# Machine Learning in Digital Forensics: A Systematic Literature Review

Tahereh Nayerifard<EMAIL_ADDRESS>Haleh Amintoosi
<EMAIL_ADDRESS>Abbas Ghaemi Bafghi<EMAIL_ADDRESS>Ali Dehghantanha
<EMAIL_ADDRESS>Faculty of Engineering, Ferdowsi University of Mashhad,
Mashhad, Iran  Cyber Science Lab, School of Computer Science, University of
Guelph, Guelph, ON, Canada

###### Abstract

Development and exploitation of technology have led to the further expansion
and complexity of digital crimes. On the other hand, the growing volume of
data and, subsequently, evidence is a severe challenge in digital forensics.
In recent years, the application of machine learning techniques to identify
and analyze evidence has been on the rise in different digital forensics
domains. This paper offers a systematic literature review of the research
published in major academic databases from January 2010 to December 2021 on
the application of machine learning in digital forensics, which was not
presented yet to the best of our knowledge as comprehensive as this. The
review also identifies the domains of digital forensics and machine learning
methods that have received the most attention in the previous papers and
finally introduces remaining research gaps. Our findings demonstrate that
image forensics has obtained the greatest benefit from using machine learning
methods, compared to other forensic domains. Moreover, CNN-based models are
the most important machine learning methods that are increasingly being used
in digital forensics. We present a comprehensive mind map to provide a proper
perspective for valuable analytical results. Furthermore, visual analysis has
been conducted based on the keywords of the papers, providing different
thematic relevance topics. This research will give digital forensics
investigators, machine learning developers, security researchers, and
enthusiasts a broad view of the application of machine learning in digital
forensics.

###### keywords:

Digital forensic , Machine learning , Convolutional neural networks , Image
forensics , Deep learning , SLR

##  1 Introduction

With the expanding use of digital devices and their role in human life and
increasing cybercrime, digital forensics (DF) has become a significant area of
research. However, there are substantial challenges in digital forensics. One
of these challenges is the growing volume of data and its complexity, making
the investigation process time-consuming [1, 2]. In many cases, analysis
requires the classification of big data into sets that are not easy to define
[3]. Another problem facing digital forensics is the diversity of data. For
example, in the Internet of Things (IoT) environments, there are billions of
sensors collecting various types of data, posing severe challenges in real-
time cybercrime investigation cases [4]. Another essential requirement in
digital forensics is accuracy and reliability in the investigation process and
its results. Three factors of intelligent computing, speeding up, and reducing
time, bring more reliable and accurate results in some cases [5, 6].

In recent years, machine learning (ML) techniques in various fields such as
image processing, text analysis, voice recognition, optical, and character
recognition are still expanding and advancing [7]. In digital forensics,
various ML techniques could gather knowledge from large volumes of digital
evidence by matching conceptual models to enable data mining and knowledge
discover-y [1], and help investigators to analyze high volumes of data [8].
These methods are employed to find anomalies and identify patterns in digital
forensic investigation. The automation of the investigation process in digital
forensics can lead to bringing valuable aids to researchers, speeding up the
process, and increasing the processing capacity [9]. Deep learning (DL) models
are used in many DF domains, in adversarial image forensics [10], image tamper
detection [11], and computer forensics [12]. These models can also be a viable
solution for handling divergent data in big volumes with acceptable accuracy,
e.g., analysis network traffic [13].

Given the importance of using ML techniques to address the digital forensics
challenges and to enhance its process, in this research, a community-driven
initiation has been provided to better study digital forensics and ML
techniques. Identifying the ML techniques of interest in the digital forensics
science community can help researchers use these techniques better and more
effectively. Toward this goal, the previous investigations on digital
forensics and ML have been reviewed, and new directions have been developed.

###  1.1 Prior research

To the best of our knowledge, no peer-reviewed systematic literature review
has been conducted, discussing the application of ML to the problem of digital
forensics explicitly. Besides, the related works have not been as
comprehensive as this research thus far. The works introduced in this section
have examined the relationship between DF and ML from a specific and limited
view. Some papers have focused on specific techniques or applications of ML in
digital forensics. Quick and Raymond Choo [1] studied some papers since 2004
about the problem of large amounts of data in digital forensics and offered
solutions, including artificial intelligence (AI) and ML-based solutions.
Pratama et al. [5] conducted a study on digital forensics trends from the
1990s to 2014. They also had a brief review of the role of computational
intelligence and its effects on digital forensics.

Faye Rona Mitchell [3] introduced AI techniques in applying pattern
recognition to be used in cybersecurity and digital forensics. Some techniques
such as knowledge representation, pattern recognition techniques (ML and
knowledge discovery), exploratory data analysis, and knowledge refinement were
briefly studied in this research. A. M. Qadir and A. Varol [8] introduced the
application of using ML algorithms and techniques in digital forensics to
analyze large amounts of diverse datasets to find criminal behaviours. Adam
and Varol [2] studied the literature of papers between 2005 and 2019 that used
classification and clustering in the process of a digital forensics
investigation. They also proposed a framework for the intelligence of digital
forensics. These papers only examine a specific role and application of ML in
digital forensics.

Some articles have only been conducted in a specific domain of digital
forensics. Kebande et al. [4] highlighted the importance of supervised ML
methods in live digital forensics. They presented a framework for Emergent
Configurations in IoT Environments using machine learning facilities. N.
Koroniotis et al. [13] conducted a comprehensive discussion and explored the
challenges of botnets and current solutions. They also studied the application
of DL in network forensics and intrusion detection and its role in handling
diverse data in IoT forensics as an appropriate solution. In video forensics,
Abdul RehmanJaved et al. [6]conducted a survey considering challenges and
presenting a taxonomy of prominent video forensics products available for
investigation. Al-Khateeb and Epiphaniou [14] discussed the role of ML
classification techniques in an incident response methodology to improve the
detection of unwanted patterns, for example, in text messages, cyberstalking,
and online grooming. In 2018, Karampidis et al. [15] conducted a review of
steganalysis techniques for image digital forensics. Krivchenkov et al. in
[16] investigated the state of the art intelligent methods used in IoT between
2009 and 2018 and their problems in three categories of rule extraction,
anomaly detection, and intrusion classification. In digital camera source
identification, Jaroslaw Bernacki [17] scrutinized some methods available,
including ML and DL models. Their result showed that using DL models has
grown, and the CNN-based classifiers present high detection accuracy.

In a recent study conducted in 2021, Manjunatha and Patil presented a review
of the DL-based passive image forensics analysis methods for detection
tampering [11]. In a survey [18], Cifuentes et al. studied using the DL
methods to automate the detection of sexually explicit videos. In terms of
obtaining digital evidence, Zaytsev et al. [19] revealed that AI enables a
multifaceted, complicated, and objective approach to investigate crime
situations and notably enhances the proof of efficiency. Jarrett and Raymond
Choo [20] examined the relationship between multimedia science in three areas
of Cyber Threat Intelligence, AI, and Cybercrime. They inspected the effect of
AI and automation in DF on efficiency, accuracy, and cost‐reduction and
explored the main automation challenges of digital forensics. To apply the ML
techniques in image manipulation detection, a comprehensive survey conducted
by Norzoi et al. [10] examined the techniques available and pointed out their
vulnerabilities against adversarial attacks. In another work on cybersecurity
intrusion detection [21], and file type identification [12], the effectiveness
of using ML techniques has been indicated. Shalaginov et al. [22] discussed ML
techniques in static malware analysis, which can help researchers to use
machine learning in malware forensics. In a systematization of knowledge
(SoK), Xiaoyu Du et al. [9] studied the state-of-the-art of AI-based tools and
approaches in digital forensics. In this SoK, applying AI in Data Discovery,
Device Triage, Network Traffic Analysis, Handling Encrypted Data, Computer
Vision, Forgery Detection, and Fingerprinting were examined, and current
challenges and future directions in each field were discussed. However, this
research has not been conducted as a systematic literature review.

###  1.2 Research goals

This research aims to review and identify the applications of ML in digital
forensics domains. In particular, This study focuses on answering five
research questions given in Table 1.

Research Questions (RQ) |  Discussion
---|---
RQ1: How are publications related to ML applications in DF spread throughout the years? |  To identify the trend and the progress of the subject in each year.
RQ2: How is the research activity in the applications of ML in DF dispersed geographically? |  To identify leading countries in this field.
RQ3: What are the most popular publication venues and databases in this domain? |  To identify the leading publishers and specify the extent to which conferences and journals pay attention to this subject.
RQ4: What are the most commonly used related keywords in the research, and how are they related? |  Identifying the essential keywords used in the research can be helpful to categorize the trending topics and the fields receiving less attention.
RQ5: What are ML methods used in digital forensics, and in what fields? |  Digital forensics use ML in various fields. Identifying the areas in which the ML techniques are utilized can help understand the ML’s role in digital forensics. Because ML has a wide range of techniques, it is essential to identify the most used ones in digital forensics.
Table 1: Research questions.

###  1.3 Contributions and layout

By considering all ML methods and DF domains, this SLR is complementary to the
current research and presents the following contributions for those having a
curiosity in digital forensics and ML to promote their work:

  * 1.

We identify 608 primary studies related to ML and digital forensics up to
December 2021. The results can give an excellent view to researchers in this
specific field.

  * 2.

We present a meta-analysis of the state of play regarding ML methods employed
to improve the digital forensics investigation process and address DF
challenges.

  * 3.

We Provide visual analysis based on all 608 related articles according to the
authors’ selected keywords, showing thematic relevance in the last decade’s
research.

  * 4.

We conduct a comprehensive mind map of the relationship between ML methods and
DF domains. Other researchers can use this mind map to further their work.

  * 5.

We make representations and produce guidelines to help further work in this
area.

The structure of this research is as follows: Section 2 describes the methods
in which the primary studies are systematically selected for analysis. Section
3 discusses the findings related to the research questions presented earlier.
Section 4 discusses the future research directions of ML application in
digital forensics. Section 5 concludes the research.

##  2 Research methodology

To answer the RQs mentioned above, the SLR was conducted based on the guidance
presented by Kitchenham and Charters [23]. In iterations, we desired to move
via the review’s planning, conducting, and reporting phases to complete the
SLR evaluation.

###  2.1 Selection of primary studies

Primary studies were gathered by searching keywords in the publication’s
search tool or the search engine. The keywords were chosen to aid in
discovering research findings that would address the research questions. We
used AND and OR Boolean operators. The search terms were as follows:

(”machine learning” OR ”artificial intelligence” OR ”classification”) AND
“digital forensic”

(”neural network” OR ”convolutional neural network” OR ”deep neural network”
OR ”deep Learning”) AND “digital forensic”

(”support vector machine” OR bayesian OR regression OR ”decision tree” OR
”k-nearest neighbor” OR supervised OR ”k-means” OR reinforcement OR ”Markov”
OR ”random forest”) AND “digital forensic”

The platforms searched were:

  * 1.

ACM Digital Library

  * 2.

IEEE Xplore Digital Library

  * 3.

ScienceDirect

  * 4.

SpringerLink

Depending on the search platforms, the searches were done against the title,
keywords, or abstract. The final search was performed on December 10, 2021,
and all studies published till that date were reviewed. The inclusion/ex-
clusion criteria described in Section 2.2 were used to filter the results. The
filtered results were then fed into Wohlin’s [24] snowballing process.
Iterations of forward and backward snowballing were done until no more papers
meeting the inclusion criteria were found.

###  2.2 Inclusion and exclusion criteria

Studies can be research papers or case studies, new technical ML applicati-
ons, and commentaries on developing existing digital forensics processes
through the ML combination. They must be written in English and peer-reviewed.
In cases where multiple versions of a study are found, the most recent version
is considered. The critical inclusion and exclusion criteria are shown in
Table 2.

Criteria for Inclusion |  Criteria for Exclusion
---|---
The paper must contain information related to the ML technologies used in improving digital forensics. |  Grey literature such as blogs and government documents.
The paper must offer empirical data related to the ML application in digital forensics. |  Non-English papers
The paper must be peer-reviewed research published in a conference or journal. |
Published between 2010 and 2021. |
Table 2: Inclusion and exclusion criteria for the primary studies.

###  2.3 Selection results

The initial keyword searches yielded to identifying 6781 studies, which were
reduced to 4521 once duplicates were removed. The remaining papers were then
reviewed considering the inclusion/exclusion criteria, resulting in 605 papers
being left. The 605 publications were read completely, and the
inclusion/exclusion criteria were reapplied, resulting in 533 studies
remaining. Snowballing was done in iterations until no more papers fulfilled
the requirem-ents, resulting in 608 papers being included in the SLR. Fig. 1
displays the number of studies picked at each stage as well as the rate of
attrition of articles.

Figure 1: Attrition of papers through processing.

###  2.4 Data extraction and analysis

The data belonging to studies that passed the quality assessment was then
extracted, categorised, and saved as a spreadsheet to check for completeness
and the accuracy of recording. The categories given to the data were as
follows:

  * 1.

Context data: Information about the study goal.

  * 2.

Qualitative data: Findings and conclusions provided by the authors.

  * 3.

Quantitative data: data are observed by experimentation and research when
applied to the study.

To meet the goals of research questions, the data contained within the
qualitative and quantitative findings categories were compiled. In addition, a
meta-analysis of those studies subjected to the final data extraction process
was conducted.

##  3 Discussion

Each primary study was fully read, and relevant qualitative and quantitati-ve
data was extracted provided as a mind map in answer to RQ5. All the primary
studies have been focused on how ML deals with a particular problem in digital
forensics. Primary keyword research shows that many papers have been published
about ML techniques in digital forensics since 2006. One of the main problems
in digital forensics is the large amount of evidence that makes collecting and
analyzing problematic for an investigator. This high volume of data and the
need to spend a very long time to find relevant evidence also increase the
probability of human error. The study results show that the ML techniques can
be well used in response to this problem and increase the accuracy and speed
of the investigation process in data collection, inference, and analysis. The
proposed ML-based methods present outstanding performance to improve the
accuracy and reduce the error rate. However, limitations and challenges often
relate to the ML’s nature, such as the need for adequate and appropriate
training data and samples [120, 310, 355, 365, 366, 409, 463], the selection
of features [233, 385, 445, 516], the number of features [169, 172, 366], the
massive number of parameters, and the determination of optimal values [48].

###  3.1 Quantitative data

This section provides a quantitative analysis of the set of studies resulting
from the primary research. In particular, the research questions RQ1 to RQ3
were addressed by analyzing the number of publications related to the use of
ML in DF over the years, the geographical distribution of these studies, and
the favourite publication venues.

####  3.1.1 RQ1: Spread of Publications Throughout the Years

Fig. 2 indicates the number of publications between 2010 and 2021. Altho-ugh
the research in ML application in digital forensics has grown between 2010 and
2015, it has been more impressive since 2016. A sharp increase observed from
2016 to 2021 shows that ML application in DF has been at the centre of
interest of the research community.

