See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/324516058

Medical Image Forgery Detection for Smart Healthcare

Article  in  IEEE Communications Magazine · April 2018

DOI: 10.1109/MCOM.2018.1700817

CITATIONS READS

14 1,853

4 authors, including:

Ahmed Ghoneim Ghulam Muhammad

King Saud University King Saud University
54 PUBLICATIONS   608 CITATIONS    250 PUBLICATIONS   2,786 CITATIONS   

SEE PROFILE SEE PROFILE

Syed Umar Amin

King Saud University
24 PUBLICATIONS   210 CITATIONS   

SEE PROFILE

Some of the authors of this publication are also working on these related projects:

Defending Distributed Denial of Service (DDoS) Attacks View project

Research of new image recognition methods View project

All content following this page was uploaded by Syed Umar Amin on 04 June 2018.

The user has requested enhancement of the downloaded file.

 A​DVANCES IN NEXT GENERATION NETWORKING TECHNOLOGIES FOR SMART HEALTHCARE
Medical Image Forgery Detection for
Smart Healthcare
Ahmed Ghoneim, Ghulam Muhammad, Syed Umar Amin, and Brij Gupta
Abstract
With the invention of new communication
technologies, new features and facilities are
provided in a smart healthcare framework. The
features and facilities aim to provide a seamless,
easy-to-use, accurate, and real-time healthcare
service to clients. As health is a sensitive issue,
it should be taken care of with utmost security
and caution. This article proposes a new medical
image forgery detection system for the healthcare
framework to verify that images related to health-
care are not changed or altered. The system works
on a noise map of an image, applies a multi-res-
olution regression filter on the noise map, and
feeds the output to support-vector-machine-based
and extreme-learning-based classifiers. The noise
map is created in an edge computing resource,
while the filtering and classification are done in a
core cloud computing resource. In this way, the
system works seamlessly and in real time. The
bandwidth requirement of the proposed system is
also reasonable.
Introduction
Next-generation network technologies such as
fifth generation (5G), edge computing, and cloud
computing have revolutionized many sectors
including the healthcare sector. Recently, the
healthcare sector has seen drastic improvement
in terms of facilities [1]. Many new features have
been added to improve people’s satisfaction. Peo-
ple can now consult with doctors without visiting
them, check diabetes, heartbeat, voice abnor-
mality, and emotion using various sensors. While
the healthcare sector is booming, several aspects
need attention to make the healthcare facility
more secure and private. For example, if medical
data are leaked or altered, the concerned patient
may face social embarrassment or let down,
while other people may gain an illegal advantage.
Therefore, there should be a system in a smart
healthcare framework that can check whether the
medical data are changed during transmission by
hackers or intruders [2].
There are two types of methods to check
whether the data are changed or not: intrusive
and non-intrusive. In the intrusive method, some
information is added to the data in such a way
that it does not hamper the message in the data.
The information is called a watermark. Later, if
any question arises, the watermark is extract-
Ahmed Ghoneim(corresponding author) is with King Saud University and Menoufia University; Ghulam Muhammad and Syed Umar Amin are with
King Saud University;Brij Gupta is with National Institute of Technology.
IEEE Communications Magazine • April 2018
ed from the data and matched with the orig- The authors propose a
inal watermark. If they do not match, the data new medical image forg-
are considered to be forged or changed. In the ery detection system for
non-intrusive method, no watermark is added to
the healthcare framework
the data. Some algorithms are used to find any
distortion or change in the data by analyzing any to verify that images
abnormal patterns. The intrusive method some- related to healthcare are
times is not feasible, because some data may not not changed or altered.
have watermarks intentionally or unintentional- The system works on a
ly. As the non-intrusive method does not require
noise map of an image,
any watermark, any data can be verified against
change or fraud. applies a multi-resolution
There are many non-intrusive techniques pro- regression filter on the
posed in the literature. In this article, we focus noise map, and feeds the
on non-intrusive techniques to detect image forg- output to support-vec-
ery. A good review on this topic can be found in
tor-machine-based and
[3]. Image forgery can be done in many ways,
involving one or more images. The most common extreme-learning-based
image forgeries are copy-move forgery and splic- classifiers.
ing. In copy-move image forgery, one or some
parts are copied and pasted into other parts in the
same image. This type of forgery is mainly done to
conceal some information in the image. In splic-
ing, some parts of an image or more images are
copied and pasted into another image. This type
of forgery is done mostly to defame a person.
In the healthcare domain, image forgery can
be serious. If a mammogram is hacked, and the
intruder uses the copy-move forgery to enlarge
the area of cancer, the diagnosis will be wrong,
and the patient will be in life-threatening trouble.
If there is an image forgery detection system in a
healthcare framework, it can detect the forgery
before starting the diagnostic process. In the case
of a forgery, the system can ask for another sam-
ple from the patient. The intrusive method (e.g.,
embedding a watermark in the medical image) of
forgery detection is not suitable in a cloud-based
smart healthcare framework mainly because of
two reasons:
• Embedding a watermark needs extra infor-
mation for transmission, which may require
extra bandwidth and cause a delay in the
transmission.
• Embedding a watermark may decrease the
visual quality of the image, which in turn
affects the diagnostic process.
There are some existing medical image forgery
detection systems in the literature, although the
number is small. Ulutas et al. proposed a forgery
detection method using a rotation invariant local
binary pattern (LBPROT) and a scale invariant
Digital Object Identifier:
10.1109/MCOM.2018.1700817
0163-6804/18/$25.00 © 2018 IEEE 33

