detection[END_REF][START_REF] Bayar | Constrained convolutional neural networks: A new approach towards general purpose image manipulation detection[END_REF][START_REF] Bunk | Detection and localization of image forgeries using resampling features and deep learning[END_REF][START_REF] Flenner | Resampling forgery detection using deep learning and a-contrario analysis[END_REF][START_REF] Cao | Resampling detection of recompressed images via dual-stream convolutional neural network[END_REF][START_REF] Maier | Toward Reliable Models For Authenticating Multimedia Content: Detecting Resampling Artifacts With Bayesian Neural Networks[END_REF].

Retouching

The image retouching forgery consists in enhancing the visual imagery contents by applying several global or local transformations on the original image using one or more filters or by manipulating a part of the image to mask or to add information to it. The image manipulation techniques involve global characteristics improvements (color or contrast enhancement, color remapping...) as well as retouching a particular region in the image. The figure 2.17 gives an example of image retouching where a filtering operation was applied on the original image (a) to make it look more recent. [START_REF] Cao | Forensic estimation of gamma correction in digital images[END_REF][START_REF] Wen | Contrast enhancement estimation for digital image forensics[END_REF][START_REF] Cao | Contrast enhancement-based forensics in digital images[END_REF], by identifying the use of histogram equalization [START_REF] Matthew | Forensic detection of image manipulation using statistical intrinsic fingerprints[END_REF], or through statistical distribution of block variance and AC DCT coefficients [START_REF] Singh | Global contrast enhancement based image forensics using statistical features[END_REF]. Complementary approaches are exploring the median filtering (MF). This filter is widely used in image processing to remove noise and preserve edges. It leaves statistical traces in the image. Therefore, MF can be detected by analyzing those traces. For example, authors in [START_REF] Kirchner | On detection of median filtering in digital images[END_REF] use subtractive pixel adjacent matrix (SPAM) features with 686-D to detect MF manipulation, Others feature set have served in this field such as median filtering forensics (MFF) features sets [START_REF] Yuan | Blind forensics of median filtering in digital images[END_REF] and the global and local feature (GLF) set [START_REF] Chen | Blind detection of median filtering in digital images: A difference domain based approach[END_REF], The probability of zero values in texture regions on the first order difference map may also serve as the MF statistical fingerprint [START_REF] Cao | Forensic detection of median filtering in digital images[END_REF]. More statistical features like the one-dimensional autoregressive (1D-AR) model of the image's median filter residual [START_REF] Kang | Robust median filtering forensics using an autoregressive model[END_REF], the two-dimensional autoregressive

One of the most common techniques is the global contrast enhancement (CE). It generates impulsive gaps and peaks effect in the image's histogram which can be captured by analyzing the histogram characteristics

DIGITAL IMAGE FORENSICS: SOURCE SCANNER IDENTIFICATION AND FORGERY DETECTION 27

(2D-AR) model [START_REF] Yang | Detecting median filtering via two-dimensional AR models of multiple filtered residuals[END_REF], the histograms features based on invariant patterns [START_REF] Gui | Blind median filtering detection based on histogram features[END_REF], the second-order local ternary pattern (LTP) [START_REF] Zhang | Revealing the traces of median filtering using high-order local ternary patterns[END_REF], and local difference descriptor (LDD) features [START_REF] Niu | Robust median filtering detection based on local difference descriptor[END_REF]. Some algorithms for the detection of MF have been proposed in the frequency domain such as the work proposed by Liu et al. [START_REF] Liu | Median filtering forensics in digital images based on frequency-domain features[END_REF]. Authors in [START_REF] Hu | Median filtering forensics based on discriminative multi-scale sparse coding[END_REF] and [START_REF] Chen | Median filtering forensics based on convolutional neural networks[END_REF] recently proposed MF detection methods based on automated feature learning and CNNs. Face manipulation has also become a great research concern [START_REF] Bharati | Detecting facial retouching using supervised deep learning[END_REF][START_REF] Bharati | Demography-based facial retouching detection using subclass supervised sparse autoencoder[END_REF][START_REF] Jain | On detecting gans and retouching based synthetic alterations[END_REF][START_REF] Jain | Detecting GANs and retouching based digital alterations via DAD-HCNN[END_REF][START_REF] Wang | Detecting photoshopped faces by scripting photoshop[END_REF][START_REF] Rathgeb | Differential detection of facial retouching: A multi-biometric approach[END_REF] with the growing number of face-retouched images shared via social media.

Device based methods

While the state-of-the-art methods discussed in the previous sub-section operate each for only one specific type of forgery, utilizing flexible and generalized algorithms that can simultaneously detect various forms of forgery seems to be a more attractive direction. The following is a brief description of the so-called passive device-based methods related to scanners that may achieve this goal. These methods detect the image manipulation by extracting features related to each scanner model and consider it as an intrinsic fingerprint of that model and then analyzing the coherence of this fingerprint in the suspected image. For example, the fingerprint can be modeled as an alteration in edges, in illumination, or in the characteristics of the scanning noise.

Most of these methods present an extension of the SSI approaches [START_REF] Choi | Scanner identification using spectral noise in the frequency domain[END_REF][START_REF] Khanna | Scanner identification using feature-based processing and analysis[END_REF] previously reported in Section 2.2. The basic concept behind these approaches is to split the image into non-overlapping blocks and then separately identify the source of each block. The questioned image is admitted as authentic if almost all the blocks are classified as acquired by the same scanner which will be declared as the source scanner of that image. If not, the image will be considered as forged.

One approach for detection of fallacious documents and tampering has been performed in [START_REF] Khanna | Scanner identification with extension to forgery detection[END_REF] by using statistical features of image sensor pattern noise where the forged images had been synthesized using scanned images from different scanners.

In [START_REF] Choi | Forged region detection for scanned images[END_REF], the method using spectral noise in the frequency domain [START_REF] Choi | Scanner identification using spectral noise in the frequency domain[END_REF] has been used to detect malicious forgery in scanned images where forging was realized using images acquired by scanners and digital cameras. The traces of dust, dirt, and scratches over different scanners platen on the scanned images are explored as unique patterns in [START_REF] Zeinab | Accurate and robust identifying forged region method in scanned images[END_REF]. Each block of the questioned image is compared to the acquisition scanner's template to differentiate the authentic scanned blocks and the tampered ones. If the scanner template matches all the blocks in one image, it is quite possible that this image is an authentic one coming from that source. A more sophisticated approach has been proposed in [START_REF] Zeinab | New and efficient blind detection algorithm for digital image forgery using homomorphic image processing[END_REF]. It explores the differentiation of the illumination component histograms as a tool for slicing detection. Separating illumination from reflectance components is realized by applying homomorphic image processing on the suspicious image. Table 2.2 summarizes a variety of distinct digital imaging forgery detection mechanisms along with their details, techniques used as well as their merits and demerits.

Discussion

Important documents such as contracts, educational certificates and government publications become easy to forge once digitized. Protecting those documents is not an easy task. It has even become more difficult with the tremendously advance in digital technologies.

In this section, we presented an overview of the prior work made on the task of forgery detection. These methods were not tested on text documents and were not proved to perform well under post-processing. In addition, the accuracy of these methods actually depends on the block size that affects the outcome of the comparison between the document in question and the scanner fingerprint. Furthermore, the previously stated methods were successful in detecting forged images, but all methods have errors in determining the precise forged regions. Some of the fraudulent regions are missing or some original regions are detected as fraudulent. Therefore, the development of methods to overcome these limitations is still an open issue.

DIGITAL IMAGE FORENSICS: SOURCE SCANNER IDENTIFICATION AND FORGERY DETECTION 29

Conclusion

In this chapter, a brief description of the imaging pipeline of a flatbed scanner as well as the related state-of-the-art forensic methods are introduced. Despite the fact that denoising and patterns comparison techniques are critical in the entire identification process, the selection of features utilized for source assessment plays an important role, particularly in classification methods. We also observed that various techniques have been proposed, however, a good part deal with particular scanned images and more investigations are needed to distinguish between scanners of the exactly same model. Moreover, we pointed out that a large number of images acquired by each scanner could not always be at hand to generate its fingerprint. So far, we presented an extensive analysis of the technologies used for passive image IFD. This analysis is performed in terms of the features used, the identified forgery, the used datasets, and the limitations. As also mentioned, only few works have been devoted to deal with tampered scanned images and none of the scanner-based IFD methods have been tested on scanned documents. In addition, only splicing forgery has been investigated. Exploring these challenges may open the door to more efficient contributions.

In Chapter 3 and 4, we propose more advanced source scanner attribution techniques taking advantage of the potential of the wavelet domain and the artificial intelligence classification techniques. Later, we proposed a method for verifying whether two digital documents were obtained using the same scanner, a problem known as device linking (DLK). Our work is the only study that proves the feasibility of DLK for the case of scanned images. It will be the subject of the chapter 5. For IFD, we extended upon our works for SSI to find out if a scanned document has been manipulated. We explore small patches in order to better localize the forged regions.

Better be despised for too anxious apprehensions, than ruined by too confident security.

Mieux vaut être méprisé pour des appréhensions trop anxieuses, que ruiné par une sécurité trop confiante.

-Edmund Burke In the previous Chapter, we presented an overview of existing handcrafted scanner features extraction models. If most of these models appear to be quite useful under certain circumstances they also have some limitations that should be 32

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION

considered. Natural follow-up works are to study the Joint Photographic Experts Group (JPEG) compression process as no prior model has been dedicated to this image format and also to improve, for uncompressed images, the scan artifacts extraction so as to better distinguish scanners of the same model.

To achieve those goals, in this chapter, we design new solutions to identify the scanner at the origin of a questioned digital document using fingerprints generated from features extracted manually from a large variety of scanned documents with a better forensic detectability compared with recent state-of-the-art methods as follows:

We start by exploiting the JPEG bitstream and find out that it is possible to extract a scanner fingerprint directly from the header of JPEG images. However, the extracted fingerprint gives only access to information about the brand of the device that have acquired the image. Moreover, JPEG headers are easy to manipulate. Thus, the proposed technique does not form a reliable solution for source identification. developing solutions that becomes desirable.

Considering the limitations of the JPEG based approach and convinced of the importance of working in uncompressed domain, we proposed to explore the forensic traces left by the scanner at each step of the acquisition process. The goal of the following solutions is to extract reliable and robust digital footprints in order to enhance the identification rates. The idea behind the proposed methods is to search for unique properties for each scanner model and then use those properties to identify the origin scanner of a digital image in question. To obtain these features, it is necessary to build a model that extract the scanning noise left by each device, and then, find a suitable measure to compare the features extracted from one image to the ones initially deduced from each device. Here, the model we build profits from the scanning noise contained in the high level subbands and extracts a set of features that fits the statistical distribution of those subbands. Then, a well-adapted distance measure is used to calculate the similarity between the features extracted from the investigated image and known scanners fingerprints. Note that a scanner fingerprint is generated by combining the features extracted from images acquired by it. However, neither the wavelet decomposition or any filtering operation is able to extract a perfect noise (without any image details).

When it goes to official and administrative documents, it is possible to incorporate the a priori knowledge of their content to reduce most of it and, therefore, guarantee a purer scanning noise across the whole image. This is the main contribution of the following approach. This Chapter is organized into three parts. Firstly, we come back on the principles of JPEG compression and describe the general idea of our JPEG based technique. In its second part, we focus on Tagged Image File Format (TIFF) images and propose a wavelet-based forensics mechanism [START_REF] Ben | Identification de l'Origine d'un Document Numérisé sur la Base d'une Empreinte de Scanner Dans le Domaine des Ondelettes[END_REF][START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF] in which the statistical properties of the wavelet subbands are exploited so to build a scanner fingerprint one can extract from scanned documents. Then, in the third part, we introduce a novel framework to solve the problem of SSI [START_REF] Ben Rabah | Semi-Blind Source Scanner Identification[END_REF] that take advantage of some prior knowledge of the type of the digitized document in order to refine the source identification process and to increase its performance.

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION 33

Scanner Source Identification of JPEG Images

JPEG is one of the most commonly used standards for storing digital images. When compressing an image in JPEG, it takes up considerably less space while preserving quality. In fact, JPEG has been broadly studied for many forensics investigations.

The question is: How can we use it for the sake of scanner origin identification? As stated above, the first solution we worked on exclusively focuses on scanned images that have been stored accordingly the JPEG format. It uses ancillary information about the compressed bitstream that are stored in the JPEG file header.

Before entering into the details of our approach, let us first come back on the basic principles of the JPEG standard, that is to say the way it works so to convert a color image into a compressed bitstream. We will then see how to exploit information from the JPEG file header to find a unique fingerprint for each scanner and the performance of the proposed solution. • Image color transformation -The purpose of this task is to reduce information redundancy that exists in-between Red Green and Blue color channels. To do so, the digital image is converted from RGB into the YCbCr color space followed by a down sampling operation performed on the chrominance channels (Cb Cr).

The JPEG standard

• Discrete Cosine Transform (DCT) -Next, each 8x8 block of pixels is converted from raw pixels to their DCT signal representation. Note that the purpose of the DCT is to concentrate the information on a few number of low frequency coefficients and decorrelate information. To do so, pixels P (x, y) from each 8x8 pixel blocks are transformed using the following formula:

P (u, v) = 2 N c(u)c(v) N -1 x=0 N -1 y=0 P (x, y) • cos π N u x + 1 2 • cos π N v y + 1 z (3.1)
where N is often equal to 8 and

c(x) = 1 √ 2 , if x = 0 c(x) = 1, otherwise (3.2)
Note that P (0, 0) is the direct current (DC) coefficient which refers to the average brightness in the block. For u, v > 0, P (u, v) are the alternating current (AC) coefficients.

• Quantization -Later, a quantization table is used to scale the DCT values. Due to sensitivity of human eyes to low frequencies, many of those values become zero. In fact, to get rid of the DCT coefficients that are not essential for recreating a close approximation of the original, they are independently quantized using psychovisual-dependent quantization tables (QT). More clearly, let us consider C(u, v), the quantized DCT coefficient associated to the spatial frequency (u,v)

C(u, v) = P (u, v) q(u, v) Q f (3.3)
Where P (u, v) is the original DCT coefficient, q(u, v) is the quantization step and Q f is the quality factor such that 0 Q f 100. This equation confirms that the JPEG compression is lossy and irreversible. This step is applied so as to turn the block-based matrix of DCT coefficients into a one dimensional (1D) sequence of coefficient. The basic idea of this transform is to ensure that two consecutive coefficients in the one sequence are closed in terms of spatial frequency. Notice that, as exposed in Fig. 3.1, quantized AC coefficients and quantized DC coefficients are treated separately. The Differential Pulse Code Modulation (DPCM) [START_REF] Rizal | Compression Method in JPEG Standard[END_REF] ancomputes the difference between DC coefficients of adjacent blocks. Thus, it decreases the information entropy to encode if those coefficients are redundant. On the other hand, a Run Length Encoding (RLE) is applied to the AC coefficient after ordering them in 1D vector through a zigzag scan. Its role is to encode the coefficient vector in (run, value) pairs where run refers to the number of zeros preceding a non-zero AC coefficient, and value refers to the value of the non-zero AC coefficient.

• Entropy encoding -Finally, the encoded AC coefficients and the DC prediction errors presented in term of their difference between adjacent blocks are subjected to a Huffman entropy encoding using a set of Huffman tables.

Once DCT coefficients are entropically encoded, they are organized into a bitstream as exposed in Fig. 3.2. The bitstream consists of a sequence of segments led by markers that can be either a header or a body. The header purpose is to present some general information about the bitstream like the coder algorithm while the body represents the data itself. The body is mainly composed of six important tables which are quantization table for luminance, quantization table for chrominance, Huffman table for luminance DC, Huffman table for luminance AC, Huffman table for chrominance DC and Huffman table for chrominance AC. Each of the segments starts with a 0xFF byte followed by a byte specifying the marker type. JPEG markers can be grouped into two general types: First, the stand-alone markers which consist of no data other than their two bytes. And then, the markers, that do not stand alone, are immediately followed by a 2-byte-long value that gives the number of bytes of data the marker contains. Most of these markers are listed in Table 3.1. Any JPEG file in the bitstream domain must begin with a start-of-image (SOI) marker followed by an APP0 marker and end with an end-of-image (EOI) marker which must immediately follow the compressed data of the last scan in the image.

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION 35

Proposed JPEG based approach

Manufacturers use different configurations when balancing the compression in their devices. Hence, we take advantage of this fact in order to find unique fingerprints in the JPEG bitstream. To do so, we have parsed bitstreams of different scanned images and find out that each manufacturer uses a different QT. The idea is, thus, to extract the QT for luminance and chrominance for which an example is illustrated in Fig. 3.3. We start by searching their marker in the JPEG bitstream and extracting a vector with 64 values for each table corresponding to the conversion of the 8x8 matrices to their zigzag ordering. The concatenation of both QT is the signature The basic architecture of our verification scheme is given in Fig. 3.4 where extractQT is the function developed in Algorithm 1. To associate each image with the scanner that have acquired it, we first extract its luminance quantization table as well as its chrominance one. Then, a decision is made by comparing them to a database of known scanners' fingerprints (QTs). If the QTs of the questioned image and those of one of the scanners are the same, then the image

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION 37

Algorithm 1: extractQT Input: I : a JPEG image Output: tab : the combined QT can be linked to that scanner. Otherwise, we can confirm that none of the known scanners is at the origin of that image.

Bt ← Bitstream(I) n, m ← size(Bt) // Find starting indices of QT o ← 0 for j ← 1 : n -1 do if strcmp(dec2hex(Bt(j), F F ) & strcmp(dec2hex(Bt(j + 1)), DB ) then o ← o + 1 indices_start(o) ← j + 5 // Extract quantization table of luminance j1 ← indices_start(1) + 2 j2 ← indices_start(2) + 2 T abY ← [] for j ← j1 : j1 + 63 do T abY (j -j1 + 1) ← Bt(j) //

Experimental results

The following experiments have been conducted considering five distinct models of scanners. As depicted in Table 3.2, some of them are from the same manufacturer. We collected 45 images scanned and saved in JPEG format at the same quality factor from each scanner. By extracting and comparing images' fingerprints, we found that images acquired by the same scanner have the same fingerprint. However, and as it can be seen in the example displayed in Table 3.3, scanners of the same manufacturer share the same QT while these later differ from one brand to another. Thus, this solution can only serve for identifying the brand of the scanner and not the scanner itself.

Discussion

The main advantage of this method is that it is simple and fast. Indeed, a scanner's fingerprint can be extracted from only one image; no training task is needed. Moreover, the fingerprint is of fixed value and not an estimation error of which varies from an image to another. However, even the previously shown results give a first positive proof of concept of the proposed technique, a manipulation of the EXIF header or a different re-saving of the image may induce a miss-classification. This solution can mostly serve in the situation of source scanner linking where the forensic investigator need to know whether two images of unknown sources are taken by scanners of the same brand or not.

In the following, we will focus on digital images saved in the TIFF format.

Source Scanner Model Identification Based on Wavelet Features

Digitized documents can be stored in a variety of formats, including GIF, PNG, JPEG and TIFF, depending if they will be saved with or without lossy compression.

In the previous section, we addressed JPEG images having some features such that entropy encoding tables and QTs contained in the JPEG header. This later often includes information about the acquisition device and its settings is thought to be the most basic approach to identify an image origin. However, it can be easily altered, resaved or deleted. Another problem is the limitation to scanner brand identification. Therefore, there is a significant deal of interest in developing forensic techniques based on intrinsic fingerprints to overcome these problems. An alternative solution is the analysis of the scanner defects using the traces they left in the acquired Images. Chapter 2 has presented an overview on existing scanner model identification approaches that rely on extracting various traces from scanned images. These ones can be categorized into five classes as shown in Fig. 3.5. As we are interested in the analysis of the details (various traces) in scanned images, our focus was oriented to the frequency domain. Thus, the study we propose in this section is performed in the frequency domain and more precisely in the wavelet domain (See Appendix B) so as to take advantage of the fact that the subbands of details of the first level of decomposition of an image give access to the scanning noise contained in its subbands. In fact, wavelets have lately emerged as a powerful analysis tool because of its ability to offer multi-scale and orientation representation via subbands. In many DIF applications, decomposition of images utilizing basis functions such as wavelets has proven to be particularly effective [START_REF] Matthew | Anti-forensics of digital image compression[END_REF][START_REF] Vladimir | Authentication of fingerprint scanners[END_REF]. One reason is that statistical regularities in such decompositions can be exploited. The model we propose is made up of first-order statistics that can capture the regularities found in scanned images. Based on a supervised classification, our work consists in two stages; The first stage involves collecting and scanning documents by each of the available scanners. Those scanned documents are, then, divided into training and testing image sets and are used to evaluate the performance of the proposed system. This process, illustrated in Fig. 3.6, is adopted by almost all SSI methods. The rest of this section is organized as follows. First, we present the proposed system architecture, as well as the process of extracting fingerprints. Then, we explain how the origin of an image can be identified. Experimental results are provided in Sub-Section 3.2.3. Finally, we draw the concluding remarks and the next challenges.

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION 39

Image and scanner fingerprints

The overall structure of our proposal to identify a scanned image source is depicted in Fig. 3.7. It is composed of two main parts: Image scanner fingerprint extraction and scanner identification. The first aims at estimating reliable wavelet parameters from the two dimensional high frequency wavelet subband HH, while, the role of the later is to identify, when an unknown image is presented, the scanner used to acquire it. The two steps have a common process for scanner image fingerprint extraction.

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION 41

The process of extracting a scanner image fingerprint, a signature that will be used later in a scanner identification scheme, is illustrated in Fig. 3.8.

The proposed method is applied to the RGB color chanel separately since 3.9. Among these subbands, we are interested only in the HH subbands of each color channel in which the noise is concentrated [START_REF] Yu | Improved WαsH feature matching based on 2D-DWT for stereo remote sensing images[END_REF].

In this work, we choose to use the Symlet wavelet which showed good performance in features extraction compared to the other wavelet families particularly for printed documents. Furthermore, the Symlet4 is recommended as the most powerful in analyzing peaks that resemble Gaussian distribution curves [START_REF] Prikler | Improving detection power in trace analysis using wavelet transform[END_REF]. The features of this wavelet make it a good candidate as a scanner fingerprint as shown in [START_REF] Daubechies | Ten lectures on wavelets[END_REF].

The constitution of our scanner signature stands on the fact that the distribution of wavelet coefficients in a subband of details is approximated by a generalized Gaussian [START_REF] Grace | Adaptive wavelet thresholding for image denoising and compression[END_REF]. Given a subband H and a color channel C, the density probability of that subband C H can be approximated such as

f C H (x) = β 2αΓ 1 p exp -[ |x| α ) β (3.4)
where x, α, β and µ represent the subband samples and the parameters of scale, shape and location, respectively, while Γ (.) is the known Gamma function defined by

Γ(z) = ∞ 0 e -t t z-1 dt, u > 0 (3.5)
Note that α models the width of the probability density function peak and β is inversely proportional to the diminishing rate of the peak.

For our task, it is more interesting to estimate these parameters for the HH subband only since the wavelet coefficients in this subband are dominated by noise which is none other than sensor noise while the other subbands contains more image details. These parameters will constitute our signature. Motivated by our observations, and to decrease the number of parameters to be estimated, we simply approximate the value of µ with zero. As a result, we only consider the α and β parameters to characterize the distribution of noise in a subband.

To the best of our knowledge, there are three methods for estimating the generalized

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION 43

Gaussian distribution (GGD) parameters: (1) Moment estimation (ME) [START_REF] Sharifi | Estimation of shape parameter for generalized Gaussian distributions in subband decompositions of video[END_REF] (2) Entropy matching estimation (EME) [START_REF] Kokkinakis | Exponent parameter estimation for generalized Gaussian probability density functions with application to speech modeling[END_REF] (3) maximum likelihood estimation (MLE) [START_REF] Minh | Wavelet-based texture retrieval using generalized Gaussian density and Kullback-Leibler distance[END_REF]. Almost the same accuracy can be obtained by these methods. In this work, we propose to calculate the GGD parameters using the MLE method with the Newton-Raphson's iterative algorithm [START_REF] Verbeke | The Newton-Raphson method[END_REF]. On this basis, we obtain a pair of estimated parameters per color channel from each corresponding HH wavelet subband.

The image scanner fingerprint V I have this form:

V I =    V R I V G I V B I    =         αHH R , βHH R αHH G , βHH G αHH B , βHH B         (3.6)
In our approach, the scanner signature is obtained via the fusion of the signatures of several images scanned with it using the median operation. The choice of the median has been demonstrated in [START_REF] Ben | Identification de l'Origine d'un Document Numérisé sur la Base d'une Empreinte de Scanner Dans le Domaine des Ondelettes[END_REF]. In that case, the identifier of a scanner S from the signatures of N images is then such that

V R S = median(V R S,i , i = 1..N ) V G S = median(V G S,i , i = 1..N ) V B S = median(V B S,i , i = 1..N ) (3.7)
where V R S,i , V G S,i and V B S,i are the features vectors of the HH subband of the R, G and B color channels of the i th image scanned with the scanner S, respectively.

Image origin predictor

Identifying the origin of a digitized document is based on the comparison between the signature of several scanners and the signature extracted from a questioned document. There are numerous ways to measure the difference between two distributions. However, the Kullback-Leibler divergence (KLD) [START_REF] Kullback | On information and sufficiency[END_REF] is the most adapted and appropriate measure for comparing statistical features exhibiting generalized Gaussian distributions, that is why we propose to use it in our work. Herein, the source scanner of a document will be the one that minimizes this measure. Since the coefficients of the detail subbands of the first level of the wavelet decomposition of an image follows generalized Gaussian distribution, the KLD of the color channel j is given by

KLD α j I , α j s , β j I , β j s = log     β f S α I r 1 β i β j I α j S Γ 1 σ S + α S α j I β j I r β j 1 +1 β J S r 1 β S - 1 β S     (3.8)
where j ∈ R,G,B. The global distance between the query image Q and the scanner S is given by summing along the three color channels

KLD Q,S = 3 j=1 KLD(α j Q , α j S , β j Q , β j S ) = 3 j=1 log β j S α j Q Γ 1 β j Q β j Q α j S Γ 1 β j S + α j S α j Q β j Q Γ β j Q +1 β j S Γ 1 β j S -1 β j S (3.9) 44

Experimental results

To empirically evaluate the effectiveness of our previous method, we tested it on five different scanners of various native resolutions as shown in Table 3.4. First, we created a test database of 100 documents of varied content all scanned with each scanner. These documents contain black and white or colored text. Some of them includes figures and tables. We give some examples of this test image dataset in Fig. 3.10. The digitized documents or equivalently images were saved in TIFF format, that is to say in a format of raw data without loss of information, at a resolution of 300 dpi, leading thus to the constitution of a database of 500 images. Notice that, this resolution is the commonly used in general practice [START_REF] Cochran | A proposed standard procedure to define minimum scanning attribute levels for hard copy documents[END_REF] whatever the activity domain; being the default parameter value of scanners. 50 out of 100 images were chosen randomly for generating each scanner fingerprint, while the remaining 50 images were used to evaluate the detection performance through a testing phase.