Figure 2: Publication year

####  3.1.2 RQ2: Geographical Distribution of using ML in DF Research

The geographical distribution of the research activity has been shown in Fig.
3. The data were obtained by extracting the first author’s affiliation with
the desired studies. China, India, and the USA are the three major
contributors. This can be due to the size of their industries and the
importance of research in this field. However, about 18% of the studies emerge
from Europe, indicating that this topic is less intriguing. The 21 countries
in the ’others’ group with five or fewer publications in this field are:
Greece, Turkey, Norway, Pakistan, Japan, Russia, Austria, Vietnam,
Netherlands, Canada, Bangladesh, Romania, Poland, United Arab Emirates,
Colombia, Hong Kong, Jordan, Lithuania, Portugal, South Africa, and Estonia.

Figure 3: Demographic: geographical distribution of research activity based on
the first author’s country of affiliation.

The papers were classified based on their publication’s venue type and
database, as shown in Figs. 4 and 5, respectively. As can be seen, conference
proceedings are more active in publishing papers compared to journals.
Although the Springer database has the highest number of publications, most
journal papers belong to Elsevier, with about 47% of all.

Figure 4: The popularity of different venue types. Figure 5: The number of
publications in different databases.

###  3.2 Quality data

In this section, a quality analysis of the primary studies was provided to
answer RQ4 and RQ5.

####  3.2.1 RQ4: Keyword network: analysis for identifying research areas

To summarize the common topics amongst the selected primary papers, keywords
were analysed across all 608 papers based on authors’ keywords. Table 3 shows
the significant words that have been repeated more than 20 times along with
their number of repetitions, and Fig. 6 shows their relations. For this aim, a
keyword network analysis was conducted using VOSviewer [25]. At first, the
social network map of the co-occurrence matrix was obtained. Fig. 6 shows a
network based on the repetition of authors’ keywords in the literature. Based
on the similarity of keywords in topics, a classification of the keywords with
the most thematic relevance is displayed in different colours. It could
intuitively reveal the relationship of research themes of using machine
learning in digital forensics. The size of the node’s font indicates the
frequency of keywords: the higher the frequency causes the larger the node’s
font size. The thickness of the line is relevant to the closeness of
connections between two keywords. The settings in VOSviewer are based on the
number of occurrences of a term=5 and Binary counting with Max. length=30,
Max. lines=100 and weights= Occurrences.

Keywords |  Count
---|---
Image |  347
Detection |  210
CNN |  139
Forensic(s) |  122
Identification |  91
DL |  91
Forgery |  81
SVM |  71
classification |  69
Video |  61
Compression |  58
Jpeg |  43
Camera |  42
Splicing |  41
Audio |  31
Computer |  28
Multimedia |  27
Table 3: Counts of the significant authors’ keywords in the primary studies
Figure 6: Map of a co-occurrence network of authors’ keywords.

A graph of density visualization is illustrated in Fig. 7 with a kernel size
of 1.5 (default) to acquire more information on these keywords. In the item
density visualization, the items indicated by their labels are similar to the
network visualization. The colour of each point on the map is determined by
the density of its items. In the item density visualization, items are
represented by their labels, similar to the network visualization. By default,
the range of colours is blue to green to yellow. Larger number of items in the
neighbourhood of a point and higher weights of neighbouring items result in
the colour of the point closer to yellow. On the other hand, the smaller
values are blue [25].

Figure 7: Density visualization of authors’ keywords.

The goal of this research question is two folds. Firstly, the aim is to
determine which digital forensics domains successfully used the ML methods,
leading to their advancement. Secondly, the aim is to specify the ML techniqu-
es with the most capabilities to be used in digital forensics and discover the
DF domains which have used each of these ML techniques. Notice that the last
perspective is different from the first one.

To answer this question, the categorization of digital forensics domains
presented in [9] was considered. These categories are Data Discovery and
Recovery, Fingerprinting, Multimedia Forensics (Image, Video, Audio, Text),
Network, and Triage mode as shown in Fig. 8. The statistical results of this
section are based on the authors’ keywords. It should be noted that the papers
related to Electromagnetic side-channel analysis were included in the network
category due to their relevance to the IoT and malware detection. However, to
better identify the relationship between ML techniques and digital forensics
domains, a comprehensive mind map is presented in Fig. 10 to enable
researchers to identify the field of study of papers more accurately. This
mind map is based on the paper’s context and not just keywords. Due to the
existence of many works in the multimedia domain, and for more clarity of the
presented results, this domain is considered with its subsets in Fig. 8. As
can be seen, image forensics has been at the centre of interest among other
domains. A statistical analysis of the papers revealed that about 62% of the
works were related to image forensics. Video with about 11%, followed by audio
and fingerprinting domains with about 7%, have been exciting topics to
researchers. The ’others’ group of DF domains consists of three forensics
phrases written by the authors, namely, sensor forensics, computational
forensics, and location forensics.

Figure 8: DF domains using ML methods (Based on authors’ keywords)

Fig. 9 shows the main ML methods used in DF. Deep neural network (DNN) methods
are placed in the category of DL with 14 repetitions in keywords. Furthermore,
the Deep CNN (DCNN) keyword with eight repetitio-ns is placed in the CNN
category. The ’others’ group consists of the six methods that have ten or
fewer repetitions in the authors’ keywords: Bayesian, Logistic Regression
(LR), KNN (k-nearest neighbour), LSTM (Long Short-Term Memory), CapsNet, and
K-means. Based on the results obtained, deep learning, especially
convolutional methods, plays a more meaningful role in digital and image
forensics. It is considered a strength for digital forensics because of the
more accurate results gained by CNN-based models. However, this may also be a
weakness due to an increase in adversarial attacks. Using deep models in
digital forensics has significantly grown since 2017. In 2021, about 53% of
the papers related to using CNN-based methods, and about 50% were conducted in
the image forensics domain.

Figure 9: The main ML methods used in DF (Based on authors’ keywords)

In the following, some articles, mostly selected from Q1-ranked journals, are
briefly reviewed to cover the main topics. A comprehensive grouping of all
related works published from 2010 to 2021 is presented in Fig. 10. As
mentioned before, this mind map is based on the papers’ context and covers all
DF domains considered in papers. Considering the full text of the papers, this
map shows that the CNN models have the most application in providing the DF
approaches and frameworks, primarily in the image domain. Besides, it shows
that the most significant concern in digital forensics is image manipulation.
The dominant ML methods in this field have been CNN and Support Vector Machine
(SVM). Another consideration is that SVM, tree-based, and Neural network-based
(NN) models are effective in about all of DF categories, and K-means are used
to a limited extent. One of the growing areas in data source identification is
Social media source identification, and SVM techniques are used more. In the
Triage models, traditional models such as Bayesian, Tree-based, and SVM are
used, and DL models do not play a significant role in this regard.

##### Multimedia:

With the development of mobile photography devices and editing software tools,
the detection and identification of computer-generated images (CGI),
recaptured images, and manipulated images have become the most severe
challenges in multimedia forensics. Image manipulation includes a wide range
of tampering and forgery, including splicing, copy-move, double compression,
re-sampling, removal, resizing, sharpening, or smoothing operati-ons such as
median filtering and Gaussian filtering. In the following, the main works in
this field will be reviewed.

  * 1.

CGI and fake detection

image: Deep learning models, especially CNN-based models, have been successful
in automatic multidimensional feature extraction [239, 272], training, and
classification for high accuracy recognition [96] due to their ability to
obtain higher-order features. However, DL models have challenges. The
performance of these models decreases in blind detection. For example, when
training and testing data are generated with unknown computer graphics
rendering tools, they deeply extract context from images without inferring any
unique fingerprint. To solve this problem, Convolutional Traces analysis and
feature extraction with Expectation-Maximization (EM) algorithm have had good
results in the classification of fake images with SVM [64, 87].
Correspondingly, transfer learning [28, 304] can overcome two main DL models
problems: 1) the need for a massive amount of training data and 2) overfitting
on CNN. The reason is that the parameters of the pre-trained neural network
(called source network), belonging to a particular task, are transferred to a
new neural network (called target network), designed to solve somewhat similar
tasks. A local-to-global strategy can also reduce the computational cost of
images that are not the same size [508]. In this way, the CNN model will
decide on local patches and the whole image in actual size through simple
majority voting. Indeed, it crops several image patches with a fixed size in
training, thus increasing the augmentation power of the training dataset.

SVM classification has been suggested to be applied to CGI detection in two
aspects. The first is extracting histogram and multifractal spectrum features
from residual images and regression model fitness features [493]. The second
one is binary similarity measures of Photo Response Non-Uniformity (PRNU is a
unique attribute in natural imag-es) [309, 408]. However, in combination with
the DL methods, feature extraction can be done automatically. In NNs, using
laplacian of gaussian, auto-correlation, and extreme learning machines have
been suggested [511]. In fake colourized image detection [218], extracting
features from HSV colour space instead of RGB and NN training instead of SVM
(due to low speed in large datasets and difficulty in choosing the correct
kernel) can be a good solution. Detection in recaptured images can be done
based on the difference in the number of pixels at the edges of the actual
image and the recaptured image. This technique enables the detection of the
image taken from the screens but presented as the original image. The same is
possible for the hidden tampered images [114].

Video: To distinguish fake videos from the original, extracting recompr-ession
error can be a good criterion for detection using CNN-based models [424]. A
fake detection scheme in [115] has been proposed for both video and audio with
a convolutional recurrent neural network framework. In fake bitrate detection,
SVM showed an excellent classific-ation accuracy [248]. In biometric
authentication, video manipulation to fail authentication is more effortless
compared to other authentication methods. An increase in AI-generated videos-
based attacks leads to identifying the original videos from the tampered ones.
In [81], a hybrid CNN-LSTM model was proposed to improve the facial motion
differences between fake and original videos.

Audio: Similar to other Multimedia forensics domains, data manipula-tion is
one of the problems of audio forensics. The CNN-based method proposed in [334]
determines whether an audio recording is recaptured or is genuine. The results
showed that it has more robustness against ambient noise. Moreover, it can be
detected appropriately for short 2-second clips.

  * 2.

Manipulation detection

image: In the handcrafted-features-based methods, the learning and classifying
steps cannot be simultaneously optimized [203], as they are separate steps. In
the CNN models, feature extractors and classifiers work automatically, and
each feature map is generated at each network step. By performing a
convolutional operation on the whole image and learning weights, features are
extracted while training on a set of images. One of the essential advantages
of these models is weight sharing. This capability makes them work faster and
reduces data latency due to the computational resources of edge nodes while
providing acceptable detection accuracy. Hence, weight sharing has been used
in many works ranging from detecting forgery and locating it [29, 138, 267,
268], based on the part of the image or the whole image and with any size
[32], to global manipulation detection and processing history detection [47,
118]. The results of [73] show analysis of colour filter array (CFA) using a
trained SVM with original images and forged images, which leads to less
computation time. Using the CNN models is recommended in small images.

Determining proper filter parameters can help in retrieving the manipu-lation
history of an image. In [361], authors suggested adding a transform layer to
CNN and training it with frequency-domain features to identify template
parameters of various spatial smooth filtering operations. Acc-urate locating
of tampered and refined contours of tampered regions has been proposed in
[529]. In some works [39, 82, 530], the automatic feature extraction
capability of the CNN models has been used. Then, in the classification step,
other methods such as SVM are indicated to provide good results in two-class
problems [39, 530] and the Forensic Similarity Graph approach proposed in
[82]. However, the scheme presented in [54] extracts features based on median
filter residual image creation using least-squares and employs CNN as the
classifier. One of the CNN-based model features is the possibility of changing
the kernel size. This feature improves the performance and is used to extract
and integrate multi-scale features for copy-move tampering [296] and increase
the reassembling rate estimation [101, 117]. Most deep-based methods pay
attention to high-level features while there is much digital forensics
evidence in low-level features. When these features are extracted,
manipulations can be detected by training the network via a small dataset
[83].

Face images contain much personal information such as age, race, or even
feelings. One of the challenges of the CNN models in image forensics is how to
design a network for learning features through weak traces related to a
specific manipulation [47, 132]. Because metadata is easier to manipulate in
fake facial images, the RGB-based detection will work better [528]. In tamper
detection, a determination is carried out if an image is derived from another
one [183, 143]. Moreover, training a DNN with any pair of images in the face
swap detection is also proposed [123].

Compressed images are difficult to detect due to the influence of quality
factors on multiple compressions, and the available methods work well under
certain conditions [200]. In recent years, DNNs are suggested for JPEG
compression manipulation detection [100, 167, 342], non-aligned double JPEG
compression detection [119, 496], and resizing manipulation detection [184].
In [125], features such as spatial, frequency, and compression increase
detection performance. In the low-resolution image, which is a lossy
compressed image that leads to the lack of statistical pixels to extract
reliable features, filter layers and residual learning for Median filtering
detection can be helpful [164]. SVM-based techniques are suitable to solve
binary problems. Still, they are not appropriate for three-class issues, and
most detection solutions are related to double compression. In a different
work presented in [173], the Triple JPEG Compressed Color Images detection was
addressed. According to [181], SVM obtains acceptable results for median
filtering detection using an autoregressive model to extract features from
bit-planes in uncompressed images. It also obtains promising results in
uncompressed and JPEG compressed images based on the streaking effect.

In the field of splicing detection, Jinwei Wang et al. [93] proposed a CNN-
based solution that uses a combination of YCbCr, edge, and PRNU features based
on the weighting strategy and eliminates redundant information to obtain
better results. In median filtering, a CNN-based model with an adaptive
filtering layer was proposed in [514], which is built upon the discrete cosine
transform (DCT) domain. In social network image splicing detection, SVM is
used for classification based on Texture Features [510]; SVM also utilizes
Markov Features in QDCT and QWT Domains [253]. In [98], using Vicinity Noise
Descriptor with SVM has been proposed to solve the noise fluctuation problem
in splicing zone detection.

For various types of motion or out-of-focus, blur image detection has been
proposed using CNN-based model detection [188]. Furthermore, authors in [176]
used multi-derivative grey level co-occurrence matrix (MGLCM) features to
train SVM. Among image manipulations, sharp-ening is one of the most common
techniques in most image editing tools [125]; however, its detection is a
challenge in small images. To deal with this problem, using DCT-CHDMY features
with SVM has been suggested [42].

In Modified Contrast Enhancement-based forgery detection [284] and overlapping
concurrent directional patterns [313], NNs are suggested instead of SVM to
obtain more robustness and accuracy. It should be mentioned that SVM had
better results compared to NN in forgery detection of illumination component
change using homomorphic image processing [196] and linear transformations
such as rotation and resizing [278]. Although the NN and DL models and
conventional classifiers such as SVM have been used more in works, some of
which are mentioned earlier, other techniques also presented good results.
High accuracy was obtained in classification via KNN in splicing detection
[353], Naive Bayes (NB) in tampered JPEG image detection [159], ensemble
learning in seam carving forgery, and JPEG detection down-recompression [331].

