Leveraging Deep Learning for Identification of Illicit Images in Digital Forensic Investigations

1.1 Background

In the contemporary digital age, facilitated by the proliferation of the Internet and technological advancements, access to diverse data types has become increasingly seamless. This ease of access undeniably enhances various facets of life, including education, science, and healthcare, but it simultaneously augments the dissemination of harmful content.

Numerous online content-sharing platforms are monitored by Law Enforcement Agencies (LEAs) and automatic content recognition systems to curb the propagation of inappropriate content on the Internet [1]. Upon detecting such content, countermeasures range from blocking the offending platforms or websites to removing the harmful content. Content intended for specific age groups also necessitates stringent control systems, particularly to safeguard children from potential online hazards.

Globally, content deemed inappropriate for public consumption predominantly involves the sharing of pornographic material. Despite numerous platforms implementing restrictions or outright bans on the distribution of such content, the illicit dissemination of this material persists [2].

In the current landscape, access to sites and platforms dedicated to sharing pornographic content varies greatly, with outright prohibition in some countries, and age-verified accessibility in others. Furthermore, child abuse and child pornography (collectively referred to as CSA) are universally recognized as criminal activities [3]. The detection and blocking of such criminal content, particularly after it has been disseminated, becomes critically important.

The increasing accessibility and demand for such content heightens the probability of encountering this data in crime-related evidence. Additionally, pornographic content disseminated on the Internet often finds its way into digital media. The rapid detection of such content not only aids in blocking data published on the Internet but also proves instrumental in identifying objectionable content during forensic digital evidence investigations, thereby expediting crime resolution. The detection of pornographic content on confiscated digital media can significantly accelerate the comprehensive investigation of the crime [4].

1.2 Literature review

1.2.1 Early studies based on traditional techniques for pornography detection

Numerous methodologies for detecting pornographic content in video and image data have been proposed in academic literature. A common objective in many of these previous studies has been the detection of human skin, given its prevalence in most pornographic material. Techniques such as color-based identification or manually applied features to localized areas were employed to discern human skin [5-7].

However, these methods possess a significant limitation: all data in which skin color is dominant can be erroneously classified as pornographic content. For instance, skin color is prominently observed in certain contexts such as sports competitions, beach scenes, and fashion shows, yet these scenarios are not pornographic in nature. Consequently, the use of skin color detection as an isolated technique can result in a high rate of false positives, reducing its effectiveness as a standalone tool. Moreover, its inability to function effectively with grayscale data allows for easy circumvention of the skin color detection method.

To achieve more accurate results, subsequent studies used classifiers with multiple manually extracted regional features. Some studies have employed the Bag-of-Visual-Words (BoVW) method in conjunction with features like SIFT, SURF, and ORB, using classical machine learning classifiers such as Support Vector Machines (SVMs) [8-12].

1.2.2 Deep learning-based studies for pornography detection

While traditional feature extraction methods have achieved partial success, they have not yet reached the desired level in terms of reducing false positives and augmenting overall accuracy. The promising results garnered from applying deep learning techniques to image data have incentivized researchers to utilize these methods for detecting pornographic content. Early studies in this domain recommended leveraging successful ImageNet pre-trained models as feature extractors. Some of these studies fused the decisions from multiple pre-trained models to detect pornography in images [13]. In contrast, other studies introduced custom CNN architectures for this purpose, as exemplified in the study [14]. However, these custom architectures often require additional data for training, making it challenging to compare these studies with the broader literature.

Numerous studies have explored diverse approaches to enhance the detection of inappropriate content in images and videos. Some researchers have proposed integrating motion data from videos with image data for training. For instance, Perez et al. [15] combined GoogleNet image features with motion features extracted using optical flow and MPEG motion vectors, achieving an impressive accuracy of 97.9% on the NPDI dataset. Wehrmann et al. [16] used GoogleNet and ResNet CNN models for image data feature extraction and employed the LSTM model to capture temporal connections in video data, achieving a peak accuracy of 95.6%.

Various methods for detecting and safeguarding against pornography have been explored across different domains. Yousaf and Nawaz [17] introduced a model for automatically filtering inappropriate content in YouTube videos. Their model utilized the EfficientNet-B7 CNN model for extracting features from video frames and incorporated a BiLSTM model with 128 hidden units to capture temporal information, achieving a commendable accuracy of 95.66%. Gautam and Vishwakarma [18] proposed a Frame Sequence ConvNet that employed the ResNet-18 backbone to analyze sequential features of NPDI videos. By extracting features from sequential frames using the ResNet-18 model, their approach reached a peak accuracy of 98.3% on the NPDI dataset. Furthermore, Yang and Xu [19] developed a generative adversarial network (GAN) model for automatically censoring inappropriate content in educational platform streams. They trained their model specifically on indoor images from the NPDI dataset for binary classification, achieving an average accuracy of 98% in detecting inappropriate content within videos.