Patients & Edge Cloud
doctors computing computing
Platform
Protocol VMs
Figure 1. The proposed smart healthcare framework.
feature transform (SIFT) [13]. The LBPROT was
used to define the texture of the medical image,
while the keypoints were extracted using the SIFT.
The forgery decision was made using a match-
ing between the keypoints. Gao et al. proposed a
reversible data hiding algorithm to detect forgery
in medical images [15]. This is a rather intrusive
technique. In their proposed method, the regions
of interest were inserted into the least significant
bits of the background regions. The regions of
interest were represented by different feature-bit
matrices. To verify the authenticity of the image,
the feature-bit matrix of a certain region of inter-
est was extracted and matched with the original
feature-bit matrix.
There are other image forgery detection
methods that involve some texture descriptors
to define the image and run machine learning
algorithms to detect whether the image is forged
or not. In [11], the authors used a local binary pat-
tern (LBP) on different sub-bands of a steerable
pyramid transform (SPT). An image was decom-
posed into several sub-bands having various scales
and orientations; then the LBP was applied to
these sub-bands to form a concatenated LBP his-
togram. This histogram was fed to a support vec-
tor machine (SVM)-based classifier. The accuracy
was good in different databases. One of the prob-
lems of this method is haveing many sub-bands,
which is not suitable for real-time transmission in
the cloud-based healthcare framework. In [12],
the authors used a Markov chain pattern on the
intrinsic manufacturer layout in the image. Every
camera maker has an intrinsic pattern embed-
ded in the image. This pattern is destroyed when
there is a forgery in the image. The irregularity in
the Markov chain pattern can reveal the forgery.
Although this method of detecting forgery is inter-
esting, it may not be suitable for detecting medi-
cal image forgery because the intrinsic pattern is
more prominent in color images, and the medical
images are mostly gray images.
This article presents a new image forgery
detection system, which can be implemented in
the smart healthcare framework. In the system,
a noise map is extracted from the image using a
Wiener-filter-based noise reduction technique. A
multi-resolution regression filter is applied to the
noise map to find an inter-relationship between
a pixel and the neighboring pixels. The output
of this filter is normalized and fed into an SVM-
34
based classifier. We also use an extreme learning
machine (ELM)-based classifier and combine the
scores of these two classifiers using a Bayesian
sum rule (BSR) [4].
Proposed Framework
The proposed smart healthcare framework con-
sists of several components. One component
contains patients (clients) and doctors, another
component comprises edge computing, and yet
another component covers cloud computing. Fig-
ure 1 shows these three components of the pro-
posed framework.
The patients can reside in smart homes in a
smart city, while the doctors and caregivers can
be located at any designated hospitals and clinics.
They do not need to interact face to face; howev-
er, they do interact via web apps or mobile apps.
Any smart devices or the Internet of Things (IoT)
can capture the images or data from the patients
and upload them via a web app or a mobile
app. While uploading, the devices or the IoT can
embed watermarks in the data.
Some primary work is accomplished in the
edge computing to provide seamless and real-
time transmission of data to the core cloud. The
edge computing is designed to provide low-la-
tency and real-time transmission of data by using
limited computing resources [5]. To interact and
synchronize with the core cloud, two manage-
ment systems are residing on the edge comput-
ing: an edge computing platform applications
management system and an edge computing
hosting infrastructure management system.
The edge computing platform applications
management system manages communication
applications, the wireless network, and the radio
access network. In addition to this, it provides
interaction with the applications management
system (in the cloud) and the infrastructure as a
service (IaaS). The edge computing hosting infra-
structure consists of a virtualization layer and
hardware resources. The edge computing host-
ing infrastructure management system manages
these two components. The application manage-
ment system actually interacts with both the edge
computing and the cloud computing. The system
includes several virtual machines that do data pro-
cessing, feature extraction, classification, record
keeping, and processing analysis.
The core cloud consists of storage devices,
virtual machines (servers), a registration and veri-
fication unit, and a distribution manager. The reg-
istration and verification unit registers first-time
users and verifies already registered users. It is
also responsible for sending data and decisions to
registered doctors and caregivers. The distribution
manager distributes the work to different servers
to minimize the load on each server.
The edge computing and cloud computing
together provide low-latency communication,
high-performance computing, and real-time out-
put.
In the current context, the core cloud also
contains an image forgery detection module.
This module involves two servers: one for feature
extraction and the other for classification. The
feature extraction part may require several paral-
lel units depending on the image; if the image is
monochrome, there is no need for parallel units.
IEEE Communications Magazine • April 2018
 Image Forgery Detection
The image forgery detection algorithms either Multi-
work at the pixel level or at the segment level. In Image Weiner-filter
based noise
Estimated resolution
- noisy
the pixel level algorithm, the relationship between reduction image regression
filter
the intensities of the pixels is captured to define
the texture of the image. In the segment level
algorithms, segments of an image are compared.
SVM
The segmentation of the image is considered as