Video: Ease of manipulation risks the authenticity and integrity of digital
videos, mainly when it is considered digital evidence in court. Unlike image
data, video data contains temporal information. One of the problems with video
manipulation detection is that there are no datasets with various tags for
tampered videos to be large enough to be used in the ML techniques training.
The CNN-based techniques can extract features and estimate various compression
parameters such as quantification parameters, intra- or inter-frame type.
Johnston and Elyan [128] deblocked the filter setting from good videos and
trained a CNN model for manipulation detection. In relocated I-frames
detection in double compressed videos, using a smaller CNN model for feature
extraction and detection is appropriate to be embedded into mobile forensics
devices [507].

In compressed double videos, detecting abnormal frames in HEVC (High-
Efficiency Video Coding) videos using NN has been proposed [439]. SVM
classification is also considered in various fields due to its good compromise
between computational complexity and detection accuracy [503]. A comparison
has been conducted in [432] among SVM, KNN, and logistic regression to detect
deleted frames based on feature extraction from the bitstream and the
reconstructed images. The results showed that SVM in CBR (constant bitrate)
coding and LR in VBR (variable bitrate) coding has higher true positive (TP)
rates compared to other techniques. Simultaneously, using KNN and linear
discriminant analysis (due to their simplicity) and a three full connected
multilayer perceptron (due to its accuracy) have better and more reliable
performance in the classification of single and double compressed [170].

Audio: Voice biometrics is an approach that is increasingly used in speaker
verification systems. Audio spoofing is one of the significant challenges in
this field. [410]. Pitch shifting technique in audio editing and increasing or
decreasing it is a prevalent voice manipulation to hide the true identity.
Detecting a weakly pitch-shifted voice is one of the challenges in this field.
The proposed CNN-based model in [92] has been able to overcome it. D. Luo et
al., [339] used NN in double compressed AMR audio detection via a stacked
autoencoder to learn the optimal features of audio waveforms. For higher
efficiency, they extracted compressed-domain speech features instead of
decoded speech waveforms from encoded AMR files. However, the accuracy in [69]
has been higher because of using SVM classification. Reis et al. [343]
utilized electrical network frequency to detect and identify tampered audio
recordings by detecting abnormal variations.

  * 3.

Text analysis Due to daily user activities such as email, web browsing, word
processing, etc., textual evidence is vital. Much of this evidence can be in
the unallocated space, or the file’s signature has been overwrit-ten. Lang
Beebe et al. [419] employed SVM to provide ranking algorith-ms for the search
string. In Uyghur Web Text Classification [323], SVM also presented good
results. In automating the analysis of text and log chats analysis, the ML
techniques help investigators analyze and identify conversations containing
sexually inappropriate subjects [49]. In the child sexual abuse and the
identification of Unknown Criminal Media in P2P networks, SVM performed better
than Naive Bayes and LR in text and image classification [520] regarding the
F-score. Identifying the source of evidence is essential in the investigation
of online communications on social networks and email. In [540], a ML-based
framework and natural language processing has been developed. The results
indicated that random forest (RF) has the best average precision in
classification compared to the Decision tree (DT), NB, AdaBoost, LR, and SVM.

  * 4.

Other multimedia fields A SVM-based classification tool has been recommended
in [534] to reduce costs and speed up the investigation. They used a parallel
software architecture for photo and video multimed-ia evidence classification
easily and instantly. If the results are positive and there is evidence, the
device should be taken to the laboratory for further analysis. In face
detection and Sketch Synthesis (FSS), drawing the suspect face showed
promising results by applying the IEHO algorithm to hyperparameter
optimization in the proposed CNN-based model [108]. Although existing DL
modelling tools work well on adult age estimation, they do not perform well on
underage subjects. Authors in [65, 531] improved a DL-based approach,
especially in child sexual abuse investigations. Their scheme performed well
by obtaining a large dataset with balanced and valid class labelling. In
gender identification, good results were reported in CNN-based gender
identific-ation of handwriting by extracting hierarchical page features and
word features [43].

In video object detection, there is footage recording quality dependency. The
low quality of the recording will reduce the reliability of the evidence
collected for presentation to the court. In object detection in the footage,
the colour of a particular object is not consistent for reasons such as
changing the quality of video or changing light, etc., all of which make
identification difficult. In this case, the DL methods will be more efficient
in identifying the image object [220]. Due to the high noise in the
circumference, environmental sound classification (ESC) is one of the most
challenging problems for DF and ML. Several solutions based on DNN [37] and
SVM [40] were proposed to solve these problems. In sound-based gun model
identification, which is complex and costly to do manually, the KNN classifier
showed better accuracy than SVM [535].

##### Fingerprinting

In identifying a suspected source, which could be a printer, a digital camera,
malicious code writers, or even the way people behave, often there are clues
in relevant evidence that help investigators. Footprints can be left in
various data such as images, audio, video documents, etc. The ML methods can
help investigators to extract and analyze these footprints more accurately and
quickly.

  * 1.

Camera or phone source identification

image: The issue of device source identification based on their fingerpr-ints
is a growing topic in digital forensics [33]. Source camera identificat-ion is
a serious issue in digital forensics areas such as copyright and property
[305], including camera manufacturer identification and camera model
identification (CMI). The DL models like CNN can automatically extract
features and identify multiple camera models [51, 149, 198, 509, 516]. They
have also been used in pre-processing tasks to remove scene content [116],
which severely hides the camera fingerprints. Distinguish-ing between images
taken directly by a camera or downloaded from social networks is challenging
in image forensics. In this field, using SVM classifiers is taken into
consideration [256, 257, 258, 340]. In source camera identification without
knowing the models, using the KNN classifier and a self-training strategy
showed better results than a binary SVM and a multi-class SVM [377]. KNN is
also used in multimedia phylogeny [357] to find abusive or original content
publishers.

In uploaded images to messenger applications or social networks, remai-ning
footprints can be extracted to help identify the image source. In this regard,
a CCN-based camera detection on a shared document has been proposed [501]. One
of the challenges in messengers is that filters applied to images can cause
sensor pattern noise (SPN). This can cause camera detection methods not to
work correctly. A CNN-based solution in [180] has been suggested for messenger
apps like Whatsapp to identify these filters. Another challenge is low
accuracy with a limited set of labels for training. In [62], the deep siamese
network significantly increased the classification accuracy. The RF has been
proposed to identify image sources from social networks like Facebook,
Twitter, and Flickr [512].

Video: The supervised ML algorithms effectively detected the video editing
tool used in social networks and messengers, and higher perform-ance was
obtained by random forest [34]. In [84], a container-based method has been
proposed to identify software and operating systems that manipulate videos on
social networks. They also employed a decision tree to explain decisions.

Audio: Identifying a mobile device based on taken images is an approach that
has been considerably used in the literature [51, 62, 116, 149, 180], as
discussed earlier. Another method that can be employed to identify cell phones
is microphone identification. Using directly extracted features from audio
signals is a common way. It works well in identifying different brands, but it
fails to distinguish different brand models. In [122], a CNN-based model
identified cell phones through their built-in microphone by extracting
features from different parts of the spectrogram of multiple streams [122]. In
addition to identifying different brands, it also identifies different models
of the same brand. Using NN with device noise feature [113] and sparse
representation-based classification method [497] have their benefits in source
recording device recognition.

One of the challenges in audio forensics is recognising VoIP calls as caller-
ID that can be easily manipulated in such calls. Among ML-based proposed
methods for this problem, SVM and NN showed good accuracy and robustness
[490]; however, they can be used to identify a specific source device. Hence,
a CNN model was suggested in [186] based on temporal and spectral domain
features.

  * 2.

Printer source identification Printer or scanner source identification is
vital in matters such as copyright ownership or document authent-ication
manipulation. In recent years, using SVM has been discussed in various areas
such as printer source identification of a text document [109, 212, 325],
printer source identification for both text and image using image processing
and microscopic image techniques [252], and data exploration methods [244].
Furthermore, the method composed of Naive Bayes classifiers, KNN, and RF has
been proposed in [26] as a feature extraction method (to extract Speeded Up
Robust and Oriented Fast Rotated features). Random forest algorithm presented
better performance than SVM due to feature importance that allows explaining a
method with less run-time and no need for kernel and parameterization
adjustments [242].

  * 3.

Authorship attribution and Profiling In digital forensics, the details of the
document author, such as identity, demographic information of the authors,
etc., are significant [44]. Authorship verification is trying to identify
whether the authors of the two documents are the same or not. This is a
challenging issue due to the shortness of the messages on social networks
[210]. In programming, Source Code Authorship Attribution can be necessary for
digital forensics in some ways, including developer privacy and the importance
of identifying malicious code programmers. To identify three programming
languages like C++, Java, and C#, the accuracy of the DL-based technique among
100 programmers was reported to be 97.34% [110].

The results of [211] showed that using syntax tree and deep learning versus
Program Dependence Graph with Deep Learning has a lower complexity cost.
Because the time and rhythm of people typing can have a specific pattern,
keystroke-based identification techniques are used as the biometric tool to
identify individuals. The lack of a dataset with real keystroke dynamics is
one of the problems in this field. Authors in [112] created a new keystroke
dynamic dataset. They also showed that classification with radial basis neural
networks was more accurate than the other ML models.

##### Network

  * 1.

Attack and malware detection In detecting the source of cyber-attacks, the
high accuracy and low false alarms rate are important parameters. Among the
DNN models, the multilayer perceptron algorit-hm [36] showed promising results
in identifying attacks for high-volume data. Among the NN-based models, Neuro-
Fuzzy-based techniques [365, 376, 491, 537] can be used in network traffic
analysis to extract accurate and interpretable data. The Fuzzy Min-Max NN
model [524] with online adaptation and online learning capability can add new
classes or modify existing classes without the need for retraining.

Autoencoders do not learn patterns that they have not seen before, so multi-
autoencoders have been suggested in [95]. A One-Class SVM model and a semi-
supervised model can be trained using the appropriate core function, only with
data from a normal class (without attack). They can then be utilized to
classify normal events from abnormal [66, 297]. In an under-attack situation
such as critical infrastructures, various critical processes are executed,
each of which can have its attack. By applying the appropriate SVM settings
for each process, the specific attacks can be more accurately identified.

Deep learning models are complex in detecting and analyzing malware and
require much training and pre-processing time, which is unsuitable for
critical infrastructure environments. The NN models can be faster options
[513, 386]. Specifically, CNNs are Shift invariant, meaning the CNN models do
not require the expertise of an investigator. In the models that rely on
signatures and malware behaviour, raw static byte code as input [245] can
solely solve time-consuming and high computational resource consumption
challenges. For detecting malicious web pages, authors in [76] proposed a DNN-
based tool, which reported 99.8% accuracy. Among tree-based models, Boosted
tree methods can provide investigators with a simple approach that detects
malware faster than an antivirus. Likewise, among various ML techniques, the
DT can perform better in malware family classification due to having a
comprehensive analysis nature and effective in reducing false alarm rates
[517]. On the networks with Windows operating systems, extracting features
from the registry to train Boosted tree [134] reported good results compared
to NN, LR, and DT. The use of LR in identifying the reason for scavenging
adversaries accessing data has been suggested in IoT environments [457]. In
the fields such as cyber threat intelligence (CTI) [158], RF can have good
results in malware classification thanks to reducing the total token count.

  * 2.

Attack and malware detection With the expansion of the IoT, the devices used
in these networks could be a potential source of evidence for Digital
forensics. However, the diversity of devices and the lack of a standard
interface are some of the problems facing DF investigators. Because of the
limited interface of smartphones, retrieving valuable forensics information is
a challenging task. Recently, researchers have employed EM-SCA attacks to
gather information from IoT devices in a forensically sound way. However, the
successful implementation of this attack requires knowledge and equipment that
most investigators do not have. To solve this challenge, evidence collection
and analysis can be done automatically [536].

Although the analysis of the massive amount of collected EM traces is
complicated, the efficiency of the analysis can be increased if a subset of
frequency channels with sufficient information can be obtained. Using the RF
classifier [57] due to its fastness and high accuracy can be suitable for
identifying information-leaking frequency channels from EM side-channel data
with high dimensions and selecting features (time domain and frequency domain
properties). In the DL models, the large volume of collected data can increase
the accuracy of data analysis by receiving an input vector with a larger size.
However, this data is not directly suitable for the input and training of the
DL models and requires pre-processing. In a recurrent neural network (RNN),
the LSTM architecture is appropriate to identify the patterns that occur in
time series data. With the Fast Fourier Transform (FFT) vector, LSTM can be
trained to distinguish elliptic curve cryptography (ECC) operations from other
software activities [527].

##### Data Discovery and Recovery

In data carving and fragmentation, identifying the data type is essential
because it helps identify the type of crime. Large-scale file fragment type
identification is one of the challenges in this field. Implicit extraction of
features with a CNN model has better performance and run-time than similar
works [86]. Another challenge is related to the fragmented JPEG files whose
metadata is lost intertwined with non-JPEG files in the scanned area. Using
extreme learning [206], better accuracy and timing have been reported to
classify and identify JPEG than non-JPEG. Using SVM in this area has also been
considered, which consists of improving the accuracy of classification of file
systems accessed during a digital crime [140], improving data type
identification [443], and file fragment classification [277, 469]. Based on
n-gram analysis [533], SVM-based approaches performed better in file type
identification than NN. However, their scalability is still a challenge.

In data theft detection, regression tree [426] performs better than neural
networks. Moreover, in data wiping, where files are securely deleted, one of
the abuses is related to eliminating evidence. Random forest with high
accuracy [28] can help investigators identify what data was deleted and what
tools were used. Because some devices have built-in encryption algorithms for
security reasons, the EM-SCA process becomes more complex. There is also a
need to identify and classify encryption algorithms. Neural networks with FFT
vector [192] and DNN with amplitudes as input [61] are used effectively in
this field.

Figure 10: Mind map of the primary studies.

##  4 Future research directions of ML application in DF

This study aims to provide an exhaustive review of the ML applications in DF
over the past decade. We present the details of ML applications in various
domains of digital forensics. Based on the results of this survey, we present
the following research directions of machine learning for digital forensics
that are worth further investigation:

  * 1.

The lack of a standard taxonomy and ontology for a The complete classification
of digital forensics domains based on the scope of their applications and the
type of evidence is one of the crucial issues the authors faced in this study.
For example, in the discussion of image source identification, different
researchers have used different terms. Some have included it in printer
forensics, camera forensics (device forensics), and some in image forensics.
Different categories such as e-mail forensics, network forensics, or text
forensics were used in cases related to identifying the author of a text.

  * 2.

This work is a systematic review to identify the state of ML methods in
digital forensics. The results showed that the CNN-based models are the
dominant method in studies. However, researching the technical aspect,
identifying the level of security of using these methods, and examining the
effect of adversarial attacks on the proposed methods can significantly help
increase the security of the CNN-based methods.

  * 3.

Adjusting many parameters in the DL models and defining the usefuln-ess of
layers in some applications are among the problems raised in the related
works. One of the essential needs, especially in image forensics, can be
related to collecting the relevant settings in the investigations and
comparing the results to identify the best settings in each digital forensics
application.