Conversely, some studies have reframed the detection of pornographic images as an object detection problem. For example, Mallmann et al. [20] aimed to censor specific body areas using object detection models like the Faster R-CNN and SSD with different backbones. They achieved a maximum mean average precision (mAP) of 63.5% using the Faster R-CNN model with the Inceptionv2 backbone. Similarly, Hor et al. [21] aimed to detect inappropriate body parts in videos using object detection models, with the EfficientDet model achieving the highest accuracy, averaging 75% on a dataset derived from the NPDI dataset.

1.2.3 Studies about age estimation

Historically, studies on age determination have relied on handcrafted features for facial and body analysis [22]. For instance, Hajizadeh and Ebrahimnezhad [23] achieved an 87% accuracy in classifying images into four age groups by utilizing probabilistic neural networks and HOG features extracted from various facial regions. Eidinger et al. [24] deployed LBP and FPLBP methods in tandem with dropout-SVM to determine age and sex from facial images, obtaining accuracies of 66.6% and 45.1% on the Gallegher and Adience datasets, respectively, for 7 and 8 age groups. Sai et al. [25] employed LBP, Gabor, and biological features, coupled with ELM classification, achieving a 70% accuracy for age group classification.

Recent studies have underscored the superiority of deep learning models, particularly Convolutional Neural Networks (CNNs), over traditional approaches. One of the pioneering studies by Wang et al. [26] introduced a two-layer CNN model, which outperformed handcrafted features in age estimation tasks. Chen et al. [27] proposed a ranking-CNN model, which enhanced age estimation results by amalgamating binary CNN classifiers. Anda et al. [28] developed a VGG-16-based CNN model, demonstrating successful results in identifying borderline age groups. Castrillón-Santana et al. [29] improved the performance of non-adult face classification by integrating local face descriptors with deep CNN model features.

In the context of Child Sexual Abuse (CSA) detection, age determination using facial features has gained considerable attention, largely due to the availability of labeled data. Sae-Bae et al. [30] proposed a CSA detection system that combined skin tone detection and age estimation from facial images, achieving accuracies of 83% and 96.5% in detecting explicit-like images and child faces, respectively. Yiallourou et al. [31] considered various factors such as age, gender, lighting, and the number of people in the pictures to classify CSA material, utilizing LBP features for age estimation. Macedo et al. [32] integrated age estimation and pornography detection, achieving an accuracy of 79.84% by identifying faces with the MTCNN face detector and classifying child faces using a fine-tuned VGG-16 CNN model. Similarly, Gangwar et al. [33] proposed an attention-based CNN model for age classification and pornography detection, achieving accuracies of 92.7% and 97.1% on CSA and NPDI dataset classifications, respectively.

In our work, we propose a system with fewer parameters than other models and also test the model with a novel dataset collected from the internet. Given that transfer learning is known to enhance accuracy [34] when data is limited, we employed models trained with the ImageNet dataset, which contains considerably more data than pornography benchmark datasets, in our proposed model.

1.3 Problem statement

The surge in data directly influences the volume of data potentially associated with crime [35]. Digital forensics encompasses the processes of preventing crimes before they occur, responding as they are committed, and revealing and examining evidence after a crime has been perpetrated. The impact of today's data growth is palpable in this field [36]. Particularly after crimes are committed, the demand for experts needed to scrutinize the evidence is escalating daily. At this juncture, there is a clear need for software tools that provide automatic detection and analysis methodologies for data expected to be investigated in digital environments [37].

Various commercial and open-source software tools are employed in forensic evidence analysis [38]. These tools ease the examination process and present the data in the digital environment in a comprehensive and understandable manner. The tools include features such as data carving, visualization, indexing, data type grouping, performing operating system-specific analyses, and reporting. However, conveying the content analysis of this data to the examiner often constitutes the most exhausting and time-consuming portion of the investigation. To expedite this step, efforts are being made to develop software capable of performing automatic content analysis, particularly for image data [39-41].

Nonetheless, evidence examiners using automatic content analysis tools in digital evidence investigations have reported that these tools typically function by filtering the hash values of known data. This is a limiting factor for the evidence review process, indicating a need for tools that evaluate content without dependency on hash values [42]. Additionally, a significant proportion of participants in this study (61.7%) reported experiencing sluggish performance with the tools used, while a considerable percentage (23.4%) voiced concerns about the accuracy of the applied software. These challenges underscore the immediate need for improved tools and software solutions that enhance efficiency and accuracy.

