Biblio

We define a number of threat models to describe the goals, the available information and the actions characterising the behaviour of a possible attacker in multimedia forensic scenarios. We distinguish between an investigative scenario, wherein the forensic analysis is used to guide the investigative action and a use-in-court scenario, wherein forensic evidence must be defended during a lawsuit. We argue that the goals and actions of the attacker in these two cases are very different, thus exposing the forensic analyst to different challenges. Distinction is also made between model-based techniques and techniques based on machine learning, showing how in the latter case the necessity of defining a proper training set enriches the set of actions available to the attacker. By leveraging on the previous analysis, we then introduce some game-theoretic models to describe the interaction between the forensic analyst and the attacker in the investigative and use-in-court scenarios.