  * 4.

Except for image and video forensics, using the DL models in other domains is
relatively less. Consequently, further attention and research are required to
take advantage of the DL capacity in other digital forensics domains.

  * 5.

The focus in using ML in the DF process is on evidence acquisition and
detection. Using ML methods in the evidence reconstruction and analysis phase
could be valuable in the future of DF research.

##  5 Conclusion

In recent years, the growth of digital data and the increase of tools to
facilitate digital crime showed that traditional digital forensics methods are
no longer responsive. There is a need to automate processes to increase speed
and accuracy in investigating and analyzing the results. In particular, ML
techniques have been used for a long time in various fields, and their
features have also been growing in digital forensics. Having a general view of
the conducted investigations is necessary to identify the leading ML methods
in DF and the affected DF domains, discover existing gaps, and clarify the
future scientific path for researchers. Thus far, studies and surveys have
been conducted, but these studies have some limitations. They have focused on
a specific DF domain or only have examined the specific ML methods. In this
paper, for the first time -as far as we know-, we review the last ten years of
research related to using ML in Digital forensics. Furthermore, colour
keywords-based visual analysis and a comprehensive Mind Map were provided to
identify the applications of ML methods in DF domains. It can be used as a
general map for digital forensics researchers.

The growing trend of using ML in DF indicates that it effectively improves the
DF process, and there are still open research areas. As the meta-analysis of
this study showed, CNN models have found an important place in DF. Due to the
increase in attacks on these models, it is appropriate to consider the
security of these models in DF in future research. The number of studies
related to DL models other than image and video was significantly lower. Due
to the high performance of these models, more research on their application in
other DF domains will be valuable. Another important and exciting topic in
future research is expanding ML methods in the investigation process and more
DF phases and paying attention to explainable ML in digital forensics.