In conclusion, the exponential increase in data directly affects the amount of data linked to criminal activities, thereby necessitating advancements in digital forensics. The critical need for automated detection and analysis methods is evident, especially considering the rising number of experts required to scrutinize evidence post-crime. While many commercial and open-source software tools facilitate the examination of digital evidence, content analysis remains a daunting and protracted task. This underscores the pressing need for tools that can appraise content without solely relying on hash values, and that also address concerns related to performance and accuracy. The findings of this study highlight the urgency of developing superior tools and software solutions that can boost efficiency and accuracy in evidence examination, thereby tackling the challenges faced by practitioners in the field.

1.4 Motivation and contributions

Motivations:

This study is motivated by the identified limitations and challenges that forensic practitioners encounter in the realm of digital forensics. The burgeoning volume of data, dependencies on hash values, and concerns surrounding performance and accuracy have collectively underscored the need for enhanced tools and software solutions. By addressing these motivations, this study seeks to advance the development of automated content analysis methods to augment the efficiency, reliability, and comprehensiveness of digital evidence examination. The ultimate aim is to equip practitioners with advanced tools that can expedite the investigative process and facilitate more effective analysis of digital data in forensic investigations.

In this study, we propose the use of the OCDet model in digital evidence investigations to automatically present pertinent data to the examiner. In addition, we introduce the IMPD model to detect underage individuals in explicit content, should it exist. Our goal is to swiftly and automatically detect CSA material using the proposed dual-model system. With this proposed system, the digital evidence examination process will be expedited, and the demand for manpower will be reduced. While the developed model is intended for forensic evidence examination, its near real-time operation speed allows for its application in areas such as broadcast content censorship and online media analysis.

Contributions:

This work presents the following contributions:

• We propose a robust deep learning-based model to assist in forensic evidence investigations.

• We present a new dataset, collected from the internet, for obscene image detection.

• Our proposed OCDet model, to our knowledge, achieves state-of-the-art performance on the NPDI benchmark dataset.

• We propose a lightweight, high-performance IMPD CNN model with skip connections to detect underage faces in images.

• We propose a CSA detection system by integrating the aforementioned models.

• Both proposed models boast an accuracy rate of over 99%.

The proposed method consists of two parts: the obscene detection part and the age detection part. The model has four main steps namely preprocessing, feature extraction, classification and decision fusion.

Image preprocessing: Image preprocessing pipeline consists of two primary elements: image resizing and image normalization. Image resizing is performed to standardize the dimensions of all input images. By resizing images to a consistent resolution or aspect ratio, we eliminate variations in size and simplify the subsequent computational processes. Following image resizing, image normalization is applied to adjust the pixel values of the images to a common scale. This process involves techniques such as mean subtraction and min-max scaling. Normalization helps to mitigate the impact of varying pixel value ranges across images, promoting fair comparisons and improving the convergence of subsequent analysis algorithms. Additionally, within our proposed model, a crucial preprocessing step involves the detection and cropping of all faces present in the images. This essential process is seamlessly integrated into our preprocessing pipeline. The formulas of preprocessing steps are given in Eqs. (1)-(5).

Feature extraction: In our proposed model, a significant stage of the pipeline is dedicated to feature extraction. This step involves the utilization of two distinct Convolutional Neural Network (CNN) models designed for specific tasks: obscenity detection and immature face detection. One of these models comprises a pretrained CNN, while the other is newly created. These CNN models are employed to extract deep features from preprocessed images.

The pretrained CNN model, which has been trained on a large-scale dataset, possesses the capability to learn high-level representations of general image features. By utilizing this pretrained model, we leverage the knowledge gained from extensive prior training to extract discriminative features related to obscenity detection.

For the task of immature face detection, a separate CNN model is specifically designed and trained from scratch. This model is tailored to capture facial features associated with immaturity, enabling effective identification of immature faces in the images. The formulas for extracting features from image input with CNN models are given in Eq. (6).

Classification: In the classification step of our proposed model, we employed fully connected layers to classify the deep features extracted from the images. These fully connected layers serve as the final component of our model's architecture, responsible for mapping the extracted features to the corresponding class labels.

The deep features obtained from the feature extraction step encode rich and discriminative information about the input images. However, they are in a high-dimensional space and not directly interpretable for classification purposes. Therefore, we utilize fully connected layers, also known as dense layers, to transform these deep features into meaningful predictions. Formulas used for transforming deep features into predictions are given in Eqs. (7)-(9).