Fusion: BSR
an extra overhead of the algorithms. In the pixel Decision Normalization
level case, the image may be divided into blocks. ELM
This article proposes a pixel level algorithm to
detect image forgery.
There are several pixel level algorithms that are Figure 2. Block diagram of the proposed image forgery detection system.
used in image forgery detection in the literature.
The most famous one is LBP [6], which is fast to
compute, but vulnerable to the presence of noise.
Another one is the Weber local descriptor (WLD) 3 3 3 3 3 3 3
[7], which is less prone to noise, but computation-
ally more expensive than LBP. There are other tex- 3 2 2 2 2 2 3
ture descriptors such as a histogram of gradients,
circular LBP, and Markov chain, which are also 3 2 1 1 1 2 3
used in forgery detection.
We propose an image forgery detection
system to be deployed in the smart healthcare 3 2 1 1 2 3
framework. The system consists of several compo-
nents, such as noise-pattern extraction, the realiza- 3 2 1 1 1 2 3
tion of a multi-resolution regression filter, and two
classifiers. Figure 2 shows a block diagram of the
3 2 2 2 2 2 3
proposed system. The steps of the work flow of
the system are given below.
Step 1: If the image is a color image, decom- 3 3 3 3 3 3 3
pose it into red, green, and blue channels. If
the image is a monochrome image, there is
Figure 3. Illustration of a multi-resolution regression
no need for this step.
filter.
Step 2: The Wiener-filter is applied to each
component of the color image or the mono-
chrome image itself. The output of this step SVM and the ELM classifiers, because both of
is an image (or component) free from noise. them are very good as binary classifiers, and they
Step 3: The noise-free image is subtracted from are complementary in nature. In the SVM, a ker-
the original image to get an estimated noise nel projects a low-dimensional data space into a
pattern of the image. The noise pattern is high-dimensional data space so that the samples
considered as the fingerprint of the image. of two different classes can be separated by a
If any forgery is done, this fingerprint is dis- hyperplane. In the ELM, there is only one hidden
torted. layer, the convergence is very fast, and there is
Step 4: The multi-resolution regression filter is no overfitting [10]. Both the SVM and the ELM
applied to the noise pattern. The regression classifiers were successfully used in many image
filter is illustrated in Fig. 3. In this filter, the processing applications; however, their fusion was
nearest eight-pixel positions have weight 1, never explored in the image forgery detection
while the next neighboring pixels’ positions task. In the experiments, we investigated the use
have weight 2, and so on. The characteristic of the SVM and the ELM separately and com-
of this filter is to capture the relative intensi- bined.
ty of a center pixel. The final weight is nor-
malized between 0 and 255 to maintain the Database for Experiments
intensity level of a gray image. We used two publicly available image data-
Step 5: The output of the filter is fed to two bases for the experiments. These databases
classifiers: the SVM classifier and the ELM are CASIA 1 and CASIA 2. The images of the
classifier. We investigated different kernels of databases are available in [8]. Both databases
the SVM: linear, polynomial, and radial basis consist of authentic and forged images. The
function (RBF). CASIA 1 database contains 800 authentic and
Step 6: The scores of the SVM and the ELM 921 forged images. The images are forged by
are fused by using the BSR, and the decision copy-move and splicing. Around half of the
whether the image is forged or not is made forged images are copy-move forged. The
from the score of the BSR. images are saved in JPEG format, and the size
In the proposed system, the Wiener-filter-based is 384  256 pixels. The CASIA 2 database
noise reduction technique is used because this contains more than 7400 authentic and 5000
technique works locally in an image. Other noise forged images. The images are in either JPEG,
reduction techniques may also be used, but we TIFF, or BMP format. The sizes of the imag-
have to be careful about not losing any import- es are not fixed. In both databases, different
ant information, especially when we are dealing geometric transformations such as rotation,
with medical images. In the system, we use the scaling, and flipping are done to the copied