## References

  * [1] D. Quick, K.K.R. Choo, Impacts of increasing volume of digital forensic data: A survey and future research challenges, Digital Investigation 11 (4) (2014) 273-294.
  * [2] I.Y. Adam and C. Varol, Intelligence in Digital Forensics Process, in: IEEE International Symposium on Digital Forensics and Security (ISDFS), 2020, pp. 1-6.
  * [3] F.R. Mitchell, An Overview of Artificial Intelligence Based Pattern Matching in a Security and Digital Forensic Context, In: Cyberpatterns, 2014, pp. 215-222.
  * [4] V.R. Kebande, R.A. Ikuesan, N.M. Karie, S. Alawadi, K.K.R. Choo, A. Al-Dhaqm, Quantifying the need for supervised machine learning in conducting live forensic analysis of emergent configurations (ECO) in IoT environments, Forensic Science International: Reports 2 (2020).
  * [5] S.F. Pratama, L. Pratiwi, A. Abraham, A.K. Muda, Computational Intelligence in Digital Forensics, In: Computational Intelligence in Digital Forensics: Forensic Investigation and Applications. Studies in Computational Intelligence 555, 2014. pp. 1-16.
  * [6] A.R. Javed, Z. Jalil, W. Zehra, T.R. Gadekallu, D.Y. Suh, Md. Jalil Piran, A comprehensive survey on digital video forensics: Taxonomy, challenges, and future directions, Engineering Applications of Artificial Intelligence 106 (2021).
  * [7] F. Mitchell, The use of Artificial Intelligence in digital forensics: An introduction. Digital Evidence and Electronic Signature Law Review 7 (2014).
  * [8] A.M. Qadir and A. Varol, The Role of Machine Learning in Digital Forensics, In: IEEE International Symposium on Digital Forensics and Security (ISDFS), 2020, pp. 1-5.
  * [9] X. Du, C. Hargreaves, J. Sheppard, F. Anda, A. Sayakkara, N. Le-Khac, and M. Scanlon, SoK: exploring the state of the art and the future potential of artificial intelligence in digital forensic investigation, In: ACM International Conference on Availability, Reliability and Security (ARES), 2020, pp. 1–10.
  * [10] E. Nowroozi, A. Dehghantanha, R.M. Parizi, K.K.R. Choo, A survey of machine learning techniques in adversarial image forensics, Computers & Security 100 (2021).
  * [11] S. Manjunatha. and M.M. Patil, Deep learning-based Technique for Image Tamper Detection, In: IEEE International Conference on Intelligent Communication Technologies and Virtual Mobile Networks (ICICV), 2021, pp. 1278-1285.
  * [12] J. Sester, D. Hayes, M. Scanlon, N. Le-Khac, A comparative study of support vector machine and neural networks for file type identification using n-gram analysis, Forensic Science International: Digital Investigation 36 (2021).
  * [13] N. Koroniotis, N. Moustafa and E. Sitnikova, Forensics and Deep Learning Mechanisms for Botnets in Internet of Things: A Survey of Challenges and Solutions, IEEE Access, 7 (2019) 61764-61785.
  * [14] H.M. al-Khateeb, G. Epiphaniou, How technology can mitigate and counteract cyber-stalking and online grooming, Computer Fraud & Security, 2016 (1) (2016) 14-18.
  * [15] K. Karampidis, E. Kavallieratou, G. Papadourakis, A review of image steganalysis techniques for digital forensics, Journal of Information Security and Applications 40 (2018) 217-235.
  * [16] A. Krivchenkov, B. Misnevs, D. Pavlyuk, Intelligent Methods in Digital Forensics: State of the Art, In: Springer International Conference on Reliability and Statistics in Transportation and Communication, 2018, pp. 274-284.
  * [17] J. Bernacki, A survey on digital camera identification methods, Forensic Science International: Digital Investigation 34 (2020).
  * [18] J. Cifuentes, A.L. Sandoval Orozco, L.J. García Villalba, A survey of artificial intelligence strategies for automatic detection of sexually explicit videos, Multimed Tools Appl (2021).
  * [19] O.A. Zaytsev, P.S. Pastukhov, M.Y. Fadeeva, V.N. Perekrestov, Artificial Intelligence as a New IT Means of Solving and Investigating Crimes, In: ”Smart Technologies” for Society, State and Economy, 2021, pp. 1266-1273.
  * [20] A. Jarrett, K.K.R. Choo, The impact of automation and artificial intelligence on digital forensics. WIREs Forensic Sci. 3 (6) (2021).
  * [21] I. F. Kilincer, F. Ertam, A. Sengur, Machine learning methods for cyber security intrusion detection: Datasets and comparative study, Computer Networks 188 (2021).
  * [22] A. Shalaginov, S. Banin, A. Dehghantanha, K. Franke, Machine Learning Aided Static Malware Analysis: A Survey and Tutorial, In: Cyber Threat Intelligence. Advances in Information Security, 70, 2018, pp. 7-45.
  * [23] B. Kitchenham, O.P. Brereton, D. Budgen, M. Turner, J. Bailey, S.Linkman, Systematic literature reviews in software engineering – A systematic literature review, Information and Software Technology 51 (1) (2009) 7-15.
  * [24] C. Wohlin, Guidelines for snowballing in systematic literature studies and a replication in software engineering, In: ACM International Conference on Evaluation and Assessment in Software Engineering (EASE). Association for Computing Machinery, 1–10.
  * [25] VOSviewer, Software tool for constructing and visualizing bibliometric networks.
  * [26] M. Kumar, S. Gupta, N. Mohan, A computational approach for printed document forensics using SURF and ORB features. Soft Comput 24 (2020) 13197–13208.
  * [27] T. Yang, J. Wu, G. Feng, X. Chang, L. Liu, A Deep Learning Approach to Detection of Warping Forgery in Images, In: Artificial Intelligence and Security. ICAIS, Lecture Notes in Computer Science, 12240 ,pp. 109-118.
  * [28] K.B. Meena, V. Tyagi, A Deep Learning Based Method to Discriminate Between Photorealistic Computer Generated Images and Photographic Images, In: Springer International Conference on Advances in Computing and Data Sciences, 2020, pp. 212-223.
  * [29] S. Jabeen, U. G. Khan, R. Iqbal, M. Mukherjee, J. Lloret, A deep multimodal system for provenance filtering with universal forgery detection and localization. Multimed Tools Appl, 80 (2020) 17025–17044.
  * [30] K. Karampidis, E. Kavallieratou, G. Papadourakis, A Dilated Convolutional Neural Network as Feature Selector for Spatial Image Steganalysis – A Hybrid Classification Scheme, Pattern Recognit. Image Anal. 30 (2020) 342–358.
  * [31] J. Wu, K. Feng, X. Chang, T. Yang, A Forensic Method for DeepFake Image based on Face Recognition, In: High Performance Computing and Cluster Technologies Conference & International Conference on Big Data and Artificial Intelligence (HPCCT & BDAI), 2020, pp. 104–108.
  * [32] F. Marra, D. Gragnaniello, L. Verdoliva and G. Poggi, A Full-Image Full-Resolution End-to-End-Trainable CNN Framework for Image Forgery Detection, IEEE Access 8 (2020).
  * [33] A. Khodabakhsh and C. Busch, A Generalizable Deepfake Detector based on Neural Conditional Distribution Modelling, In: International Conference of the Biometrics Special Interest Group (BIOSIG), 2020, pp. 1-5.
  * [34] A.L. Sandoval Orozco, C. Quinto Huamán, D. Povedano Álvarez, L. J. García Villalba, A machine learning forensics technique to detect post-processing in digital videos, Future Generation Computer Systems 111 (2020) 199-212.
  * [35] Y. Rodríguez-Ortega, D.M. Ballesteros, D. Renza, A Machine Learning Model to Detect Fake Voice, In: Springer International Conference on Applied Informatics, 2020, pp. 3-13.
  * [36] N. Koroniotis, N. Moustafa, E. Sitnikova, A new network forensic framework based on deep learning for Internet of Things networks: A particle deep framework, Future Generation Computer Systems, Volume 110 (2020) 91-106.
  * [37] T. Tuncer, A. Subasi, F. Ertam, S. Dogan,A novel spiral pattern and 2D M4 pooling based environmental sound classification method, Applied Acoustics 170 (2020).
  * [38] C.C. Huang, C.E. Lee, L.L. Thing Vrizlynn, A Novel Video Forgery Detection Model Based on Triangular Polarity Feature Classification, Digital Crime and Forensics 12 (1) (2020) 14-34.
  * [39] E.I. Abd El-Latif, A. Taha, H.H. Zayed, A Passive Approach for Detecting Image Splicing Based on Deep Learning and Wavelet Transform. Arab J Sci Eng 45 (2020) 3379–3386.
  * [40] E. Akbal, An automated environmental sound classification methods based on statistical and textural feature, Applied Acoustics 167 (2020).
  * [41] P. Mehta, S. Maheshkar, V. Maheshkar, An Effective Video Bootleg Detection Algorithm Based on Noise Analysis in Frequency Domain, In: Springer International Conference on Computer Vision and Image Processing , 2019, pp. 227-238.
  * [42] D. Wang, T. Gao, An efficient USM sharpening detection method for small-size JPEG image, Journal of Information Security and Applications, Volume 51 (2020).
  * [43] G. Xue, S. Liu, D. Gong, Y. Ma, ATP-DenseNet: a hybrid deep learning-based gender identification of handwriting, Neural Computing and Applications 33 (2021) 4611–4622.
  * [44] T. Raghunadha Reddy, M. Srilatha, M. Sreenivas, N. Rajasekhar, Author Profiles Prediction Using Syntactic and Content-Based Features, In: Data Engineering and Communication Technology, 2020, pp. 265-273.
  * [45] Y. Wei, Y. Chen, X. Kang, Z. J. Wang and L. Xiao, Auto-Generating Neural Networks with Reinforcement Learning for Multi-Purpose Image Forensics, In: IEEE International Conference on Multimedia and Expo (ICME), 2020, pp. 1-6.
  * [46] X. Du, Q. Le and M. Scanlon, Automated Artefact Relevancy Determination from Artefact Metadata and Associated Timeline Events, In: IEEE International Conference on Cyber Security and Protection of Digital Services (Cyber Security), 2020, pp. 1-8.
  * [47] Y. Chen, Z. Wang, Z.J. Wang and X. Kang, Automated Design of Neural Network Architectures With Reinforcement Learning for Detection of Global Manipulations, IEEE Journal of Selected Topics in Signal Processing 14 (5) (2020) 997-1011.
  * [48] Z. Guo, L. Hu, M. Xia, G. Yang, Blind detection of glow-based facial forgery, Multimed Tools Appl 80 (2021) 7687–7710.
  * [49] C.H. Ngejane, J.H.P. Eloff, T.J. Sefara, V.N. Marivate, Digital forensics supported by machine learning for the detection of online sexual predatory chats, Forensic Science International: Digital Investigation 36 (2021).
  * [50] A.R. Javed and Z. Jalil, Byte-Level Object Identification for Forensic Investigation of Digital Images, In: IEEE International Conference on Cyber Warfare and Security (ICCWS), 2020, pp. 1-4.
  * [51] C. Kang, Su. Kang, Camera model identification using a deep network and a reduced edge dataset, Neural Computing and Applications 32 (2020) 13139–13146.
  * [52] M.H. Al Banna, M. Ali Haider, M.J. Al Nahian, M. M. Islam, K. A. Taher and M. S. Kaiser, Camera Model Identification using Deep CNN and Transfer Learning Approach, In: IEEE International Conference on Robotics, Electrical and Signal Processing Techniques (ICREST), 2019, pp. 626-630.
  * [53] M. Kulkarni, S. Kakad, R. Mehra, B. Mehta, Camera Model Identification Using Transfer Learning, In: Machine Learning and Information Processing, 2020, pp.61-68.
  * [54] K.H. Rhee, Composition of Visual Feature Vector Pattern for Deep Learning in Image Forensics, IEEE Access 8 (2020) 188970-188980.
  * [55] C. Yang, H. Li, F. Lin, B. Jiang and H. Zhao, Constrained R-Cnn: A General Image Manipulation Detection Model, In: IEEE International Conference on Multimedia and Expo (ICME), 2020, pp. 1-6.
  * [56] X. Wang, S. Niu, H. Wang, Contrast Adjustment Forensics Based on Second-Order Statistical and Deep Learning Features, In: Springer International Conference on Artificial Intelligence and Security, 2020, pp. 27-37.
  * [57] A. Sayakkara, L. Miralles-Pechuán, N. Le-Khac, M. Scanlon, Cutting Through the Emissions: Feature Selection from Electromagnetic Side Channel Data for Activity Detection, Forensic Science International: Digital Investigation 32 (2020).
  * [58] D.B. Oh, K.H. Park, H.K. Kim, De-Wipimization: Detection of data wiping traces for investigating NTFS file system, Computers & Security 99 (2020).
  * [59] J. Ni Shu, H. Xie, Decoupling-Gan for Camera Model Identification of JPEG Compressed Images, In: IEEE International Conference on Multimedia and Expo (ICME), 2020, pp. 1-6.
  * [60] D. Feng, X. Lu, X. Lin, Deep Detection for Face Manipulation, In: Springer International Conference on Neural Information Processing, 2020, pp. 316-323.
  * [61] V. Tirumaladass, S. Axelsson, M. Dougherty, M.A. Rasool and M. H. Eldefrawy, Deep learning-based Electromagnetic Side-Channel Analysis for the Investigation of IoT Devices, In: IEEE International Conference on Inventive Research in Computing Applications (ICIRCA), 2020, pp. 150-156.
  * [62] V.U. Sameer, R. Naskar, Deep siamese network for limited labels classification in source camera identification. Multimed Tools Appl 79 (2020) 28079–28104.
  * [63] H. -T. Wang and P. -C. Su, Deep-Learning-Based Block Similarity Evaluation for Image Forensics, In: IEEE International Conference on Consumer Electronics - Taiwan (ICCE-Taiwan), 2020, pp. 1-2.
  * [64] L. Guarnera, O. Giudice and S. Battiato, DeepFake Detection by Analyzing Convolutional Traces, In: IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), 2020, pp. 2841-2850.
  * [65] F. Anda, N. Le-Khac, M. Scanlon, DeepUAge: Improving Underage Age Estimation Accuracy to Aid CSEM Investigation, Forensic Science International: Digital Investigation 32 (2020).
  * [66] K. Yau, KP. Chow, SM. Yiu, Detecting Attacks on a Water Treatment System Using Oneclass Support Vector Machines, In: IFIP International Conference on Digital Forensics, 2020, pp. 95-108.
  * [67] Z. Zhao, P.i Wang, W. Lu, Detecting Deepfake Video by Learning Two-Level Features with Two-Stream Convolutional Neural Network, In: ACM International Conference on Computing and Artificial Intelligence (ICCAI), 2020, pp. 291–297.
  * [68] R.A. Frick, H. Liu, M. Steinebach, Detecting double compression and splicing using benfords first digit law, In: ACM International Conference on Availability, Reliability and Security (ARES), 2020, pp. 1–9.
  * [69] J. F.P. Sampaio, F.A. de O. Nascimento, Detection of AMR double compression using compressed-domain speech features, Forensic Science International: Digital Investigation 33 (2020).
  * [70] T. Wu, D. Yan, L. Xiang, R. Wang, Detection of Operation Type and Order for Digital Speech, In: Springer Conference on Sound and Music Technology (CSMT), 2020, pp. 25-37.
  * [71] D. Bhardwaj, C. Kumawat and V. Pankajakshan, Detection of Various Anti-Forensic Operations Based on DCT Coefficient Analysis, In: IEEE India Council International Conference (INDICON), 2018, pp. 1-5.
  * [72] D. Yan, T. Wu, Detection of Various Speech Forgery Operations Based on Recurrent Neural Network, In: Springer International Conference on Security and Privacy in Digital Economy, 2020, pp. 415-426.
  * [73] G. Singh, K. Singh, Digital image forensic approach based on the second-order statistical analysis of CFA artifacts, Forensic Science International: Digital Investigation 32 (2020).
  * [74] S. Sharma, U. Ghanekar, Digital Image Forensics Using Local Optimal-Oriented Pattern and ELM, In: Soft Computing: Theories and Applications, 2020 , pp. 311-319.
  * [75] A. Büker and C. Hanilçi, Double Compressed AMR Audio Detection Using Long-Term Features and Deep Neural Networks, In: IEEE International Conference on Electrical and Electronics Engineering (ELECO), 2019, pp. 590-594.
  * [76] H. Kim, I. Kim, K. Kim, AIBFT: Artificial Intelligence Browser Forensic Toolkit, Forensic Science International: Digital Investigation 36 (2021).
  * [77] M. Barni, E. Nowroozi, B. Tondi and B. Zhang, Effectiveness of Random Deep Feature Selection for Securing Image Manipulation Detectors Against Adversarial Examples, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2020, pp. 2977-2981.
  * [78] P. Yang et al., Efficient Video Integrity Analysis Through Container Characterization, IEEE Journal of Selected Topics in Signal Processing 14 (5) (2020) 947-954.
  * [79] M. Mao, Z. Xiao, X. Kang, X. Li, L. Xiao, Electric Network Frequency Based Audio Forensics Using Convolutional Neural Networks, In: IFIP International Conference on Digital Forensics, 2020, pp. 253-270.
  * [80] S. M.L. Lima, D. M. Souza, R.P. Pinheiro, S. H.M.T. Silva, P.G. Lopes, R.D.T. de Lima, J.R. de Oliveira, T. de A. Monteiro, S.M.M. Fernandes, E. de Q. Albuquerque, W. W.A. da Silva, W. P. dos Santos, Next generation antivirus endowed with bitwise morphological extreme learning machines, Microprocessors and Microsystems 81 (2021).
  * [81] J. Fei, Z. Xia, P. Yu, Exposing AI-generated videos with motion magnification, Multimed Tools Appl 80 (2021) 30789–30802.
  * [82] O. Mayer and M.C. Stamm, Exposing Fake Images With Forensic Similarity Graphs, IEEE Journal of Selected Topics in Signal Processing 14 (5) (2020) 1049-1064.
  * [83] B. Liu, C. Pun, Exposing splicing forgery in realistic scenes using deep fusion network, Information Sciences 526, (2020) 133-150.
