面向纸质文件的数字化被动取证研究

发布时间：2018-02-24 02:48

本文关键词： 纸质文件检验数字化被动取证文件来源取证文件变造取证文件碎片拼接　出处：《大连理工大学》2015年博士论文　论文类型：学位论文

【摘要】：随着人们生活中数字化程度不断加深,与打印、复印文件相关的民事和刑事案件也越来越多并呈逐年上升趋势,传统的文件检验方法须专业的人员和设备,并依靠物理、化学方法对可疑文件检验,这些方法存在检测时间长、成本高、对文检人员要求严格及有损检测等特点。司法鉴定部门迫切需要新的取证手段对损坏文件进行恢复,对伪造、变造文件进行取证。为减少对专业文检人员和设备依赖,提高取证效率,近年来只利用计算机和扫描仪的纸质文件被动取证技术逐渐发展起来,成为国际上信息安全的研研究热点之一。本文从文件碎片拼接、文件来源取证和文件变造取证三个方面进行纸质文件的被动取证问题研究,具体工作如下：(1)针对纸质文件碎片拼接,提出一种基于曲线匹配和信息对齐的文件碎片拼接方法。该方法利用曲线间距离描述曲线的相似性,并通过曲线相似性匹配寻找正确碎片对,在曲线匹配过程中,通过碎片上多元信息对齐来提高匹配效率。该方法结合计算机识别与人工选择完成碎片拼接,对碎片旋转具有鲁棒性。实验以DARPA提供的竞赛题目为测试数据集,能够对前3个题目进行有效拼接,所提出的方法在完成题目数量和匹配效率上均优于现有方法。(2)针对纸质文件来源取证,分别提出了纸张来源取证和设备类型取证方法。纸张来源取证方法主要利用纸张空白区域的纹理特征进行纸张品牌的来源鉴别,特征包括灰度共生矩阵特征和傅里叶频谱特征,该方法实现了纸张的数字化被动取证。此外,本文提出一种设备类型取证方法,该方法针对激光打印机、喷墨打印机和静电复印机三种典型设备,对每个字符提取高斯噪声能量、冲击噪声能量、字符轮廓粗糙度和字符边缘平均梯度4维特征,使用SVM分类器进行设备类型取证。该方法可对每个字符进行设备类型取证,并且可以检测由不同类型设备生成的变造文件。(3)针对纸质文件的变造取证,提出一种基于字符几何参数失真突变识别的取证方法。该方法通过扫描文件图像与参考文件图像的匹配获得每个字符的失真参数,利用参数失真幅度计算字符的变造概率,最后通过概率分布对变造字符进行鉴别和定位。该方法对JPEG压缩具有鲁棒性,并可对文件进行字符级取证,不需要提供待测文件的先验知识,在算法性能上优于现有算法。
[Abstract]:With the increasing digitization of people's lives, the number of civil and criminal cases related to printing and copying documents is increasing year by year. Traditional document inspection methods need professional personnel and equipment, and rely on physics. These methods have the characteristics of long testing time, high cost, strict requirements for document examiners and harmful detection. The forensic appraisal department urgently needs new methods to recover the damaged documents and forge them. In order to reduce the dependence on professional document inspectors and equipment and improve the efficiency of forensics, the passive forensics technology, which only uses computers and scanners, has been developed in recent years. This paper studies the passive forensics of paper documents from three aspects: document fragmentation, document source evidence and document alteration evidence. The main work is as follows: (1) for paper document fragment splicing, a method of document fragment splicing based on curve matching and information alignment is proposed, which uses the distance between curves to describe the similarity of curves. In the process of curve matching, the matching efficiency is improved by multi-element information alignment. This method combines computer recognition with artificial selection to complete the splicing of fragments. The experiment takes the competition topic provided by DARPA as the test data set, and can effectively splice the first three questions. The proposed method is superior to the existing method in terms of the number of questions completed and the efficiency of matching. The paper source evidence method mainly uses the texture features of the blank area of paper to identify the origin of the paper brand, which includes gray level co-occurrence matrix feature and Fourier spectrum feature. In addition, this paper puts forward a kind of equipment type evidence collection method, which is aimed at three typical equipments: laser printer, inkjet printer and electrostatic photocopier. Gao Si noise energy, impulse noise energy, character contour roughness and four-dimensional feature of average gradient of character edge are extracted from each character, and the device type evidence is obtained by using SVM classifier. And it can detect altered files generated by different types of equipment. In this paper, a method of obtaining evidence based on character geometric parameter distortion mutation identification is proposed, in which the distortion parameters of each character are obtained by matching the scanning file image with the reference file image, and the variation probability of the character is calculated by using the distortion amplitude of the parameter. Finally, the modified characters are identified and located by probability distribution. This method is robust to JPEG compression, and can be used to document character level forensics, and does not need to provide prior knowledge of the files to be tested, and the algorithm performance is better than the existing algorithm.
【学位授予单位】：大连理工大学
【学位级别】：博士
【学位授予年份】：2015
【分类号】：D918;TP391.41

【参考文献】