IEEE Communications Magazine • April 2018 35

 CASIA 1 CASIA 2 CASIA 1 CASIA 2 98.8 98.9
100 99
98.1 98.4
97.4 97.5 98.4
98 98.5 98.1 98.2

Accuracy (%)

Accuracy (%)
96 98
93.2 93.5 97.4
94 97.5

92 97

90 96.5
Linear Polynomial RBF SVM ELM SVM+ELM

Figure 4. Accuracies of the system. The left figure shows the accuracies using different kernels of the SVM.
The right figure shows the accuracies using the SVM, the ELM, and the SVM+ELM.

84.3
Experimental Results
85 SVM ELM SVM+ELM The accuracies of the proposed system in differ-
80 77.6 ent conditions are shown in Fig. 4. When we used
76.4 75.4 the SVM, the system achieved 98.1 and 98.4 per-
Accuracy (%)

73.5 72.8
75
71.272.4 cent accuracies by using the RBF kernel in the
69.570.2
70 CASIA 1 and CASIA 2 databases, respectively.
The other two kernels gave lower accuracies.
65
The system using the ELM as the classifier
60 achieved 97.4 and 98.2 percent accuracies for
Proposed LBP WLD Method [11]
the two databases, respectively. The system using
Figure 5. Accuracies of the proposed system and the BSR on the SVM and the ELM obtained the
other systems. highest accuracies: 98.8 and 98.9 percent, respec-
tively, for the two databases. From the results, we
realize that the proposed system worked the best
340 when combining the two classifiers.
With edge Without edge If we compare these accuracies with those of
320 other existing systems such as those described
in [11, 12], we find the proposed system out-
300 performed the other systems. For example, the
Bandwidth (b/s)