  * [84] YK. Lin, CY. Chang, Face Forgery Detection Based on Deep Learning, In: International Conference on Security with Intelligent Computing and Big-data Services, 2019, pp. 270-278.
  * [85] L. Chen, L. Chen, A. Li and X. Wang, FATE:Fingerprints Automatically Targeting and Extracting for image source identification, In: International Conference on Big Data Computing and Communications (BIGCOM), 2020, pp. 117-121.
  * [86] G. Mittal, P. Korus and N. Memon, FiFTy: Large-Scale File Fragment Type Identification Using Convolutional Neural Networks, IEEE Transactions on Information Forensics and Security 16 (2021) 28-41.
  * [87] L. Guarnera, O. Giudice and S. Battiato, Fighting Deepfake by Exposing the Convolutional Traces on Images, IEEE Access 8 (2020) 165085-165098.
  * [88] S. Gupta, M. Kumar, Forensic document examination system using boosting and bagging methodologies, Soft Comput 24 (2020) 5409–5426.
  * [89] M.T. Jafar, M. Ababneh, M. Al-Zoube, A. Elhassan, Forensics and Analysis of Deepfake Videos, In: International Conference on Information and Communication Systems (ICICS), 2020, pp. 053-058.
  * [90] J. Baek, Y. Yoo and S. Bae, Generative Adversarial Ensemble Learning for Face Forensics, IEEE Access 8 (2020) 45421-45431.
  * [91] Y. Li, Ming Xia, X. Liu, G. Yang, Identification of various image retargeting techniques using hybrid features, Journal of Information Security and Applications 51 (2020).
  * [92] Y. Ye, L. Lao, D. Yan, R. Wang, Y. He, Identification of Weakly Pitch-Shifted Voice Based on Convolutional Neural Network, Digital Multimedia Broadcasting 2020 (2020).
  * [93] J. Wang, Q. Ni, G. Liu, X. Luo, S. Kr. Jha, Image splicing detection based on convolutional neural network with weight combination strategy, Journal of Information Security and Applications 54 (2020).
  * [94] A. Ghosh, Z. Zhong, S. Cruz, S. Veeravasarapu, M. Singh and T. E. Boult, Infoprint: Information Theoretic Digital Image Forensics, In: IEEE International Conference on Image Processing (ICIP), 2020, pp. 638-642.
  * [95] Y. Wei, KP. Chow, SM. Yiu, Insider Threat Detection Using Multi-autoencoder Filtering and Unsupervised Learning, In: IFIP International Conference on Digital Forensics, 2020, pp. 273-290.
  * [96] W. Quan, K. Wang, D. Yan, X. Zhang, D. Pellerin, Learn with diversity and from harder samples: Improving the generalization of CNN-Based detection of computer-generated images, Forensic Science International: Digital Investigation 35 (2020).
  * [97] D. Spiekermann, J. Keller, Unsupervised packet-based anomaly detection in virtual networks, Computer Networks 192 (2021).
  * [98] B. Liu, Ch. Pun, Locating splicing forgery by adaptive-SVD noise estimation and vicinity noise descriptor, Neurocomputing 387 (2020) 172-187.
  * [99] N. M. Baishya and P. K. Bora, Luminance Channel Based Camera Model Identification, In: International Conference on Signal Processing and Communications (SPCOM), 2020, pp. 1-5.
  * [100] I. -J. Yu, S. -H. Nam, W. Ahn, M. -J. Kwon and H. -K. Lee, Manipulation Classification for JPEG Images Using Multi-Domain Features, In: IEEE Access 8 (2020) pp. 210837-210854.
  * [101] F. Ding, H. Wu, G. Zhu and Y. -Q. Shi, METEOR: Measurable Energy Map Toward the Estimation of Resampling Rate via a Convolutional Neural Network, In: IEEE Transactions on Circuits and Systems for Video Technology 30 (12) (2020) 4715-4727.
  * [102] G. Boato, D. Dang-Nguyen and F. G. B. De Natale, Morphological Filter Detector for Image Forensics Applications, IEEE Access 8 (2020) 13549-13560.
  * [103] A. U. Deshpande, A. Narayan Harish, S. Singh, V. Verma and N. Khanna, Neural Network based Block-Level Detection of Same Quality Factor Double JPEG Compression, In: International Conference on Signal Processing and Integrated Networks (SPIN), 2020, pp. 828-833.
  * [104] J. Wang, W. Huang, X. Luo, Non-aligned double JPEG compression detection based on refined Markov features in QDCT domain, Real-Time Image 17 (2020) 7–16.
  * [105] A. Kuznetsov, On deep learning approach in remote sensing data forgery detection, In: International Conference on Information Technology and Nanotechnology (ITNT), 2020, pp. 1-4.
  * [106] H. Dang, F. Liu, J. Stehouwer, X. Liu and A. K. Jain, On the Detection of Digital Face Manipulation, In: IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2020, pp. 5780-5789.
  * [107] O. Mayer, B. Hosler and M. C. Stamm, Open Set Video Camera Model Verification, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2020, pp. 2962-2966.
  * [108] M. Elhoseny, M.M. Selim, K. hankar, Optimal Deep Learning based Convolution Neural Network for digital forensics Face Sketch Synthesis in internet of things (IoT), International Journal of Machine Learning and Cybernetics 12 (2021) 3249–3260.
  * [109] H. Jain, S. Joshi, G. Gupta, Passive classification of source printer using text-line-level geometric distortion signatures from scanned images of printed documents, Multimed Tools Appl 79 (2020) 7377–7400.
  * [110] F. Ullah, S. Jabbar, F. Al-Turjman, Programmers’ de-anonymization using a hybrid approach of abstract syntax tree and deep learning, Technological Forecasting and Social Change, 159 (2020).
  * [111] Y. Quan, X. Lin and C. -T. Li, Provenance Inference for Instagram Photos Through Device Fingerprinting, IEEE Access 8 (2020) 168309-168320.
  * [112] I. Tsimperidis, P. D. Yoo, K. Taha, A. Mylonas and V. Katos, R2BN: An Adaptive Model for Keystroke-Dynamics-Based Educational Level Classification, IEEE Transactions on Cybernetics 50 (2) (2020) 525-535.
  * [113] X. Shen, X. Shao, Q. Ge and L. Liu, RARS: Recognition of Audio Recording Source Based on Residual Neural Network, IEEE/ACM Transactions on Audio, Speech, and Language Processing 29 (2021) 575-584.
  * [114] A. Anjum, S. Islam, Recapture detection technique based on edge-types by analysing high-frequency components in digital images acquired through LCD screens. Multimed Tools Appl 79 (2020) 6965–6985.
  * [115] A. Chintha et al., Recurrent Convolutional Structures for Audio Spoof and Video Deepfake Detection, IEEE Journal of Selected Topics in Signal Processing 14 (5) (2020) 1024-1037.
  * [116] A.M. Rafi, T.I. Tonmoy, U. Kamal, et al. RemNet: remnant convolutional neural network for camera model identification, Neural Comput & Applic 33 (2021) 3655–3670.
  * [117] L. Peng, X. Liao, & M. Chen, Resampling parameter estimation via dual-filtering based convolutional neural network, Multimedia Systems 27 (2020) 363–370.
  * [118] X. Liao, K. Li, X. Zhu and K. J. R. Liu, Robust Detection of Image Operator Chain With Two-Stream Convolutional Neural Network, IEEE Journal of Selected Topics in Signal Processing 14 (5) (2020) 955-968.
  * [119] N. Alipour, A. Behrad, Semantic segmentation of JPEG blocks using a deep CNN for non-aligned JPEG forgery detection and localization, Multimed Tools Appl 79 (2020) 8249–8265.
  * [120] V. inolin, M. Sucharitha, Spliced Image Detection in 3D Lighting Environments Using Neural Networks, In: Intelligent System Design, 2021, pp. 143-152.
  * [121] X. Wu, Z. Xie, Y. Gao and Y. Xiao, SSTNet: Detecting Manipulated Faces Through Spatial, Steganalysis and Temporal Features, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2020, pp. 2952-2956.
  * [122] X. Lin, J. Zhu and D. Chen, Subband Aware CNN for Cell-Phone Recognition, IEEE Signal Processing Letters 27 (2020) 605-609.
  * [123] X. Ding, Z. Raziei, E.C. Larson, et al., Swapped face detection using deep learning and subjective assessment, EURASIP Journal on Information Security 6 (2020).
  * [124] F. Ahmed, F. Khelifi, A. Lawgaly and A. Bouridane, Temporal Image Forensic Analysis for Picture Dating with Deep Learning, In: International Conference on Computing, Electronics & Communications Engineering (iCCECE), 2020, pp. 109-114.
  * [125] P. Wang, F. Liu, C. Yang, Thresholding binary coding for image forensics of weak sharpening, Signal Processing: Image Communication 88 (2020).
  * [126] A. Maier, B. Lorch and C. Riess, Toward Reliable Models For Authenticating Multimedia Content: Detecting Resampling Artifacts With Bayesian Neural Networks, In: IEEE International Conference on Image Processing (ICIP), 2020, pp. 1251-1255.
  * [127] I. Masi, A. Killekar, R.M. Mascarenhas, S.P. Gurudatt, W. AbdAlmageed, Two-Branch Recurrent Network for Isolating Deepfakes in Videos, In: European Conference on Computer Vision, 2020, pp. 667-684.
  * [128] P. Johnston, E. Elyan, & C. Jayne, Video tampering localisation using features learned from authentic content, Neural Comput & Applic 32 (2020) 12243–12257.
  * [129] T. Yang, J. Wu, L. Liu, X. Chang and G. Feng, VTD-Net: Depth Face Forgery Oriented Video Tampering Detection based on Convolutional Neural Network, In: Chinese Control Conference (CCC), 2020, pp. 7247-7251.
  * [130] L. Yang, P. Yang, R. Ni, Y. Zhao, Xception-Based General Forensic Method on Small-Size Images, In: Advances in Intelligent Information Hiding and Multimedia Signal Processing, 2020, pp. 361-369.
  * [131] M. Wang, X. Zhang and S. Rahardja, A Hybrid Approach for Mobile Phone Clustering with Speech Recordings, In: International Conference on Ubi-Media Computing (Ubi-Media), 2019, pp. 205-209.
  * [132] Y. Chen, X. Kang, Y.Q. Shi, et al. A multi-purpose image forensic method using densely connected convolutional neural networks. J Real-Time Image 16 (2019) 725–740.
  * [133] S. Seshadri, K.R. Akshatha, A.K. Karunakar, K.H. Paul, A Preliminary Approach to Using PRNU Based Transfer Learning for Camera Identification, In: Science and Information Conference, 2020, pp 246-255.
  * [134] M. Ali, S. Shiaeles, N. Clarke, D. Kontogeorgis, A proactive malicious software identification approach for digital forensic examiners, Journal of Information Security and Applications 47 (2019) 139-155.
  * [135] D.B. Tariang, R. S. Chakraborty and R. Naskar, A Robust Residual Dense Neural Network For Countering Antiforensic Attack on Median Filtered Images, IEEE Signal Processing Letters 26 (8) (2019) 1132-1136.
  * [136] B. Hosler et al., A Video Camera Model Identification System Using Deep Learning and Fusion, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2019, pp. 8271-8275.
  * [137] Z. Zuo, J. Li, B. Wei, L. Yang, F. Chao and N. Naik, Adaptive Activation Function Generation for Artificial Neural Networks through Fuzzy Inference with Application in Grooming Text Categorisation, In: IEEE International Conference on Fuzzy Systems (FUZZ-IEEE), 2019, pp. 1-6.
  * [138] Y. Liu, X. Zhu, X. Zhao and Y. Cao, Adversarial Learning for Constrained Image Splicing Detection and Localization Based on Atrous Convolution, IEEE Transactions on Information Forensics and Security 14 (10) (2019) 2551-2566.
  * [139] S. Qu, An approach based on object detection for image forensics, In: International Conference on Industrial Artificial Intelligence (IAI), 2019, pp. 1-6.
  * [140] R.M.A. Mohammad, An Enhanced Multiclass Support Vector Machine Model and its Application to Classifying File Systems Affected by a Digital Crime, Journal of King Saud University - Computer and Information Sciences (2019).
  * [141] X. Wang, H. Wang, S. Niu, An Image Forensic Method for AI Inpainting Using Faster R-CNN, In: International Conference on Artificial Intelligence and Security, 2019, pp. 476-487.
  * [142] Q. Zhang, J. Sang, W. Wu, B. Cai, Z. Wu, H. Hu, An Image Splicing and Copy-Move Detection Method Based on Convolutional Neural Networks with Global Average Pooling, In International Conference on Image and Graphics, 2019, pp. 255-265.
  * [143] X. Zhang, Z. H. Sun, S. Karaman and S. -F. Chang, Discovering Image Manipulation History by Pairwise Relation and Forensics Tools, IEEE Journal of Selected Topics in Signal Processing 14 (5) (2020) 1012-1023.
  * [144] S. Jadhav, R. Patole and P. Rege, Audio Splicing Detection using Convolutional Neural Network, In: International Conference on Computing, Communication and Networking Technologies (ICCCNT), 2019, pp. 1-5.
  * [145] E. Tripathi, U. Kumar, S. P. Tripathi and S. Yadav, Automated Image Splicing Detection using Texture based Feature Criterion and Fuzzy Support Vector Machine based Classifier, In: International Conference on Cutting-edge Technologies in Engineering (ICon-CuTE), 2019, pp. 81-86.
  * [146] S. Shao, C. Tunc, A. Al-Shawi and S. Hariri, Automated Twitter Author Clustering with Unsupervised Learning for Social Media Forensics, In: International Conference on Computer Systems and Applications (AICCSA), 2019, pp. 1-8.
  * [147] S. M. Darwish, A. A. El-Zoghabi, and H. M. Elgohary, Bio-inspired Expert System for Identifying Questioned Documents’ Printer Source Suitable for Digital Forensics, In: International Conference on Software and Information Engineering (ICSIE ’19). Association for Computing Machinery, 2019, pp. 100–104.
  * [148] J. Wu, X. Chang, T. Yang and K. Feng, Blind Forensic Method Based on Convolutional Neural Networks for Image Splicing Detection, In: IEEE 5th International Conference on Computer and Communications (ICCC), 2019, pp. 2014-2018.
  * [149] X. Ding, Y. Chen, Z. Tang and Y. Huang, Camera Identification Based on Domain Knowledge-Driven Deep Multi-Task Learning, IEEE Access 7 (2019) 25878-25890.
  * [150] Z. Zou, Y. Liu, W. Zhang, and Y. Chen, Camera Model Identification Based on Residual Extraction Module and SqueezeNet, In: International Conference on Big Data Technologies (ICBDT2019). Association for Computing Machinery, 2019, 211–215.
  * [151] H.H. Nguyen, J. Yamagishi, and I. Echizen, Capsule-forensics: Using Capsule Networks to Detect Forged Images and Videos, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2019, pp. 2307-2311.
  * [152] S. Walia and K. Kumar, Characterization of splicing in digital images using gray scale co-occurrence matrices, In: International Conference on Contemporary Computing (IC3), 2019, pp. 1-6.
  * [153] T. Narendra, A. M.S. and S. P.S., Classification of Pitch Disguise Level with Artificial Neural Networks, In: International Conference on Communication and Signal Processing (ICCSP), 2019, pp. 0631-0635.
  * [154] T. Cai, Z. Shao, Y. Tomioka, Y. Liu and Z. Li, CNN-based Camera Model Identification Using Image Noise in Frequency Domain, In: IEEE International Conference on Systems, Man and Cybernetics (SMC), 2019, pp. 3518-3524.
  * [155] F. Ahmed, F. Khelifi, A. Lawgaly and A. Bouridane, Comparative Analysis of a Deep Convolutional Neural Network for Source Camera Identification, In: IEEE 12th International Conference on Global Security, Safety and Sustainability (ICGS3), 2019, pp. 1-6.
  * [156] S. Nam et al., Content-Aware Image Resizing Detection Using Deep Neural Network, In: IEEE International Conference on Image Processing (ICIP), 2019, pp. 106-110.
  * [157] W. Liu and C. Y. Wu, Crime Scene Investigation Image Retrieval using a Hierarchical Approach and Rank Fusion, In: IEEE Conference on Industrial Electronics and Applications (ICIEA), 2019, pp. 1974-1978.
  * [158] Y. Keim, A.K. Mohapatra, Cyber threat intelligence framework using advanced malware forensics, Information Technology (2019).
  * [159] P.M Shelke, R.S. Prasad, DBFS: Dragonfly Bayes Fusion System to detect the tampered JPEG image for forensic analysis, Evolutionary Intelligence (2019).
  * [160] B. Liu, CM. Pun, Deep Fusion Network for Splicing Forgery Localization, In: European Conference on Computer Vision, 2019, pp. 237-251.
  * [161] A. Mazumdar and P. K. Bora, Deep Learning-Based Classification of Illumination Maps for Exposing Face Splicing Forgeries in Images, In: IEEE International Conference on Image Processing (ICIP), 2019, pp. 116-120.
  * [162] P. Domingues and A.Frazão Rosário, Deep Learning-based Facial Detection and Recognition in Still Images for Digital Forensics, In: International Conference on Availability, Reliability and Security (ARES ’19). Association for Computing Machinery, 2019, pp. 1–10.
  * [163] C. Deng, Z. Li, Xinbo Gao, and D. Tao, Deep Multi-scale Discriminative Networks for Double JPEG Compression Forensics, ACM Transactions on Intelligent Systems and Technology 10 (2) (2019) 1-20.
  * [164] S. Luo, A. Peng, H. Zeng, X. Kang and L. Liu, Deep Residual Learning Using Data Augmentation for Median Filtering Forensics of Digital Images, IEEE Access 7 (2019) 80614-80621.
  * [165] B. Wei, M. Yu, K. Chen and J. Jiang, Deep-BIF: Blind Image Forensics Based on Deep Learning, In: IEEE Conference on Dependable and Secure Computing (DSC), 2019, pp. 1-6.
  * [166] Y. Chen, F. Peng, X. Kang and Z. J. Wang, Depthwise Separable Convolutional Neural Network for Image Forensics, In: IEEE Visual Communications and Image Processing (VCIP), 2019, pp. 1-4.
