隨著網路科技進展日新月異，數位生活已顛覆過去傳統生活型態，任何生活點滴皆能夠利用數位化的方式記錄與分享，使用數位裝置如數位相機、數位攝影機，民眾可以創造出獨特多樣的數位內容。由於網路日漸普及其無遠弗界的特性超越時間和空間限制，新興的網路犯罪也順應而生。現今，網路上有許多影音、圖片檔案，意圖不軌的有心人士將多媒體內容於下載後經由非法的拷貝及散佈，造成非法侵權、發行與剽竊和色情氾濫問題。

現今網路傳輸電子圖片大多以JPEG格式為主，如何有效嚇阻網路上散播不合法的JPEG影像及掌握非法傳播的相關證據，提供警方能進一步持有搜索票至嫌犯電腦搜查，我們提出一套新的針對JPEG影像檔案之數位特徵值擷取機制，在資料仍為封包型態，未達用戶端的狀態下(On the fly)，啟動網路監聽查看封包內容，可依據JPEG檔案格式擷取出有效特徵值，存下嫌疑JPEG特徵影像，如此能夠增進資料處理的效率，並降低收集者的硬體儲存空間。事後進行資料比對時，依據packet-level的影像特徵，能夠有效列出有嫌疑的資料，提供初步的JPEG影像數位證據，作為司法判決的輔助佐證，建構安全的網路使用環境。

Recently, multimedia transmission in the Internet is popular. Digital files are widespread. However, digital distribution may cause problems including illegal duplication, piracy and pornographic inundation.

Now, digital pictures transmit on the network are mostly used JPEG format. To avoid disseminating unlawful JPEG images and to provide more the evidences of illegal distribution are important for digital forensics. In this research, a novel digital feature retrieval mechanism for JPEG image files is proposed. By using network monitor tool to get the packet in the state of transmission on the network, we retrieved effective features based on Baseline JPEG format and store them in our front feature database. This machine can increase the data process efficiency and decrease the cost of storage hardware which collected JPEG packet feature. We compared packet-level image feature database to find out the suspicious files, provided the preliminary digital evidences, stored them into the database, and then constructed a secure network
environment.

[1] G. Palmer, “A Road Map for Digital Forensics Research,” Technical Report DTR-T0010-01, DFRWS. Report from the First Digital Forensics Research Workshop (DFRWS), November 2001

[2] Kruse, W. & Heiser, J. (2002). Computer forensics: Incident response essentials. Boston: Addison Wesley

[3] G. Kruse II and J. G. Heiser, Computer Forensics: Incident Response Essentials, Addison Wesley, 2002, pp:2-8,163-174

[4] Farmer D , Venema W .Computer Forensics Analysis Class Handouts. http://www.fish.com/forensicss/class.htm1, 1999

[5] Mandia K, Prosise C. Incident Response. Osborne/McGraw-Hill, 2001

[6] Technical Working Group for Electric Crime Scene Investigation. Electronic Crime Scene Investigation: A Guide for First Responders. 2001

[7] Alec Yasinsac. Policies to Enhance Computer and Network Forensics. In: Proc. Of the 2001 IEEE Workshop on Information Assurance and Security, June 2001

[8] M. Reith, C. Carr, and G. Gunsch, “An Examination of Digital Forensics Model,” International Journal of Digital Evidence, vol. 1, 2002

[9] Casey, E , “Digital Evidence and Computer Crime: Forensics Science, Computers, and the Internet,” second edition, Academic Press, 2004.

[10] James F. Kurose, Keith W. Ross, “Computer Networking – a top-down approach featuring the Internet,” second edition, Addison Wesley, 2001

[11] Vicka Corey, Charles Peterman, Sybil Shearin, Michael S.Greenberg, and James Van Bokkelen, “Network forensics analysis”, IEEE INTERNET COMPUTING, 2002.