system in [11] had accuracies of 94.9 and 97.3

280
percent for CASIA 1 and CASIA 2, respectively,
260
while the system in [12] had an accuracy of 94.7
percent for CASIA 1.
240 The proposed system with SVM+ELM was
applied in the DDSM database images and their
220 forged versions. Figure 5 shows the accuracies
1 5 9 13 17 21 25 29 33 37 41 45 49 53 57 61 65 69 73 77 81
Time (s)
of the system using SVM only, ELM only, and
SVM+ELM. In another two instances, we replaced
Figure 6. Bandwidth consumption in bits per second of the proposed system. the regression filter of the proposed system by the
LBP and the WLD, respectively, and performed
the experiments again. We also ran the system
object before pasting. The images of these two described in [11] using this medical database.
databases are not medical related; we used From Fig. 5, we see that the proposed system out-
them in the experiments to check the accuracy performed the system with the LBP and the WLD.
of the proposed system. Also, the accuracy of the system [11] is lower. It
We used another database where the can be noted that the system in [11] used only
images are mammograms. The database is the SVM as the classifier. The proposed system
the digital database for screening mammog- achieved 84.3 percent accuracy using the data-
raphy (DDSM) [9]. There are more than 2000 base.
mammograms in the database, and the cancer From the above results, we can say that the
regions are annotated by expert radiologists. proposed system was successful in verifying
All the images are grayscale. We applied copy- whether an image is forged or not. The verifica-
move forgery to all the images. The copied tion of medical images has gotten less attention in
parts and the pasted regions were selected the research community, and very few works are
randomly. The copied parts are rotated by dif- available in the literature. Some reasons behind
ferent angles before pasting. The number of that are the lack of proper medical images, the
forged images was 8000. lack of sufficient texture pattern in medical imag-
es, and the poor entropy of medical images. From
Experimental Setup the results, we can also see the deviation of accu-
A five-fold cross-validation approach was uti- racies from natural images (CASIA 1 and CASIA 2
lized for the experiments. The final accuracy was images) to medical images.
obtained by averaging the accuracies of the five The bandwidth consumption in bits per sec-
iterations. For the SVM, we investigated the three ond of the proposed system with and without
kernels mentioned above, and for the ELM, we edge computing is shown in Fig. 6. From the
used the Gaussian mapping function [10]. figure, we understand that the system does not