The following results are given in average. Indeed, the training and testing phases have been repeated five times to obtain the final performance measures.

Identification performance evaluation

We give in Fig. 3.11, the distributions of the couples (α HH , β HH ) of the HH subband of the red color channel for all test images. It can be seen that these parameters discriminate well the images according to the scanner that acquired it which proves that the noise is different from one scanner to another.

We study the performance in terms of classification accuracy by measuring the percentage of images from scanner model correctly identified. We obtain a matrix as shown in Table 3.5 and a total accuracy 95.6%. Notice also that these detection results remain the same regardless of the content of the scanned document. However, we notice a low rate of 87.6% which may be due to the close similarity between the fingerprints of S1 and S2.

To go further in this analysis, Figure 3.12 illustrates an example of an image scanned with different scanners and the HH subband issued of a one level DWT applied on each one. We can notice the differences between the HH sub-bands which tell the difference between the scanners fingerprints that somehow explains the discriminability of the parameters (α, β).

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION 45

Evaluation of the effect of the subband choice

To highlight the relevance of the choice of the HH subband from each color channel, we choose to conduct the same experiments realized previously, but as this time, we change the subband to work on. More clearly, we extract the image scanner fingerprint from LL, HL and LH. Table 3.6 shows the identification accuracy of the proposed system for each of these subbands obtained by averaging the resulting accuracies of five different tests. It can be noted that the identification accuracy decreases with those subbands and, in particular, with the LL subband which has the lower level of noise. Indeed, this subband corresponds to an approximated version of the original document as shown in Fig. 3.13.

Evaluation of the effect of the color channels

The color channel is also an important parameter to consider. The following experiments are conducted by considering only one color channel each time which, by the way, reduces the size of the image's fingerprint. The identification performance corresponding to those tests is shown in table 3.7. It can be noticed that the decline in the accuracy is not important especially for the green channel. This may be justified by the correlation between the color channels, and that the green channel contains more of the image information while the blue one is not so relevant.

Considering the results of table 3.5, using the color channels jointly is still better to avoid miss classification. The difference of performance is around 1% compared to using the green channel separately.

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION 47

Comparison with a recent method

The proposed method shows greater accuracy in discriminating different scanners comparing to the last and the most powerful existing method [START_REF] Choi | Scanner identification using spectral noise in the frequency domain[END_REF] which uses spectral noise in the frequency domain.

As it can be seen in Table 3.8, Choi et al. [START_REF] Choi | Scanner identification using spectral noise in the frequency domain[END_REF] method is not able to correctly discriminate scanners of the same brand (Epson).

Evaluation of the robustness against lossy compression

In the following, we investigate the effect of lossy compression on the reliability of our scanner model identification technique. Indeed, it is likely that, in practice, scanned documents will be stored in the JPEG format.

To conduct this experiment, we built another dataset consisting of single JPEG images created by compressing the uncompressed previously generated TIFF image dataset with a quality factor QF equal to 75. Such a quality factor value is the default one of most image software. Table 3.9 shows average accuracy of the dedicated classifier for scanned documents saved in JPEG format. The proposed method maintains an average classification accuracy of 67.6% despite the decline in performance. This demonstrates that our identification method is robust to JPEG compression. The relative decline of accuracy in this experiments is due to the introduction of the JPEG quantization noise in the HH subband which deviates significantly the sensor noise characteristics from the original one.

Discussion

In this section, we presented a new approach to identify the scanner that was used to scan a document. We rely on a fingerprint extracted from the wavelet decomposition of the image which highlights the statistical properties of the scanning noise of a given scanner. The experimental results show a good identification accuracy independently of the content of the scanned documents. We conclude that, for a fixed scanning resolution, the parameters (α,β) are discriminative for different scanner models. However, these parameters are almost similar for different devices of the same model. In Fig. 3.14, we show an example of the parameters distributions of four Epson scanners where two of them are of the same model "Perfection V39" (d1,d2) and the others (s1,s2) are of the same model "Perfection V370". Therefore, the proposed model can be only exploited for scanner model identification and further work is desirable for device recognition. Moreover, another challenging part is the impact of the post-acquisition compression process. Experiments have shown that JPEG compression modifies the scanning noise model by introducing a quantization noise. The later can be suppressed by tresholding the wavelet coefficients. We consider this issue as a future work.

Semi-blind source scanner Identification

One of the key challenges in digital content forensics for images and scanners, is the capacity to extract exactly the acquisition noise from the image or equivalently to exactly remove the image content. More clearly, the more the image content remove, the greatest are the identification performance. Thus, to guarantee that the parameters (α,β ) defined in the previous section remain identical for different images digitized with the same scanner, we should make sure that their content is removed perfectly. In practice, working with the observed image only, those parameters are still influenced by the image content because the optimal denoising filter is difficult to obtain. For instance, Fig. 3.15 shows how the HH subband is influenced by different image details which, consequently, affect the identification process. In many cases, especially when handling official documents, it is possible to get such prior knowledge (e.g. registration forms, contracts, agreements). The solution we present in this Section takes advantage of this proposal. More clearly, we consider a framework where some administrative documents are filled by hand by people before being scanned and transmitted. We propose thus to introduce the very first solution that associates a digital document with its source device in a semi-blind way. Again, we compare the digitized document with the original one to extract all kinds of noise resulting from the scanning process. This noise is then exploited to generate a unique fingerprint for each scanner that is by next compared to scanner fingerprint extracted from the test document. Finally, the scanner having the most similar fingerprint to the one of the test document is identified as the source scanner. The remainder of this section is organized as follows. In Sub-section 3.3.1, we describe how we build the image and scanner fingerprints in our approach. The image origin predictor is detailed in Sub-section 3.3.2. Experimental evaluation plan and results are presented in Sub-section 3.3.3. Finally, Sub-section 3.3.4 gives our conclusions.

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION 49

Image and scanner fingerprints

The global architecture of our scheme is shown in Fig. 3.16. It consists of three steps. First, it extracts the noise present in a scanned document. Let us recall that We notice some image details in the HH subband that we have surrounded in red such a document is an official form a user has to print and fulfill before scanning it. This process takes advantage of the original document; we also name reference document. Once the scanned document noise extracted, the scanner fingerprint (signature) is generated. Then, to identify the source of the questioned document, we compare this fingerprint to the ones of some scanners using an adequate metric and a decision is taken. Scanners fingerprints have been generated in the same way and stored in a database. We come back on these different steps in the sequel. The task of noise extraction is conducted as follows. Let us denote by I r and I r,i the reference document and the questioned document filled and scanned by the user i, respectively. In order to reduce the amount of information to process, we first convert the color images I r and I r,i into their grayscale versions Ĩg r and Ĩg r,i using a simple color transform [START_REF] Jack | Video Demystified-forth edition[END_REF] as follows

I = 0.21 * I R + 0.72 * I G + 0.07 * I B , ( 3.10)
where I R , I G and I B are the red, green and blue components of the image I, respectively. Then, due to the scanner acquisition resolution, Ĩg r is resized so as to have the same dimensions as Ĩg r,i . By next, since the scanned and the reference documents are usually not correctly aligned, we also apply the feature-based registration algorithm F [START_REF] Ardeshir | 2-D and 3-D image registration: for medical, remote sensing, and industrial applications[END_REF]. This one is based on Speeded-Up Robust Features (SURF) [START_REF] Bay | Speeded-up robust features (SURF)[END_REF] to the resized Ĩg r as depicted in Ĩreg

r = F ( Ĩg r ), (3.11)
where Ĩreg r is the registered version of Ĩg r . We modify the reference document and not the scanned document so as to preserve at best the scanner signature, i.e. not R i is a combination of the different noises depicted in Chapter 2 along with some residues of the document content (e.g. modifications made by the user before he or she scanned the document). As the scanning process is made line by line, the scanner noise is repeated over the noise image R i along the scan direction [START_REF] Gloe | Forensics for flatbed scanners[END_REF]. Averaging information along this direction will reduce the power of the random noise while enhancing the one of the scanner noise. This is why we consider the fingerprint V i of a given document as follows

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION 51

V i (l) = 1 K K k=1 R i (k, l) , 1 ≤ l ≤ L, (3.13)
where K and L are respectively the number of rows and the number of columns of R i .

Image origin predictor

To make the source scanner identification possible, we need to build a database with the signature of several scanners. Figure 3.17 illustrates the different steps for generating a scanner fingerprint. As it can be seen, it works similarly to the one above. The main difference is that the scanner fingerprint is derived from several documents. These ones have been printed and scanned. Then, their noise images have been computed before being averaged. The scanner fingerprint corresponds to the average of the pixels' lines of this averaged noise image. More clearly, let us consider P available scanners where 1 ≤ j ≤ P .

The fingerprint S j of the j th scanner is computed as follows: From a set of M differently filled documents that have been printed and scanned, we derive an

R j = 1 M M i=1 R i , (3.14)
where M is the number of documents scanned by the j th scanner. Then, S j is obtained by averaging along the scanning direction

S j (l) = 1 K K k=1 R j (k, l) , 1 ≤ l ≤ L, ( 3.15)
where K and L are respectively the number of rows and the number of columns of R j .

As shown in Fig. 3.18, to identify the source scanner of a given document, the questioned document fingerprint is compared with the different scanners fingerprints using the Euclidean distance as a similarity measure defined by

d(V i , S j ) = L x=1 (V i (x) -S j (x)) 2 , 1 ≤ j ≤ P. (3.16)
where V i is the questioned document fingerprint and S j is the j th scanner fingerprint.

The final decision about the source scanner is performed by choosing the scanner, from the different devices in the database, having the shortest distance l with the query document

l = min(d(V i , S j )) , 1 ≤ j ≤ P.
(3.17)

Experimental results

In the sections below, we discuss the performance of the proposed technique. Five scanners with various native resolutions as shown in Table 3.10 have been considered. Two of these scanners are the exact same model. HP Scanjet Pro 2500 F1 1200x1200

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION 53

Creation of test images dataset

In the following experiments, the reference document corresponds to a computer generated form which contains: a logo, some text and frames as well as some other non-textual elements. It has been printed 90 times with the same printer and filled by hand by more than five persons. Some examples of the documents after scan are given in Fig. 3.19.

A dataset of 450 uncompressed images stored in TIFF format has been built by scanning all these filled forms with the five scanners at a resolution of 300dpi.

Identification performance

We analyse the performance in terms of classification accuracy by measuring the percentage of images from scanner model correctly identified. We follow a randomized multi-testing procedure in which various training and testing sets are selected to verify the consistency in reported results across experiments and, thus, limit any misleading impressions that might be given by a single experiment. We obtain an averaged accuracy of 100%. We also compare the proposed technique with the method proposed in [START_REF] Gloe | Forensics for flatbed scanners[END_REF] to guarantee a fair comparison since this latter works similarly to our proposed method in term of fingerprint generation and comparison while using different filtering approach. The confusion matrix of this method [START_REF] Gloe | Forensics for flatbed scanners[END_REF] is presented in Table 3.11. It can be seen that the proposed scheme outperforms the method in [START_REF] Gloe | Forensics for flatbed scanners[END_REF] for which confusion exists among scanners of the same model with an identification accuracy of 94,51%. To more investigate the use of the original document with previous methods, we implement the spectral method in [START_REF] Choi | Scanner identification using spectral noise in the frequency domain[END_REF] and the wavelet method that we have proposed in Section 3.2 by adding the noise extraction step introduced previously as a pre-processing step. Table 3.12 shows the experimental result of performance accuracy. It can be seen that applying a wavelet decomposition to an already filtered image did not improve the identification of the source scanner. Note that we also reduced the number of features since we no longer consider the three color channel. Compared to the spectral method, the main benefit of our method is to achieve maximum accuracy with less computational steps.

To further demonstrate the robustness of our approach, we also experimented our approach considering source scanner identification after lossy JPEG compression.

To do so, the original TIFF images previously generated were compressed with a quality factor equal to 75. The accuracy for classifying questioned documents is 100% for all scanners. This proves that our method is still able to capture scanning noise even when the image are post-compressed.

Discussion

In this section, we proposed an automatic source scanner identification method which takes advantage of the a priori knowledge of the nature of the scanned document. Such a priori knowledge is available in many domains, in particular in

SOURCE SCANNER IDENTIFICATION BASED ON A HANDCRAFTED FEATURES EXTRACTION 55

Table 3.12: Overall identification accuracy for spectral methods [START_REF] Choi | Scanner identification using spectral noise in the frequency domain[END_REF] and wavelet method [START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF] Accuracy Spectral method 100% Wavelet method 42.44% healthcare, banking, . . . , every activity sector where people have to fill administrative forms. By analyzing the noise resulting from the subtraction of the original document from the scanned document, a unique scanner fingerprint is built averaging signatures of documents scanned with it. Notwithstanding its simplicity, compared to methods proposed in the literature, the proposed filtering approach also brings competitive advantages. The proposed approach yields a very high accuracy even with compressed low-quality documents, which make it valuable tool in real life.

It requires however to be further studied with much more scanners. In the future, we will investigate and extend the proposed method against other image post processing such as contrast stretching and sharpening.

Conclusion

Estimating scanners' noise models may be performed from single or multiple images.

The very first work, presented in this chapter, allows identifying each scanner by a unique fingerprint from just one of the JPEG images. This fingerprinting is extracted from the JPEG file header where we have shown that the QTs contained in this header are unique for each scanner brand. To the best of our knowledge, the proposed approach is the only one that focuses on JPEG images to identify scanners models. It is however very simple and absolutely not robust to file format conversion and image re-compression. Also, it can not differentiate scanner form the same manufacturer. However, for generating more robust digital evidence, we mainly focus on TIFF images and do not rely on fragile information such as data of the EXIF header. That's why, we developed two novel forensic methods. One [START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF] working in a fully blind way and another one [START_REF] Ben Rabah | Semi-Blind Source Scanner Identification[END_REF] requires a prior knowledge about the original document template before it was printed. The first method defeats most recent and efficient approach proposed in literature when tested on our dataset containing genuine images of various content but cannot be very accurate when the image in question is acquired by a scanner having the same model as one of the known scanners in the dataset. Notwithstanding, its performance may be further improved by reducing the image content left in the HH subband. In the proposed semi-blind strategy [START_REF] Ben Rabah | Semi-Blind Source Scanner Identification[END_REF], we solved the problem of scanners of the same model. Yet, the disadvantage of this method is that it is useful only if the original document is known. A hybrid framework combining these two approaches is likely to further push the performance of the forensic SSI. It is worth mentioning that proposed works in this chapter operate on the entire image. However, can we learn scanner features from small regions of the image? We will answer this question in the next chapter.

Our intelligence is what makes us human, and AI is an extension of that quality.

Notre intelligence est ce qui nous rend humains, et l'IA est une extension de cette qualité.

- In the previous chapter, we addressed the problem of device identification by means of hand-crafted features. In order to perform a reliable fingerprint estimation, the traditional pipeline relies on the availability of a good number of images from each scanner which is unsuitable in scenarios where a small database is analyzed. Furthermore, the fingerprints comparison is based on distance measures that could be time consuming [START_REF] Helén | Audio query by example using similarity measures between probability density functions of features[END_REF] and may become a major bootstrap when large device fingerprint databases need to be scanned. It is also important to notice that digital images may be processed with some information loss before investigation. They can be cropped for instance. Thus, it is important to design an alternative scheme which resembles a realistic situation under which only a small part or patches of the questioned image is available. In this chapter, still following the research line of designing a source scanner identification (SSI) model, we provide two data-driven approaches that automatically learn features from patches of digitized documents. It is organized as follows. In the first part, we give an overview of the deep learning-based methods that deal with source device identification. Then, in the second part, we present our approach based on a Two Dimensional Convolutional Neural Network (2D-CNN) and inspired from our previous work presented in 3. The third part describes another different framework using a One Dimensional Convolutional Neural Network (1D-CNN) and a Support Vector Machine (SVM). The first approach is working on non-overlapping squared patches while the second one takes linear inputs. For each one, we provide discussions and experimental comparisons with existing well-known neural networks as well as our previous method [START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF] proposed in 3.

Related work

Artificial Neural Networks (NN) are one of the trendiest research topics in 2021. They offer cutting-edge solutions to solve classification, prediction and detection problems in many fields [START_REF] Dt Mane | A survey on supervised convolutional neural network and its major applications[END_REF]. They are a subset of Machine Learning (ML) composed of algorithms that train a system to learn pattern from data on its own and make predictions. In fact, NN simulate human decision-making to address real-world problems using ML approaches. Moreover, ML is a subset of Artificial intelligence (AI). AI refers to any computer program that performs a smart task. Notice that Deep Learning (DL) is a specific sub-field in NN that entails creating large and deep NN (generally more than three layers of neurons) to address specific problems. It may be costly and requires a large amount of data for training. A CNN consists primarily of convolutional layers, activation functions, pooling layers and fully-connected layers stacked together to create the CNN architecture. Figure 4.1 shows a simple example of CNN. Such tools have an exceptional capability to learn accurate and convenient features representation automatically from image data (See Appendix C for further details). Recently, the use of CNNs has spread in multimedia forensics community and, in particular, for source device identification. CNN-based digital content forensic approaches can be broadly split into two categories: (i) methods that rely on stacked convolutional layers in the CNN to learn the camera patterns automatically from input images; and (ii) works relying on a pre-processing step to prevent the CNN from learning features related to the image's content and to learn only device specific features.

The first algorithm in the first category was proposed by Bondi et al. [START_REF] Baroffio | Camera identification with deep convolutional networks[END_REF]. It utilizes a simple architecture with five layers working on 48 × 48 pixel patches which learns camera features directly from acquired pictures. A low accuracy of 29.8% is obtained at patch level when cameras of same models were considered and this accuracy got increased to 72.9% for model-level camera identification. Later, Huang et al. [START_REF] Huang | Identification of the source camera of images based on convolutional neural network[END_REF] introduced a similar architecture and improved the accuracy by using Batch Normalization and more convolutional layers. In [START_REF] Freire-Obregón | Deep learning for source camera identification on mobile devices[END_REF], a six-layer CNN architecture was evaluated on three smartphone devices. Despite the high accuracy obtained, the results cannot be considered as reliable due to the small set of devices used. A deeper CNN architecture was proposed by Yao et al. [START_REF] Yao | Robust multi-classifier for camera model identification based on convolution neural network[END_REF] composed of 16 layers with 13 convolutional layers and three fully connected layers. The authors observed an average accuracy over 90%. Besides, they found that the proposed multi-classifier is not able to distinguish correctly between cameras of twinborn models. In [START_REF] Chen | Camera model identification with residual neural network[END_REF], Chen et al. discussed the use of a residual neural network (ResNet) composed of 26 layers. According to the reported results, ResNet performs better than AlexNet [START_REF] Krizhevsky | Imagenet classification with deep convolutional neural networks[END_REF], GoogLeNet [START_REF] Szegedy | Going deeper with convolutions[END_REF], and the architecture proposed by Bondi et al. [START_REF] Baroffio | Camera identification with deep convolutional networks[END_REF]. Further works applied new architectures from computer vision such as DenseNet, XceptionNet and MobileNet [START_REF] Muntakim | Application of DenseNet in Camera Model Identification and Post-processing Detection[END_REF][START_REF] Kuzin | Camera model identification using convolutional neural networks[END_REF][START_REF] Ferreira | An inception-based data-driven ensemble approach to camera model identification[END_REF][START_REF] Hasan | Camera model identification using deep CNN and transfer learning approach[END_REF].

SOURCE SCANNER IDENTIFICATION BASED ON AN AUTOMATIC FEATURES EXTRACTION 59

Considering the second category, we can cite methods that use Gaussian filter residuals [START_REF] Ding | Camera identification based on domain knowledge-driven deep multi-task learning[END_REF] or high-pass filter [START_REF] Tuama | Camera model identification with the use of deep convolutional neural networks[END_REF] prior to feeding images into CNNs. To improve the results obtained with these conventional fixed filters, Bayar and Stamm [START_REF] Bayar | Augmented convolutional feature maps for robust cnn-based camera model identification[END_REF] have proposed a data-driven constrained convolutional layer as a preprocessing step. In [START_REF] Wang | Source camera model identification based on convolutional neural networks with local binary patterns coding[END_REF], the authors used local binary patterns (LBP) to code the input images.

Recently, Rafi et al. [START_REF] Muntakim | RemNet: remnant convolutional neural network for camera model identification[END_REF] introduced a novel data-driven preprocessing block composed of several remnant blocks. In [START_REF] Kang | Camera model identification using a deep network and a reduced edge dataset[END_REF], strong edge components were reduced in each image patch before feeding it into the CNN.

Earlier studies [START_REF] Mo Chen | Digital imaging sensor identification (further study)[END_REF] have reported that the camera recognition is more accurate for smooth and non-saturated images. Thus, selecting patches verifying these conditions, as a preprocessing step, can have a positive effect on the performance.

Another selection criterion has been proposed in [START_REF] Bondi | First steps toward camera model identification with convolutional neural networks[END_REF][START_REF] Bondi | A preliminary study on convolutional neural networks for camera model identification[END_REF], which seeks to find better textured pixel patches to train the CNN. Güera et al. [START_REF] Güera | Reliability map estimation for CNN-based camera model attribution[END_REF] introduced a reliability map to estimate a value, for a given patch, indicating if it is containing valuable camera information. Interestingly, the approach in [START_REF] Yang | Source camera identification based on content-adaptive fusion residual networks[END_REF] has proposed to separate image patches into three subsets according to their mean and variance, and then, train each subset with its adapted CNN. The analysis of those techniques shows the importance of the preprocessing to make the CNN invariant to image content and that using an automatic filtering is better than using manual one. However, even though the applied preprocessing operations really helped to reduce the influence of image contents, it may filter out useful information.

Scanner Source Identification using Wavelets and 2D-CNN

As previously exposed, CNNs are able to learn device features that could not be seen by hand-crafted approaches. The identification accuracy in most of the CNN-based source camera identification approaches presented in the previous section exceeds 90%. However, the training process of those networks is usually long and timeconsuming. Moreover, the principal limitation of all above data-driven methods is that they mainly focus on the identification of the camera model instead of classifying devices of the same model. An additional uncontrolled factor is the complexity of the CNN architectures used in these approaches which, consequently, require a large amount of training images that may not be available in real situations. Nevertheless, due to inherent mechanical, processing and sensors differences between cameras and flatbed scanners, the vast majority of these approaches cannot be applied directly to scanners. So far, very little attention has been paid to the role of neural networks to solve SSI problems. To the best of our knowledge, only Shao and Delp [START_REF] Shao | Forensic scanner identification using machine learning[END_REF] proposed a SSI mechanism using CNN. They used an architecture inspired by the one proposed by Chollet in [START_REF] Chollet | Xception: Deep learning with depthwise separable convolutions[END_REF] and which relies on 14 layers, including 12 convolutional steps and two fully connected layers, working on 64 × 64 patches. As we will show it later, this mechanism does not perform efficiently once tested on an adapted dataset. This gives rise to investigating more effective CNN-based forensics scanner solutions.

In addition, distinguishing scanners of same brand and model is another key issue which has not been solved yet.

In this section, we propose to take advantage of CNNs and propose a solution that identifies the scanner that has acquired a given scanned document in a blind way. It takes as input the document diagonal HH wavelet subband coefficients; coefficients that carry complementary information about the scanner noise. Our work is inspired by our methodology presented in section 3.2 which has shown advanced performance compared to the state of art. In fact, by feeding CNN with HH subbands coefficients, we expect: i) to be able to remove the scanned document content that is not relevant for SSI and, ii) that deep learning will be able to extract the noise mixture that is unique to one scanner. In this work, we opted for the stationary wavelet transform (SWT) [START_REF] James | The redundant discrete wavelet transform and additive noise[END_REF] rather than for the traditional DWT due to its better performance for image denoising [START_REF] Kumar | Signal denoising with interval dependent thresholding using DWT and SWT[END_REF] due to the shift invariance property of SWT. In addition, SWT avoids coefficients decimation, a property of interest for small images. The architecture of our system is depicted in Fig. 4.2. As it can be seen, it first cuts the image into non-overlapping blocks, that is to say into patches. This is an important step in order to obtain enough data for the training process, when the training image set is small, and to avoid memory saturation. Then, these blocks are wavelet transformed and their HH wavelet subbands are used as input of a CNN. The final decision about the source scanner relies on a majority voting considering CNN responses for all image blocks. We come back on the details and the purpose of each of these steps in the sequel.

Image and scanner fingerprints

SOURCE SCANNER IDENTIFICATION BASED ON AN AUTOMATIC FEATURES EXTRACTION 61

Pre-processing: Wavelet decomposition

WT has been successfully applied in a wide variety of scientific fields. In our previous work [START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF], we explored the DWT transform in order to: i) suppress block content information so as to better extract the flatbed scanner mixture noise; ii) reduce the dimensions of the data to process. Whereas, in the current work, we rather use SWT, an extension of the traditional DWT, thus neglecting the downsampling step.

In the following, the wavelet transforms are performed with the Symlet4 wavelet filter based on the results presented in [START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF].

For one decomposition level and for an image of N xM pixels, a dyadic SWT produces four subbands of coefficients of the same size N xM (LL, LH, HL, HH).

As an input to our system, only the HH subband is exploited for the same reasons explained previously in Section 3.2. We will see in the experimental section that this pre-processing step is of importance in order to obtain valuable classification results.

CNN architecture

A key way to achieve high accuracy rate is to design a CNN that is adapted to the identification system desired. First, to avoid increasing the number of weights/ parameters of the network, we proposed a shallow CNN with only one convolutional layer (Conv). A second main reason of not going deeper is to be able to train the network using considerably less training data. When a coefficient subband enters the network, it goes through this convolutional layer that convolves the input image with 32 kernels of size 3x3 where the kernel stride is by default set to 1. It is followed by the non-linear activation function ReLu to make our network sparse and help the training to quickly converge. The max-pooling operator of window size 2x2 is by next applied in order to reduce the spatial dimension of the input. These pieces of information are the inputs of two fully connected layers (FC layers) of 512 and R neurons, respectively, preceded by a dropout layer with a probability of 0.5 to prevent over-fitting [START_REF] Srivastava | Dropout: a simple way to prevent neural networks from overfitting[END_REF]. The layer located at the very end of our network accompanied by the sigmoid activation function plays the role of a classifier which make the source prediction of the input image. Notice that the R nodes represent the likelihood of the image to be acquired by each scanner, where R is the number of scanners. Table 4.1 sums up the hyper-parameters of our network.