  * [167] Z. Zhang, Q. Liu, Detect Video Forgery by Performing Transfer Learning on Deep Neural Network, In: International Conference on Natural Computation, Fuzzy Systems and Knowledge Discovery, 2020, pp. 415-422.
  * [168] B. Li, H. Zhang, H. Luo, et al., Detecting double JPEG compression and its related anti-forensic operations with CNN, Multimed Tools Appl 78 (2019) 8577–8601.
  * [169] S. Rajoo et al., Detecting False Messages in the Smartphone Fault Reporting System, In: International Conference of Reliable Information and Communication Technology, 2020, pp. 759-768.
  * [170] J. Hyung Hong, Y. Yang, B. Tae Oh, Detection of frame deletion in HEVC-Coded video in the compressed domain, Digital Investigation 30 (2019) 23-31.
  * [171] A. Mazumdar, J. Singh, Y.S. Tomar, P.K. Bora, Detection of Image Manipulations Using Siamese Convolutional Neural Networks, In: International Conference on Pattern Recognition and Machine Intelligence, 2019, pp. 226-233.
  * [172] S.K. Tiwari, A. Mazumdar, P.K. Bora, Detection of Splicing Forgery Using CNN-Extracted Camera-Specific Features, In: International Conference on Pattern Recognition and Machine Intelligence, 2019, pp. 473-481.
  * [173] H. Wang, J. Wang, J. Zhai and X. Luo, Detection of Triple JPEG Compressed Color Images, IEEE Access 7 (2019) 113094-113102.
  * [174] H. Song, B. Kwon, S. Lee and S. Lee, Dictionary based Compression Type Classification using a CNN Architecture, In: Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), 2019, pp. 245-248.
  * [175] S.H. Mekala, Z. Baig, Digital Forensics for Drone Data – Intelligent Clustering Using Self Organising Maps, In: International Conference on Future Network Systems and Security, 2019, pp. 172-189.
  * [176] Q. Zhang, H. Xiao, F. Xue, W. Lu, H. Liu, F. Huang, Digital image forensics of non-uniform deblurring, Signal Processing: Image Communication 76 (2019) 167-177.
  * [177] B. Boenninghoff, S. Hessler, D. Kolossa and R. M. Nickel, Explainable Authorship Verification in Social Media via Attention-based Similarity Learning, In: IEEE International Conference on Big Data (Big Data), 2019, pp. 36-45.
  * [178] X. Yang, Y. Li and S. Lyu, Exposing Deep Fakes Using Inconsistent Head Poses, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2019, pp. 8261-8265.
  * [179] A. Rössler, D. Cozzolino, L. Verdoliva, C. Riess, J. Thies and M. Niessner, FaceForensics++: Learning to Detect Manipulated Facial Images, In: IEEE/CVF International Conference on Computer Vision (ICCV), 2019, pp. 1-11.
  * [180] S.Joshi, S. Saxena, N.Khanna, First steps toward CNN based source classification of document images shared over messaging app, Signal Processing: Image Communication 78 (2019) 32-41.
  * [181] K. H. Rhee, Forensic Detection Using Bit-Planes Slicing of Median Filtering Image, IEEE Access 7 (2019) 92586-92597.
  * [182] G. Pop, S. Mihalache and D. Burileanu, Forensic Recognition of Narrowband AMR Signals, In: International Conference on Speech Technology and Human-Computer Dialogue (SpeD), 2019, pp. 1-6.
  * [183] O. Mayer and M.C. Stamm, Forensic Similarity for Digital Images, IEEE Transactions on Information Forensics and Security 15 (2020) 1331-1346.
  * [184] L. Darmet, K. Wang and F. Cayre, GRAFT: Unsupervised Adaptation to Resizing for Detection of Image Manipulation, IEEE Access 8 (2020) 55619-55632.
  * [185] A. Algurashi, W. Wang, Hybrid Feature Selection Method for Improving File Fragment Classification, In: International Conference on Innovative Techniques and Applications of Artificial Intelligence, 2019, pp. 379-391.
  * [186] Y. Huang, B. Li, M. Barni and J. Huang, Identification of VoIP Speech With Multiple Domain Deep Features, IEEE Transactions on Information Forensics and Security 15 (2020) 2253-2267.
  * [187] X. Liu, W. Lu, W. Liu, S. Luo, Y. Liang and M. Li, Image Deblocking Detection Based on a Convolutional Neural Network, IEEE Access 7 (2019) 26432-2643.
  * [188] C. Song, P. Zeng, Z. Wang, T. Li, L. Qiao and L. Shen, Image Forgery Detection Based on Motion Blur Estimated Using Convolutional Neural Network, IEEE Sensors Journal 19 (23) (2019) 11601-11611.
  * [189] Y. Liang, Y. Fang, S. Luo and B. Chen, Image Resampling Detection Based on Convolutional Neural Network, In: International Conference on Computational Intelligence and Security (CIS), 2019, pp. 257-261.
  * [190] W. Quan, K. Wang, D.M. Yan, D. Pellerin, and X. Zhang, Impact of Data Preparation and CNN’s First Layer on Performance of Image Forensics: A Case Study of Detecting Colorized Images, In: IEEE/WIC/ACM International Conference on Web Intelligence - Companion Volume (WI ’19 Companion), 2019, pp. 127–13.
  * [191] F.Anda, D. Lillis, A. Kanta, B. A. Becker, E. Bou-Harb, N. Le-Khac, and M. Scanlon, Improving Borderline Adulthood Facial Age Estimation through Ensemble Learning, In: International Conference on Availability, Reliability and Security (ARES ’19), 2019, 1–8.
  * [192] A. Sayakkara, N. Le-Khac, M. Scanlon, Leveraging Electromagnetic Side-Channel Analysis for the Investigation of IoT Devices, Digital Investigation29 (2019) S94-S103.
  * [193] X. Du and M. Scanlon, Methodology for the Automated Metadata-Based Classification of Incriminating Digital Forensic Artefacts, In: International Conference on Availability, Reliability and Security (ARES ’19), 2019, pp. 1–8.
  * [194] K. H. Rhee, Improvement Feature Vector: Autoregressive Model of Median Filter Residual, IEEE Access 7 (2019) 77524-77540.
  * [195] S. Saleem, A. Dilawari and U. G. khan, Multimedia Forensic: An Approach for Splicing Detection based on Deep Visual Features, In: International Conference on Robotics and Automation in Industry (ICRAI), 2019, pp. 1-6.
  * [196] Z.F. Elsharkawy, S.A.S. Abdelwahab, F.E. Abd El-Samie, et al., New and efficient blind detection algorithm for digital image forgery using homomorphic image processing, Multimed Tools Appl 78 (2019) 21585–21611.
  * [197] K. Zhang, Y. Liang, J. Zhang, Z. Wang and X. Li, No One Can Escape: A General Approach to Detect Tampered and Generated Image, IEEE Access 7 (2019) 129494-129503.
  * [198] D. Cozzolino and L. Verdoliva, Noiseprint: A CNN-Based Camera Model Fingerprint, IEEE Transactions on Information Forensics and Security 15 (2020) 144-159.
  * [199] X. Xuan, B. Peng, W. Wang, J. Dong, On the Generalization of GAN Image Forensics, In: Chinese Conference on Biometric Recognition, 2019, pp. 134-141.
  * [200] Y. Niu, B. Tondi, Y. Zhao and M. Barni, Primary Quantization Matrix Estimation of Double Compressed JPEG Images via CNN, IEEE Signal Processing Letters 27 (2020) 191-195.
  * [201] Y. Quan, X. Lin, CI. Li CT, Provenance Analysis for Instagram Photos, In: Australasian Conference on Data Mining, 2019, pp. 372-383.
  * [202] Q. Yin, J. Wang, X. Luo, J. Zhai, S. K. Jha and Y. Shi, Quaternion Convolutional Neural Network for Color Image Classification and Forensics, IEEE Access 7 (2019) 20293-20301.
  * [203] F. Ding, Y. Shi, G. Zhu, et al., Real-time estimation for the parameters of Gaussian filtering via deep learning. Real-Time Image 17 (2020) 17–27.
  * [204] L. Yu, Y. Zhang, H. Han, L. Zhang and F. Wu, Robust Median Filtering Forensics by CNN-Based Multiple Residuals Learning, IEEE Access 7 (2019) 120594-120602.
  * [205] W. Shan, Y. Yi, J. Qiu and A. Yin, Robust Median Filtering Forensics Using Image Deblocking and Filtered Residual Fusion, IEEE Access 7 (2019) 17174-17183.
  * [206] R. R.Ali, K. M. Mohamad, RX myKarve carving framework for reassembling complex fragmentations of JPEG images, Journal of King Saud University - Computer and Information Sciences 33 (1) (2021) 21-32.
  * [207] Z. Chen, B. Tondi, X. Li, R. Ni, Y. Zhao and M. Barni, Secure Detection of Image Manipulation by Means of Random Feature Selection, IEEE Transactions on Information Forensics and Security 14 (9) (2019) 2454-2469.
  * [208] S.K. Yarlagadda et al., Shadow Removal Detection and Localization for Forensics Analysis, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2019, pp. 2677-2681.
  * [209] O. Giudice, L. Guarnera, A. B. Paratore, G. M. Farinella and S. Battiato, Siamese Ballistics Neural Network, In: IEEE International Conference on Image Processing (ICIP), 2019, pp. 4045-4049.
  * [210] B. Boenninghoff, R. M. Nickel, S. Zeiler and D. Kolossa, Similarity Learning for Authorship Verification in Social Media, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2019, pp. 2457-2461.
  * [211] F. Ullah, J. Wang, S. Jabbar, F. Al-Turjman and M. Alazab, Source Code Authorship Attribution Using Hybrid Approach of Program Dependence Graph and Deep Learning Model, IEEE Access 7 (2019) 141987-141999.
  * [212] S. Joshi and N. Khanna, Source Printer Classification Using Printer Specific Local Texture Descriptor, IEEE Transactions on Information Forensics and Security 15 (2020) 160-171.
  * [213] C. Jin, R. Wang, D. Yan, Source smartphone identification by exploiting encoding characteristics of recorded speech, Digital Investigation 29 (2019) 129-146.
  * [214] B. Hadwiger, D. Baracchi, A. Piva and C. Riess, Towards Learned Color Representations for Image Splicing Detection, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2019, pp. 8281-8285.
  * [215] Q. Phan, G. Boato, R. Caldelli and I. Amerini, Tracking Multiple Image Sharing on Social Networks, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2019, pp. 8266-8270.
  * [216] S. Nam, J. Park, D. Kim, I. Yu, T. Kim and H. Lee, Two-Stream Network for Detecting Double Compression of H.264 Videos, In: IEEE International Conference on Image Processing (ICIP), 2019, pp. 111-115.
  * [217] M.F. Sabir, J.H. Jones, H. Liu, and A.V. Mbaziira, Using Machine Learning to Predict Stealthy Watermarks in Files During Cyber Crime Investigations, In: International Conference on Compute and Data Analysis (ICCDA), 2019 , pp. 20–25.
  * [218] Y. Li, Y. Zhang, L. Lu, Y. Jia, J. Liu, Using Neural Networks for Fake Colorized Image Detection, In: IFIP International Conference on Digital Forensics, 2019, pp. 201-215.
  * [219] Y. Gan, J. Yang and W. Lai, Video Object Forgery Detection Algorithm Based on VGG-11 Convolutional Neural Network, In: International Conference on Intelligent Computing, Automation and Systems (ICICAS), 2019, pp. 575-580.
  * [220] J. Xiao, S. Li and Q. Xu, Video-Based Evidence Analysis and Extraction in Digital Forensic Investigation, IEEE Access 7 (2019) 55432-55442.
  * [221] V.U. Sameer, I. Dali, R. Naskar, A Deep Learning Based Digital Forensic Solution to Blind Source Identification of Facebook Images, In: International Conference on Information Systems Security, 2018, pp. 291-303.
  * [222] J. Bakas, R. Naskar, A Digital Forensic Technique for Inter–Frame Video Forgery Detection Based on 3D CNN, In: International Conference on Information Systems Security, 2018, pp. 304-317.
  * [223] S. Agarwal, W. Fan and H. Farid, A Diverse Large-Scale Dataset for Evaluating Rebroadcast Attacks, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2018, pp. 1997-2001.
  * [224] A. El-Yamany, H. Fouad and Y. Raffat, A Generic Approach CNN-Based Camera Identification for Manipulated Images, In: IEEE International Conference on Electro/Information Technology (EIT), 2018, pp. 0165-0169.
  * [225] D.C. Moreira and J. M. Fechine, A Machine Learning-based Forensic Discriminator of Pornographic and Bikini Images, In: International Joint Conference on Neural Networks (IJCNN), 2018, pp. 1-8.
  * [226] B. Yang, X. Chen, T. Zhang, A Multichannel Convolutional Neural Network Based Forensics-Aware Scheme for Cyber-Physical-Social Systems, In: International Conference on Cloud Computing and Security, 2018, pp. 243-254.
  * [227] R.M. Mohammad, A Neural Network based Digital Forensics Classification, In: IEEE International Conference on Computer Systems and Applications (AICCSA), 2018, pp. 1-7.
  * [228] N. Huang, J. He and N. Zhu, A Novel Method for Detecting Image Forgery Based on Convolutional Neural Network, In: IEEE International Conference On Trust, Security And Privacy In Computing And Communications/ 12th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE), 2018, pp. 1702-1705.
  * [229] Y. Chen, Z.X. Lyu, X. Kang and Z. J. Wang, A Rotation-Invariant Convolutional Neural Network for Image Enhancement Forensics, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2018, pp. 2111-2115.
  * [230] Y. Zhang, V.L.L. Thing, A semi-feature learning approach for tampered region localization across multi-format images. Multimed Tools Appl 77 (2018) 25027–25052.
  * [231] M. Iuliani, D. Shullani, M. Fontani, S. Meucci and A. Piva, A Video Forensic Framework for the Unsupervised Analysis of MP4-Like File Container, IEEE Transactions on Information Forensics and Security 14 (3) (2019) 635-645.
  * [232] H. Gao, M. Hu, T. Gao, R. Cheng, An Effective Image Detection Algorithm for USM Sharpening Based on Pixel-Pair Histogram, In: Pacific Rim Conference on Multimedia, 2018, pp. 396-407.
  * [233] C.S. Prakash, A. Kumar, S. Maheshkar, et al., An integrated method of copy-move and splicing for image forgery detection, Multimed Tools Appl 77 (2018) 26939–26963.
  * [234] S. Joshi, M. Lomba, V. Goyal and N. Khanna, Augmented Data and Improved Noise Residual-Based CNN for Printer Source Identification, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2018, pp. 2002-2006.
  * [235] P. Wang, F. Liu, C. Yang, X. Luo, Blind forensics of image gamma transformation and its application in splicing detection, Journal of Visual Communication and Image Representation 55, (2018) 80-90.
  * [236] A. Kuzin, A. Fattakhov, I. Kibardin, V. I. Iglovikov and R. Dautov, Camera Model Identification Using Convolutional Neural Networks, In: IEEE International Conference on Big Data (Big Data), 2018, pp. 3107-3110.
  * [237] D. Cozzolino and L. Verdoliva, Camera-based Image Forgery Localization using Convolutional Neural Networks, In: European Signal Processing Conference (EUSIPCO), 2018, pp. 1372-1376.
  * [238] V. Verma, P. Khaturia and N. Khanna, Cell-Phone Identification from Recompressed Audio Recordings, In: National Conference on Communications (NCC), 2018, pp. 1-6.
  * [239] C. Chawla, D. Panwar, G. S. Anand and M. P. S. Bhatia, Classification Of Computer Generated Images From Photographic Images Using Convolutional Neural Networks, In: International Conference on Advances in Computing, Communication Control and Networking (ICACCCN), 2018, pp. 1053-1057.
  * [240] M. Barni, A. Costanzo, E. Nowroozi and B. Tondi, Cnn-Based Detection of Generic Contrast Adjustment with Jpeg Post-Processing, In: IEEE International Conference on Image Processing (ICIP), 2018, pp. 3803-3807.
  * [241] M. Abuhamad, J. Rhim, T. AbuHmed, S. Ullah, S. Kang, D. Nyang, Code authorship identification using convolutional neural networks, Future Generation Computer Systems 95 (2019) 104-115.
  * [242] L.C. Navarro, A.K.W. Navarro, A. Rocha, R. Dahab, Connecting the dots: Toward accountable machine-learning printer attribution methods, Journal of Visual Communication and Image Representation 53 (2018) 257-272.
  * [243] B. Bayar and M. C. Stamm, Constrained Convolutional Neural Networks: A New Approach Towards General Purpose Image Manipulation Detection, IEEE Transactions on Information Forensics and Security 13 (11) (2018) 2691-2706.
  * [244] MJ. Tsai, I. Yuadi, & YH. Tao, Decision-theoretic model to identify printed sources, Multimed Tools Appl 77 (2018) 27543–27587.
  * [245] Q. Le, O. Boydell, B. Mac Namee, M. Scanlon, Deep learning at the shallow end: Malware classification for non domain experts, Digital Investigation 26 (2018) S118-S126.
  * [246] J. Li, X. Liao, R. Hu and X. Liu, Detectability of the Image Operation Order: Upsampling and Mean Filtering, In: Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), 2018, pp. 1544-1549.
  * [247] X. Huang, S. Wang and G. Liu, Detecting Double Jpeg Compression with Same Quantization Matrix Based on Dense Cnn Feature, In: IEEE International Conference on Image Processing (ICIP), 2018, pp. 3813-3817.
  * [248] X. Liang, Z. Li, Y. Yang, Z. Zhang and Y. Zhang, Detection of Double Compression for HEVC Videos With Fake Bitrate, IEEE Access 6 (2018) 53243-53253.
  * [249] P. Peng, T. Sun, X. Jiang, K. Xu, B. Li and Y. Shi, Detection of Double JPEG Compression with the Same Quantization Matrix Based on Convolutional Neural Networks, In: Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), 2018, pp. 717-721.
  * [250] X. Ding, Y. Li, M. Xia, et al., Detection of motion compensated frame interpolation via motion-aligned temporal difference, Multimed Tools Appl 78 (2019) 7453–7477.
  * [251] Z. Wang, J. Wang, C. Zeng, Q. Min, Y. Tian and M. Zuo, Digital Audio Tampering Detection Based on ENF Consistency, In: International Conference on Wavelet Analysis and Pattern Recognition (ICWAPR), 2018, pp. 209-214.