[12] Martin Karresand ,Nahid Shahmehri “File Type Identification of Data Fragments by Their Binary Structure” ,Volume: 1, The 7th IEEE Information Assurance Workshop (IAWorkshop 2006) , pp.577-580.Reference

[13] G.K. Wallace, “The JPEG Still Picture Compression Standard,” IEEE Trans. Consumer Electronics, vol.38, no.1, pp. 18-34, Feb. 1992

[14] “Information Technology - Digital Compression and Coding of Continuous-tone Still Image - Requirements and Guidelines” ITU-T Recommendation T.81, 1992. |ISO/IEC 10918-1:1993 International Telecommunications Union.

[15] Encryption, Key Recovery, and Privacy Protection in the Information Age: Hearings Before the Senate Comm. on the Judiciary, 105th Cong. (June 4.1997) (testimony of Louis J. Freeh)

[16] Felix Fuentes, Dulal C. Kar, “Ethereal vs. Tcpdump: a comparative study on packet sniffing tools for educational purpose”, Journal of Computing Sciences in Colleges, Volume 20 , Issue 4 , pp. 169-176, April 2005

[17] G. Theo, W.M. Arnold, PicToSeek: combining color and shape invariant features for image retrieval, IEEE Transactions on Image Processing 9 (1) (2000) 102–119.

[18] Chin-Chen Chang, Jun-Chou Chuang, Yih-Shin Hu, Retrieving digital images from a JPEG compressed image database, Image and Vision Computing 22 (2004) pp.471-484

[19] R.J. Anderson, F.A.P. Petitcolas, "On The Limits of Steganography", IEEE Journal on Selected Areas in Communications, May 1998

[20] F.A.P. Petitcolas, R.J. Anderson, and M.G. Kuhn, “Information Hiding-A Survey,” Proc. IEEE, vol. 87, no. 7, pp. 1062-1078, July 1999.

[21] V. Venkatachalam, L. Cazzanti, N. Dhillon, M. Wells, "Automatic Identification of Sound Recordings", IEEE Signal Processing Magazine, Mar. 2004

[22] D. Boneh, J. Shaw, "Collusion-Secure Fingerprinting for Digital Data", IEEE Transaction on Information Theory, Sep. 1998

[23] W. Trappe, Min Wu, K.J. Ray Liu , "Collusion-Resistant Fingerprinting for Multimedia", IEEE International Conference on Acoustics, Speech, and Signal Processing, Aug. 2002

[24] W. Luh, D. Kundur, "New Paradigms for Effective Multicasting and Fingerprinting of Entertainment Media", IEEE Communications Magazine, June 2005

[25] Hartung F, Kutter M. Multimedia watermarking techniques. Proc. IEEE, July 1999, 87(7): 1079–1107

[26] D. Kirovski, H. Malvar, Y. Yacobi, “A Dual Watermark-fingerprinting System”, IEEE Multimedia, July 2004

[27] Adams J, Parulski K, Spaulding K, “Color processing in digital cameras.”, IEEE Micro, Nov.-Dec. 1998, 18(6): 20–30

[28] Lukas J, Fridrich J, Goljan M., “Digital camera identification from sensor pattern noise.”, IEEE Trans. Information Forensics and Security, June 2006, 1(2): 205–214

[29] Luo Weiqi , Qu Zhenhua , Pan Feng, and Huang Jiwu, “A survey of passive technology for digital image forensics”, Frontiers of Computer Science in China, May 2007, Volume 1, 2007, pp. 166-179

[30] T.-T. Ng, S.-F. Chang, and Q. Sun, “Blind detection of photomontage using higher order statistics,” IEEE International Symposium on Circuits and Systems, Vancouver, Canada, 2004.

[31] Neelamani R, de Queiroz R, Fan Z, et al. “Jpeg compression history estimation for color images.”, IEEE Trans. Image Processing, June 2006, 15(6): 1365–1378

[32] http://www.w3.org/Protocols/

[33] http://www.dfrws.org/

[34] http://www.fbi.gov/hq/lab/fsc/backissu/april2000/swgde.htm

[35] http://www.jpeg.org/

[36] http://www.tcpdump.org/

[37] http://www.wireshark.org/

[38] http://netflow.ncku.edu.tw/

[39] http://www.impulseadventure.com/photo/jpeg-snoop.html