Image origin predictor

In the previous section, we proposed a network that predicts the source of blocks rather than the entire image. Thus, after having classified all the blocks of an image under observation, majority voting is adopted in order to take the final decision about the specific scanner that has acquired the full image. It is calculated as follows

M(Q) = k if occ(k) = max j=1.n (occ(j)), 1 ≤ k ≤ N (4.1)
where: Q is the questioned image and occ is the occurrence number of a class j defined by:

occ(j) = M i=1 (P i = j) (4.2)
where P i is the predicted class (i.e. the source scanner) of the ith block of Q and M is the total number of blocks. In other terms, the scanner the mostly predicted is identified as the source scanner of Q.

Experimental results

To validate the proposed SSI method, several network parameters are discussed and compared. Experiments were performed using a dataset of images of different content acquired with 8 commonly-used flatbed scanners (see Table 4.2). The image dataset corresponds to 54 documents of different types (forms, certificates, contracts, records...) of various content (text, figures, stamps...), which were printed on A4 paper with the same printer and then scanned at the same resolution (300dpi) with each scanner. Scanned documents are stored in the TIFF format.

Performance measurements are mostly based on classification accuracy, which is the ratio of correct predictions to total predictions made, and confusion matrices.

In the confusion matrix, each row refers to the predicted label for each scanner instance while each column corresponds to the actual class (scanner). Each of the following schemes has been implemented in Python using Keras [189] deep learning library on a ZOTAC GeForce RTX 2070 SUPER AMP EXTREME GPU with 32 GB of RAM. The RMSprop optimizer [START_REF] Tieleman | Lecture 6.5-rmsprop: Divide the gradient by a running average of its recent magnitude[END_REF] was used. The learning rate was set to 10 -6 and the training batch size to 32 images. The final training period consists of 49 epochs which provides the smallest loss on validation blocks. For each CNN model, we randomly selected 40% of the images for the training, 20% for the validation and 40% for the testing. During training, K-fold cross-validation technique [START_REF] Juan D Rodriguez | Sensitivity analysis of k-fold cross validation in prediction error estimation[END_REF][START_REF] Varoquaux | Cross-validation failure: small sample sizes lead to large error bars[END_REF] is applied to guarantee generalization that is to say a low dispersion of the accuracies across the folds. In this study, K is set to 5.

SOURCE SCANNER IDENTIFICATION BASED ON AN AUTOMATIC FEATURES EXTRACTION 63

Classification results for the proposed scheme

To train our network, all images from our dataset were split into non-overlapping blocks of size 256x256 pixels. These sub-images are annotated with their corresponding scanner candidate as label. Thus, in total, we have approximately 48000 scanned sub-images with different varieties of image details. As stated in section 3.2, in order to make our system less sensitive to the image content and that it only learns scanner fingerprints, SWT is applied on these samples giving access to HH subbands next used as CNN input.

To test the effectiveness of the proposed neural network in distinguishing scanners, we have carried out a series of experiments. The main purpose of the first experiment is to evaluate the performance of our method when it works on single image blocks, that is to say taking a decision about the source scanner of a document from one block, only. A decent testing accuracy of 99.31% is obtained. We repeat the same experiments using the DWT instead of the SWT and a decrease in the classification accuracy by 2.31% is observed. Then, after demonstrating the good performance of our scheme only on single block, we evaluated the entire pipeline. More clearly, we apply a majority voting on the decisions obtained from the CNN on all image blocks as presented in Fig. 4.4. The confusion matrix presented in Table 4.3 for classifying full images has an average classification accuracy of 100% using the same dataset.

To further evaluate the reliability of our scheme, we propose to use another image test set. 90 new documents were scanned using each scanner from the lsit in Table 4.2, leading thus to 720 new images next classified with our network. Again, we obtained 100% of accuracy. Thus, our system is proven to be reliable whatever the content of the processed images. The following experiment investigated the impact of the number of convolutional layers onto the performance of our scheme. Figure 4.5 shows that the dynamics of the model with 1, 2 and 3 layers are pretty similar. But, the model converges more rapidly with only one convolutional layer, learning thus the problem more quickly.

Next, we provide experimental evaluation to prove the efficiency of feeding CNN with the HH subband of each block rather than with the block pixel, directly. As it can be seen in Fig. 4.6, better performance is achieved compared to the classification without this pre-processing step. This demonstrates the important role of this step. This result shows that, for SSI, it is more appropriate to extract features in the transformed domain than in the spatial domain. This explains the interest of considering the HH subband which isolates the high frequencies in the images, and in particular, the noise related to the scanners.

It is interesting to note that scanners embed vertical and horizontal artifacts that can be found in the HL and LH sub-bands. So, an alternative is to use these The HH sub-band provides better accuracy results. The LL sub-band is also considered to confirm its non-adaptation to solve SSI problems. Notice also that the LH subband is also suitable for SSI which is related to the linearity of the scanner sensor.

Another important parameter that is crucial when analyzing the performance of the proposed CNN is the choice of the color channels. Figure 4.8 shows that a preserving all color channels dramatically improves the forecasting accuracy.

The block size is one of the most important parameter of our proposal with an impact on its classification accuracy. Thus, more experiments were carried out in order to show the effect of the block size while considering both DWT and SWT. Two different block sizes were considered. From Fig. 4.9, it appears that high classification accuracy is achieved when training the CNN with just 1000 blocks from each scanner whatever the block size. It can be also observed that using the DWT decreases the forecasting accuracy significantly for smaller blocks. These results confirm that the SWT is more suitable than DWT for SSI based on neural networks due to its up-scaling property which likely preserves more information about the scanning noise.

SOURCE SCANNER IDENTIFICATION BASED ON AN AUTOMATIC FEATURES EXTRACTION 65

Comparison assessments

A comparison of the current method with respect to all the SSI methods in literature is well beyond the scope of this work since most of them require specific testing image types and/or additional requirements. Therefore, to assess the superiority of our proposal, we propose to compare it with the KLD-based method we proposed in Chapter 3; a method that has demonstrated better behavior than other recent approaches. Let us recall that KLD-based method extracts hand-designed features in the wavelet domain. We have also implemented the CNN based method of Shao and Delp [START_REF] Shao | Forensic scanner identification using machine learning[END_REF]. Table 4.4 shows the various methods and their respective accuracies. As it can be seen, our method outperforms the state-of-art methods by obtaining an overall accuracy of 100%. We can also notice that Shao and Delp method [184] 66 failed to correctly identify most of the scanners. This can be explained by the absence of a pre-processing denoising step which, as shown previously, is necessary to remove the image content. Note that the classification accuracy degrades also in [START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF] along with the increase of the number of scanners to discriminate.

Scanner Source Identification using Wavelets and 2D-CNN

To compare with common CNN, we trained AlexNet [START_REF] Szegedy | Going deeper with convolutions[END_REF] and GoogLeNet [c44432] on our image data set, using the same pre-processing strategy. We obtained an accuracy of 94.69% and 90.64% at block level and 97.5% and 96.66% at full image level for AlexNet and GoogLeNet, respectively, as reported in Table 4.4. We further compare the time complexity of each network. Based on the results shown in Figure 4.10, AlexNet requires the shortest training time but performs the worst in term of classification accuracy. We reported 5227.77s, 4026.55s, and 36607.06s as average training time for our CNN, Alexnet and GoogLeNet respectively. Compared to the performance of our scheme, one can conclude that much better performance are achieved with a small, less time-consuming and compact CNN configuration of only one convolutional layer.

SOURCE SCANNER IDENTIFICATION BASED ON AN AUTOMATIC FEATURES EXTRACTION 67

Discussion

In this section, we proposed a novel approach that exploits the scanner noise located in the wavelet HH subband while simultaneously benefiting of the capacity of CNN to automatically extract useful features from this subband. We evaluated the advantage of using the SWT and the HH subband as input to the network. More experiments have been conducted to assess the performance gains achieved by limiting the number of convolutional layers to only one layer and, on the other side, keep using all the color channels of the images. Classification results also demonstrate that our CNN offers superior performance than recent scanner identification techniques even under the condition of limited training samples. Another result of our scheme is that it is able to identify the source scanner even from small blocks of the image. This is a promising prospect for forensics applications particularly when only a part of the investigated image is available such as forgery detection.

Scanner Source Identification using SVM and 1D-CNN

The existing CNN-based solutions for camera source identification work by analyzing square image patches. The geometry of the patches is suitable for such task since it is coherent with the geometry of the camera sensors array. This interpretation, however, contrasts with the one related to scanners due to the linear geometry of its sensors. Therefore, it is better to take into consideration the linearity of the scanning noise to build more sophisticated and reliable architecture. Moreover, there is a need to meet real world conditions with a scheme capable to work whatever the digitized document content. More clearly, the effectiveness of existing methods is limited by their capability to suppress most of the image content and to only extract the scanning noise.

In recent years, sequence classification using 1D neural networks, also called sequence learning, has demonstrated groundbreaking performance in the field of machine learning tasks such as speech emotion recognition [START_REF] Li | Speech emotion recognition using 1d cnn with no attention[END_REF][START_REF] Zhao | Speech emotion recognition using deep 1D & 2D CNN LSTM networks[END_REF], accent classification [START_REF] Ayodeji Olalekan Salau | Accent classification of the three major nigerian indigenous languages using 1d cnn lstm network model[END_REF], and text classification [START_REF] Gumilang | Experiments on character and word level features for text classification using deep neural network[END_REF].

In this section, we introduce a new sensor fingerprint-based approach for SSI. Its originality is twofold. At first, as opposed to actual approaches, it focuses on the 1D sensor characteristics of flatbed scanners with as objective to automatically extract optimal discriminative features that are next classified by an SVM (See Appendix D). By doing so, the proposed hybrid 1D-CNN-SVM approach is able to learn only from a small part of each scanned pixel lines making our solution of small complexity. In second, our scheme can discriminate scanners of same model, even they are more than one. Experiments conducted on a large set of documents and scanners demonstrate that our 1D-CNN-SVM approach is capable to provide efficient training with limited size of training data and that it surpasses the most recent state-of-the-art method. They also show the interest to take into account the 1D characteristic of scanner rather than working with a 2D-CNN model. Our new data-driven approach works on segments extracted from each row of scanned documents. The features extracted from each of those segments are later fitted into an SVM for classification in order to achieve better performance than with a CNN model alone. The final judgment about the source scanner relies on decisions taken over all segments of an image by means of a majority voting mechanism.

Image and scanner fingerprints

The solution we propose focus on three critical issues in SSI: (i) discrimination or identification of scanners of same brand and model (ii) availability of only a few documents for the model training task and (iii) testing made on a portion of the document. The general structure of our framework is illustrated in Fig. 4.11. As it can be seen it is constituted of two main tasks: feature extraction with the help of a 1D-CNN model followed by a SVM as a source scanner predictor. This work addresses the scanner's sensor noise corresponding to the line-by-line scanning pattern. To meet up the one-dimensional characteristic of this noise pattern, we designed a 1D-CNN to determine the source scanner used to capture a scanned image by considering fixed-length segments taken from each of its rows as input to the CNN. Each row segment position is chosen randomly but fixedly for training and testing the proposed system. The measurement results are more or less affected by the selected position as the sensors noise is expected to be repeated over all the rows of a scanned document, as explained in Chapter 2. These multi-channel segments are then fed into a 1D-CNN. The final model has been decided based on numerous experiments to verify the best balance between network complexity and system performance. Since the number of images used for training is limited, it is not recommended to use a more in-depth architecture [START_REF] Xu | SDD-CNN: Small data-driven convolution neural networks for subtle roller defect inspection[END_REF]. Moreover, the number of filters and their corresponding kernels is chosen to provide a general presentation of the scanning noise. As shown in Fig. 4.12, the 1D-CNN is composed of 8 layers structured as follows:

SOURCE SCANNER IDENTIFICATION BASED ON AN AUTOMATIC FEATURES EXTRACTION 69

• The multi-channel segment is generated from each line of the digitized document and fed as input to the first convolutional layer producing 100 feature maps as output. The purpose of this processing is to extract enough statistical properties and different types of dependencies among pixels in the noise inserted when digitizing an image.

• A second convolutional layer with another 100 filters with kernel size 10 is applied to the output of the first layer.

• The resulting feature maps are aggregated with a Max-pooling layer of kernel size 3.

• A third and fourth convolutional layer with 160 filters of size 10 are then applied.

• The number of parameters is reduced by a global average pooling layer before using a dropout layer with a probability of 0,5. The key idea of this later is to generate more robust features by randomly dropping different subsets during training.

• A last dense layer with 9 output neurons using a softmax function played the role of a classifier.

ReLu, the most used activation function in CNNs, was adopted as the activation function in all the convolutional layers to help learning complex functional mappings from data by thresholding values at 0, i.e. activating all output nodes larger than zero and suppressing output nodes smaller than zero. It is chosen to improve the non-linear problem-solving ability of our network. The architecture of the proposed 1D-CNN was adapted according to the parameters described in Table 4.5.

Full image source scanner identification

Although Softmax performs very well in terms of classification, it has been proved recently that the SVM classifier enhances the classification accuracy [START_REF] Tang | Deep learning using linear support vector machines[END_REF]. In the present study, the softmax layer was replaced by an SVM classifier. Therefore, the preceding layer outputs (Layer 7) are treated as features to train the SVM. Once

SOURCE SCANNER IDENTIFICATION BASED ON AN AUTOMATIC FEATURES EXTRACTION 71

trained, it performs a source identification task of segments from the testing images with those extracted features.

Since the classification is performed on segments extracted from rows of the questioned document, during testing, SVM predictions need to be aggregated to decide which scanner has acquired that document, as illustrated in the bottom of Fig. 4.11. Therefore, the final decision about the source of the questioned document is taken according to a majority voting rule. Let c i,j denotes a binary metric indicating if the i th segment is predicted as acquired by the j th scanner:

c i,j =    1, if j is the predicted class (scanner) of the i th segment 0, otherwise (4.3)
where i = 1,.., M , j = 1,.., R, M is the number of image rows (number of segments in one image), and R is the number of scanners. For each scanner, the number of segments identified as acquired by the scanner j is denoted by L j and defined as

L j = M i=1 c i,j (4.4)
The final decision about the source scanner is chosen such that it has the highest number of segment predicted as belonging to it, thus, verifying:

L j = max k=1..N (L k ) (4.5)

Experimental results

Our system was implemented in Python using Keras library from the tensorflow [START_REF] Abadi | Tensorflow: A system for large-scale machine learning[END_REF] framework and executed on a computer equipped with ZOTAC GeForce RTX 2070 SUPER AMP EXTREME GPU and 32 GB of memory. A batch size of 8 samples was used for training the 1D-CNN which was trained up to 35 epochs with early stopping equal to 10. The batch size is chosen so as to reduce loss fluctuation. For optimization and weights updating in the backpropagation training stage, we used Adam [START_REF] Diederik | Adam: A method for stochastic optimization[END_REF] optimizer with a small learning rate of 0.0001 to prevent falling into local minima.

The length of the segments to be extracted from image rows is fixed to 128 and the start position within columns is 1000. A sample on how segments are extracted from each image is shown in Fig. 4.13. A block of size M x128 is first cropped at the given column position and then segmented horizontally. For SVM, the Python Scikit-learn library [START_REF] Pedregosa | Scikit-learn: Machine learning in Python[END_REF] was used for training and classification.

Dataset

The dataset used to train and evaluate the proposed approach has been generated by scanning 90 documents at the resolution of 300dpi with a collection of 9 scanners of different brand and model given in Table 4.6. These documents are of different types in order to simulate real-world situations (forms, hand-written documents, certificates, medical records, reports...) leveraging various content. They were then printed at 600dpi on similar quality A4 paper using the same printer. This is crucial to get rid of the variability due to the variations in paper quality or printer. At least, we obtained a dataset composed of 810 document images saved in TIFF format. Fig. 4.14 shows several samples of the cropped blocks from which the segments were extracted.

Evaluation

All reported experiments used a 3-fold cross-validation procedure. In all cases, 20 documents were taken at random for training and validation and the remaining documents for testing.

Evaluation of the features extraction network

In order to evaluate the proposed architecture, we observe through various experiments the proposed 1D-CNN architecture by observing its ability to extract high discriminative features for limited training data. We proceeded by first considering different segment lengths (128, 256 and 512) to assess the impact of the input length on the classification performance. Figure 4.15 shows that a segment of length equal to 128 pixels is the best choice since it provides the highest training accuracy even though working with other segment sizes performs well. This result is of great interest as it indicates that our system shows obvious advantages when dealing with small size images and with processor of limited capacity.

Since the digitized documents considered in these experiments are full color images, we preferred to test the effectiveness of each color channel separately. It can be seen in Fig. 4.16 that jointly handling color channels leads to higher performance. This confirms what has been reported that combining the three color channels tends to produce superior performance compared to using with each separate color channel independently due to the possible inter-channel correlation [START_REF] Foi | Pointwise shape-adaptive DCT denoising with structure preservation in luminance-chrominance space[END_REF]. For this reason, we decided to exploit the three color channels jointly.

SOURCE SCANNER IDENTIFICATION BASED ON AN AUTOMATIC FEATURES EXTRACTION 73

In order to have a better insight of the behavior of the proposed 1D-CNN during training and validation, learning curves were computed and provided in Fig. 4.17. The training curves show that our model is learning well the scanners fingerprints. On the other hand, the model generalization capacity can be confirmed by observing the validation learning curves. No over-fitting or under-fitting have been reported. To the greatest extent, fast convergence rates were observed as the training and validation loss converged in around 35 epochs. When converging, validation accuracy and loss curves slightly oscillate indicating the robustness of our network in reducing sensitivity to documents' content.

1D-CNN vs 1D-CNN-SVM

To verify the validity of the improved 1D-CNN-SVM model, we performed the following experiments: the first one aims at evaluating the source scanner prediction performance of the 1D-CNN-based classifier for separate segments as well as on full images (i.e. with majority voting applied on segments of each testing image); the second experiment is designed to validate the performance of the SVM-based classifier. Firstly, experiments performed on segments reached almost 90% of accuracy when the softmax layer is adopted for classification. On the other hand, a total identification accuracy of 95.65% is obtained when testing on entire images. The final results are illustrated in Table 4.7. One key reason behind the high accuracy of the proposed SSI based on the 1D-CNN scheme is that this neural network is able to perform adaptive extraction of the features that characterized the sensor noise.

Next, we verified the performance of the proposed ensemble 1D-CNN-SVM model. We reported 93.13% and 98.14% at segment level and full image level respectively. Table 4.8 illustrates the confusion matrix related to this model. It can be observed that, for both architectures, a small confusion arises between S3 and S4 which are two instances of the same model CanonScan 9000F due to the high similarity between their settings which is not the case for the Epson Perfection V370 instances. These results demonstrate the capability of the 1D-CNN-SVM model to better discriminate between scanners of the same brand and model even when they are difficult to differentiate.

SOURCE SCANNER IDENTIFICATION BASED ON AN AUTOMATIC FEATURES EXTRACTION 75

Comparison with previous work

The performance of the proposed deep learning based method is, first, compared with the most recent method (DWT-KLD) that we have presented in Section 3.2 for different identification levels. As shown in Table 4.9, the deep learning features based on 1D-CNN outperforms handcrafted features based method and achieved the best accuracy independently of the number and the models of scanners. Much of the instability in the DWT-KLD method stems for the increase in the number of scanners, the availability of scanners of same model, and the use of a small training dataset to generate the scanners' fingerprints.

In order to show the interest of working with 1D-CNN, we decided to investigate the performance of the 2D-CNN-based model proposed in the previous section. To allow fair comparison of results, we fixed the size of the input patch to 128x128. We also attempted to keep the same training parameters across experiments. The outcomes of this experimental analysis are shown in Table 4.9. A good accuracy that approaches the results obtained by the 1D-CNNs was achieved when only the scanners of different models (7 scanners) are considered. However, it appears that the 1D-CNN-SVM architecture leads to a significant increase of performance when more scanners of the same model are considered. It is also worth noting that the 1D-CNN used in this work is more suitable to exploit the geometry of the scanner sensors array.

Discussion

In this part, we proposed a new SSI approach applying a hybrid 1D-CNN-SVM model on digitized document lines. We have shown that features extracted by the neural network fits scanners fingerprints better than manually designed features using limited training data (only 20 documents per scanner). Assessments have demonstrated the effectiveness of the 1D-CNN to greatly suppress the content of documents and to preserve most of the sensors noise. Our network extracts more significant scanner features with inherent independence from the image content especially for scanners of different models. Moreover, replacing the softmax layer by SVM is proved to be beneficial for the generalization ability of the SSI system, overcoming the fact that CNN linear separability is not complete.

Conclusion

Long ago, the task of SSI has been dealt with many techniques based on statistical analysis and patterns comparison. However, recent advances in the capabilities of computer chips have prompted a renewed interest in ML, and in particular NN-based techniques. Thus, in this chapter, we proposed to automate the SSI process by implementing two CNN models using the one dimensional and the two dimensional architectures. We jointly search for the best features extractor-classifier pair that boosts the accuracy of the scanner identification. We prove the efficacy of the proposed models by testing on a larger number of scanners compared to the hand-designed features based methods presented in the previous chapter. Moreover, we have shown that they outperform state-of-art methods. The main benefit of these approaches is that a small number of images is required to learn a good discriminative CNN. Nevertheless, current SSI assumes that the investigated document was acquired by one of the known scanners. Because forensic investigators frequently work in open circumstances, this is a serious constraint. The fact that new scanner models are introduced every year and that many of them are difficult to obtain makes the problem more and more complicated. Moreover, a typical investigator may be only interested to know whether or not images are acquired by the same device.

That is why we propose in the next chapter to design a new forensic technique that brings a solution to this problem using only fingerprints extracted from each scanned image without any knowledge about their source scanner.

We're entering a new world in which data may be more important than software.

Nous entrons dans un nouveau monde dans lequel les données peuvent être plus importantes que les logiciels.

-Tim O'Reilly Current source scanner identification (SSI) methods can accurately identify the source device that has captured an image between a range of known scanner models. In another word, the source to identify is predefined in the database of scanners used to train these methods. This is known as a closed-set classification. It is thus natural to think about what may happen if the instigated digitized image has not been acquired by one of these known models? In this real-world situation, existing methods will associate the image to one of these scanners leading to a misclassification. As a consequence, the problem of SSI must be treated as an open-set detection problem.

SOURCE SCANNER LINKING

On the other hand, one may just need to know if two images have been acquired by the same scanner model or not. This problem is referred as device linking (DLK). In this chapter, we aim at solving both problems by developing a novel approach with as objective to verify the similarity between two images sources without having physical access to their source acquisition devices. Consequently, this information about source similarity could be exploited to check if a suspected image was acquired by one of the few known scanners. In realistic situations, it is not possible to have full access to all source scanners and to build a unified database of scanner footprints. Therefore, it is important to know if an image is coming from a device that hasn't been used during training the SSI system with the goal to decrease false matches.

Device linking schemes

In the following, we address the problem of DLK for flatbed scanners by designing a hybrid 2D-1D-CNN architecture that, given two images of unknown sources, can decide whether they were captured by the same scanner or not. This solution is the first step towards challenging open-set SSI. One advantage of this method is that prior information about the scanner or its fingerprint is not necessary to make a DLK decision. More clearly, our system can perform matching between pairs of patches without being trained with samples from the source of those pairs. Moreover, the performance degradation for post-processed images is a critical problem in the field of digital image forensics (DIF). In order to work in real world scenarios where images may be compressed for sharing and storage purposes, it is important to devise methods that are resistant to compression operations. In this work, we have proposed a new robust deep learning approach to forensically determine if two JPEG compressed images are of the same make and model of a scanner that captured them. This chapter is organized into three parts. First, we come back to the existing schemes that have been designed for source DLK. In the second part, we detail the main principles of our approach. Some experimental results are then presented in the third part of this chapter so as to demonstrate the effectiveness of our scheme and how it is well suited for verifying the source similarities of a pair of images.

Device linking schemes

Given two questioned images I1 and I2, DLK is a dilemma in which a forensic investigator is required to choose between the following two hypotheses: Fingerprints-matching through correlation -In these schemes, the fingerprint of each image is obtained by applying a wavelet based denoising filter on it [START_REF] Goljan | Identifying common source digital camera from image pairs[END_REF] or on selected regions [START_REF] De | Open set source camera attribution and device linking[END_REF]. In [START_REF] Goljan | Identifying common source digital camera from image pairs[END_REF], the authors extract, for each image, the noise residuals W1 and W2 and combine them with the original images as given in Eq. 5.1. X and Y are then compared statistically using the NCC.

X = I 1 W 1 σ 2 2 I 2 1 + σ 2 1 I 2 2 , Y = I 2 W 2 σ 2 2 L 2 1 + σ 2 1 L 2 2 (5.1)
Next, the peak sharpness is measured using the ratio between the primary peak to the secondary peak (PSR). PSR [START_REF] Bvk | Performance measures for correlation filters[END_REF] is the highest value in the NCC excluding a central region around the primary peak. If the PSR is greater than a predefined threshold, the images are declared to be from the same camera. However, this method requires that the questioned images have the same size. As a result, we may need to pad the images with zeros or crop them which reduces the percentage of correctly classified matching pairs. The second approach [START_REF] De | Open set source camera attribution and device linking[END_REF] uses a support vector machine (SVM) in conjunction with a decision boundary carving procedure which consists in moving the decision hyperplane in a way that helps deal with images issued from unknown devices. As shown in Fig. 5.1, the residual noise in each ROI (Grey blocks) for each color channel R, G and B is estimated. After that, a feature vector is created based on the correlation between the noises in each ROI of both images. Each pair of images are, later, labeled as the positive (if taken by the same camera) or as negative (if taken by a different camera) before being fed into an SVM. The first conceptual component is a network that maps images I 1 and I 2 into a low-dimensional feature vectors f (I 1 ) and f (I 2 ) that encodes important forensic patterns about the source device. Indeed, some recent studies proved that CNNs have shown significant improvements in features extraction from image patches [START_REF] Bayar | Design principles of convolutional neural networks for multimedia forensics[END_REF]. Details of the network used as a features extractor in [START_REF] Mayer | Learned forensic source similarity for unknown camera models[END_REF], [START_REF] Mayer | Forensic similarity for digital images[END_REF], [START_REF] Swaroop | Device-based image matching with similarity learning by convolutional neural networks that exploit the underlying camera sensor pattern noise[END_REF] can be found in [START_REF] Bayar | Augmented convolutional feature maps for robust cnn-based camera model identification[END_REF]. Those vectors are, then, mapped to a similarity score by training separately the second component, a dual-input network, shown by a gray block in Fig. 5.2. This neural network is usually composed of two or three fully-connected layers followed by an output layer delivering a score that indicates whether I 1 and I 2 have different or similar forensic traces. If the score is 0 then one will consider that these images contain different forensic traces. On the contrary, a score of 1 means that both images contain similar forensic traces.