Decision fusion: Finally, the results obtained from the two parts were combined in the decision fusion step, and the CSA detection classification was performed. The formula for fusing decision of the classification results are given in Eq. (10).

The flow diagram of the proposed method is given in Figure 7.

The proposed model exhibits a reduced number of trainable parameters in comparison to other relevant studies documented in the literature. For instance, a comparable model in [33] was reported to possess 9M parameters for tasks involving pornography and age group detection. In contrast, our model consists of merely 4M parameters, achieving an approximate reduction of 50% in terms of trainable parameters. Moreover, our model demonstrates superior performance on the NPDI dataset for pornography detection. Conversely, in contrast to the approach in [15, 16, 19] that involves the utilization of continuous data types such as video, our training process employs a reduced amount of data. In conclusion, our model outperforms alternative approaches while simultaneously requiring a smaller dataset and less computational power.

In the proposed model, we used CNN models to classify obscenity and immaturity. The model gets input data and applies the face detection algorithm to the input image to get faces. After face detection, face images and original input images are fed to CNN architectures as shown in Figure 7. For the obscene detection task, we used a pre-trained MobileNetV3-large CNN model. This model was first used only as a feature extractor for training newly added fully connected layers by freezing the weights in the network. After a short training, we unfree all layers except the batch normalization layer of the MobileNetV3-large model and trained the network secondly in an end-to-end fashion. The second training was performed with a much lower learning rate not to distort already trained layer weights. The architecture of the MobileNet-based model OCDet model is given in Figure 8.

Although the MobileNetV3-large model looks small in Figure 8, it is a large model with 69 convolution layers, excluding the classification layer. At the same time, we also processed face images with other skip connection CNN that we created for immature detection. The architecture of the IMPD model is given in Figure 9. As seen from here, our network has one skip connection and 5 convolution layers followed by two dense layers with dropout. This model is a lightweight model according to the OCDet model.

7.png

Figure 7. Flow Diagram of the proposed method

8.png

Figure 8. The architecture of the fine-tuned OCDet CNN model

9.png

Figure 9. The architecture of the IMPD model

We trained the IMPD model from scratch in an end-to-end fashion. As a result, both models get successful results in the relevant tasks, ensuring that the result obtained in the decision fusion stage is robust. Parameter numbers, kernel sizes, output sizes, and other details of the models are given in Table 3 and Table 5.

The process steps of the proposed model are as follows.

Step 0: Resize and rescale the input images.

Since the datasets contain various-sized images, we resized images of NPDI and the manually collected dataset into 224 × 244. On the other hand, the UTKFace dataset cropped face images were already resized into 200 × 200 images, and we used these images. The formula notation of the resizing process is given in Eq. (1).

$X^{(i)}=R\left(X^{(i)},[h, w]\right)$                      (1)

where, $X^{(i)}$ represents the i.th image in the dataset, and R is the resizing function that resizes input images to h × w sized images. In this way, it is ensured that all images are 224 × 244 in size. After resizing, images are rescaled using the method in Eq. (2).

$X^{(i)}=X^{(i)} \cdot / 255$                     (2)

where, $X^{(i)}$ is the i.th input image. All pixel values are rescaled into an interval of [0,1] by dividing every pixel value of images by 255. This way, we prevent our models from the exploding gradient problem. In step 0, Eq. (1) is applied to all datasets except the UTKFace dataset, while Eq. (2) is applied to all datasets.

Step 1:  Detect faces in images and preprocess face images.

Face detection and preprocessing are performed by Eqs. (3), (4), and (5). In Eq. (3) faces in images are cropped and face images are resized and rescaled using Eqs. (4) and (5).

$\begin{gathered}F^{(i)}= { DetectFace }\left(X^{(j)}\right) \\ i \in\{1,2, \ldots, m\}, j \in\{1,2, \ldots, n\}\end{gathered}$                     (3)

$F^{(i)}=R\left(F^{(i)},[h, w]\right)$                    (4)

$F^{(i)}=F^{(i)}. / 255$                       (5)

where, F⁽ⁱ⁾ denotes the i.th face image detected in the j.th image. Here m is the number of faces detected from images in the dataset. And n is the number of images in the dataset, R is the resizing function. DetectFace is the face detection function that returns face images cropped from the original images. After then this, as shown in Eq. (4), cropped face images are resized into h x w since our IMPD model expects images in 200 × 200 × 3 shape. Finally, in Eq. (5), resized face images are also rescaled.

Step 2: Feed original images and face images to CNN models.

In Eq. (6), the calculation of output in a CNN layer is given.