  * [252] MJ. Tsai, I. Yuadi, Digital forensics of microscopic images for printed source identification. Multimed Tools Appl 77 (2018) 8729–8758.
  * [253] R. Wang, W. Lu, J. Li, S. Xiang, X. Zhao, and J. Wang, Digital Image Splicing Detection Based on Markov Features in QDCT and QWT Domain, Digital Crime and Forensics 10 (4) (2018) 90–107.
  * [254] A. Roy, D. B. Tariang, R. S. Chakraborty and R. Naskar, Discrete Cosine Transform Residual Feature Based Filtering Forgery and Splicing Detection in JPEG Images, In: IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW), 2018, pp. 1633-16338.
  * [255] J. Park, D. Cho, W. Ahn, HK. Lee, Double JPEG Detection in Mixed JPEG Quality Factors Using Deep Convolutional Neural Network, In: European Conference on Computer Vision, 2018, pp. 656-672.
  * [256] U.S. Venkata, R. Naskar, Eliminating the effects of illumination condition in feature based camera model identification, Visual Communication and Image Representation, 52 (2018) 24-32.
  * [257] B. Wang, K. Zhong, & M. Li, Ensemble classifier based source camera identification using fusion features, Multimed Tools Appl 78 (2019) 8397–8422.
  * [258] Y. Huang, L. Cao, J. Zhang, L. Pan and Y. Liu, Exploring Feature Coupling and Model Coupling for Image Source Identification, IEEE Transactions on Information Forensics and Security 13 (12) (2018) 3108-3121.
  * [259] E. R.S. de Rezende, G. C.S. Ruppert, A. Theóphilo, E. K. Tokuda, T. Carvalho, Exposing computer generated images by using deep convolutional neural networks, Signal Processing: Image Communication 66 (2018) 113-126.
  * [260] K. Ye, J. Dong, W. Wang, B. Peng and T. Tan, Feature Pyramid Deep Matching and Localization Network for Image Forensics, In: Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), 2018, pp. 1796-1802.
  * [261] Y. Wang, Z. Su, and D. Song, File Fragment Type Identification with Convolutional Neural Networks, In: International Conference on Machine Learning Technologies (ICMLT), 2018, pp. 41–47.
  * [262] D. Wang and T. Gao, Filtered Image Forensics Based on Frequency Domain Features, In: IEEE International Conference on Communication Technology (ICCT), 2018, pp. 1208-1212.
  * [263] C. Zhang, D. Du, L. Ke, H. Qi and S. Lyu, Global Contrast Enhancement Detection via Deep Multi-Path Network, In: International Conference on Pattern Recognition (ICPR), 2018, pp. 2815-2820.
  * [264] Z. Zuo, J. Li, P. Anderson, L. Yang and N. Naik, Grooming Detection using Fuzzy-Rough Feature Selection and Text Classification, In: IEEE International Conference on Fuzzy Systems (FUZZ-IEEE), 2018, pp. 1-8.
  * [265] JD. Wei, HJ. Cheng, & CW. Chang, Hopfield network-based approach to detect seam-carved images and identify tampered regions, Neural Comput & Applic 31 (2019) 6479–6492.
  * [266] B. Kwon, M. Gong, J. Huh and S. Lee, Identification and Restoration of LZ77 Compressed Data Using a Machine Learning Approach, In: Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), 2018, pp. 1787-1790.
  * [267] Z. Shi, X. Shen, H. Kang and Y. Lv, Image Manipulation Detection and Localization Based on the Dual-Domain Convolutional Neural Networks, IEEE Access 6 (2018) 76437-76453.
  * [268] R. Salloum, Y. Ren, C.-C. Jay Kuo, Image Splicing Localization using a Multi-task Fully Convolutional Network (MFCN), Journal of Visual Communication and Image Representation 51 (2018) 201-209.
  * [269] O. Mayer and M. C. Stamm, Learned Forensic Source Similarity for Unknown Camera Models, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2018, pp. 2012-2016.
  * [270] A. Thakur and N. Jindal, Machine Learning Based Saliency Algorithm For Image Forgery Classification And Localization, In: International Conference on Secure Cyber Computing and Communication (ICSCCC), 2018, pp. 451-456.
  * [271] A. Kumar, C.S. Prakash, S. Maheshkar, V. Maheshkar, Markov Feature Extraction Using Enhanced Threshold Method for Image Splicing Forgery Detection, In: Smart Innovations in Communication and Computational Sciences, 2019, pp. 17-27.
  * [272] H.H. Nguyen, T.N. Tieu, H.Q. Nguyen-Son, V. Nozick, J. Yamagishi, and I. Echizen, Modular Convolutional Neural Network for Discriminating between Computer-Generated Images and Photographic Images, In International Conference on Availability, Reliability and Security (ARES), 2018, pp. 1–10.
  * [273] J. Bakas, P. Rawat, K. Kokkalla, R. Naskar, Re–compression Based JPEG Tamper Detection and Localization Using Deep Neural Network, Eliminating Compression Factor Dependency, In: International Conference on Information Systems Security, 2018, pp. 318-341.
  * [274] D. Güera, F. Zhu, S. K. Yarlagadda, S. Tubaro, P. Bestagini and E. J. Delp, Reliability Map Estimation for CNN-Based Camera Model Attribution, In: IEEE Winter Conference on Applications of Computer Vision (WACV), 2018, pp. 964-973.
  * [275] Y. Aizezi, A. Jiamali, R. Abdurixiti, K. Ubul, Research on the Methods for Extracting the Sensitive Uyghur Text-Images for Digital Forensics, In: Chinese Conference on Biometric Recognition, 2018, pp. 709-718.
  * [276] F. Ding, Y. Shi, G. Zhu, et al., Smoothing identification for digital image forensics, Multimed Tools Appl 78 (2019) 8225–8245.
  * [277] F. Wang, T. Quach, J. Wheeler, J. B. Aimone and C. D. James, Sparse Coding for N-Gram Feature Extraction and Training for File Fragment Classification, IEEE Transactions on Information Forensics and Security 13 (10) 2553-2562.
  * [278] G.K. Birajdar, V.H. Mankar, Subsampling-Based Blind Image Forgery Detection Using Support Vector Machine and Artificial Neural Network Classifiers, Arabian Journal for Science and Engineering 43 (2018) 555–568.
  * [279] P. Johnston, E. Elyan, C. Jayne, Toward Video Tampering Exposure: Inferring Compression Parameters from Pixels, In: International Conference on Engineering Applications of Neural Networks, 2018, pp. 44-57.
  * [280] B. Bayar and M. C. Stamm, Towards Open Set Camera Model Identification Using a Deep Learning Framework, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2018, pp. 2007-2011.
  * [281] Z. Wang, Z. Feng, Z. Tian, Neural Representation Learning Based Binary Code Authorship Attribution, In: International Conference on Digital Forensics and Cyber Crime, 2021, pp. 244-249.
  * [282] S. Verde, L. Bondi, P. Bestagini, S. Milani, G. Calvagno and S. Tubaro, Video Codec Forensics Based on Convolutional Neural Networks, In: IEEE International Conference on Image Processing (ICIP), 2018, pp. 530-534.
  * [283] M. Kaur, S. Gupta, A fusion framework based on fuzzy integrals for passive-blind image tamper detection, Cluster Comput 22 (2019) 11363–11378.
  * [284] B. Subrahmanyeswara Rao, A fuzzy fusion approach for modified contrast enhancement based image forensics against attacks, Multimed Tools Appl 77 (2018) 5241–5261.
  * [285] P.B. Suresha, S. Nagesh, P. S. Roshan, P. A. Gaonkar, G. N. Meenakshi and P. K. Ghosh, A high resolution ENF based multi-stage classifier for location forensics of media recordings, In: National Conference on Communications (NCC), 2017, pp. 1-6.
  * [286] C. Jiang, T. Wu, J. Xu, N. Zheng, M. Xu, T. Yang, A MapReduce-Based Distributed SVM for Scalable Data Type Classification, In: International Conference on Collaborative Computing: Networking, Applications and Worksharing, 2017, pp. 115-126.
  * [287] B. Yang, Z. Li, W. Hu, E. Cao, A Median Filtering Forensics Approach Based on Machine Learning, In: International Conference on Cloud Computing and Security, 2017, pp. 518-527.
  * [288] Y. Zhang and V. L. L. Thing, A multi-scale noise-resistant feature adaptation approach for image tampering localization over Facebook, In: IEEE International Conference on Signal and Image Processing (ICSIP), 2017, pp. 272-276.
  * [289] Z. Ali, M. Imran and M. Alsulaiman, An Automatic Digital Audio Authentication/Forensics System, IEEE Access 5 (2017) 2994-3007.
  * [290] J. Ye, Y.Q. Shi, An effective method to detect seam carving, Journal of Information Security and Applications 35 (2017) 13-22.
  * [291] B. Bayar and M. C. Stamm, Augmented convolutional feature maps for robust CNN-based camera model identification, In: IEEE International Conference on Image Processing (ICIP), 2017, pp. 4098-4102.
  * [292] C. Zhang, S. Wang, J. Wu, Z. Niu, Authorship Identification of Source Codes, In: Asia-Pacific Web (APWeb) and Web-Age Information Management (WAIM) Joint Conference on Web and Big Data, 2017, pp. 282-296.
  * [293] Y. Zhang, L. Zheng and V. L. L. Thing, Automated face swapping and its detection, In: IEEE International Conference on Signal and Image Processing (ICSIP), 2017, pp. 15-19.
  * [294] G.K. Birajdar, V.H. Mankar, Blind image forensics using reciprocal singular value curve based local statistical features, Multimed Tools Appl 77 (2018) 14153–14175.
  * [295] HY. Choi, HU. Jang, J. Son, D. Kim, HK. Lee, Content Recapture Detection Based on Convolutional Neural Networks, In: International Conference on Information Science and Applications, 2017, pp. 339-346.
  * [296] Y. Liu, Q. Guan, & X. Zhao, Copy-move forgery detection based on convolutional kernel network, Multimed Tools Appl 77 (2018) 18269–18293.
  * [297] K. Yau, K. P. Chow, S. M. Yiu and C. F. Chan, Detecting anomalous behavior of PLC using semi-supervised machine learning, In: IEEE Conference on Communications and Network Security (CNS), 2017, pp. 580-585.
  * [298] H. Choi et al., Detecting composite image manipulation based on deep neural networks, In: International Conference on Systems, Signals and Image Processing (IWSSIP), 2017, pp. 1-5.
  * [299] J. Yang,, H. Ren,, G. Zhu, et al., Detecting median filtering via two-dimensional AR models of multiple filtered residuals. Multimed Tools Appl 77 (2018) 7931–7953.
  * [300] X. Jiang, P. He, T. Sun, F. Xie and S. Wang, Detection of Double Compression With the Same Coding Parameters Based on Quality Degradation Mechanism Analysis, IEEE Transactions on Information Forensics and Security 13 (1) (2018) 170-185.
  * [301] D. Zhang, Q. Li, G. Yang, L.Li, X. Sun, Detection of image seam carving by using weber local descriptor and local binary patterns, Journal of Information Security and Applications 36 (2017) 135-144.
  * [302] H. Tang, R. Ni, Y. Zhao and X. Li, Detection of various image operations based on CNN, In: Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), 2017, pp. 1479-1485.
  * [303] Z. Wang, L. Zhu, Q. Min and C. Zeng, Double compression detection based on feature fusion, In: International Conference on Machine Learning and Cybernetics (ICMLC), 2017, pp. 379-384.
  * [304] T. Carvalho, E. R. S. de Rezende, M. T. P. Alves, F. K. C. Balieiro and R. B. Sovat, Exposing Computer Generated Images by Eye’s Region Classification via Transfer Learning of VGG19 CNN, In: IEEE International Conference on Machine Learning and Applications (ICMLA), 2017, pp. 866-870.
  * [305] L. Bondi, L. Baroffio, D. Güera, P. Bestagini, E. J. Delp and S. Tubaro, First Steps Toward Camera Model Identification With Convolutional Neural Networks, IEEE Signal Processing Letters 24 (3) (2017) 259-263.
  * [306] F. Mayer and M. Steinebach, Forensic Image Inspection Assisted by Deep Learning, In: International Conference on Availability, Reliability and Security (ARES), 2017, pp. 1-9.
  * [307] K. H. Rhee, Forgery image detection of Gaussian filtering by support vector machine using edge characteristics, In : International Conference on Ubiquitous and Future Networks (ICUFN), 2017, pp. 231-236.
  * [308] F. Peng, X. Hu, M. Long, Identification of Natural Images and Computer Generated Graphics Based on Multiple LBPs in Multicolor Spaces, In: International Conference on Security, Privacy and Anonymity in Computation, Communication and Storage, 2017, pp. 368-380.
  * [309] M. Long, F. Peng, & Y. Zhu, Identifying natural images and computer generated graphics based on binary similarity measures of PRNU. Multimed Tools Appl 78 (2019) 489–506.
  * [310] I. Yu, D. Kim, J. Park, J. Hou, S. Choi and H. Lee, Identifying photorealistic computer graphics using convolutional neural networks, In: IEEE International Conference on Image Processing (ICIP), 2017, pp. 4093-4097.
  * [311] J. Li, G. Wu, Image Recapture Detection Through Residual-Based Local Descriptors and Machine Learning, In: International Conference on Cloud Computing and Security, 2017, pp. 653-660.
  * [312] C. Li, Q. Ma, L. Xiao, M. Li, A. Zhang, Image Splicing Detection Based on Markov Features in QDCT Domain, In: International Conference on Intelligent Computing, 2015, pp. 170-176.
  * [313] ML. Wu, CS. Fahn, & YF. Chen, Image-format-independent tampered image detection based on overlapping concurrent directional patterns and neural networks, Appl Intell 47 (2017) 347–361.
  * [314] A.A. Vorobeva, Influence of features discretization on accuracy of random forest classifier for web user identification, In: Conference of Open Innovations Association (FRUCT), 2017, pp. 498-504.
  * [315] Y. Choi, D. Kang, J. J. Hwang and K. H. Rhee, JPEG Compression Detection Based on Edge-Corner Features Using SVM, In: International Conference on Machine Learning and Data Science (MLDS), 2017, pp. 80-84.
  * [316] F. Cruz, N. Sidère, M. Coustaty, V. P. D’Andecy and J. Ogier, Local Binary Patterns for Document Forgery Detection, In: IAPR International Conference on Document Analysis and Recognition (ICDAR), 2017, pp. 1223-1228.
  * [317] Z. Hu and S. Wang, Median filtering forensics based on discriminative multi-scale sparse coding, In: IEEE Global Conference on Signal and Information Processing (GlobalSIP), 2017, pp. 141-145.
  * [318] Y. Li et al., Mobile phone clustering from acquired speech recordings using deep Gaussian supervector and spectral clustering, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2017, pp. 2137-2141.
  * [319] M.M. Isaac, M. Wilscy, Multiscale Local Gabor Phase Quantization for image forgery detection. Multimed Tools Appl 76 (2017) 25851–25872.
  * [320] B. Bayar and M. C. Stamm, On the robustness of constrained convolutional neural networks to JPEG post-compression for image resampling detection, In: IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2017, pp. 2152-2156.
  * [321] A. Venckauskas, A. Karpavicius, R. Damaševičius, R. Marcinkevičius, J. Kapočiūte-Dzikiené and C. Napoli, Open class authorship attribution of lithuanian internet comments using one-class classifier, In: Federated Conference on Computer Science and Information Systems (FedCSIS), 2017, pp. 373-382.
  * [322] S. Y. Arnob, R. Ohib, M. M. Muhaisin and T. B. Hassan, Power file extraction process from bangladesh grid and exploring ENF based classification accuracy using machine learning, In: IEEE Region 10 Humanitarian Technology Conference (R10-HTC), 2017, pp. 79-82
  * [323] Y. Aizezi, A. Jamal, R. Abudurexiti, and M. Muming, Research on Digital Forensics Based on Uyghur Web Text Classification, Digital Crime and Forensics 9 (4) (2017) 30-39.
  * [324] L. Shen, G. Yang, L. Li and X. Sun, Robust detection for object removal with post-processing by exemplar-based image inpainting, In: International Conference on Natural Computation, Fuzzy Systems and Knowledge Discovery (ICNC-FSKD), 2017, pp. 2730-2736.
  * [325] S. Joshi and N. Khanna, Single Classifier-Based Passive System for Source Printer Classification Using Local Texture Features, IEEE Transactions on Information Forensics and Security 13 (7) (2018) 1603-1614.
  * [326] M. Tsai, M. Yuadi, Y. Tao and J. Yin, Source Identification for Printed Documents, In: IEEE International Conference on Collaboration and Internet Computing (CIC), 2017, pp. 54-58.
  * [327] S. Bosse, D. Maniry, T. Wiegand and W. Samek, A deep neural network for image quality assessment, In: IEEE International Conference on Image Processing (ICIP), 2016, pp. 3773-3777.
  * [328] W. Pan and G. Chen, A method of off-line signature verification for digital forensics, In: International Conference on Natural Computation, Fuzzy Systems and Knowledge Discovery (ICNC-FSKD), 2016, pp. 488-493.
  * [329] B. Yang, N. Li and J. Jiang, A new triage process model for digital investigations, In: IEEE Advanced Information Management, Communicates, Electronic and Automation Control Conference (IMCEC), 2016, pp. 712-717.
  * [330] A. Taimori, F. Razzazi, A. Behrad, et al., A novel forensic image analysis tool for discovering double JPEG compression clues, Multimed Tools Appl 76 (2017) 7749–7783.
  * [331] Q. Liu, An approach to detecting JPEG down-recompression and seam carving forgery under recompression anti-forensics, Pattern Recognition 65 (2017) 35-46.
  * [332] C. Jin, R. Wang, D. Yan, et al., An efficient algorithm for double compressed AAC audio detection. Multimed Tools Appl 75 (2016) 4815–4832.