Proposed DLK Method

The approach we propose estimates the likelihood of a pair of scanned documents by using a dual-CNN architecture which will, first, extracts local forensic patterns from their associated equally sized patches via a 2D-CNN and, then, use another CNN composed of a number of fully-connected layers to compute a similarity score for each pair of patches. Later, those similarity scores are combined to produce a final unified prediction. The purpose of this study is to overcome the drawbacks of working in a closed-set context where prior knowledge of the source scanners is required which is generally not the case, given the large variety of flatbed scanners commercialized. Let us also recall that source identification systems are often not scalable, that is to say, they cannot meet the requirement of an increased number of devices. Furthermore, the fact that some forensic investigations do not require explicit identification of the particular device that has acquired a particular document. For example, in the splicing detection task, the digital investigator needs only to detect that some regions of the image have been acquired by distinct devices without specifically identifying those devices. Figure 5.3 depicts the overall design of our DLK system. It consists of four major components. Firstly, the investigated images are decomposed into equally sized patches for model training. Secondly, a pre-processing is required so that those patches get converted to their corresponding high frequency subbands through a one-level wavelet decomposition. Thirdly, features of these subbands are compared using our system designed to estimate a similarity metric between every pair of patches. Finally, the decision is made based on a majority voting mechanism. A detailed description of the last three components are presented below.

Pre-processing

A popular method to minimize the effect of the image content is to apply a preprocessing function. In our previous works, we have shown the interest of the wavelet transform and, in particular, of SWT for achieving this goal. Moreover, we have also demonstrated that the most valuable scanning features that enable us to distinguish between scanners can be extracted from the HH subband. In this work, we propose to use this particular wavelet subband as an input to the first component of the proposed dual-CNN. This is the key behind efficient scanner fingerprint extraction which has a direct impact on DLK.

Patches comparison

The establishment of the proposed system involves two main subsystems, namely the fingerprints extraction module designed to map a feature vector to each patch and the classification module where each pair of patch vectors are compared. Its architecture is inspired from the existing CNN-based DLK architectures previously revealed in Fig. 5.2. As a matter of fact, it's important to note that our proposed patches comparison system uses the same position image patches each time.

Fingerprints extraction

The role of the first sub-system is to construct a representative features vector for each input image. This vector represents the forensic pattern of the device at the origin of that image and can be regarded as its fingerprint. To be effective, this fingerprint should be unrelated to the image's content.

If we refer to CNN-based studies that have been conducted in recent years, we will find out that they play an important role in underlying interpretable and powerful image features representations that can discriminate between different classes. More clearly, once a network has been trained for a specific classification task, relevant features could be extracted from one of its deep layers and then used to perform a different task. For example, features maps extracted from CNNs trained for some facial components (e.g. hair, mouth, eyes, nose, and beard) identification tasks have been demonstrated to be useful for face detection [START_REF] Yang | From facial parts responses to face detection: A deep learning approach[END_REF]. Therefore, some researchers began to develop forensics approaches to study traces left by acquisition devices using deep learning architectures. With regard to forensic features extraction, it has been shown that deep features extracted from a CNN trained for source device identification can be used for DLK [START_REF] Mayer | Learned forensic source similarity for unknown camera models[END_REF][START_REF] Mayer | Forensic similarity for digital images[END_REF][START_REF] Swaroop | Device-based image matching with similarity learning by convolutional neural networks that exploit the underlying camera sensor pattern noise[END_REF] and IFD [START_REF] Bihari | A Deep Learning based Method for Image Splicing Detection[END_REF][START_REF] Bayar | Constrained convolutional neural networks: A new approach towards general purpose image manipulation detection[END_REF].

In this work, we suggest conducting the fingerprints extraction using our 2D-CNN proposed in Chapter 4. Let us recall that this model consists of one convolutional layer followed by max-pooling and dropout blocks and two fully connected layers. The fingerprint is the output of our trained model truncated at layer 4 (see Table 4.1). It is composed of 512 high level features that encode forensic information about the source scanner.

Linking algorithm

After getting the HH subband from each patch, the above forensic fingerprints extractor, that we will call 2D -CN N shrinked , is used in a symmetric bilinear architecture to map the patches to their features vectors, as depicted in Fig. 5.4.

Notice that both instances are employed under a hard parameter sharing paradigm.

In fact, two fundamentally different types of paradigms commonly used in joint learning exist: the hard parameter sharing (HPS) and the soft parameter sharing (SPS) [START_REF] Savarese | Learning implicitly recurrent CNNs through parameter sharing[END_REF]. SPS means that each task has its own CNN and its own parameters but with the same topology, which is subsequently regularized using a similarity function. As a result, the amount of memory space used at runtime is proportional to the number of tasks. On the other side, HPS shares the hidden CNN layers between all tasks, and maintains task-specific fully connected output layers. It is one of the most common methods employed for multi-task learning [START_REF] Caruana | Multi-task learning Machine Learning[END_REF]. HPS is able not only to minimize space complexity, but also to improve performance and reduce the risk of overfitting.

In order to accurately compare the fingerprints extracted from a pair of patches, the formulation of a novel secondary NN, that we will call "ImSiM ", is proposed. This NN takes a pair of fingerprints as input and gives a similarity score so as to help decide if the pair of patches have similar or different forensic traces. The architecture is shown in Fig 5 .4. As it can be seen, this one is composed of three Dense layers and a fusion function:

i) Two identical layers of 2048 neurons in a HPS mode with a ReLu activation function to process the outputs of the 2D -CN N shrinked simultaneously ii) Next, a deep features fusion module, specifically a concatenation function, is used to mix the output maps of the previous layers. This is an important step to integrate the features together and to obtain more prominent accuracy iii) Further, a second layer of 128 neurons is followed by a parametric ReLu activation in which the fused features are embedded iv) Finally, a single neuron layer is used to generate one score indicating if the inputs are issued from the same scanner or not. Basically, it provides a high score in the case of similar sources. We decided to choose Sigmoid as the scoring function based on experimental results we detail in the following section Our design choices are supported by extensive experiments on a large number of image patch pairs.

Decision making

Given that investigated images' patches are classified based on the sigmoid output units, we propose to use a majority voting procedure. This later judges the source similarity between images by counting the number of times a pair of patches are classified to be acquired by the same scanner. It is the simplest strategy but it is also the most effective in terms of classification results. Based on the output of the ImSiM , we set a label of 1 (similarity) or 0 (dissimilarity) based on a threshold ν set based on precision-recall analysis in order to guarantee the highest accuracy. Basically, we compare the sigmoid output O to ν such that the label is

1 if O ≥ ν 0 if O < ν
A majority vote of 50% or more is required to classify the images to belong to the same device.

Parameters settings

In all our experiments, we have used our trained 2D-CNN model described in the previous Chapter for features vector extraction. It is important to recall that, as stated earlier, no training or fine tuning phases were additionally performed on this sub-system. On the other side, ImSiM was trained by a binary cross entropy as loss function along with an Adam optimizer. It produced high accuracy, and the validation error attended the minimum after being trained for 8 epochs, with a batch size of 4, a learning rate of 0.0001 and a decay factor of 0.1. The training was done on a ZOTAC GeForce RTX 2070 SUPER AMP EXTREME GPU. Experimentations were conducted on the same images used in the previous chapters acquired by flatbed scanners with a variety of native resolutions. In our experiments, the documents were scanned at 300dpi resolution. We split these images into two disjoint sets: K and U k. Images from K were used to train our system and were only acquired by scanners indicated as 'known' in Table 5.1. Both sets are then used to test the performance of our proposed model. From K, we generated 168 random pairs of patches where each pair corresponds to patches taken from the same position in two different images acquired by the same device. Next, we built, in the same way, a second set of 280 pairs from images acquired by different devices. Later, 80% of those 448 pairs were used for training and 20% for validation in a random stratified manner. For evaluating our network, we considered other pairs of patches by randomly selecting 448 image patches from K, where 35% of patch pairs were chosen from the same device, and 65% from different devices. Each pair was given a label of 0 or 1 depending on whether they were acquired by different or the same scanner. We consider only non-overlapping 128x128 patches and we run the DLK algorithm with matching and non-matching patch pairs. For full system testing, we experimentally determine that a threshold ν=0.7 results in more reliable accuracy scores. We can also notice that, after the 5 th epoch, the accuracy and the loss evolution almost stop and converge to approximately the same rates. Therefore, our model is not overfitting.

Performance of the proposed system on image patches

Effect of the feature fusion method

To better understand the choice of the concatenation module in the ImSiM network depicted in Fig. 5.4, we investigated the performance of some fusion methods on our dataset. Thus, a set of experiments were conducted in order to determine which one is the best suited for our DLK system. In fact, various feature fusion mechanisms and their application is very dependent on the desired outcome. In this section, we compared the following four different fusion methods:

F concat then y i,j = F concat (x 1 i,j , x 2 i,j ) is such that    y 2i-1,j = x 1 i,j y 2i,j = x 2 i,j (5.2)
where x 1 i,j and x 2 i,j correspond to elements of the first and the second features the network has to take into account, respectively, with i=1..N and j=1..M . N and M are the number of rows and the number of columns of the concatenated inputs, respectively.

• Subtract -This operation is commonly used to determine how close one feature to another is. The output is obtained by subtracting one input from the other one following this formula

y i,j,k = x 1 i,j -x 2 i,j (5.3)
• Multiply -It computes the element-by-element product of two input data. If the same special position's input elements are either positive or negative, their multiplication will be positive. This information may be used to determine the similarity between the inputs. The output result is obtained in this way

y i,j = x 1 i,j * x 2 i,j
(5.4)

• Average -It is a common merging function for networks that adds inputs which are in the same spatial position (i, j). The calculation of the final output y i,j is as follows

y i,j = (x 1 i,j + x 2 i,j )/2 (5.5)
In terms of size, the traditional concatenation method is different from the other methods. As an example, when considering the case of two input images of same dimensions, the output of this fusion function has twice the input dimensions whereas the other methods maintain the same size, i.e. the size of their inputs. According to the above-mentioned fusion methods, cross-validations were carried-out to get a fair accuracy rate. As shown in Table 5.2, the concatenation fusion method used in this work appears to be the best choice as it gives the highest accuracy rate of 94,02% resulting from averaging the accuracy values obtained by repeating the cross-validations three times. It can be also concluded that the multiplication method, opted by state-of-art approaches, gains a small margin over the average and subtraction fusion methods by 0.19% and 1.24%, respectively. In fact, since weights were shared when extracting fingerprints from the image patch pair, the resulting feature vectors of the two 2D -CN N shrinked branches will have their corresponding features in the same location. Thus, information about the location is kept, which is why the concatenation function brought improvement.

Effect of the pre-processing and the scoring function

We evaluated the impact of the pre-preprocessing step on the validation accuracy, that is to say the influence of using the HH subband from the SWT decomposition of the input image patches to feed the fingerprint extractor. It can be seen from Fig. 5.6. that the images' patches directly applied as input to the CNN are less effective with an accuracy of around 75%. This is in line with our observations made in Chapter 3 and 4, where the effectiveness of this preprocessing stage has been demonstrated for scanner features extraction. It was also observed that, when comparing the output activation functions, the proposed method achieves a relatively better performance when the Sigmoid function is used in the final layer of the proposed ImSiM compared to the Softmax function.

Let us recall that the Sigmoid activation function is more adapted to the problem of binary classification; this justifies the results we obtained.

Effect of lossy image compression

As already stated in Chapter 3, the identification and the extraction of device fingerprints have become more challenging when the acquired images and documents have been subject to post-processing such as compression; a hypothesis far from being unrealistic with the increasing use of image editing tools by the general public and professionals.

Here, we investigated the impact of lossy compression on DLK performance. To do so, we JPEG compressed images while varying the JPEG quality factor (QF) (see Section 3.1). We examined performance at QF ∈ 50, 60, 70, 80, 90. What is interesting in our experiments is that only ImSiM training is required, i.e. no need to train the fingerprint extractor as we will use our pre-trained 2D-CNN. Finally, the accuracy measures were computed for patches of sizes 64x64 and 128x128 and are shown in Fig. 5.7.

As expected, DLK performance decreases with heavier compression (lower QF). However, our system is not too much impacted by JPEG compression. Another interesting observation is that both patch sizes show a similar performance degradation. This demonstrates strong robustness against patch size decline.

Comparison and analysis

In the next series of experiments, we applied different standard algorithms to replace the proposed ImSiM for pairs matching. Experiments have been performed considering each time one of the following classifiers:

• SVM with a linear kernel -This one is the most basic SVM classifier type.

It is preferably used to classify linearly separable data. The linear kernel function F L is such that

F L (x 1 , x 2 ) = x t 1 .x 2 (5.6) 88

Evaluation

where x 1 and x 2 are the data to classify.

• SVM with a Gaussian Radial Basis Function kernel -Such a SVM is based on a general-purpose kernel used when no prior knowledge about the data is available. Its kernel function F G is expressed as

F G (x 1 , x 2 ) = exp (-γ x 1 -x 2 ∧ 2) (5.7)
• Linear Regression [START_REF] Groß | Linear regression[END_REF] -It is a statistical technique for predictive modelling analysis used to explain the relationship between a dependent variable (output) and one or more explanatory variables using a straight line.

• Random Forest [214] -It is a machine learning algorithm that produces decision trees, each of which gives a vote for a certain class through a subset of training samples.

When compared with the overall accuracy of these approaches, accordingly to experimental results summarized in Table 5.3, ImSiM has a significant advantage.

As it can be seen, the Random Forest Classifier also provides good classification accuracy of 93,02%. In terms of complexity, our scheme is a bit slower due to the dense layer applied before the concatenation of the ImSiM inputs compared to other methods that directly fuse these inputs. Our system is then compared with the most recent and efficient approach [START_REF] Swaroop | Device-based image matching with similarity learning by convolutional neural networks that exploit the underlying camera sensor pattern noise[END_REF] proposed for DLK of images acquired by digital cameras across two different patch sizes. Figure 5.8. mentions the performance obtained from each model. A visualization of these performances clearly discerns the fact that our model outperforms Guru et al. [START_REF] Swaroop | Device-based image matching with similarity learning by convolutional neural networks that exploit the underlying camera sensor pattern noise[END_REF] model with more than 30% superiority for 64x64 and 128x128 patches. In contrast to DLK methods related to cameras, our system takes advantage of the pre-processing of the patches to extract device features in a more accurate way. This may be the reason behind the huge difference between their performances. Another reason is the scalability of the fingerprint extractor. More clearly, our 2D -CN N shrinked model may not be adapted to extract digital camera features and vice versa. Indeed, training the fingerprint extractor adopted by Guru et al. [START_REF] Swaroop | Device-based image matching with similarity learning by convolutional neural networks that exploit the underlying camera sensor pattern noise[END_REF] on our dataset resulted in an accuracy of 50% which means that it did not properly learn scanners patterns as it did for digital cameras.

Performance of the proposed system on full images

In the previous section, we assessed the performance of our method in detecting whether a pair of patches belongs to images acquired by the same device or not. However, in real life situations, most image documents are investigated and, due to their large size, they cannot be directly tested through a neural network. If we consider two images I 1 and I 2 , the first step is to cut them out into nonoverlapping patches. Then, SWT is applied to each pair of patches P i from I 1 and L i from I 1 located in the same position so as to get their corresponding high frequency subbands HH 1 i and HH 2 i . These transformed patches are, next, normalized. In fact, it is an extremely common practice to scale the CNN inputs to have zero mean and unit variance [START_REF] Yann A Lecun | Efficient backprop[END_REF]. To do so, we simply scaled them by 1/255. The following step is to map to their features vectors f v 1 and f v 2 using the 2D -CN N shrinked described above. To evaluate the similarity between f v 1 and f v 2 , they are fed into our ImSiM network which measures a matching score between 0 and 1. After that, this score is compared to a predefined threshold that will predict if the patches are issued by the same scanner (prediction label is 1) or not (prediction label is 0). The final step regarding the decision for the images consists in applying a majority voting mechanism which will decide, based on the number of pairs labeled as 1, whether the inputs I 1 and I 2 are of the same or different origin. Algorithm 2 for each patch P i in S 1 and its corresponding patch L i in S 2 where 1 i N and N is the total number of patches in each set do

HH 1 i ← SW T (P i ) // HH subband HH 2 i ← SW T (L i ) HH 1 i ← HH 1 i /255 // Normalization HH 2 i ← HH 2 i /255 f v 1 ← 2D -CN N shrinked (HH 1 i ) f v 2 ← 2D -CN N shrinked (HH 2 i ) score ← ImSiM (f v 1 , f v 2 ) if score > ν then pred.append (1)
else pred.append(0) final ← M ajority V oting(pred) if final == 1 then I 1 and I 2 are declared as acquired by the same scanner else I 1 and I 2 are declared as acquired by different scanners To evaluate our model on full-size images, we have used 324 pairs from both K and U k, which were divided into 128x128 patches. Figure 5.9. displays the similarity matrix resulting from testing our model. The diagonal line shows the correct predictions rates of images acquired by the same source scanner, while offdiagonal rectangles show the correct predictions rates when images were captured by different devices. As an example, the system correctly identifies that pair of images which are both acquired by the scanner S4 with an accuracy of 85.71%. Furthermore, when the first image was captured by the scanner S4 and the second image was captured by the scanner S5, the system correctly identifies that they are issued by different devices with an accuracy of 100%. In general, our proposed system is able to achieve approximately 96% accuracy.

Generally, it can be noted that for unknown scanners the total classification accuracy is 100%. On the other hand, we can notice that there are pairs for which our system does not attain high accuracy. These situations seem to occur when the pair of patches were acquired by scanners of the same model. A notable example is when the scanner model is Epson Perfection V370, our system got no correct prediction for pairs of patches acquired by a different instance of this model. This was most likely owing to the hardware and processing pipeline similarities between the two devices, which resulted in highly comparable forensic traces. Few prediction errors also occurred when the pair of patches are acquired by the scanner S4 and S6.

Conclusion

In this chapter, we have focused on the problem of DLK taking advantage of our previous approach on image origin identification through a 2D-CNN. As exposed, existing SSI methods assume a closed-set of scanner models which limit their utility especially in cases when a large number of scanner instances is investigated. The proposed approach is the first technique designed for scanned documents. It allows forensics investigators to verify if two images were acquired by the same device or not without the need to know the brand or the model of those devices. To accomplish this, we developed a hybrid 2D-1D-CNN based system that, given two questioned images, makes a decision about their source similarity by comparing their corresponding noise patches. It is composed as follows: 1) A pre-processing step to obtain the HH subband of each patch 2) The 2D-CNN for features vector extraction, 3) Patches' patterns similarity evaluation which is a 1D dual-entries CNN taking a pair of features vector at a time and finally, 4) A majority voting tool is performed by counting the pair of patches whose similarity score exceeded a certain threshold. We experimentally demonstrated that our system accurately maps pairs of patches as well as full images, although it fails to link images from some specific scanners of the same brandwith about 3% classification error. Moreover, our simple yet effective approach may offer a new perspective on the multi-class open-set classification problem. In another word, it can be extended to find if the origin of a questioned image is not one of the known scanners, which is a common forensics scenario. This can be done by comparing that image to one image acquired by each of these scanners. That information can minimize the number of incorrectly classified pairs resulting from assigning an image of an unknown model to one of the known ones. Given these promising results, our future work will focus on testing on different databases and exploiting the applicability of our approach to test if two images have the same processing history. In line with those goals, it is also desired to reinvestigate the features extracted from scanners of the same model which are usually evaluated as similar due to the similarity between their manufacturing process. In this chapter, we introduce a novel image collection annotated with respect to each scanner as a useful tool for forensics investigators to test and compare scanner-based forensic techniques. We call it 'The SUPATLANTIQUE' dataset [START_REF] Ben Rabah | The SUPATLANTIQUE scanned document database for digital image forensics purposes[END_REF] referred to the names of universities I belong to. It is an image database that contains document of various content scanned with more than one resolution with 11 different scanner instances of widely known brands. Moreover, our dataset is suitable for the study of image manipulations. It comprises more than 100 forged images created using various forgery operations. Besides, the growth of fake data has raised the attempts to detect and localize areas of forgeries in forged images. To address the second question related to forgery detection (FD) which has been announced in the introduction of this manuscript, we propose two new approaches based on the findings, previously presented in chapters 3 and 4, to detect tampering independently of the size of the forged area. The rest of this chapter is organized as follows: In the first part, we present the protocol of acquisition and the organization of our dataset. Then, we follow up with two schemes that, unlike existing schemes in the literature, are able to accurately localize the manipulated regions in a forged scanned image. Finally, experimental results and comparison of both methods are given and discussed.

New Image dataset: Acquisition and organization

When working on source camera identification related problems, most methods can be implemented and tested quite easily thanks to a large number of available public datasets. In Fig. 6.1, we show the variation trend of the annual number of publications in the field of Digital image forensics (DIF) related to the source identification of cameras and flatbed scanners where the black line reflects scannersrelated works while the green one represents works related to cameras. The availability of publicly available data collections like Flickr, the 'Dresden Image Dataset' [START_REF] Gloe | The'Dresden Image Database'for benchmarking digital image forensics[END_REF] and the Raise dataset [START_REF] Dang-Nguyen | Raise: A raw images dataset for digital image forensics[END_REF] show clearly why cameras have gained greater attention. It is also important to mention that the demand for public benchmark datasets is rising in wide range of applications apart from DIF such as medical [START_REF] Sivaswamy | Drishti-gs: Retinal image dataset for optic nerve head (onh) segmentation[END_REF], solar [START_REF] Michael | A large-scale solar image dataset with labeled event regions[END_REF] and human action recognition [START_REF] Chen | UTD-MHAD: A multimodal dataset for human action recognition utilizing a depth camera and a wearable inertial sensor[END_REF]. For scanners, there is an urgent need for a standardized image database. Researchers are wasting too much time and money in building their own datasets. Therefore, we acquired a novel and large-scale dataset using 11 flatbed scanners of different brands and models commonly used in offices. The images in our dataset are annotated according to each brand which include Canon, Epson and HP as well as other characteristics that we will explore in the following. Note that it was necessary to create an extra dataset since the images used in the previous chapters are subject to standards of privacy and confidentiality. The full dataset is available for download upon request at https://sites.google. com/view/supatlantique-dataset/downloads. An overview of the scanners used to create the dataset is given in Table 6.1. We distinguish them according to their: One can notice the presence of scanners of the same brand and model marked by -d1 and -d2. Those scanners will serve to solve the problem of scanner instance identification which is a more challenging and deeper lever of identification as shown in our previous chapters. All class levels are exposed in Fig. 6.3 with examples from scanners listed in Table 6.1.

•
The workflow of the acquisition of the dataset is shown in Fig. 6.2. We defined two types of documents: Official documents and Wikipedia documents. As official records in the real word are normally private or covered by copyrights, we have decided to create synthetic documents with artificial content to be scanned. By 'official', we mean a document which may serve as a proof in criminal and civil proceedings. We began by creating 100 realistic documents (e.g. financial statements, contracts, visa forms, civil certificates) using Microsoft Word. We ensured that these documents' contents are miscellaneous by varying setting options such as colors (i.e., full-color or grey levels), the text format as well as the font size and type (i.e., hand-written or computer-generated). Visual elements such as graphs, logos, and tables were also added. We generated logos using 1 , a free online logo maker.

NEW ANNOTATED IMAGE DATASET TAILORED FOR IMAGE FORGERY DETECTION

. New Image dataset: Acquisition and organization

In addition to the manually generated documents, we downloaded some freely available file documents from the Internet. On the other hand, we picked 108 printable versions of Wikipedia articles in different foreign languages (e.g. Arabic, French, English, Turkish) with various letter sizes, colors and fonts. All documents are then stored in pdf format and printed in color using the same printer (RICOH MP C3004ex) in A4 paper. The use of one printer is important to avoid the interference between its defects and scanners ones. The printing resolution is fixed at 600dpi. The last step consists in using VueScan Pro 9.7.02 to scan these documents at two different resolutions:150dpi and 300dpi. This software includes drivers of more than 6000 scanners which is time saving and recognizes almost all scanning parameters. Once digitized, the documents were saved in uncompressed TIFF format. Advanced parameters, including contrast and brightness, remain unchanged. Examples of these images are shown in Fig. 6.4. We further included flatfield images, also called calibration images, for each scanner and each resolution. Image forgery detection (IFD) is a very challenging task and no image dataset is yet proposed that include image manipulations of scanned documents. Thus, another directory, whose structure is shown in Figure 6.5, is built by manipulating 34 documents (scanned at 300dpi). For each one of these documents, we applied three common forgeries which are copy-move, splicing, and retouching and, for each type of forgery, we attempted to produce a large number of semantically meaningful manipulations that are not obvious to the human eye. The images were manipulated using Adobe Photoshop. Moreover, the modified pixels may correspond to realistic regions or to fixed blocks. Finally, we stored the original image, the manipulated output image, and a ground truth binary mask showing the altered pixels as well as a detailed text file in which every operation made on the original images and its related parameters are provided.

An illustrating example of a retouching operation is given in Fig. 6.6. It is important to mention that we make use of the copy-move operation when we need to replace a text in the document without leaving visual traces. We created a fake image (b) by copying a white rectangular region from the same image and placing it over the parts to be manipulated (highlighted by orange boxes in Figure 6.6). Then, we add text in those regions. The added text should have the same or similar color, font and size as the original one so the manipulation could be unnoticed by the naked eye. After that, we generate the binary mask by drawing black regions for all manipulated pixels over a white background.

NEW ANNOTATED IMAGE DATASET TAILORED FOR IMAGE FORGERY DETECTION 99

To summarize, the SUPATLANTIQUE database, which comprises 208 document files and a total of 4700 images, is composed of:

• Digital original official documents

Optimal forgery detection

Nowadays, even one with amateur editing skills can create realistic documents by combining a variety of pictures, deleting objects, adding text, etc. These manipulated images are often used to spread fake news, forge signatures and lead to law violation. In many countries, altering a document and using it as authentic is a crime and the forger can be sentenced in prison. Unfortunately, new techniques for creating forged documents make the task of IFD very hard and, until recently, proposed IFD methods are far from being reliable. Furthermore, forensics methods related to scanned images received much less attention from the forensics researchers' community. As shown earlier, those methods can either identify if an image is forged or not [START_REF] Zeinab | New and efficient blind detection algorithm for digital image forgery using homomorphic image processing[END_REF] or assume that it is forged and try to detect the anomalies in it. More clearly, as they are focusing on splicing detection where an image is composite of two or more images, the localization is made based on finding inconsistencies between the investigated image regions. Their experimental results are very preliminary and only use handcrafted features. Moreover, they are limited by the size of the block (region) as reported in Table 2.2. It is also important to mention that none of these methods has been tested on text documents. This section provides details on the proposed studies for detection and localization of splicing forgeries. For further details on this type of forgery and its related state-of-art methods, please refer to Chapter 2.