$X_{i, j}^l=\sum_{s 1=0}^{s 1-1} \sum_{s 2=0}^{s 2-1} w_{s 1, s 2} X_{(i+s 1)(j+s 2)}^{l-1}$                  (6)

where, X^l-1 is the input image, i, and j are the pixel indexes of images, l is the layer index, s1, and s2 are the kernel sizes of the convolution layers and X^I is the output of the l. th CNN layer. In this situation, X0 is the original image data. Here every new output is calculated by multiplying inputs with corresponding w weights of the convolution layer. And the input of convolution layers is the output of the layer before the l.th layer. The network architectures of the CNN models are given in Figure 8 and Figure 9.

Step 3: Classify images using MLP classifiers.

In Eq. (7), the calculation of output in a fully connected layer is given.

$Z^{(i)}=a\left(I * W^{(i)}+B^{(i)}\right)$                  (7)

where, z⁽ⁱ⁾ is the i.th fully connected layer output in MLP, I is the input of the fully connected layer, W⁽ⁱ⁾ is the weights of the fully connected layer, B⁽ⁱ⁾ is the bias values of the fully connected layer, and a is the activation function. In our experiments, we used the ReLU activation function in CNN and MLP layers except for the last layer of the MLP, wherein we used the softmax activation function.

Step 4: Get softmax probabilities of predicted classes and final predictions.

In softmax activation step, outputs of the model are calculated using Eq. (8) and then the final decision is calculated as given in Eq. (9).

${sfmx}(z)=\left\{\begin{array}{l}o^{(i)}=\frac{e^{z^{(i)}}}{\sum_{j=1}^k e^{z^{(j)}}} \\ i \in\{1,2,3, \ldots k\}\end{array}\right.$                        (8)

$p=\operatorname{Max}(o)$                     (9)

where, sfmx is the softmax activation function and z is the input vector to the softmax activation function. Here e is the exponentiation constant, o⁽ⁱ⁾ is the i.th element of the output probabilities, z⁽ⁱ⁾ is the i.th element of the input vector, and k is the number of classes. Finally, Max is a function to find the index of the maximum value in vector o and obtain class prediction p. This step is applied to both CNN model outputs, and two classification results are obtained.

Step 5: Combine prediction results to decide CSA existence as given in Eq. (10).

${cs} a(p 1, p 2)=\left\{\begin{array}{c}1, p 1=p 2=1 \\ 0, p 2=0\end{array}\right.$                     (10)

where, csa is the function for deciding CSA existence. p1 and p2 are predictions of IMPD and OCDet. These prediction values get the value 1 if the content contains immature or obscenity; otherwise, they take the value 0. When two predictions are 1, the image contains both immature and obscenity which means it probably contains CSA.

12.png

13.png

Figure 13. The architecture of the IMPD model

We trained the proposed IMPD model from scratch in an end-to-end fashion. In the model, we first increased the input images' number of channels in the first two layers while keeping activations map sizes unchanged using the same padding. Then we decreased the number of channels and added first and third convolution filter activations to each other to combine low-level and high-level features. Thus, the model becomes more resistant to overfitting, and representations are learned better [49]. We then decreased the dimensions of the activation maps by using convolution layers with valid padding while increasing the number of channels. The results show that the model is achieving good results on the UTKFace dataset. The proposed model achieved a maximum accuracy of %99.16 on the UTKFace dataset. In our experiments, we divided the dataset into training and validation sets whose ratios are 80% and 20%. The architecture of the proposed method is given in Figure 13.

Training results show that there is no sign of overfitting and the model puts a robust performance on the UTKFace dataset. The proposed model achieved an accuracy of 99.7% and 99.0% on training and test data, respectively. Besides, this model's inference time is 5 times lower than the OCDet model. The model can process an image in 0.1 seconds. Moreover, the model can be run simultaneously with the other model without delay.

The results show that both proposed models have achieved successful results on the relevant data.  Considering the success of the models, it can be deduced that the proposed system works with a 98% success rate in the worst case in the decision combination stage.

In future studies, this model can be developed to have only one common CNN model for feature extraction from both face images and obscene or normal images. This way, the disadvantages such as running two models simultaneously, arising from the use of two different models can be avoided.  Besides the OCDet model can be used for video stream content filtering or content moderation applications thanks to its high speed of image processing. Similarly, the IMPD model can be used in content filtering systems, online platforms, educational platforms, and legal proceedings to identify and restrict access to age-inappropriate or explicit content. Its application promotes safer online environments, ensures age-appropriate content delivery, and aids in evidence analysis for legal cases.