36 IEEE Communications Magazine • April 2018

 require much bandwidth. It can be noted that the
noise map of the given image was created in the
edge computing, while the other processing was
done in the core cloud computing. If we were to
remove the edge computing, all the processing
would be in the cloud.
Conclusion
An image forgery detection system was pro-
posed in the smart healthcare framework. The
system was tested using three different databas-
es, two having natural images and one having
mammograms. The system achieved accuracies
over 98 percent for natural images and 84.3
percent for medical images. The system per-
formed best when we combined the scores of
two classifiers.
The area of medical image forgery detection
needs more attention to gain the trust of patients
and to avoid their embarrassment. There is still
a long way to go in this research. The next gen-
eration of network technologies bring immense
computing power and ubiquitous service. We can
take advantage of these technologies to make the
healthcare system seamless, real-time, trustable,
secure, and easy to use. The future directions of
this research can be as follows:
• Investigate the use of deep learning tech-
niques in medical image forgery detection.
• Scramble the medical image before transmit-
ting it to the cloud.
• Develop a robust forgery detection tech-
nique against a high degree of compression.
This will lead to a real-time application.
Acknowledgment
This work was supported by the Deanship of Sci-
entific Research at King Saud University, Riyadh,
Saudi Arabia, through the Research Group Proj-
ect RGP-229
References
[1] Solanas et al., “Smart Health: A Context Aware Health Para-
digm within Smart Cities,” IEEE Commun. Mag., vol. 52, no.
8, Aug. 2014, pp. 74–81.
[2] C. Bekara, “Security Issues and Challenges for the IoT Based
Smart Grid,” Proc. COMMCA-2104, Procedia Computer
Science 34, 2014, pp. 532–37.
[3] M. A. Qureshi and M. Deriche, “A Bibliography of Pix-
el-Based Blind Image Forgery Detection Techniques,” Signal
Processing: Image Communication, vol. 39, Part A, Nov.
2015, pp. 46–74.
[4] M. S. Hossain et al., “Audio-Visual Emotion-Aware Cloud
Gaming Framework,” IEEE Trans. Circuits and Systems for
Video Tech., vol. 25, no. 12, Dec. 2015, pp. 2105–18.
[5] J.O. Fajardo, I. Taboada, and F. Liberal, “Radio-Aware Ser-
vice-Level Scheduling to Minimize Downlink Traffic Delay
through Mobile Edge Computing,” Mobile Networks and
Management, 2015, pp. 121–34.
IEEE Communications Magazine • April 2018
View publication stats
[6] T. Ahonen, A. Hadid, and M. Pietikainen, “Face Description with
Local Binary Patterns: Application to Face Recognition,” IEEE There is still a long way
Trans. Pattern Anal. Mach. Intell., vol. 28, 2006, pp. 2037–41.
[7] J. Chen et al., “WLD: A Robust Local Image Descriptor,” IEEE to go in this research.
Trans. Pattern Anal. Mach. Intell., vol. 32, no. 9, Sept. 2010,
The next generation
pp. 1705–20.
[8] J. Dong and W. Wang, “CASIA Tampered Image Detection of network technolo-
Evaluation (TIDE) Database, v1.0, and v2.0,” 2011; http://
forensics.idealtest. org/. gies bring immense
[9] M. Heath et al., “The Digital Database for Screening Mam-
mography,” Int’l. Work. Dig. Mamm., vol. 212–8, 2000. computing power and
[10] G.-B.Huang et al., “Extreme Learning Machine for Regres-
sion and Multiclass Classification,” IEEE Trans. Sys., Man,
ubiquitous nature of
Cybern. B, Cybern., vol. 42, no. 2, Apr. 2012, pp. 513–29. the service. We can
[11] G. Muhammad et al., “Image Forgery Detection Using
Steerable Pyramid Transform and Local Binary Pattern,” take advantage these
Machine Vision and Applications, vol. 25, no. 4, May 2014,
pp. 985–95. technologies to make
[12] X. Zhao et al., “Detecting Digital Image Splicing in Chroma
the healthcare system
Spaces,” Proc. Int’l. Wksp. Digital Watermarking, 2011, pp.
12–22. seamless, real-time,
[13] G. Ulutas et al., “Medical Image Tamper Detection Based
on Passive Image Authentication,” J. Digital Imaging, vol. 30, trustable, secured, and
no. 6, Dec. 2017, pp 695–709.
[14] M. S. Hossain et al., “Toward End-to-End Biomet ric-Based easy to use.
Security for IoT Infrastructure,” IEEE Wireless Commun., vol.
23, no. 5, Oct. 2016, pp. 44–51.
[15] G. Gao et al., “Reversible Data Hiding with Contrast
Enhancement and Tamper Localization for Medical Images,”
Info. Sciences, vol. 385–86, 2017, pp. 250–65.
Biographies
A hmed G honeim (ghoneim@ksu.edu.sa) received his Ph.D.
degree from the University of Magdeburg, Germany, in the area
of software engineering in 2007. He is currently an assistant
professor at King Saud University, Riyadh, Saudi Arabia,and also
at the Department of Computer Science, Menoufia University,
Shebin El-Kom, Egypt. His research activities address software
evolution, service-oriented engineering, software development
methodologies, quality of service, net-centric computing, and
human-computer interaction.
G hulam M uhammad [M’10] is a professor in the Computer
Engineering Department, College of Computer and Information
Sciences, King Saud University. He received his Ph.D. degree
in 2006 from the Department of Electronic and Information
Engineering at Toyohashi University of Technology, Japan. His
research interests include speech and image signal processing,
multimedia forensics, cloud computing, and healthcare. He has
authored and co-authored many journal and conference publi-
cations. He owns a U.S. patent.
S yed U mar A min is a Ph.D. researcher in the Department of
Computer Engineering, College of Computer and Information
Sciences at King Saud University. He received his Master’s
degree in computer engineering from Integral University, India,
in 2013. His research interests include deep learning, EEG anal-
ysis and classification, biologically inspired artificial intelligence,
and data mining in healthcare.
Brij Gupta is a faculty member at the National Institute of Tech-
nology Kurukshetra, Haryana, India. He received a Ph.D. degree
from Indian Institute of Technology Roorkee, India in the area
of information and cyber security. He has published more than
100 research papers in International Journals and conferences
of high repute including IEEE, Elsevier, ACM, Springer, and oth-
ers. His research interests include information security, cyber
security, mobile/smartphone, cloud computing, web security,
intrusion detection, computer networks, and phishing.
37