The key idea behind our approaches is that both forgeries detection and localization are based on fingerprints discrimination among different scanners. A summary of the proposed methods is as follows. The generated frameworks usually start by a preprocessing step. It will, then, subdivide the processed image into patches. The third step is the patches matching. This step plays a critical role and thus, we will mainly focus on it. Finally, three significant detection maps are generated to localize the forged regions. Figure 6.7 illustrates the general pipeline for the proposed methods.

Notice that the order of the image division and the pre-processing may be inverted. The remainder of this section is organized as follows. In Sub-section 6.2.1, we describe our first approach based on handcrafted features matching. The second approach relying on CNN for fingerprints extraction is detailed in Subsection 6.2.2. Experimental evaluation plan and results are presented in Section 6.3 followed by some discussions.

First method: a Handcrafted-based IFD approach (HIFD)

The proposed detection method is illustrated in Fig. 6.8. and can be summarized as follows:

• Apply SWT transform on the blue channel of each suspected image I to get its HH subband as pre-processing step

• If not available, generate the scanner's signature that we will call the reference signature

• Estimate the histograms of each block of the reference signature and its corresponding block of size 64x64 from the HH subband of the suspected image

• Compare the histograms block by block using the Euclidian distance (ED) and generate a heat map by comparing the ED measures to a threshold As in our previous chapters, we proposed to use the wavelet transformation as a pre-processing step. The wavelet domain has been shown to be effective to extract relevant scanner noise estimation. In this method, the HH subband obtained from the one level stationary wavelet transform (SWT) of the blue channel of an image is used for IFD. Since, the SWT does not perform down-sampling, the HH subband keeps the same size as the image and is supposed to encode the scanner's noise that is distorted every time the image got manipulated. In fact, tampering traces will be hidden by adding noise around the edges. Therefore, HH subband patches should be affected. Furthermore, the choice of the blue channel for this work is taken after a visual and quantitative comparison of the tampering detection results carried out on each color channel as it will be seen in the following evaluation section. The core idea behind our proposal is that patches of similar noise are supposed to have identical histograms. Thus, any manipulation of the noise will result in a change of the histogram. This assumption is validated by the pair of histograms given in Fig. 6.9. It shows the histograms produced before and after splicing tampering. We can notice the significant influence of the tampering on the mean and standard deviation of the histograms.

NEW ANNOTATED IMAGE DATASET TAILORED FOR IMAGE FORGERY DETECTION 103

To generate a scanner reference signature, first, the blue channel of each image acquired by this scanner is decomposed into four subbands using a one level 2D-SWT and then the obtained HH subbands are combined by applying a suitable fusion rule. The most well-known rules are:

i) The Simple Average Rule (SAR): It computes the average of the coefficients of the two subbands as follows:

SAR (HH I , HH S ) = SAR(i, j) = (HH I (i, j), HH S (i, j)) /2 , i = 1..N and j = 1..M (6.1)

where HH I and HH S are the HH subbands of the suspected image and the scanner's signature, respectively. The indices i and j correspond to the i th row and j th column of each element. N is the number of rows and M is the number of columns of HH I .

ii) The MAX Rule (MR): It compares the coefficients of the two subbands and selects the ones with the largest magnitude between them as follows:

M R (HH 1 , HH S ) = M R(i, j) = max (HH I (i, j), HH S (i, j)) (6.2)

In this work, the max rule was selected for this task. The details of the reference signature generation are given in Algorithm 3. The ED measurements are used to create a heat map (HM), which can help the forensics investigator to have a visual inspection. HM is a data matrix that uses a sequential colormap to visualize the values in its cells. Large measurements are shown as yellow or orange in the HM announcing that a forgery exists while indicating the positions of the forged areas at the same time. On the other hand, non-tampered regions appear in blue and correspond to small ED. Figure 6.10 shows an example case of a HM with its corresponding colormap. A suspected image is labeled as non-authentic if at least one of the ED measurements is higher than an experimentally pre-defined threshold ν.

To have a better visibility of the IFD accuracy and to remove falsely detected blocks, a binary decision map M is generated such that blocks with normalized ED smaller than are considered as authentic and marked by white blocks and the rest is marked by black blocks (the ones detected as forged). Algorithm 4 gives the step followed to generate M . bs * (j -1) + bs)) ← 0 else M ((bs * (i -1) + 1 : bs * (i -1) + bs), (bs * (j -1) + 1 : bs * (j -1) + bs)) ← 1

Second method: a CNN-based IFD approach (CIFD)

The previous section proposes a handcrafted-based IFD method that rely on the dissimilarities between the HH subbands of an image and of its source scanner reference pattern to find the tampered regions. However, the source scanner is not expected to be known in realistic situations. Another limitation of this method is that it may fail if the spliced area is taken from an image acquired by the same scanner model as the suspected image due to the similarity between the distributions of the HH subband coefficients in this case. In this section, we address the IFD problem the same way it has been tackled in most of the state-of-art methods. More precisely, we propose a new approach that applies a SSI system on image blocks rather than on the full image in order to determine which patches of the suspected image did not originate from the same scanner as the other patches or did not contain the scanning noise of the device that has been used to capture it. In contrast to earlier findings, our approach adopted a data-driven strategy which has been successfully applied in our previous works. As mentioned earlier, we consider the 2D-CNN system proposed in chapter 4. This is the first CNN-based architecture specifically dedicated to IFD. This decision was made with the goal to achieve high source scanner attribution accuracy with a relatively small network architecture. Our choice was motivated by the fact that our 2D-CNN is efficient in working at patch level facilitating, for instance, tampering localization. The idea is to divide the suspected image it into non-overlapping blocks and then to find the ones that are predicted to be acquired or generated with a different device. To do so, each block is fed into the 2D-CNN network, after being preprocessed, in order to associate it to one of the known scanners. Next, a majority vote is applied to find out the source scanner of the suspected image. We may consider that the image is forged if the number of blocks identified as acquired by a different scanner is important. The proposed forgery detection scheme is illustrated in Fig. 6.11. Incorrectly identified blocks, marked by bounding blue boxes, indicates predicted forged area.

Once forged blocks are predicted, we create a tampering mask that will be compared to the ground truth for evaluating the reliability of the proposed approach. The mask is a binary matrix of the same size as the suspected image where authentic blocks are presented by white blocks (block values are zeros) and the forged one are in black (block values are ones).

Evaluation

To test the performance of the proposed IFD methods, the steps outlined above are performed on images from the SUPATLANTIQUE dataset which provides realistic forgeries. The presented results have been evaluated visually through masks and heat maps, as well as, numerically using the following metrics: Sensitivity = true positive/(true positive + false negative) Specificity = true negative/(true negative + false positive) Predictability = true positive/(true positive + false positive) where i) true positive is the number of forged blocks correctly detected as such; ii) true negative is the number of pristine blocks correctly detected as such; iii) false positive is the number of non-forged blocks detected as forged; and, iv) false negative is the number of forged blocks that have not been detected as such.

Evaluation of HIFD

To evaluate the performance of the first approach, it was evaluated on different test images that were forged using splicing operations. It was implemented in Matlab. We selected block size of 64x64 pixels, which gives a total of 2052 blocks per image. The optimal threshold was experimentally determined as ν =0,7 so as to have the lowest false positive rate. Considering a supervised setting, we generate a signature (See Section 6.2.1) for each scanner using 50 images. First, to justify the choice of the blue component in our approach, we compared the results we obtained taking as input of pipeline the different color channels independently. Figure 6.12 shows the HH subbands of each color channel of one of our forged test image and their corresponding estimated forgery masks. In the tampered image (e), two signatures has been added at the bottom of the document. We notice the superiority of working on the blue channel in IFD which offers less false predictions.

Testing results demonstrate that the proposed approach can be used for IFD in digital scanned documents. Again, we have treated the HH subband successfully and proved that the noise and textures concentrated in this high frequency subband are intended to be a good discriminator between flatbed scanners. Examples of detection results are presented in Fig. 6.13. We observed that the detection is more reliable for large forged areas and for copied dense regions (such as logos).

NEW ANNOTATED IMAGE DATASET TAILORED FOR IMAGE FORGERY DETECTION 107

In a second experiment, we considered testing the fusion rules (SAR and MR) defined in section 6.2.1 for computing the scanners 'fingerprints. It is clear from the binary masks shown in Fig. 6.13 that both rules are providing a good performance. However, it is worth noting that there is a slight decrease in the number of predicted forged blocks in the case of SAR. Thus, MR is more appropriate for combining the scanning noise from different HH subbands without any loss while catching the most relevant features.

In the last experiment, we intended to test the feasibility of the proposed approach in the case of an unknown source scanner. For that, we perform several tests by using each time a different scanner. Figure 6.14 gives a comparison between the binary masks resulting from applying our IFD method on the same image but with three different reference signatures. It can be found that the proposed method is efficient independently of the scanner used to generate the reference signature. Therefore, we can conclude that our system is more interested in finding similarities and dissimilarities between blocks of the compared HH subbands than looking for the origin of each block and, thus, can work without an a priori knowledge of the source scanner, that is to say, the source of the suspected image is unknown.

Evaluation of CIFD

In this work, our 2D-CNN model has been re-trained on the three scanner models S1, S9 and S11. A total of 9000x3=27000 image patches of size 128x128 are involved in the training and evaluation phases.

To show the capability of the proposed approach to distinguish between forged and non-forged patches, we performed a set of tests on some manipulated images of size 2480×3508 in which we fixed the block size to 128x128. Each image is, thus, split into 1026 non-overlapping blocks. Figure 6.15 illustrates the visual results obtained by applying the current method on four forgeries examples. From a subjective perspective, it can be seen that our method is effective in the detection of forged areas.

We observe some falsely detected blocks in the second image. Such a false positive detection may be due to different reasons: low scanning noise, saturated regions... As far as tampering localization accuracy is concerned, we decided to examine the effect of reducing the testing block size on the proposed method. Therefore, the CNN was again trained over 64x64 blocks. A comparison between the previous result and the current ones is presented in Fig. 6.16. Obviously, we can observe that the tampered regions are located with more precision at the cost of the appearance of a number of falsely predicted blocks.

To further validate the performance of our approach, we applied three different forgeries on an image to create three manipulated images using a different editing tool than the one used to produce the tampered images of the SUPATLANTIQUE dataset. The example is illustrated in Fig. 6.17. The left image represents the original image. In the middle, each case of forgery is given such that: • In the first image (a), a blank area is copied and moved within the same image. It has been manipulated to cover up the desired area • In the second image (b), a block from another image scanned with a different scanner has been paste

NEW ANNOTATED IMAGE DATASET TAILORED FOR IMAGE FORGERY DETECTION 109

• In the third image (c), a block from another image captured with a camera has been pasted

One can immediately observe that altered areas, marked with blue rectangles, are detected with a relatively high precision.

To numerically evaluate the ability of our proposed model to distinguish between pristine and forged blocks, we used the true positive, false positive, true negative and false negative rates to derive the sensitivity, specificity and predictability of each model in forgery detection. Table 6.2 shows results in terms of those metrics for both block sizes stated previously that we compare to the first method. As for predictability and specificity, we surprisingly found that the HIFD indicated 100% for all the investigated images. However, the sensitivity of the CIFD with 64x64 blocks surpasses the HIFD and the CIFD with 128x128 blocks with 63,81% and 39,43%, respectively. Notice also that the CIFD method with block size 128x128 has the lowest sensitivity due to high number of non-predicted forged regions compared to the predicted ones.

Discussion

We proposed two blind splicing scanned document forgery detection methods with SWT as a pre-processing procedure. We utilized the HH subbands to find dissimilarities between the image regions. The first method was based on handcrafted features while the second one used CNN for scanner fingerprints extraction. We evaluated them on forged images from the SUPATLANTIQUE dataset. The efficacy of the proposed methods was demonstrated visually as well as quantitatively. Both techniques succeed to detect areas in a suspected image resulting from replacing an object with another one downloaded from the Internet or copied from an image DETECTION 111 acquired by a different scanner (splicing). Copy-moved objects can also be detected if they have received some geometrical transformations (rotation, resizing...). However, the advantage of using the CNN-based approach is its adaptability to automatically extract characteristics and its ability to detect manipulated patches when the copied patch was acquired by a scanner of the same model as the source of the suspected image. Moreover, given the challenges in training CNNs with a small labeled dataset, our network, trained on few samples from three scanners only, has been successful in addressing the IFD problem. On its side, the handcrafted-based approach provides good result on small size patches. More interesting, these approach are able to detect forgeries even when tested on images acquired by unknown scanners. At last, one should also notice that these approaches face difficulties to detect relatively small forgeries and tampering in regions for which the scanning noise is almost absent such as saturated or heavily textured areas. These areas are at the origin of false alarms as previously shown in Fig. 3.15.

NEW ANNOTATED IMAGE DATASET TAILORED FOR IMAGE FORGERY

Conclusion

In this chapter, we first presented the SUPATLANTIQUE database, the only document image collection available in public domain which contains scanned documents suitable for evaluating the performance of SSI and FD techniques. It combines official and Wikipedia documents, flatfield images as well as forged digitized images. Next, in order to achieve the second specific objective of this thesis, we propose to take benefit of the SSI models presented in the previous chapters to develop two new transform-based approaches for IFD. The parameters characterizing the scanning noise are extracted from the HH subband and are investigated to detect traces of tampering. The proposed methods are more relevant to localize forgeries in images acquired using flatbed scanners than other existing methods in the literature. We evaluated the performance of the proposed schemes using the SUPATLANTIQUE database. Experimental results clearly prove the significantly high accuracy of these schemes to discern pristine areas from forged ones, though they may occasionally result in false positive. Furthermore, in the hand-crafted approach, ED is used to evaluate the dissimilarity between the histograms of the HH subbands blocks. However, despite its effectiveness, it is worth testing more distance measures like the Bhattacharyya distance [START_REF] Kailath | The divergence and Bhattacharyya distance measures in signal selection[END_REF], the Matusita distance [START_REF] Cha | Comprehensive survey on distance/similarity measures between probability density functions[END_REF] and the K-L metric [START_REF] Rubner | Empirical evaluation of dissimilarity measures for color and texture[END_REF]. One limitation of our methods is that they cannot detect all kinds of forgeries. Thus, a more solid study for other types of forgery is highly desirable as future research.

Besides, it would be interesting to use our DLK solution proposed in the previous chapter for the purpose of IFD. This has not been completed due to time constraints.

Conclusion

This manuscript presents a number of digital image forensics methods which take advantage of the fact that every acquisition system leaves residual noises called fingerprint on every image it acquires. As demonstrated, each scanner's fingerprint is unique and the likelihood two scanners have similar fingerprints is relatively low. Thus, this fingerprint has become an asset for several forensic tasks, including device identification, device linking, and forgery detection.

From that perspective, the thesis' contributions can be summarized as follows.

Proposing new source scanner identification approaches: The different works conducted in this thesis were first dedicated to solve the SSI problem. The main goal was to design an adaptive model for estimating the scanner that has acquired a suspect digital document where all scanners are supposed to be known. The idea was to find a unique pattern that can be used as a scanner fingerprint. An analysis of the state-of-art shows that existing models mainly focus on a particular image type or structure and, thus, present unsatisfactory results in realistic cases. Besides, there was a limited exploitation of the scanning noise compared with the methods related to other acquisition devices. Moreover, most of the benchmark datasets employed by those works do not take into account the fact that a scanner model may have more than one instance. It is also important to mention that scanner manufacturers are continuously improving the resolution of their devices, which require looking for more robust and flexible solutions. Therefore, we considered all these challenges in the aim to establish new SSI frameworks based on more accurate scanning noise models. For that, we investigated the problem in many directions, depending on the image format, the image content and the techniques to be used for features computation. Approaches based on handcrafted features are firstly exploited in Chapter 3. In a first time, we were interested in the scanned images stored in the JPEG format. We established a solution that, based on the quantization tables contained in the JPEG header, is able to identify the brand of scanner that has acquired the investigated image. However, this technique is limited to brand identification and is not credible since the header can be easily replaced or deleted. Furthermore, the literature review conducted has shown that all the state-of-art methods are commonly using the TIFF format to evaluate the performances of their methods. In fact, this format is the most ubiquitous image format used by scanners since it is better suited for producing high quality images especially in the medical field [START_REF] Vaneechoutte | Application and analysis of ARDRA patterns in bacterial identification, taxonomy and phylogeny[END_REF]. Thus, we proposed an adaptive approach [START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF] for scanner model identification with fingerprints extraction in the wavelet domain based on the GGD modeling of subband coefficients. This approach achieves good performance compared to existing methods. An improved forensic performance is achieved by taking advantage of the a priori knowledge of the reference image, the original noise-free image, in the case when the scanned document is fillable [START_REF] Ben Rabah | Semi-Blind Source Scanner Identification[END_REF]. This is implemented by subtracting the reference image from the filled scanned one as a way of denoising. Indeed, the previously wavelet-based proposed method [START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF] is able to extract good scanners fingerprints from HH subbands. However, these subbands are often preserving image details leading to identification errors. Two main limitations of these approaches are the decline of performance in case scanners of the same model are considered and the dependence to the type and the number of the training images. To overcome these limitations, two novel approaches based on neural networks (NN) are proposed in Chapter 4. Their originality is two-fold. First, they perform an automatic features extraction from small patches of the scanned documents. Second, they exploit the scanning noise in two different dimensions (1D [START_REF] Ben Rabah | Automatic source scanner identification using 1D convolutional neural network[END_REF] and 2D [START_REF] Ben Rabah | Boosting up Source Scanner Identification Using Wavelets and Convolutional Neural Networks[END_REF]). These methods have been demonstrated to be effective for large number of scanners even when two instances of the same model are considered for evaluation. Their main highlight is that they can be trained from scratch using a few number of images. It is also important to mention that CNN based systems for SSI are proposed for the first time in the DIF field.

Image collection and its application to DLK:

To date, all SSI algorithms have taken into account the form of the closed set scenario, where the scanners that may have issued the investigated images are all available at the training stage. A more realistic scenario for forensics applications is the open set that takes into consideration the possibility of an unknown source of image, i.e. a scanner nonidentified a priori. The purpose of the following study was to propose a new research line in which we consider two images of unknown sources aiming at finding out if they have been acquired by the same scanner or not. Such a study is known as the device linking (DLK) and can be generalized to solve the open-set recognition problem. The proposed architecture is composed essentially of two NN; The first network is a fingerprints extractor which maps an image patch to a vector of features so as to feed the second network that takes as input a pair of the produced feature vectors and returns a similarity score indicating whether the patches were issued by the same device or not. Experiments conducted on image pairs issued from 8 different scanners, where two of them were not used to train the linking network or equivalently considered as unknown sources, confirm the efficiency of our system. To the best of our knowledge, we are the first to conduct scanned images forensics DLK. We expect this new research direction would be useful in other DIF problems such as database consistency verification and images manipulation detection.

Designing IFD approaches:

The development of digital imaging has raised a number of challenges in terms of information security. Because of the wide availability of low-cost image editing tools, trustworthiness of digital images can be more and more questioned. Examples of image tampering for various purposes are numerous. The field of DIF has been established to rebuild trust in media content. Though IFD through forensic techniques is the second main research topic of this thesis. Herein, we proposed two optimal detectors. Both integrate patch-based algorithms and are able to precisely detect falsifications in the scanned image. The basic idea of the first one is to detect image splicing using SWT and histograms of HH subbands patches based on the fact that a simple tampering operation disrupts the scanning noise contained in these subbands. A more promising research direction revisits IFD with a data-driven paradigm. Thus, as a second step, we designed a method leveraging on our prior 2D-CNN model proposed in Chapter 4 for the identification of the source of each patch of the investigated image. The rationale is to distinguish between homogeneous and heterogeneous image patches in terms of scanner noise. More clearly, heterogeneous patches notify the presence of forgeries in it. To evaluate the performance of our models, we introduced a new public image collection for digital forensics purposes related to flatbed scanners. We demonstrated the effectiveness of our approaches for splicing detection. Given examples validate the accuracy of the forgeries localization. Although the problem of IFD has received considerable attention, the efficacy of published device based prior-art approaches (given in Table 2.2) strongly depends upon the size of image patches. In contrast, the models we propose rely on a smaller patch size which is a very important parameter for forgery detection precision.

To sum up, the above works aim at contributing to the field of DIF for flatbed scanners. Their main novelty lies on several aspects: i) they deal with realistic situations, ii) they allow the development of advanced methods that provide an accurate estimation of the forensic trace of scanners, iii) they model the scanning noise in different dimensions (1D, 2D) and features spaces (spatial, wavelet), iv) they are at the origin of NN based data-driven solutions, the firsts that deal with scanned images, v) they are the first addressing the problem of DLK related to scanners, vi) and, most importantly, they are adapted to any type of images including scanned hard-copy documents which present a major challenge for state-of-art methods related to both, scanners and digital cameras, because of their pseudo binary nature and the presence of large white (saturated) regions.

Perspectives

In addition, all along this thesis, we spotlight a number of aspects of important interest for future research in the field of DIF. Our perspectives follow three major axis: scanned documents authentication, digitized documents integrity, and finally anti-forensics and counter anti-forensics. Image authentication is one of the most investigated fields of DIF where the origin of the suspected image is verified in a blind way. Even if this is a field has reached a certain degree of maturity, we demonstrated that there are still some intriguing issues to be addressed. In this thesis, we have focused on non-compressed image authentication with a less successful attempt to identify the source of JPEG compressed image from its header. Thus, there is a great interest to conduct more studies on noise-dependent fingerprints to be extracted from the JPEG images. Furthermore, previous works analyzing scanners artifacts produced during the documents acquisition have focused on the sensor defects. However, other scanner components may leave their unique trace such as optical defects that need to be considered. In addition, some new scanners can eliminate defective pixels using on-board post-processing, leading to harder fingerprint extraction. Thus, there is a motivation to provide solutions to assess these situations. Moreover, a specific limitation of SSI approaches is the knowledge of only a few scanners for training, whereas in practical situations, the document may be digitized by an unknown scanner. It would be interesting to design one system that can classify an image to 7.2. Perspectives one of the known devices and tell if its source is just unknown. For this, we can make use of the DLK model we proposed in Chapter 5 with a possible improvement of this later. Another crucial issue with noise-based approaches is that the noise pattern is affected by the desynchronization produced by post-processing operations like compression and geometrical transformations (e.g. rotation, scaling...). This motivates us to consider using cropping and rescaling techniques in our future work to solve this problem.

To address the difficulties faced by Forensics investigators in tampering detection, we proposed different block-based solutions that surpasses the existing ones. However, despite the reported promising results, the performance of those techniques is far from being trustworthy and there is still a lot of room for improvement. In fact, most of the existing works are not effective for forgeries other than splicing and when dealing with real-world documents. In addition, it is important that further research studies take into consideration the case when many different tampering operations were applied to the image. More clearly, there is a need to develop a universal manipulation detection method which is capable of detecting multiple manipulations in the same scanned document. We think that this objective can be achieved by combining passive with\or actives forensics state-of-art approaches, or by relying on new techniques based on data mining and NN. For example, a combination of image forensics and cryptography might link a scanned document to its digital fingerprint with a higher level of assurance. It is also worth noting that the methods proposed in literature present a certain complexity and require human intervention. If this issue has been solved for SSI, it will be more practical to investigate creative solutions for IFD following the same research line. This is particularly important to reduce the computational time and to improve the accuracy of manipulation detection methods. To go further, it is also important to say that there is an interest to find a solution which can not only detect forgeries but also tell the type of manipulation. For example, one can decide if the manipulation is a copy-move operation by checking if the suspected object or block is repeated in a different area of the image. Addressing these challenges will open the door to more effective contributions.

The two sides of the coin in image authentication are forensics and anti-forensics. This is the same as we talk about cryptography and cryptanalysis or steganography and steganalysis. Digital image anti-forensics [START_REF] Gül | A survey on anti-forensics techniques[END_REF] is a methodology for exposing the limitations of existing forensic methods to build more reliable forensics. The fundamental goal of image anti-forensics is to execute certain operations on digital images to mask traces left by image manipulations so that forensic algorithms cannot detect them. Notice that anti-forensics techniques aim at helping forensics researchers to know the vulnerabilities of the approaches they propose and, thus, prompt them to reinforce them against any possible attacks by introducing the so-called "counter anti-forensics" methods. During this period, we had not time to address such an issue. Anyway, it must know that image anti-forensics and counter anti-forensics are still in their infancy. Based on a literature review, it is clear that the number of publications related to those research fields are far less in number than those related to image forensics. Furthermore, existing anti-forensic and counter anti-forensics approaches bore some drawbacks. Therefore, there are still numerous research lines in this field that should be pursued. To this end, some advanced methods could be introduced by combining anti-forensic strategies with the methods proposed in this thesis.

A RÉSUMÉ DE LA THÉSE

A.1 Introduction

L'évolution des technologies de l'information et des communications sont à l'origine de changements sociétaux majeurs avec notamment la dématérialisation de nombreux services et de documents administratifs. Cette transition vers un monde entièrement numérique implique la numérisation de documents : ceux qui étaient traités sous forme papier avant dématérialisation, comme les dossiers médicaux d'un établissement de santé ou encore les documents pour lesquels la réglementation impose le passage par une version papier et une numérisation une fois ceux-ci complétés tel que les actes notariés, d'état civils ou bancaires, etc. Une fois scannés, ces documents peuvent alors être aisément distribués, échangés, collectés et traités, accélérant les procédures tout en réduisant les coûts. Plusieurs pays ont même procédé à l'archivage de leur documents commerciaux, administratifs et politiques afin de préserver leur patrimoine et restaurer les documents d'importances tel que le cas de la France qui a créé une archive diplomatique qui compte près de 180 000 documents [START_REF]Victoires des Acteurs publics[END_REF]. Cependant, si cette évolution facilite l'accès et le traitement de l'information, elle soulève beaucoup questions en matière de sécurité. Par exemple, on pourra s'interroger sur l'origine d'un document numérisé comme également de son intégrité. Ces aspects sont critiques dès lors que les documents sous forme papier n'inclus pas d'éléments de sécurité (filigranes, hologramme etc.) comme il en existe pour les billets de banques ou les passeports. En effet, un tiers malveillant peut aujourd'hui Les techniques actives nécessitent généralement une étape de prétraitements. Il s'agit de mécanismes cryptographiques (ex. chiffrement [START_REF] Triand | Digital Document Security on Legalize Higher Education Diplomas with Digital Signature and SHA-1 Algorithm[END_REF], signatures numériques [START_REF] Triand | Digital Document Security on Legalize Higher Education Diplomas with Digital Signature and SHA-1 Algorithm[END_REF]), de tatouage [START_REF] Kumar | A Review on Implementation of Digital Image Watermarking Techniques Using LSB and DWT[END_REF] ou de crypto-tatouage [START_REF] Borra | Crypto-watermarking scheme for tamper detection of medical images[END_REF]. Le chiffrement de données et les signatures numériques peuvent empêcher la falsification de données, mais elles contraignent, au même temps, le format de données et soulèvent des questions de partage des clés. Le chiffrement et les signatures peuvent être vus comme une protection a priori, l'information étant protégée tant qu'elle est chiffrée ou que sa signature numérique n'a pas été supprimée. A contrario, le tatouage offre une protection a posteriori. Il Une alternative intéressante est offerte par les techniques passives dites « forensiques des images numériques » [START_REF] William | A review of digital image forensics[END_REF]. Ces techniques visent à vérifier si une image a été modifiée ou à apporter la preuve de son origine (i.e. identification du scanner qui a acquis l'image) d'une manière aveugle, sans information a priori sur l'image (i.e. sans signature ou information ancillaire partagée avec l'image). Elles s'appuient sur l'extraction de caractéristiques de l'image couplées ou non avec des processus d'apprentissage pour constituer une empreinte de l'image qui peut servir soit à identifier son origine soit à détecter des modifications. Au cours des 15 dernières années, le nombre de travaux dans le domaine du « forensiques des images numériques » liés aux images numérisées a considérablement augmenté. Cependant, l'efficacité de ces approches proposées reste relative. Ainsi, il est important de fournir des solutions adéquates et fiables pour répondre à des problématiques de protection des contenus multimédias dans la transition numérique et la dématérialisation des données et des services. L'objectif de cette thèse est donc de proposer un environnement sécurisé et adapté pour la vérification de l'authenticité et la lutte contre la falsification de documents numérisés d'importance ; un environnement flexible proposant des services de transactions de confiance à des personnes ou des entités morales. Le reste de ce résumé est organisé de la façon suivante: La section A.2 présente quelques notions sur le forensique des images numériques et les scanners, et continue avec une introduction des solutions forensiques proposées dans la littérature qui répondent aux questions liées à l'authenticité et l'intégrité des images numériques. La section A.3 propose une approche qui identifie la marque du scanner ayant numérisé le document en question quand celui-ci est sauvegardé au format JPEG. Vu que la majorité des documents scannés sont au format TIFF, deux nouvelles approches sont ainsi proposées prenant en compte ce format. Cependant, ces méthodes ne sont pas efficaces pour des scanners de même modèle et présentent certaines autres limitations. De ce fait, elles seront encore améliorées dans la section A.4. La section A.4 propose deux approches d'identification du scanner source, en se basant sur les résultats trouvés précédemment. Ces approches prennent avantage des réseaux de neurones pour extraire les caractéristiques des scanners. Outre l'excellent taux de précision atteint, les réseaux proposés ne nécessitent pas un nombre important d'images pour leur apprentissage. La section A.5 résout le problème de la vérification de la correspondance des sources d'une paire d'images. En d'autres termes, l'objectif de la solution proposée est d'apporter preuve que deux images sont acquises par le même scanner ou par des scanners différents. Cette information est très utile pour un expert en forensique comme elle peut aussi servir à adresser la problématique liée aux documents acquis par des scanners 'inconnus'. La section A.6 présente une nouvelle collection de documents numérisés réalisée dans le cadre de la thèse et son exploitation pour vérifier les performances de deux nouvelles approches de détection de falsification. Nous avons proposé ces approches en s'appuyant sur les approches que nous avons précédemment proposées pour l'identification du scanner source. La section A.7 conclut ce manuscrit en présentant brièvement les contributions et les perspectives de recherche.

A.2 Forensique des images numériques

Les scanners servent de lien entre les mondes physique et numérique, facilitant et accélérant ainsi le stockage et le partage de documents. En effet, la numérisation des documents réduit les dépenses, économise de l'espace et réduit le risque de perdre des documents critiques. Les entreprises, les banques et de nombreuses autres organisations utilisent la numérisation pour économiser des centaines de milliers de dollars en impression, expédition et stockage de documents chaque année. L'accès à l'information, en revanche, est facilité, ce qui pose des problèmes de sécurité. Il est évident que notre confiance dans les images s'est dégradée même lorsqu'elles sont publiées dans des journaux populaires et des sites Web officiels, car tout le monde peut désormais acquérir, stocker et modifier des images numériques en raison de la disponibilité de divers outils d'édition d'images qui permettent la manipulation du contenu d'une manière simple et imperceptible. Ces fausses images peuvent parfois causer de sérieuses pertes financières, ou même, être à l'origine d'une crise au sein de la société. D'où la nécessité d'établir de nouvelles techniques qui permettent de retracer l'historique de ces images afin de vérifier leur authenticité et leur intégrité. • Approches qui extraient les caractéristiques du scanner à partir des hologrammes [START_REF] Khanna | Intrinsic signatures for scanned documents forensics: effect of font shape and size[END_REF] • Approches qui extraient les caractéristiques du scanner à partir des textures [START_REF] Joshi | Source classification using document images from smartphones and flatbed scanners[END_REF][START_REF] Ojala | Multiresolution gray-scale and rotation invariant texture classification with local binary patterns[END_REF][START_REF] Dirik | Flatbed scanner identification based on dust and scratches over scanner platen[END_REF] • Approches qui extraient les caractéristiques du scanner depuis les traces fixes des fissures et de la poussière situées sur le vitre du scanner [START_REF] Zankhana | Image Forgery Detection using Deep Learning: A Survey[END_REF][START_REF] Singh | Digital signature verification scheme for image authentication[END_REF] Même si ces méthodes offrent de bonnes performances pour certains types d'images, elles restent insuffisantes. Tout d'abord, elles ne réussissent pas à distinguer les scanners de même modèle. Deuxièmement, elles ne répondent pas aux conditions réelles de numérisation et ne sont pas capable de fonctionner quel que soit le contenu du document numérisé. D'autre part, le nombre de documents falsifiés est entrain de croître. Aujourd'hui encore plus qu'hier, ils sont utilisés sur les réseaux sociaux dans le but de partager des fausses informations qui peuvent, dans certains cas, alimenter des débats et des opinions politiques ayant un effet néfaste sur la stabilité de tout un pays. Il s'agit donc de faire face à ces fraudes et de proposer des méthodes qui, dans un premier temps, vérifie si un document a été falsifié ou non, et par la suite, localise les régions falsifiées une fois une falsification a été confirmée. Au cours de la dernière décennie, plusieurs approches de détection de falsification ont été proposées mais peu de celles-ci qui prennent en considération les spécificités des scanners et sont applicables à tout type de document. Par ailleurs, on distingue principalement quatre types de falsification:

A.5 Correspondance des scanners sources

Souvent, le document en question n'est pas acquis par l'un des scanners « connus », c.-à-d., non disponible lors de l'apprentissage du système d'identification du scanner source. Dans une telle situation réelle, l'expert forensique va assumer que le document a été acquis par l'un des scanners connus. Cependant, cette hypothèse est fausse et engendre de mauvaises classifications. Une solution possible est de vérifier si le document n'a pas été acquis par l'un des scanners connus en comparant son origine avec l'origine d'images acquises par ces scanners. Pour cela, nous avons proposé une nouvelle technique de correspondance de sources. Elle permet de faire face à la situation dans laquelle l'expert en forensique a besoin de savoir si une paire d'images a été acquise par le même modèle de scanner ou non. La technique est basée, tout d'abord, sur l'extraction des signatures des scanners sources de chaque image en exploitant le système 2D-CNN proposé précédemment. Ensuite, elle compare ces signatures à travers un réseau de neurones à double entrée qui génère des scores indiquant le taux de similarités entre les deux signatures qui n'est autre que le taux de similarités entre les deux images en question.

A.6 Nouvelle base d'images annotées adaptée à la détection de la falsification des images

Du fait qu'il n'existe aucune base d'images publique permettant de tester les approches forensiques relatives aux scanners, nous avons préparé une collection de documents scannés pouvant servir dans plusieurs études de recherche liées aux documents numérisés. Ensuite, inspiré par les modèles d'identification du scanner source présentés dans les sections précédentes, nous avons proposé deux nouvelles approches de détection de falsification en s'appuyant sur l'importance de l'exploitation la sous-bande HH. Les méthodes proposées sont plus pertinentes pour localiser les contrefaçons dans les images acquises à l'aide de scanners à plat que les autres méthodes existantes dans la littérature. Nous avons validé l'efficacité de ces approches en effectuant des tests sur les images falsifiées présentes dans la nouvelle base crée. Dans la première approche, nous comparons les histogrammes des sous-bandes HH des différents blocs de l'image en question avec ceux du scanner ayant la même localisation. Nous avons opté pour la distance euclidienne comme mesure de ressemblance. La deuxième approche opère directement sur l'image en suspect sans avoir recours à une signature de scanner comme référence. L'idée de diviser l'image scannée en des blocs de même taille et identifier le scanner source de chacun de ces blocs. Une diversité importance des sources identifiées fait que l'image a été falsifiée et il est ainsi possible de discerner les régions manipulées.

A.7 Conclusion et perspectives

B WAVELET TRANSFORM

The Fourier Transform (FT) projects a signal from the time domain to the frequency domain by dividing it into sinusoidal basis functions with varying frequencies. This transformation does not lose any information, that is to say, we can fully recover the original signal from its Inverse Fourier Transform (IFT) representation. However, it provides only precise information on the signal's spectral components, but not about the temporal localization of these components. Therefore, the wavelet transform (WT) has been proposed to overcome the limits of the FT by dividing the unstationary signals into discrete intervals that are short enough to obtain stationary signals in each interval. In fact, the WT is a mathematical transformation technique that aims to represent any data as a wavelet superposition. The wavelet subbands are further decomposed with a certain resolution at each level. Moreover, it is able to extract temporal and spectral information simultaneously. Unlike the FT, the DWT refers to a collection of transforms, each with its own set of wavelet basis functions such as the Haar, the Daubechies and the Symlet. In fact, given the wide variety of wavelets and the possibility to go through many levels, the WT gives the possibility to work with different subband depending on the application that it will serve. A one level 2D wavelet transform is depicted in

B.1 The discrete wavelet transform (DWT)

As we are particularly interested in images, in this section, we will present the algorithm for computing the two-dimensional DWT, which is very useful in image processing and computer vision applications. An image can be analyzed using the DWT algorithm by passing it through an analysis filter bank followed by a decimation operation. In each decomposition stage, the analytical filter bank includes a Low Pass Filter (LPF) and a High Pass Filter (HPF). When a signal crosses these filters, it got divided into two bands. After each decomposition, the image's most energy is contained in the low frequency subband while the image's details and edges are represented by the other subbands. Note that for a 2D image of M rows and N columns, the produced subbands are of size M \2 rows and N \2 columns due to the decimation operation. DWT is not a transform that is shift-invariant. The SWT, also known as undecimated wavelet transform, can overcome this limitation. The downsampling stage is eliminated at every transformation level, that is to say, the subband coefficients are not decimated. Thus, the number of columns and number of rows of different subbands are the same as the original image with this decomposition.

C NEURAL NETWORKS

In the past few years, deep learning (DL) and, in particular Convolutional Neural Network (CNN), have been widely applied in the image processing field. CNN not only surpasses prior handcrafted based methods, allowing to achieve high precision in image classification, but it also serves to automatically extract features from images. It is, thus, necessary to understand its architecture and to know some classic CNN models that are commonly used in various fields. Since we use CNNs extensively in this thesis, we introduce important aspects in this appendix.

C.1 Two-Dimensional Convolutional Neural Networks (2D-CNNs) C.1.1 Overall structure

A 2D-CNN is a deep learning architecture capable of taking an input image, learning various features (e.g. aspects, objects, edges...) in that image, and then using these learned features for image classification. It includes convolutional layers (Conv), activation (Actv), pooling, and fully connected (FC) layers. The basic purpose of the convolutional layer is to extract the features of the input image. The pooling layer acts as a down sampling operation. It is mostly used to lower the resolution of features maps. On the other side, activation layers are used to introduce nonlinear elements and boost the neural network's expression ability. Then, a set of FC layers are integrated to minimize the size of feature maps and to classify them. The last layer outputs maps the input image to one of the classes of the dataset. In the following, we describe each of these layers:

Convolution Layer

The convolutional layer is the core building block of a CNN. It mainly applies a convolution filter on the input image using a sliding window algorithm. For each window, an element-wise product between each input and kernel element is calculated and summed to obtain the output value in the corresponding position of the output feature map. This later has a relative relationship with the number of kernels, the kernel size, the stride size and the padding size. The number of kernels and the kernel size represent the depth of the output features map and the size of the filter applied, respectively. The stride, by default 1, indicates how much the convolution filter is moved at each step. Big strides are usually used to make small feature maps. On the other side, padding is the process of adding pixels to the image's edge in order to ensure that the feature map has the same shape as the input of the convolutional layer. For example, if we perform a convolutional operation over the image shown in Here, only the first 16 feature maps are displayed. We can notice a lot of versions of the input image were produced but with different features highlighted.

Activation

The activation function aids in introducing non-linearity into the network by permitting certain inputs to be transmitted forward. This unit is, traditionally, a rectified linear unit (ReLU), which employs the non-saturating activation function indicated in the equation below f(x) = max(0, x) (C.1) Notice that a variety of enhanced activation functions such as Leaky ReLU, PReLU, Randomized ReLU (RReLU) as well as the scaled exponential linear units (SELU) have been derived from the ReLu. Each should be selected according to the actual issues to be addressed.

Pooling Layer

The pooling layer is a kind of down-sampling usually used after a convolutional layer. It is mainly performed to reduce the dimensionality without losing too much important information. In fact, there are two common types of pooling methods among which the maximum pooling is the most used. This later slides a window over the input and outputs the maximum value for each window.

Fully-connected Layer

In a CNN, the fully connected layer serves as a classifier. While convolutional layers, pooling layers, and activation function layers help to extract the representative features from the original data, the fully connected layers map the learned features to a number of classification probabilities. Notice that the output of a fully connected layer is a 1D vector obtained by flattening the output of the previous layer. Usually more than one fully connected layers is necessary to construct the classification part of the network. The choice of the parameters of these layers is very important to avoid overfitting.

C.1.2 Classical CNN models

In this section, we introduce some classic CNN models that have been used in this thesis. On the one hand, these models were sensational at that time and played a significant role in promoting the development of deep neural network. On the other hand, many of them are pre-trained on large datasets and are widely used in transfer learning as will be explained below.

AlexNet

Large datasets like ImageNet [START_REF] Deng | Imagenet: A large-scale hierarchical image database[END_REF], which include hundreds of thousands to millions of annotated pictures, have increased the requirement for a highly competent deep learning model such as AlexNet. This later is a tremendously strong model capable of attaining high accuracies on extremely challenging databases. Removing any of the convolutional layers, on the other hand, will significantly reduce its performance. This leading architecture has potential applications in computer vision and artificial intelligence related issues. As it is shown by It is interesting to know that GoogLeNet is has twelve times less parameters than the AlexNet and, thus, it is faster to train.

C.2 One-Dimensional Convolutional Neural Networks (1D-CNNs)

As stated above, 2D-CNNs are able to learn complicated objects and patterns if trained on a vast size visual database. Thus, when they are properly trained, they may serve as the principal tool for many applications related to 2D signals such as digital images and video frames. However, this may not be the best solution in applications involving 1D signals, particularly when training data is sparse or application specific.

During the last decade, 1D-CNN has become applicable to a wide range of fields [START_REF] Kiranyaz | 1D convolutional neural networks and applications: A survey[END_REF] due to its theoretical appeal and impressive performance. Such networks appear suitable to address issues related to 1D data. Let us recall that the general architecture of a 1D-CNN consists of several layers of different kinds as shown in Fig. C.9. The most used layers are as follows:

• 1D convolutional layer -It conducts convolution operations in order to extract feature maps by sliding a set of kernels over the input data. Its output is, then, passed through a non-linear activation function such as sigmoid, hyberbolic tangent (tanh), Rectified Linear Unit (ReLU) [START_REF] Krizhevsky | Imagenet classification with deep convolutional neural networks[END_REF],.. • Max pooling layer -It is usually used after a convolution layer for data complexity and dimensionality reduction. Its role is to down-sample the feature maps resulting from the previous layer in order to reduce the amount of parameters to learn and the network computational cost. The output of this layer is generated by scanning several regions of the feature map and computing the maximum of each of those regions.

• Global average pooling layer -This layer plays an important role in avoiding overfitting. As the max pooling layer, its main goal is the data dimensionality reduction but, this time, by computing average of every incoming feature map.

• Dropout layer [START_REF] Srivastava | Dropout: a simple way to prevent neural networks from overfitting[END_REF] -It is also used to reduce overfitting. With this layer, the generalization of the CNN got improved by becoming less sensitive to small data variations.

• Dense layer -This layer is a Multi-Layer Perceptron (MLP) that classifies the input data by computing scores of each class where the number of classes is equal to the number of neurons. Scores should sum up to one.

C.3 Transfer learning

When dealing with computer vision problems, one circumstance happens regularly; the need to establish a large database is required which is both complex and expensive. In other situations, we want to learn something new from a previously solved problem and, thus, move on to the next assignment as fast as possible. This is the idea behind Transfer Learning (TL). This later is simply a way to transfer knowledge from one field to another. For instance, knowledge gained while learning to recognize devices could apply when trying to recognize scanners. A simple illustration of TL is given in In recent years, one of the most common strategies of applying TL is to utilize a classic convolutional neural network as a pre-trained model, freeze some layers and then retrain a few layers by the target data. Another popular strategy is to use some layers from the pre-trained model as a feature extractor and, then, add a new classifier such as Support Vector Machine (SVM).

C.3. Transfer learning

D SUPPORT VECTOR MACHINE CLASSIFIER

The Support Vector Machine (SVM) is a popular supervised machine learning method used for the classification of data belonging to two classes. It can also be extended to solve regression problems. The objective of the SVM classifier is to maximize the margin which is the distance from the hyperplane, also called decision boundary, to the closest elements from each class on either side. The hyperplane can be written as the set of points x satisfying the Linear Discriminant Function (LDF)

w • x -b = 0 (D.1)
where w is the weight vector normal to the hyperplane.

.1 represents an illustration of SVM. Given a set of data points, each of which belongs to one of two classes, the goal is to determine which of the two classes a new data point belongs to. For that, we want to separate such points with a hyperplane that reflects the greatest separation, or margin, between the two classes because the larger the margin, the smaller the classifier's generalization error. The support vectors and the margins are used to find the optimal hyperplane where the support vectors are points on each of the lines w .xb = -1 and w .xb = 1. Notice that deleting some of the support vectors may change the position of the hyperplane. The distance between these two hyperplanes, which is 2 / |w|, should be minimized.

To maximize the margin of separation, these hyperplanes are represented by the following equations After training the SVM classifier, a data point x p is classified to the first class if w.x p -b > 0, otherwise it is classified as belonging to the second class. When there are more than two classes the simplest solution is to create Q two-class problems where Q is the number of classes, then, separate each class from all other classes combined, thus learning Q SVMs. We distinguish two types of SVM: Linear and non-linear, depending on how the data are separated. More clearly, if the data is linearly separable, then the SVM is linear. However, in the case where the dataset cannot be separated using a straight line, the SVM is said non-linear. Furthermore, the SVM is using a set of mathematical functions called kernels. The role of the kernel is to take data as input and transform it into the required form. Different SVM algorithms use different types of kernel functions such as linear, nonlinear, polynomial, radial basis function (RBF), and sigmoid. We introduce, in the following, these four basic kernels: Linear This kernel is used when the data can be divided linearly, that is to say, with a single line. It is one of the most often utilized kernels for text classification.

K (x i , x j ) = x T i x j (D.3)
where x i and x j are vectors of features computed from training or test samples.

Polynomial

This kernel is quite practical for natural language processing (NLP). It is used to learn non-linear models by representing the similarity of vectors in a feature space over polynomials of the original samples.

K (x i , x j ) = γx i T x j + r d , γ > 0 (D.4)
where r 0 is a free parameter in the polynomial that balances the effect of higher-order vs lower-order terms.

RBF

In general, the RBF kernel is the most used type. It is preferred when there is no prior knowledge about the data. It maps data into a higher dimensional space, allowing it to handle cases where the relationship between class labels and attributes is nonlinear. Its equation is defined as K (x i , x j ) = exp -γ x ix j 2 , γ > 0 (D.5)

When training an SVM with an RBF kernel, two parameters must be considered:

C

security mechanism

Abstract: There is no universal method for detecting counterfeit images. Several techniques have been proposed but each has its limits. Among these methods, the so-called "forensic digital image" techniques offer an interesting solution. They aim either to verify the integrity of the image, or to provide proof of its authenticity by identifying the system which acquired it. To do this, they take advantage of how the acquisition systems generate their output. In this thesis, we are particularly interested in flatbed scanners as an acquisition system and we propose to study and develop "digital image forensics" techniques for scanned multi-type documents. We first proposed techniques to identify the scanner behind a scanned document based on a set of signatures "manually" extracted from images. Then, to face the limitations of these approaches, we focused on the automatic extraction of signatures from scanners through 1D and 2D neural networks. Subsequently, we developed a new approach, called "Device Linking", which determines whether two images were acquired by the same scanner or not. Finally, we provide two security mechanisms capable of detecting content manipulation of scanned data based on certain approaches of source scanner identification proposed previously. In order to validate the solutions proposed in real situations and make comparisons between them, we have built a database of scanned documents that we have made public.

3. 1 3 . 6 5 . 2

 13652 JPEG compression scheme . . . . . . . . . . . . . . . . . . . . . . . 3.2 The organization of the JPEG bitstream . . . . . . . . . . . . . . . 3.3 Example of QT defined by their marker in the JPEG bitstream . . 3.4 General scheme of the proposed JPEG-based verification scheme. I is the investigated JPEG image, f I is its fingerprint which will be compared to each scanner fingerprint f s i where i:1..x and x is the number of known brands . . . . . . . . . . . . . . . . . . . . . . . . 3.5 Summarizing related works on source scanner identification . . . . . An illustration of the different stages of a typical SSI evaluation process. Once the hard-copies to scan are prepared, they are scanned by each of the scanner. The scanned images are, then, divided into two separate sets and used to train and test the SSI system. . . . . 3.7 Global architecture of the proposed system . . . . . . . . . . . . . . 3.8 Fingerprint extraction for a scanned image . . . . . . . . . . . . . . 3.9 Example of a decomposition of an image into four subbands using a one lever 2D DWT . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.10 Examples of images of different types used in our experiments. (a) Text color image (b) Text color image with pictures (c) Black and white text image with shapes (d) Color text image with shapes . . . 3.11 Distribution of couples (α HH , β HH ) of the HH subband of the red color channel for different scanners computed using 50 images . . . 3.12 Scanned images and its corresponding HH subband of the DWT of the blue channel. (a) s1 (b) s2 (c) s4 (d) s5 . . . . . . . . . . . . . . 3.13 Example of an image and the LL subband of its red channel . . . . 3.14 An example of the distribution of couples (α HH , β HH ) of the HH subband of the blue channel for four scanners of the same brand (Epson). s1 and s2 as well as d2 and d2 are each of the same model 3.15 Example showing a scanned image (a) and its HH subband (b). We notice some image details in the HH subband that we have surrounded in red . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.16 Flowchart of the proposed source scanner identification approach . . 3.17 Illustration of a scanner fingerprint generation: Noise is estimated from many scanned filled forms . . . . . . . . . . . . . . . . . . . . 3.18 Scanner identification scheme . . . . . . . . . . . . . . . . . . . . . 3.19 Samples of scanned filled form by different persons . . . . . . . . . . 4.1 Example of a CNN. 'Conv' refers to convolutional layer, the rectified linear unit 'Relu' is an activation function, 'FC' denotes a fullyconnected layer and 'Softmax' is an activation function that outputs a probability distribution . . . . . . . . . . . . . . . . . . . . . . . . 4.2 Global architecture of our system . . . . . . . . . . . . . . . . . . . 4.3 The network structure of the proposed CNN. The numbers below each colored figure is its dimension . . . . . . . . . . . . . . . . . . 4.4 Pipeline of an image source identification based on majority voting 4.5 Effect of adding convolutional layers to the network on the validation accuracy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6 Effect of adding convolutional layers to the network . . . . . . . . . 4.7 Effect of the subband choice on the classification accuracy . . . . . 4.8 Effect of color channels on the performance accuracy . . . . . . . . 4.9 Effect of training size on testing accuracy for multiple block sizes . 4.10 Average training time for different CNNs . . . . . . . . . . . . . . . 4.11 Main architecture of the proposed framework . . . . . . . . . . . . . 4.12 The architecture of the 1D-CNN network . . . . . . . . . . . . . . . 4.13 Segment extraction example . . . . . . . . . . . . . . . . . . . . . . 4.14 Samples of the cropped blocks from several images . . . . . . . . . . 4.15 Effect of the segment length on the training accuracy . . . . . . . . 4.16 Performance comparison results for using Red (R), Green (G) and Blue (B) color channels separately and combined . . . . . . . . . . 4.17 Plots showing learning curves of model loss and accuracy over each training epoch during training and validation (a) Training loss vs training accuracy (b) Validation loss vs validation accuracy . . . . . 5.1 DLK scheme proposed by Costa et al. [204]. The correlation values between the noise residuals of each color channel R, G, and B of nine regions of interest (ROI) shown in the right and left images are used to train the SVM . . . . . . . . . . . . . . . . . . . . . . . . . List of Figures xv General structure of CNN-based DLK solutions . . . . . . . . . . . 5.3 Global architecture of the proposed DLK process . . . . . . . . . . 5.4 Overview of the patches comparison mechanism ImSiM . It is composed of a pair of layers in a hard sharing configuration, followed by a concatenation function and another layer of neurons. The decision is an output indicating the similarity score obtained from the last layer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.5 Training and validation performances of the proposed method . . . 5.6 Change in the classification performance of our system when the pre-processing step was removed with a comparison of the effect of the scoring function: Softmax vs Sigmoid . . . . . . . . . . . . . . . 5.7 Accuracy rates with patches size 64x64 and 128x128 for JPEG compressed images . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.8 Matching rates of our proposed scheme for different patch sizes

  . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.1 Annual number of publications related to source scanner (black) and source camera (green) identification . . . . . . . . . . . . . . . . . . 6.2 Workflow of generating our dataset . . . . . . . . . . . . . . . . . . 6.3 SSI levels with scanners from our dataset as examples . . . . . . . . 6.4 Examples of images from the SUPATLANTIQUE dataset: The first row corresponds to "official" documents and the second row corresponds to Wikipedia documents . . . . . . . . . . . . . . . . . 6.5 Fraud folder structure . . . . . . . . . . . . . . . . . . . . . . . . . 6.6 Retouching forgery example (a) original image (b) forged image with

  before tampering (b) after tampering . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.10 A heat map sample . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.11 Pipeline of the data-driven forgery detection scheme . . . . . . . . . 6.12 Sample HH subbands ((b), (c), (d)) of each color channel of an RGB image and their estimated forgery masks ((f), (g), (h)). From left to right are presented R, G and B, respectively. (a) is the original image and (e) is the tampered one . . . . . . . . . . . . . . . . . . . 6.13 Examples of forged images and the outputs of the proposed handcraftedbased FD method (a) Forged images (b) Ground truths (c) Heat maps (d) Masks using the SAR (e) Masks using the MR . . . . . . 6.14 Comparison between the binary masks obtained by using different reference signatures in our method (a) Ground truth (b) Mask obtained using the first scanner (source scanner) to generate the reference signature (b) Mask obtained using the second scanner to generate the reference signature (b) Mask obtained using the third scanner to generate the reference signature . . . . . . . . . . . . . 6.15 Examples of forged images and the outputs of the proposed CNNbased FD method (a) Forged images (b) Ground truths (c) Forged blocks marked by blue boxes (d) Estimated binary masks . . . . . . xvi List of Figures 6.16 Comparison between forgeries detection performances when using different size patches (a) Ground truth (b) Mask in the case of 128x128 patches (c) Mask in the case of 64x64 patches . . . . . . . 6.17 Test case. (a) Original. ((b), (c), and (d)) Tampered. ((e), (f), and (g)) Tampered regions detected . . . . . . . . . . . . . . . . . . . . A.1 Classification of digital data protection approaches . . . . . . . . . A.2 Processus d'acquisition d'un document numérique par un scanner à plat . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B.1 Illustration of different wavelet decomposition levels . . . . . . . . . B.2 Difference between DWT and SWT decomposition trees . . . . . .

Contents 1 . 1 1 . 2 1 . 3 1 . 4

 11121314 General context and problem statement . . . . . . . . . 1 Specific objectives . . . . . . . . . . . . . . . . . . . . . . 4 Contributions . . . . . . . . . . . . . . . . . . . . . . . . . 4 Thesis outline . . . . . . . . . . . . . . . . . . . . . . . . . 8

Figure 1 . 2 :

 12 Figure 1.2: General overview of an image encryption scheme

Figure 1 . 3 :

 13 Figure 1.3: Flowchart of thesis goals and techniques used. 2D -CN N shrinked and ImSiM refers to the name given to our proposed schemes

Figure 2 . 1 :

 21 Figure 2.1: Flatbed scanner (a), Sheet-fed scanner (b), Handheld scanner (c), drum scanner (d)

Figure 2 . 2 :

 22 Figure 2.2: Flatbed scanner imaging pipeline: The orange arrow indicates the direction of the scan followed by the scanning unit composed of a light source, a set of mirrors, lens and the imaging sensor

Figure 2 . 3 :

 23 Figure 2.3: Changing positions of the scan head during the scanning process

Figure 2 .

 2 4 depicts an illustration of each of them. Unlike traditional CCFL, LED light don't need a time to warm up enabling a quick start to scan. Moreover, scanners with LED consume less power, generate less heat and tend to last longer without color change.Once the light reaches the document, it gets diverted by a series of slightly curved mirrors (two or three mirrors depending on the scanner). The light reflected by the last mirror goes into a lens which will focus it on the sensors array composed of a collection of tiny photosites.

Figure 2 . 4 :

 24 Figure 2.4: CCFL (a) vs LED (b)

Figure 2 . 5 :

 25 Figure 2.5: (a) CCD Scan relies on an actual lens together with a series of mirrors to reduce the entire document image onto the sensors compared to (b) CIS Scan which incorporates a lens array to transfer the document image to the array of sensors

Figure 2 . 6 :

 26 Figure 2.6: Digital camera vs scanner imaging sensor (a) camera sensor (b) scanner sensor

Figure 2 . 7 :

 27 Figure 2.7: Forensics investigation process for SSI

Figure 2 . 8 :

 28 Figure 2.8: Sample of a multi-directional grating hologram[START_REF] Sugawara | Identification of scanner models by comparison of scanned hologram images[END_REF]

Fig 2 .

 2 10, the dust and scratch positions on a scanned image are shown.

Figure 2 . 10 :

 210 Figure 2.10: Dark spots in a scanned image due to dust/scratches over the scanner platen

Figure 2 . 11 :

 211 Figure 2.11: First example of a digitally altered image (The original section and the duplicated one were pointed)

Figure 2 .

 2 [START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF] shows the bar chart of a variety of publications according to each form of image tampering technique over the years 2010-2020.

Figure 2 . 12 :

 212 Figure 2.12: Second example of a digitally altered image (On the left the original document and on the right the doctored one)

Figure 2 . 13 :

 213 Figure 2.13: Classification of forgery detection techniques

Figure 2 . 14 :Figure 2 . 15 :

 214215 Figure 2.14: Chart with number of published papers in the field of image forgery detection over the last decade (2010-2020)

Figure 2 . 16 :

 216 Figure 2.16: Example of copy-move forgery (a) Original image (b) Tampered image

Figure 2 . 17 :

 217 Figure 2.17: An example of retouching (a) An old photo of my father taken in 1981 (b) retouched image to look that it has been taken recently

Contents 3 . 1

 31 Scanner Source Identification of JPEG Images . . . . . 33 3.1.1 The JPEG standard . . . . . . . . . . . . . . . . . . . . 33 3.1.2 Proposed JPEG based approach . . . . . . . . . . . . . 35 3.1.3 Experimental results . . . . . . . . . . . . . . . . . . . . 37 3.1.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . 37 3.2 Source Scanner Model Identification Based on Wavelet Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 3.2.1 Image and scanner fingerprints . . . . . . . . . . . . . . 40 3.2.2 Image origin predictor . . . . . . . . . . . . . . . . . . . 43 3.2.3 Experimental results . . . . . . . . . . . . . . . . . . . . 44 3.2.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . 48 3.3 Semi-blind source scanner Identification . . . . . . . . . 48 3.3.1 Image and scanner fingerprints . . . . . . . . . . . . . . 49 3.3.2 Image origin predictor . . . . . . . . . . . . . . . . . . . 51 3.3.3 Experimental results . . . . . . . . . . . . . . . . . . . . 52 3.3.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . 54 3.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Figure 3 .

 3 Figure 3.1 provides a summary of the essential steps required for compressing an image in the JPEG format:

Figure 3 . 1 :Figure 3 . 2 :

 3132 Figure 3.1: JPEG compression scheme

Figure 3 . 3 :

 33 Figure 3.3: Example of QT defined by their marker in the JPEG bitstream

Figure 3 . 4 :

 34 Figure 3.4: General scheme of the proposed JPEG-based verification scheme. I is the investigated JPEG image, f I is its fingerprint which will be compared to each scanner fingerprint f s i where i:1..x and x is the number of known brands

Figure 3 . 5 :

 35 Figure 3.5: Summarizing related works on source scanner identification

Figure 3 . 6 :

 36 Figure 3.6: An illustration of the different stages of a typical SSI evaluation process.Once the hard-copies to scan are prepared, they are scanned by each of the scanner. The scanned images are, then, divided into two separate sets and used to train and test the SSI system.

Figure 3 . 7 :

 37 Figure 3.7: Global architecture of the proposed system

Figure 3 . 8 :

 38 Figure 3.8: Fingerprint extraction for a scanned image

Figure 3 . 9 :

 39 Figure 3.9: Example of a decomposition of an image into four subbands using a one lever 2D DWT

Figure 3 . 10 :

 310 Figure 3.10: Examples of images of different types used in our experiments. (a) Text color image (b) Text color image with pictures (c) Black and white text image with shapes (d) Color text image with shapes

Figure 3 . 11 :Figure 3 . 12 :

 311312 Figure 3.11: Distribution of couples (α HH , β HH ) of the HH subband of the red color channel for different scanners computed using 50 images

Figure 3 . 13 :

 313 Figure 3.13: Example of an image and the LL subband of its red channel

Figure 3 . 14 :

 314 Figure 3.14: An example of the distribution of couples (α HH , β HH ) of the HH subband of the blue channel for four scanners of the same brand (Epson). s1 and s2 as well as d2 and d2 are each of the same model

Figure 3 . 15 :

 315 Figure 3.15: Example showing a scanned image (a) and its HH subband (b). We notice some image details in the HH subband that we have surrounded in red

Figure 3 . 16 :

 316 Figure 3.16: Flowchart of the proposed source scanner identification approach

52 3. 3 .Figure 3 . 17 :

 523317 Figure 3.17: Illustration of a scanner fingerprint generation: Noise is estimated from many scanned filled forms

Figure 3 . 18 :

 318 Figure 3.18: Scanner identification scheme

54 3. 3 .Figure 3 . 19 : 3 . 11 :

 543319311 Figure 3.19: Samples of scanned filled form by different persons

Figure 4 . 1 :

 41 Figure 4.1: Example of a CNN. 'Conv' refers to convolutional layer, the rectified linear unit 'Relu' is an activation function, 'FC' denotes a fully-connected layer and 'Softmax' is an activation function that outputs a probability distribution

Figure 4 . 2 :

 42 Figure 4.2: Global architecture of our system

Figure 4 .

 4 3 illustrates our CNN architecture.

Figure 4 . 3 :

 43 Figure 4.3: The network structure of the proposed CNN. The numbers below each colored figure is its dimension

Figure 4 . 4 : 4 . 3 :

 4443 Figure 4.4: Pipeline of an image source identification based on majority voting

Figure 4 . 5 :Figure 4 . 6 :

 4546 Figure 4.5: Effect of adding convolutional layers to the network on the validation accuracy

Figure 4 . 7 :Figure 4 . 8 :

 4748 Figure 4.7: Effect of the subband choice on the classification accuracy

Figure 4 . 9 :

 49 Figure 4.9: Effect of training size on testing accuracy for multiple block sizes

Figure 4 . 10 :

 410 Figure 4.10: Average training time for different CNNs

Figure 4 . 11 :

 411 Figure 4.11: Main architecture of the proposed framework

Figure 4 . 12 :

 412 Figure 4.12: The architecture of the 1D-CNN network

Figure 4 . 13 :

 413 Figure 4.13: Segment extraction example

Figure 4 . 14 :

 414 Figure 4.14: Samples of the cropped blocks from several images

Figure 4 . 15 :

 415 Figure 4.15: Effect of the segment length on the training accuracy

Figure 4 . 16 :

 416 Figure 4.16: Performance comparison results for using Red (R), Green (G) and Blue (B) color channels separately and combined

Figure 4 . 17 :

 417 Figure 4.17: Plots showing learning curves of model loss and accuracy over each training epoch during training and validation (a) Training loss vs training accuracy (b) Validation loss vs validation accuracy

Contents 5 . 1

 51 Device linking schemes . . . . . . . . . . . . . . . . . . . 78 5.2 Proposed DLK Method . . . . . . . . . . . . . . . . . . . 80 5.2.1 Pre-processing . . . . . . . . . . . . . . . . . . . . . . . 81 5.2.2 Patches comparison . . . . . . . . . . . . . . . . . . . . 81 5.3 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 5.3.1 Parameters settings . . . . . . . . . . . . . . . . . . . . 84 5.3.2 Performance of the proposed system on image patches . 84 5.3.3 Performance of the proposed system on full images . . . 89 5.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . 91

78

 78

  and I2 were acquired by the same device H1 : I1 and I2 were acquired by different devices This task is based on checking the forensic similarities of the traces left by each device in those images. It has been attracting more and more attention for images acquired by general public digital cameras, while works related to scanned or digitized documents have not yet received any attention. Two categories of DLK approaches can be distinguished according to the way the image fingerprints are compared:

Figure 5 . 1 :

 51 Figure 5.1: DLK scheme proposed by Costa et al. [204]. The correlation values between the noise residuals of each color channel R, G, and B of nine regions of interest (ROI) shown in the right and left images are used to train the SVM

Figure 5 . 2 :

 52 Figure 5.2: General structure of CNN-based DLK solutions

Figure 5 . 3 :

 53 Figure 5.3: Global architecture of the proposed DLK process

Figure 5 .

 5 Figure 5.5 depicts the evolutions of the training and validation curves of the ImSiM network over 8 epochs. The training and validation accuracy are given on the right while the training and validation loss are placed on the left. One can observe that both curves jointly increase and decrease throughout the training epochs.We can also notice that, after the 5 th epoch, the accuracy and the loss evolution almost stop and converge to approximately the same rates. Therefore, our model is not overfitting.

Figure 5 . 5 :

 55 Figure 5.5: Training and validation performances of the proposed method

Figure 5 . 6 :

 56 Figure 5.6: Change in the classification performance of our system when the preprocessing step was removed with a comparison of the effect of the scoring function: Softmax vs Sigmoid

Figure 5 . 7 :

 57 Figure 5.7: Accuracy rates with patches size 64x64 and 128x128 for JPEG compressed images

Figure 5 . 8 :

 58 Figure5.8: Matching rates of our proposed scheme for different patch sizes compared to an approach adapted from Guru et al.[START_REF] Swaroop | Device-based image matching with similarity learning by convolutional neural networks that exploit the underlying camera sensor pattern noise[END_REF]

90 5. 3 .Algorithm 2 :

 9032 Evaluation provides a pseudocode detailing this process. Comparison of a pair of images Input: Images I 1 and I 2 acquired by same\different scanners Output: 1 if same source scanner and 0 if different Sample I 1 and I 2 into patch sets S 1 and S 2

Figure 5 . 9 :

 59 Figure 5.9: Accuracy results of our DLK system when applied to full images. Each block from the diagonal corresponds to the rate of correctly identifying a pair of images as sourced from the same scanner. The remaining blocks are the result of two images acquired by different scanners. The column on the right refers to the average accuracy for each scanner

2

 2 The most important persuasion tool you have in your entire arsenal is integrity. L'intégrité est l'outil de persuasion le plus important dont vous disposez dans tout votre arsenal. Optimal forgery detection . . . . . . . . . . . . . . . . . 101 6.2.1 First method: a Handcrafted-based IFD approach (HIFD)102 6.2.2 Second method: a CNN-based IFD approach (CIFD) . . 105 6.3 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 6.3.1 Evaluation of HIFD . . . . . . . . . . . . . . . . . . . . 106 6.3.2 Evaluation of CIFD . . . . . . . . . . . . . . . . . . . . 107 6.3.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . 110 6.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . 111

94 6. 1 .

 941 New Image dataset: Acquisition and organization

Figure 6 . 1 :

 61 Figure 6.1: Annual number of publications related to source scanner (black) and source camera (green) identification

95 Table 6 . 1 : 1 .

 95611 Native resolution (nominal resolution) • Acquisition technology (CIS/CCD) • External bit depth: Number of bits used to represent a given color pixel in the image transferred from the scanner to the host computer 6. NEW ANNOTATED IMAGE DATASET TAILORED FOR IMAGE FORGERY DETECTION List of scanners used to constitute the 'SUPATLANTIQUE' New Image dataset: Acquisition and organization • Price : Low('*'), medium('**'), high('***')

Figure 6 . 2 :

 62 Figure 6.2: Workflow of generating our dataset

Figure 6 . 3 :

 63 Figure 6.3: SSI levels with scanners from our dataset as examples

Figure 6 . 4 :

 64 Figure 6.4: Examples of images from the SUPATLANTIQUE dataset: The first row corresponds to "official" documents and the second row corresponds to Wikipedia documents

Figure 6 . 5 :

 65 Figure 6.5: Fraud folder structure

Figure 6 . 6 :

 66 Figure 6.6: Retouching forgery example (a) original image (b) forged image with the manipulated regions marked by orange rectangles (c) binary mask

Figure 6 . 7 :

 67 Figure 6.7: The general pipeline of the proposed schemes

Figure 6 . 8 :

 68 Figure 6.8: Forgery detection process using the proposed approach (i=1..K, K is the number of images acquired by the scanner)

Figure 6 . 9 :

 69 Figure 6.9: An illustration of a pair of histograms (a) before tampering (b) after tampering

Algorithm 3 :

 3 Reference signature generation Input: Images acquired by the scanner S Output: Scanner signature HH S HH S ← [] for i in S do I b ← I(:, :, 0) // Blue channel HH I ← SW T (I b ) [k1, k2] ← size(HH I ) for k from 1 to k1 do for j from 1 to k2 do HH S ← M AX(HH S (k, j), HH I (k, j))

Figure 6 . 10 :

 610 Figure 6.10: A heat map sample

Figure 6 . 11 :

 611 Figure 6.11: Pipeline of the data-driven forgery detection scheme

Figure 6 . 12 :

 612 Figure 6.12: Sample HH subbands ((b), (c), (d)) of each color channel of an RGB image and their estimated forgery masks ((f), (g), (h)). From left to right are presented R, G and B, respectively. (a) is the original image and (e) is the tampered one

Figure 6 . 13 :

 613 Figure 6.13: Examples of forged images and the outputs of the proposed handcraftedbased FD method (a) Forged images (b) Ground truths (c) Heat maps (d) Masks using the SAR (e) Masks using the MR

Figure 6 . 14 :

 614 Figure 6.14: Comparison between the binary masks obtained by using different reference signatures in our method (a) Ground truth (b) Mask obtained using the first scanner (source scanner) to generate the reference signature (b) Mask obtained using the second scanner to generate the reference signature (b) Mask obtained using the third scanner to generate the reference signature

Figure 6 . 15 :

 615 Figure 6.15: Examples of forged images and the outputs of the proposed CNN-based FD method (a) Forged images (b) Ground truths (c) Forged blocks marked by blue boxes (d) Estimated binary masks

Figure 6 . 16 : 113 Figure 6 . 17 :

 616113617 Figure 6.16: Comparison between forgeries detection performances when using different size patches (a) Ground truth (b) Mask in the case of 128x128 patches (c) Mask in the case of 64x64 patches

  assez facilement falsifier le contenu d'un document scanné à son avantage à l'aide d'un logiciel d'édition d'images sans laisser des traces visuellement détectables. Différentes solutions permettent de protéger les données multimédia. Ces solutions peuvent être classées en deux catégories: actives et passives (voir Fig. A.1).

Figure A. 1 :

 1 Figure A.1: Classification of digital data protection approaches

Figure A. 2 :

 2 Figure A.2: Processus d'acquisition d'un document numérique par un scanner à plat

Fig. B. 1 .

 1 Four new images are obtained, which are: the approximation subband (Low-Low LL), vertical details subband (Low-High LH), horizontal details subband (High-Low HL) and diagonal details subband (High-High HH). It is important to note that this later isolates the localized high frequency features. Further levels of decomposition can be obtained by repeating this decomposition each time on the LL subband as shown in Fig B.1.

130 B. 2 .Figure B. 1 :Figure B. 2 :

 130212 Figure B.1: Illustration of different wavelet decomposition levels

  Figure B.2 illustrates the difference DWT and SWT decomposition process.

Figure C. 1

 1 shows an overall basic structure of 2D-CNN composed of several layers.

132 C. 1 .Figure C. 1 :

 13211 Figure C.1: Example of a 2D-CNN

  Fig. C.2 with the 6 filters of size 3x3 for each color channel (R, G and B) depicted in Fig. C.3, then, we will obtain the feature maps shown in Fig. C.4.

Figure C. 2 :

 2 Figure C.2: An image sample

Figure C. 3 :

 3 Figure C.3: Normalized filters used for each color channel R, G and B

  Figure C.5 gives an example of a max pooling operation where each color refers to a different non-overlapping window. The second type of pooling is the average pooling where the output is the average of all values in each window.

Figure C. 4 :Figure C. 5 :

 45 Figure C.4:Visualization of the feature maps obtained by a convolutional layer of shape[START_REF] Mayce | Document Forgery in Healthcare: The Integral Role of Primary Source Verification as a Solution[END_REF][START_REF] Mayce | Document Forgery in Healthcare: The Integral Role of Primary Source Verification as a Solution[END_REF][START_REF] Mayce | Document Forgery in Healthcare: The Integral Role of Primary Source Verification as a Solution[END_REF][START_REF] Khanna | Source scanner identification for scanned documents[END_REF]

  Fig. C.6, AlexNet adopts three convolutional layers with different kernel sizes (11×11, 5×5 and 3×3). At each of these convolutional layers, features got extracted and the size of the resulting feature maps is reduced with max pooling layers of size 3x3. Finally, three fully connected layers are used to generate the output. GoogleNet Another notable DL architecture is the so-called GoogLeNet. This deep network is composed of 22 layers of which an inception structure, shown in Fig. C.8, is repeated 9 times. The inception acts as a single layer in the network by stacking three convolutional cores of sizes 5x5, 3x3 and 1x1 simultaneously in parallel with an occasional max pooling layer. The full architecture of this CNN is presented in Fig. C.7.

136 C. 2 .Figure C. 6 :

 13626 Figure C.6: AlexNet architecture

  Fig. C.10 .The CNN model developed for a specific task is reused with different data to solve a different problem.

Figure C. 10 :

 10 Figure C.10: Illustration of transfer learning

Figure C. 7 :

 7 Figure C.7: GoogleNet architecture

Figure C. 8 :Figure C. 9 :

 89 Figure C.8: GoogleNet Inception module

  w .x i -b >= 1, for x i points of the first class w .x i -b <= -1, for x i points of the second class (D.2)

Figure D. 1 :

 1 Figure D.1: A linear SVM example

  and γ. The parameter C, which is shared by all SVM kernels, trades off misclassification of training examples versus decision surface simplicity. A low C smoothes the decision surface, whereas a high C attempts to correctly classify all training samples. On the other hand, Gamma refers to the degree of influence a single training sample has. The selection of C and γ is critical to the performance of the SVM. To select convenient values, GridSearchCV with C and gamma spaced exponentially is recommended. Sigmoid It is originated from NN. Its equation is such that tanh γx i T x j + r (D.6) Titre : Analyse des documenents numérisés à des fins de contrôle d'intégrité et d'authenticité Mot clés : Forensiques des images numériques, intégrité de l'image, authenticité, scanners à plat, falsification, documents numérisés, mécanisme de sécurité Résumé : Aucune méthode universelle de détection des contrefaçons d'images n'existe. Plusieurs techniques ont été proposées mais chacune a ses limites. Parmi ces méthodes, les techniques dites "forensiques des images numériques" offrent une solution intéressante. Elles visent soit à vérifier l'intégrité de l'image, soit à apporter la preuve de son authenticité en identifiant le système qui l'a acquise. Pour ce faire, elles tirent avantage de la manière dont les systèmes d'acquisition génèrent leur sortie. Dans cette thèse, nous nous intéressons en particulier aux scanners à plat comme système d'acquisition et nous proposons d'étudier et de développer des techniques de forensiques pour des documents multi-type scannés. Nous avons, tout d'abord, proposé des techniques permettant d'identifier le scanner à l'origine d'un document scanné sur la base d'un ensemble de signatures extraites "manuellement" des images. Ensuite, pour faire face aux limites de ces approches, nous nous somme focalisé sur l'extraction automatique des signatures des scanners à travers des réseaux de neurones 1D et 2D. Par la suite, nous avons développé une nouvelle approche, appelée "Device Linking", qui détermine si deux images ont été acquises par le même scanner ou non. Enfin, nous fournissons deux mécanismes de sécurité capable de détecter les manipulations du contenu des données numérisées en se basant sur certaines approches d'identification du scanner source proposées précédemment. Dans le but de valider les solutions proposées dans des situations réelles et réaliser des comparaisons entre elles, nous avons construit une base de données de documents scannés que nous avons rendue publique. Title: Analysis of scanned documents for integrity and authenticity checking Keywords: Digital image forensics, image integrity, authenticity, flatbed scanners, falsification, digitized documents,

  2.1 Comparison of the acquisition process between scanners and digital cameras . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Comparison of device-based forgery detection techniques related to scanners (NN refers to Non-Numerical and NO to Non-Overlapping) 3.1 Common JPEG markers . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Scanners used in our experiments . . . . . . . . . . . . . . . . . . . 3.3 QT of luminance and chrominance of some scanners used in our experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 Scanners used in our experiments . . . . . . . . . . . . . . . . . . . 3.5 Confusion matrix for the proposed method (in %) -TIFF images . 3.6 Identification accuracy for each subband . . . . . . . . . . . . . . . 3.7 Identification accuracy for each color channel . . . . . . . . . . . . . 3.8 Confusion matrix for the Choi et al.

  Configuration of the proposed 1D CNN . . . . . . . . . . . . . . . . 4.6 Scanners used to generate the database . . . . . . . . . . . . . . . . 4.7 Confusion matrix (in%) using the 1D-CNN model over 9 scanners . 4.8 Confusion matrix (in%) using the 1D-CNN-SVM model over 9 scanners 4.9 Comparison of classification accuracies between the proposed 1D-CNN based method with and without the SVM classifier, and existing methods [14, 18] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1 Image sources used in our experiments . . . . . . . . . . . . . . . . 5.2 Accuracy comparison using different fusion methods . . . . . . . . . 5.3 Performance of the DLK system with different linking algorithms (SVM, Linear Regression, Random Forest and the proposed ImSiM ) 6.1 List of scanners used to constitute the 'SUPATLANTIQUE' . . . . Grey-Level Run Length Matrix GGD . . . . . Generalized Gaussian Distribution GLCM . . . . Gray-Level Co-occurrence Matrix GLDH . . . . . Gray-Level Difference Histogram HIFD . . . . . Handcrafted-based IFD approach HM . . . . . . Heat Map HOGM . . . . Histogram off Orientated Gabor Magnitude HPF . . . . . . High Pass Filter HPS . . . . . . Hard Parameter Sharing IBMA . . . . . Improved Block-based Matching Algorithm IFD . . . . . . Image Forgery Detection Low Pass Filter LSH . . . . . . Locality Sensitive Hashing LTP . . . . . . Local Ternary Pattern LTrP . . . . . . Local Tetra Pattern ME . . . . . . . Moment Estimation MF . . . . . . . Median Filtering MFF . . . . . . Median Filtering Forensics MLE . . . . . . Maximum Likelihood Estimation MLDD . . . . MultiLevel Dense Descriptor MLP . . . . . . Multi-Layer Perceptron MROGH . . . Multi-Support Region Order-based Gradient Histogram MSCR . . . . . Maximally Stable Color Region MZMs . . . . . Modified Zernike Moments NCC . . . . . . Normalized Cross Correlation NN . . . . . . . Neural Network NLP . . . . . . Natural Language Processing ORB . . . . . . Oriented Fast and Robust Brief PCET . . . . . Polar Complex Exponential Transform PNG . . . . . . Portable Network Graphics PPI . . . . . . Pixels Per Inch List of Abbreviations xxi PRNU . . . . . Photo-Response Non-Uniformity PST . . . . . . Polar Sine Transform QDCT . . . . . Quaternion Discrete Cosine Transforms QT . . . . . . . Quantization Table QWT . . . . . Quaternion Wavelet Transform RLE . . . . . . Run Length Encode RNC . . . . . . Réseau de Neurones Convolutif ROI . . . . . . Regions of Interest SCI . . . . . . . Source Camera Identification SIFT . . . . . . Scale Invariant Feature Transform SOI . . . . . . Start-Of-Image SPAM . . . . . Subtractive Pixel Adjacent Matrix SPT . . . . . . Steerable Pyramid Transform SPS . . . . . . Soft Parameter Sharing SSI . . . . . . . Source scanner identification SURF . . . . . Speed Up Robust Feature SVD . . . . . . Singular Value Decomposition SVM . . . . . . Support Vector Machine SWT . . . . . . Stationary Wavelet Transform TIFF . . . . . . Tagged Image File Format TL . . . . . . . Transfer Learning

	xviii xxii
	List of Abbreviations
	1D-AR . . . . One-dimensional AutoRegressive 1D-CNN . . . One Dimensional Convolutional Neural Network 2D-AR . . . . Two-dimensional AutoRegressive 2D-CNN . . . Two Dimensional Convolutional Neural Network Introduction 1
	xvii

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1 Structure of the proposed CNN . . . . . . . . . . . . . . . . . . . . 4.2 Scanners used to generate the database . . . . . . . . . . . . . . . .

4.3 Confusion matrix for full images using proposed method . . . . . . 4.4 Average classification accuracy for non-overlapping blocks and full images for different model architectures . . . . . . . . . . . . . . . . 4.5 6.2 Sensitivity, Specificity, and Predictability of the proposed models . . A.1 Comparaison des techniques de falsification basées sur les propriétés des scanners (NN correspond à Non-Numérique et SC à Sans-Chevauchement) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ADC . . . . . . Analog-to-Digital Converter BDCT . . . . . Block Discrete Cosine Transform CBMA . . . . Classical Block Based Matching Algorithm CCD . . . . . . Charge-Coupled Device CCFL . . . . . Cold Cathode Fluorescent Lamp CDS . . . . . . Correlated Double Sampling CE . . . . . . . Contrast Enhancement CFA . . . . . . Color Filter Array CIFD . . . . . CNN-based IFD approach CIS . . . . . . . Contact Image Sensor CMDF . . . . Copy-Move Forgery Detection DCF . . . . . . Digital Content Forensics DPI . . . . . . Dots Per Inch DPCM . . . . Differential Pulse Code Modulation DSNU . . . . . Dark Signal Non-Uniformity DCT . . . . . . Discrete Cosine Transform DIF . . . . . . Digital Image Forensics DL . . . . . . . Deep Learning DLK . . . . . . Device Linking DWT . . . . . Discrete Wavelet Transform EM . . . . . . . Expectation Maximization EMD . . . . . Empirical Mode Decomposition EME . . . . . . Entropy Matching Estimation EOI . . . . . . End-Of-Image EXIF . . . . . Exchangeable Image File FPN . . . . . . Fixed Pattern Noise FT . . . . . . . Fourier Transform g2NN . . . . . Generalized 2-nearest Neighbor GLF . . . . . . Global and Local Feature xix xx List of Abbreviations GLRLM . . . . IFT . . . . . . Inverse Fourier Transform JPEG . . . . . Join Photographic Expert Group LBP . . . . . . Local Binary Pattern LED . . . . . . Light Emission Diodes LDA . . . . . . Linear Discriminant Analysis LDD . . . . . . Local Difference Descriptor LDF . . . . . . Linear Discriminant Function LPA-ICI . . . Local Polynomial Approximation-Intersection of Confidence Intervals LPF . . . . . .

10 2.2 Scanned image origin identification

  Digital forensics is an exact science -Not the procedures but the results.

	La forensique numérique est une science exacte -
	Pas les procédures mais les résultats.
	-Edewede Oriwoh
	2 DIGITAL IMAGE FORENSICS:
	SOURCE SCANNER
	IDENTIFICATION AND FORGERY
	DETECTION

Contents 2.1 Image acquisition pipeline of a flatbed scanner . . . . . . . . . . . . . . . . . 14 2.2.1 Spatial domain features . . . . . . . . . . . . . . . . . . 15 2.2.2 Transform domain features . . . . . . . . . . . . . . . . 18 2.2.3 Color features . . . . . . . . . . . . . . . . . . . . . . . . 18 2.2.4 Texture features . . . . . . . . . . . . . . . . . . . . . . 18 2.2.5 Dust and scratches positions . . . . . . . . . . . . . . . 19 2.2.6 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2.3 Image forgery detection . . . . . . . . . . . . . . . . . . 20 2.3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . 20 2.3.2 Manipulation based methods . . . . . . . . . . . . . . . 21 2.3.3 Device based methods . . . . . . . . . . . . . . . . . . . 27 2.3.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . 27 2.4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . 29

Table 2 .

 2 1 summarizes the most notable differences between scanners and digital cameras. Since most of the artifacts investigated in source camera identification (SCI) methods are specific to the sensor design, they may not be potentially useful for the task of SSI.

		Scanner	Digital camera
	Color sensor	Trilinear	2D
	geometry
	Light source	Fluorescent Lamp or LED	Scene light alone or
			combined with flash
	Acquisition time Depends on the resolution,	Quick (One shot)
		the input and the device.
	Input data	Hard-copy sample	Scene

Table 2 . 1 :

 21 Comparison of the acquisition process between scanners and digital cameras

Table 2 . 2 :

 22 Comparison of device-based forgery detection techniques related to scanners (NN refers to Non-Numerical and NO to Non-Overlapping)

	Paper

Used features Size of the block Type of identified forgeries Number of scanners Number of images Resolution of scan Result reported Advantages Limitations

				[143]	et al.	Elsharkawy				[142]	et al.	Elsharkawy			[141]	al.	Choi et	[28]	et al.	Khanna
				component	illumination	Histogram of the				positions	scratch	Dust and					Spectral noise			pattern noise	imaging sensor	features of	Statistical
						Image size							(NO)	362x408					(NO)	256x256		(NO)	384x512
						Splicing								Splicing							Splicing			Splicing
						10								3							4			5
						100								7							3			125
						-								300dpi							300dpi			1200dpi
						97.25%								NN							NN			NN
	of noise	in the presence	images and	JPEG compressed	-Tested with	accuracy	-High detection	the image source	independently of	-Detect tampering	photographs	in image	splicing forgeries	Able to detect	photographs	non-scanned	blocks are	where forged	photographs	in image	splicing forgeries	Able to detect	photographs	in image	splicing forgeries	-Able to detect
					not addressed	Documents are					smaller blocks	-Cannot use	addressed	-Documents are not			not addressed	regions are	scanned forged	Documents and	smaller blocks	-Cannot use	saturated regions	textured or	in the heavily	classification	-Wrong	not addressed	-Documents are	cost	computational	Very high

Table 3 . 1 :

 31 Common JPEG markers

	Name	Code(HEX)	Description
	SOI	FFD8	Start Of Image
	SOFO	FFCO	Start Of Frame : indicates that this is a baseline
			DCT-based JPEG and specifies the width, height,
			number of components and component subsampling
	SOS	FFDA	Start Of Scan : begins a top-bottom scan of image. In
			baseline DCT JPEG, there is generally a simple san.
	DHT	FFC4	Define Huffman Table
	DQT	FFDB	Define Quantization Table
	APPn	FFEn	Application-specific
	COM	FFFE	Comment
	EOI	FFD9	End Of Image

RSTn

FFDn Restart : inserted every r macroblocks where r is the restart interval set by DRI marker. Not used if there was no DRI marker.

Table 3 . 2 :

 32 Scanners used in our experiments

	Id Brand	Model
	s1 Canon CanonScan 9000F MKII -1
	s2 Epson	Perfection V39
	s3 Epson	Perfection V550 Photo
	s4 Canon CanonScan 9000F MKII -2
	s5	HP	Scanjet Pro 2500 F1

Table 3 . 3 :

 33 QT of luminance and chrominance of some scanners used in our experiments

Table 3 . 4 :

 34 Scanners used in our experiments

Table 3 . 5 :

 35 Confusion matrix for the proposed method (in %) -TIFF images

		S1	S2	S3	S4	S5
	S1 87.6 12.4	0	0	0
	S2 7.2 92.8	0	0	0
	S3	0	0.8 99.2	0	0
	S4	0	0	0	100	0
	S5	0	0	0	1.2 98.8

Table 3 . 6 :

 36 Identification accuracy for each subband

	Subband Accuracy
	LL	23.52%
	LH	89.44%
	HL	76.96%

Table 3 . 7 :

 37 Identification accuracy for each color channel

	Color channel Accuracy
	R	90.88%
	G	94.88%
	B	90.96%

Table 3 . 8 :

 38 Confusion matrix for the Choi et al.[START_REF] Choi | Scanner identification using spectral noise in the frequency domain[END_REF] method (in %) -TIFF images

		S1 S2 S3	S4	S5
	S1 100 0	0	0	0
	S2	0	1.2	0	98.8	0
	S3	0	0 100	0	0
	S4	0	0.8	0	99.2	0
	S5	0	0	0	0	100

Table 3 .

 3

	9: Confusion matrix for the proposed method (in %) -JPEG (QF=75) images
		S1	S2	S3	S4	S5
	S1 44.4 31.6	8	17.2	0
	S2 3.2 71.6 25.2	0	0
	S3 2.4	20 75.6	6	0
	S4 18.8	0	0.8 80.4	0
	S5	0	0	0	13.6 86.4

Table 3 . 10 :

 310 Scanners used in experiments

	Id	Model \ Brand	Resolution
	S1	Canon Lide 220	4800x4800
	S2 Epson Perfection V370 Photo (1) 4800x9600
	S3 Epson Perfection V370 Photo (2) 4800x9600
	S4	Epson Perfection V550 Photo	6400x9600
	S5

58 4.2 Scanner Source Identification using Wavelets and 2D- CNN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 4

  .2.1 Image and scanner fingerprints . . . . . . . . . . . . . . 60 4.2.2 Image origin predictor . . . . . . . . . . . . . . . . . . . 62 4.2.3 Experimental results . . . . . . . . . . . . . . . . . . . . 62 4.2.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . 67 4.

	Yann LeCun
	4 SOURCE SCANNER
	IDENTIFICATION BASED ON AN
	AUTOMATIC FEATURES
	EXTRACTION

Contents 4.1 Related work . . . . . . . . . . . . . . . . . . . . . . . . .

3 Scanner Source Identification using SVM and 1D-CNN 67

  4.3.1 Image and scanner fingerprints . . . . . . . . . . . . . . 68 4.3.2 Full image source scanner identification . . . . . . . . . 70 4.3.3 Experimental results . . . . . . . . . . . . . . . . . . . . 71 4.3.4 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . 76 4.

4 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . 76

Table 4 . 1 :

 41 Structure of the proposed CNN

	Id	Layer \ Name	Size
	1	Convolution-ReLu	32 filters of size 3x3
	2	Max-Pooling	2x2
	3	Dropout 50%	-
	4	FullConnected-ReLu	512
	5 FullConnected-Sigmoid	N

Table 4 . 2 :

 42 Scanners used to generate the database

	Scanner Id Brand	Model	Sensor type Native resolution
	S1	Canon	Lide 120	CIS	2400 x 4800
	S2	Canon	Lide 220	CIS	4800 x 4800
	S3	Canon	CanonScan 9000F	CCD	4800 x 4800
	S4	Epson	Perfection V39	CIS	4800 x 4800
	S5	Epson Perfection V370 -1	CCD	4800 x 9600
	S6	Epson Perfection V370 -2	CCD	4800 x 9600
	S7	Epson	Perfection V550	CCD	6400 x 9600
	S8	HP	Scanjet Pro 2500 F1	CIS	1200 x 1200

Table 4 . 4

 44

		Accuracy
		Block level Image level
	AlexNet	94.69%	97.5%
	GoogLeNet	90.64%	96.66%
	Proposed-DWT	97%	100%
	Proposed-SWT	99.31%	100%

: Average classification accuracy for non-overlapping blocks and full images for different model architectures

Table 4 . 5 :

 45 Configuration of the proposed 1D CNN

	Layer Type	Output shape Kernel size
	1	Convolution	119x100	10
	2	Convolution	110x100	10
	3	Max Pooling	36x100	3
	4	Convolution	27x160	10
	5	Convolution	18x160	10
	6	Global average pooling 160	-
	7	Dropout	160	-
	8	Dense	9	-

Table 4 . 6 :

 46 Scanners used to generate the database

	Scanner Id Brand	Model	Sensor type Native resolution
	S1	Canon	Lide 120	CIS	2400 x 4800
	S2	Canon	Lide 220	CIS	4800 x 4800
	S3	Canon CanonScan 9000F -1	CCD	4800 x 4800
	S4	Canon CanonScan 9000F -2	CCD	4800 x 4800
	S5	Epson	Perfection V39	CIS	4800 x 4800
	S6	Epson	Perfection V370 -1	CCD	4800 x 9600
	S7	Epson	Perfection V370 -2	CCD	4800 x 9600
	S8	Epson	Perfection V550	CCD	6400 x 9600
	S9	HP	Scanjet Pro 2500 F1	CIS	1200 x 1200

Table 4 . 7 :

 47 Confusion matrix (in%) using the 1D-CNN model over 9 scanners

Table 4 . 8

 48

: Confusion matrix (in%) using the 1D-CNN-SVM model over 9 scanners

Table 4 . 9 :

 49 Comparison of classification accuracies between the proposed 1D-CNN based method with and without the SVM classifier, and existing methods[START_REF] Ben Rabah | Scanner model identification of official documents using noise parameters estimation in the wavelet domain[END_REF][START_REF] Ben Rabah | Boosting up Source Scanner Identification Using Wavelets and Convolutional Neural Networks[END_REF]

	Method	Brand Model Device
	DWT-KLD [14]	96.82% 81.22% 66.24%
	SWT-2DCNN [18] 100%	100%	97.40%
	1D-CNN	100%	99.24% 95.65%
	1D-CNN-SVM	100%	99.93% 98.15%

Table 5 . 2 :

 52 Accuracy comparison using different fusion methods

		Concatenate Subtract Multiply Average
	Cross-valid 1	94.08%	91.53%	92.73%	92.57%
	Cross-valid 2	93.78%	91.74%	93.28%	91.53%
	Cross-valid 3	94.76%	90.63%	91.62%	92.97%
	Average accuracy	94.02%	91.3%	92.54%	92.35%

Table 5 . 3 :

 53 Performance of the DLK system with different linking algorithms (SVM, Linear Regression, Random Forest and the proposed ImSiM )

	Topology	Accuracy
	SVM (Linear)	78,31%
	SVM (Gaussian)	88,18%
	Linear Regression	73,16%
	Random Forest	93,02%
	ImSiM	94,02%

Table 6 . 2 :

 62 Sensitivity, Specificity, and Predictability of the proposed models

		Sensitivity Specificity Predictability
	HIFD	63.81%	100%	100%
	CIFD (64)	83.39%	98.55%	76.87%
	CIFD (128)	39.43%	99.64%	92.39%

  Dans la littérature, il existe plusieurs approches en forensiques qui permettent d'identifier la source d'une image numérique. L'idée derrière ces méthodes est basée sur le fait que le processus d'acquisition d'un document laisse certaines traces dans l'image crée qui peuvent, si correctement exploitées, servir comme signature pour le scanner. Dans son principe un scanner convertit un document, initialement présent sous forme papier, en sa version numérique. C'est vrai que la configuration d'un scanner à plat dépend du fabricant et du modèle mais ses composants sont généralement les mêmes. La Fig. A.2 illustre les composants de base constituants un scanner. Le document, une fois placé sur la vitre, est balayé ligne par ligne par une unité de scan. Il est à noter qu'il existe deux types de technologies utilisés par les scanners: CCD ou CIS.

	Il est possible de grouper les méthodes forensiques d'identification du scanner
	source en cinq catégories:
	• Approches qui extraient les caractéristiques du scanner dans le domaine spatial
	[16, 24, 27-30]

• Approches qui extraient les caractéristiques du scanner dans le domaine fréquentiel

[START_REF] Khanna | Source scanner identification for scanned documents[END_REF]

124 A.2. Forensique des images numériques

3 Identification du scanner source basée sur une extraction manuelle des caractéristiques

  La falsification par cette technique consiste à améliorer le contenu de l'image en appliquant plusieurs transformations globales ou locales sur cette image à l'aide d'un ou plusieurs filtres ou en manipulant une partie de cette image pour la masquer ou lui ajouter des informations Dans cette thèse, nous nous intéressons aux approches basées sur les propriétés des scanners. Les méthodes de l'état de l'art relatives à ce type d'approches sont listées dans la table A.1. Dans cette table, les quatre approches traitent le même type de falsification et sont limitées par la taille du bloc de traitement. 'objectif de cette partie est de proposer de nouvelles solutions permettant l'identification du scanner à l'origine d'un document en question. En premier lieu, nous nous sommes intéressés aux images sauvegardées au format JPEG. Ce format a des spécificités liées à son entête que nous avons exploitées afin de cerner le fabricant du scanner recherché. Pour les images TIFF, nous avons proposé une méthode qui exploite les propriétés de la gaussienne généralisée caractérisant la distribution des coefficients d'ondelettes de sous-bande HH issue de la décomposition en ondelettes de l'image numérique. Cette solution s'est montrée plus fiable par rapport aux approches de l'état de l'art mais ses performances décroissent en présence d'un nombre important de scanners. Cette chute de performance peut s'expliquer par la présence dans notre jeu de scanners, de scanners de même marque et de même modèle. Ces scanners, ayant un processus de fonctionnement identique, présentent très peu de différences ce qui fait qu'ils sont difficiles à discriminer. Pour faire face à ce problème, nous nous sommes focalisés sur les documents officiels. En effet, ces derniers ont généralement la même structure et sont juste remplis différemment avant d'être numérisés. La méthode que nous proposons soustrait le document original (vierge) du document scanné afin de supprimer le maximum du contenu du document empêtrant le bruit du scanner.

	• Le «splicing»: C'est une méthode qui consiste simplement à couper et coller certaines parties d'une ou plusieurs images sur une autre image appelée image composite
	• Le copier-coller: La falsification par cette technique consiste à copier une

partie de l'image et la coller dans un autre emplacement dans la même image • Le ré-échantillonnage: Généralement, la falsification est réalisée en copiantcollant une partie d'une image sur une autre image. Pour cela, il est souvent nécessaire de redimensionner la partie collée de l'image pour l'adapter à la grille d'échantillonnage de l'image hôte. Cette opération est ainsi appelée ré-échantillonnage • Les retouches:

A.

LA.

4 Identification du scanner source basée sur une extraction automatique des caractéris- tiques

	A.4. Identification du scanner source basée sur une extraction automatique des
	126	caractéristiques
		Les travaux de cette partie visent essentiellement à trouver les caractéristiques qui permettront de mieux distinguer les scanners, en particulier ceux de même modèle. L'ambition est aussi d'exploiter des pistes permettant d'automatiser le processus d'identification du scanner à l'origine d'un document qui est quasi-exclusivement réalisée manuellement. Pour cela, nous avons proposé deux approches basées sur le CNN, réseau de neurones convolutif, qui différent principalement dans leurs dimensions (2D et 1D). Les résultats issus de ces approches sont extrêmement favorables. Dans la première approche, une architecture CNN bidimensionnelle (2D-CNN) est proposée pour classer les images selon leurs sources. Afin d'assurer une meilleure détection des caractéristiques du scanner, la transformée en ondelettes stationnaires est appliquée pour donner accès à sa sous-bande HH qui servira d'entrée à notre

réseau et donc de réduire l'effet du contenu de l'image lors de l'apprentissage du réseau. La deuxième approche est plus sophistiquée. Elle est basée sur le fait que le balayage du document à scanner est réalisé ligne par ligne et, ainsi, son bruit est répété sur toutes les lignes du document numérisé. Par conséquent, un CNN unidimensionnel (1D-CNN) combiné à une machine à vecteurs de support (SVM) est adopté pour effectuer un apprentissage automatique du bruit de balayage lié à chaque scanner.

Table A . 1 :

 A1 Comparaison des techniques de falsification basées sur les propriétés des scanners (NN correspond à Non-Numérique et SC à Sans-Chevauchement)

	Publication

Caractéristiques utilisées Taille du bloc Type des falsifications Nombre des scanners Nombre des images Résolution du scan Résultats rapportés Avantages Limitations

			[143]	et al.	Elsharkawy			[142]	et al.	Elsharkawy			[141]	al.	Choi et	[28]	et al.	Khanna
				de luminance	Histogramme de la composante					poussiére et des fissures	Les positions des					Bruit spectral		des capteurs	du bruit	statistiques	Caractéristiques
					Taille de l'image						(SC)	362x408				(SC)	256x256	(SC)	384x512
					Splicing							Splicing						Splicing		Splicing
					10							3						4		5
					100							7						3		125
					-							300dpi						300dpi		1200dpi
					97.25%							NN						NN		NN
	et en présence de bruit	images compressées JPEG	-Testée avec des	de détection	-Haute précision	source de limage	indépendamment de la	-Détecte la falsification	dans les photos	type splicing	la falsification de	Capable de détecter	photos non scannées	sont prises de	où les blocs falsifiés	dans des photos	de type splicing	les falsifications	Capable de détecter	splicing dans les photos	la falsification de type	Capable de détecter
				pas étudiés	Les documents ne sont				des blocs plus petits	-Impossible d'utiliser	pas étudiés	-Les documents ne sont			ne sont pas étudiés	falsifiées numérisées	Les documents et les régions	plus petits	des blocs de pixels	-Impossible d'utiliser	ou saturées	fortement texturées	dans les régions	-Fausse classification	pas étudiés	-Les documents ne sont	de calcul	-Coûteuse en termes

  Pour conclure, différents travaux ont été menés durant cette thèse pour la résolution du problème d'identification du scanner source. L'objectif principal était de concevoir un modèle adaptatif pour estimer le scanner qui a acquis un document numérique suspect où tous les scanners sont censés être connus. Nous avons pris en compte tous ces défis dans le but d'établir de nouvelles approches fondées sur des modèles capables d'extraire un bruit de scanner plus précis. Des approches basées sur une extraction manuelle des caractéristiques du scanner ont d'abord été exploitées. Les limitations principales de ces approches sont la baisse des performances dans le cas où des scanners de même modèle sont considérés et la dépendance au nombre 128 A.7. Conclusion et perspectives d'images d'apprentissage. Pour surmonter ces limitations, des empreintes digitales extraites automatiquement à l'aide de réseaux de neurones sont proposées. Par la suite, nous avons proposé une nouvelle piste de recherche dans laquelle nous considérons deux images de sources inconnues et visons à savoir si elles ont été acquises par le même scanner ou non. Finalement, nous avons introduit une nouvelle collection d'images à des fins d'investigations forensiques liées aux scanners. Nous avons exploitée cette base d'images pour vérifier l'efficacité de nouvelles architectures que nous avons introduites dans le but de détecter les régions falsifiées dans un document scanné. Comme travaux futures, nous avons intérêt à exploiter d'avantages les propriétés des images scannées JPEG. Par ailleurs, il serait intéressant de concevoir un système unique qui peut non seulement identifier le scanner source d'une image s'il est connu mais aussi alerter si le scanner est inconnu. Il est également possible de penser à créer de nouvelles signatures basées sur des propriétés du scanner autres que celles liées aux défauts de ses capteurs. Un autre problème crucial avec les approches proposées est qu'elles sont basées sur le bruit est qui peut être affecté par la désynchronisation produite par les opérations de post-traitement telles que la compression et les transformations géométriques (par exemple, rotation, mise à l'échelle ...). Cela motive à envisager d'utiliser des techniques de recadrage et de redimensionnement dans de futurs travaux pour résoudre ce problème. En ce qui concerne la détection de falsification, il est important de penser à des solutions qui restent fiables dans le cas où de nombreuses opérations de fraudes ont été appliquées à l'image. De plus, les approches proposées dans la littérature présentent une certaine complexité et n'ont de sens que dans le cas où l'image en question est alignée avec la signature du scanner. Les performances de ces approches dépendent également de la taille du bloc de test et ne peuvent pas informer du type de manipulation réalisée sur l'image. Il y a également un intérêt à trouver une solution qui puisse, non seulement détecter les contrefaçons, mais aussi indiquer le type de manipulation. Par exemple, on peut décider si la manipulation est une opération de type « copier-coller » en vérifiant si l'objet ou le bloc suspect est répété dans une zone différente de l'image. Relever ces défis ouvrira la porte à des contributions plus efficaces. Récemment, la notion d'anti-forensiques[START_REF] Gül | A survey on anti-forensics techniques[END_REF] a été introduite dans la littérature. C'est une méthodologie permettant d'examiner les faiblesses des méthodes forensiques existantes afin d'améliorer leur pertinence et leur fiabilité. L'objectif fondamental est donc d'exécuter certaines opérations sur des images numériques pour masquer les traces laissées par quelconque manipulation afin que les algorithmes forensiques ne puissent pas les détecter. Notons que ces techniques visent à aider les chercheurs en criminalistique à connaître les vulnérabilités des approches qu'elles proposent et, ainsi, les inciter à les renforcer contre d'éventuelles attaques en introduisant les méthodes de contre-mesures (Anti-anti-forensiques). A partir d'une analyse de publications abordant ces thèmes, il est clair que le nombre de publications liées à ces domaines de recherche est encore faible. Par conséquent, nous pouvons exploiter nos travaux comme un bon point de départ pour de futures recherches sur des problèmes anti-forensiques et leurs contre-mesures.

https://sites.google.com/view/supatlantique-dataset/downloads

DIGITAL IMAGE FORENSICS: SOURCE SCANNER IDENTIFICATION

In the United States, once the original documents got accurately reproduced by a scanner, the digital version becomes legally valid and can replace the physical one. Source: https://definitions.uslegal.com/u/uniform-photographic-copies-of-business-and-publicrecords-as-evidence-act/

4.2. Scanner Source Identification using Wavelets and 2D-CNN

Acknowledgements

Evaluation

Extensive experiments were conducted to examine the performance of the proposed DLK algorithm. It includes the evaluation of the influence of the fusion mechanism, the classification accuracy of our full system, the effect of JPEG post-processing and comparison performance assessment with similar methods for general public cameras.

The following series of experiments have been performed on images from 8 scanner instances where two of them were not used for training our model. More clearly these two devices are considered as unknown material as listed in