Camera source identification forensic analysis method based on EXIF metadata

Abstract

The invention relates to a camera source identification forensic analysis method based on EXIF metadata, and the method comprises the following steps: extracting EXIF metadata of an image, constructing a filtering rule based on imaging priori knowledge, screening metadata related to inherent imaging characteristics of a camera, and removing unrelated metadata which is unrelated to imaging physical essence and can directly leak identity information; performing type division on the screened EXIF metadata, and encoding different types of metadata by adopting a differentiated encoding strategy so as to construct a data set; and constructing a decision tree classification model based on a classification and regression tree algorithm, inputting a data set into the model for training and optimization, and further completing forensic analysis based on a visual decision path of a decision tree. According to the method, the classification logic can be clearly revealed through the visual decision path of the decision tree model, an understandable basis is provided for an identification result, meanwhile, the equipment imaging instability can be traced back to the specific imaging mode metadata, and the root of mismatching between the equipment is clarified.

Description

Technical Field

[0001] This invention relates to the field of digital image forensics, specifically to a method for camera source identification and forensic analysis based on EXIF ​​metadata. Background Technology

[0002] In the field of digital image forensics, camera source identification is one of the core tasks. Its purpose is to determine the identity of the shooting device through image analysis, providing technical support for scenarios such as judicial evidence collection and information security. Camera source identification technology based on photoresponse non-uniformity (PRNU) has long been regarded as a reliable solution. Its core principle is to use the inherent noise patterns introduced by the imaging device during the imaging process as a device fingerprint for identification.

[0003] However, with the rapid development of computational photography technology, modern imaging devices generally employ complex post-processing algorithms such as multi-frame synthesis, intelligent scene optimization, and high dynamic range imaging, which severely interferes with or even masks the inherent noise patterns of the devices (PRNU). This problem directly leads to a significant increase in the false alarm rate and a substantial decrease in recognition performance of PRNU-based detection methods. Although some studies have attempted to correct for single factors such as high dynamic range imaging and portrait patterns, these methods only focus on specific scenarios and lack the ability to systematically discover and interpret multiple potential anomalies in complex image sets, failing to meet the dual requirements of accuracy and interpretability in practical forensic scenarios. Summary of the Invention

[0004] The technical problem of this invention is to propose a camera source identification and forensics method that overcomes the shortcomings of existing PRNU-based camera source identification technology, such as the impact of modern computational photography post-processing, reduced identification performance, and lack of interpretability. The invention proposes a camera source identification and forensics method based on EXIF ​​metadata, which achieves high-precision camera source identification and can clearly reveal the identification logic and anomaly attribution.

[0005] The purpose of this invention is to solve the above-mentioned problems and propose a camera source identification and forensics method based on EXIF ​​metadata, including the following steps:

[0006] S1: Extract the EXIF ​​metadata of the image and construct filtering rules based on prior imaging knowledge to filter out metadata related to the inherent imaging characteristics of the camera, and then remove irrelevant metadata that is not related to the physical essence of imaging and can directly reveal identity information. S2: The filtered EXIF ​​metadata is categorized by type, and different types of metadata are encoded using a differentiated encoding strategy to construct the dataset; S3: Construct a decision tree classification model based on classification and regression tree algorithms, input the dataset into the model for training and optimization, and then complete the evidence collection analysis based on the visualized decision path of the decision tree.

[0007] Preferably, in step S1, the metadata related to the camera's inherent imaging characteristics includes exposure parameters such as aperture and ISO, optical parameters such as focal length and focus mode, and camera internal processing parameters such as white balance and metering mode.

[0008] Preferably, in step S1, irrelevant metadata includes shooting time and geographic location information, device identifier, and parameters related to thumbnail and original image size.

[0009] Furthermore, in step S2, a differentiated encoding strategy is adopted for different types of metadata. For numerical metadata, its original value is retained or it is converted into a standardized numerical result; for textual metadata, ordered label encoding is used to convert it into a discrete numerical sequence.

[0010] Preferably, in step S2, the encoding of different types of metadata using a differentiated encoding strategy includes the following sub-steps: 1) If the metadata value is a string containing a fraction or mathematical expression, calculate its numerical result; 2) If the metadata value is a string containing unit symbols, extract the numerical part and remove the non-numeric characters; 3) For missing numeric metadata fields, pre-fill with zero values.

[0011] Preferably, step S2 further includes encoding the text-type metadata, including: 1) The first unique text label encountered is assigned an integer identifier that increments from 1; 2) Missing or unknown text-based metadata entries are uniformly mapped to the integer 0.

[0012] Furthermore, the decision tree classification model includes the following sub-steps: 1) Growth stage: Starting from the root node containing all training samples, a forward selection strategy is adopted to recursively find the optimal split in each internal node; the optimal split is determined by calculating the Gini index to measure the node impurity, and the splitting method that reduces the impurity to the greatest extent is selected until the preset stopping condition is met to generate the maximum tree. 2) Pruning stage: A cost complexity pruning strategy is adopted, and the model complexity is controlled by a penalty term. A series of nested subtree sequences are generated, and the subtree with the highest prediction accuracy is selected as the final model based on the independent validation set. 3) Pruning stage: A cost complexity pruning strategy is adopted, which controls the model complexity through a penalty term, generates a series of nested subtree sequences, and selects the subtree with the highest prediction accuracy as the final model based on the independent validation set.

[0013] Preferably, step S3 further includes using a random forest model to statistically verify the importance of features, in order to assist in completing the evidence collection analysis.

[0014] Compared with the prior art, the beneficial effects of the present invention include: 1) The camera source identification and evidence collection analysis method based on EXIF ​​metadata proposed in this invention takes EXIF ​​metadata as the core, is not affected by existing computational photography post-processing algorithms, and improves the accuracy of camera source identification and evidence collection.

[0015] 2) The camera source identification and evidence collection analysis method based on EXIF ​​metadata proposed in this invention can clearly reveal the classification logic through the visualization decision path of the decision tree model, providing an understandable basis for the identification results. At the same time, it can trace the instability of device imaging to the metadata of specific imaging modes and clarify the root cause of mismatch between devices.

[0016] 3) The camera source identification and forensic analysis method based on EXIF ​​metadata proposed in this invention achieves lossless information conversion through a type-aware feature encoding strategy, avoiding the feature space explosion and data sparsity problems caused by one-hot encoding, generating compact low-dimensional numerical vectors, and improving the efficiency of model training and inference.

[0017] 4) The camera source identification and evidence collection analysis method based on EXIF ​​metadata proposed in this invention can meet the needs of rapid processing of large-scale image data in actual evidence collection scenarios, and can complete the identification only through metadata without relying on image pixel-level information, thereby improving the practicality of camera source identification and evidence collection analysis. Attached Figure Description

[0018] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0019] Figure 1 This is a schematic diagram of the camera source forensics method based on EXIF ​​metadata according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the visualization results of the brand-level decision tree on the HDRPlus dataset in an embodiment of the present invention; Figure 3 This is a schematic diagram of the peak-related energy distribution of the Huawei Honor 6 Plus according to an embodiment of the present invention; Figure 4 This is a schematic diagram of the importance scores of key EXIF ​​features based on random forest in an embodiment of the present invention; Figure 5 This is a schematic diagram of the peak-correlation energy distribution between abnormal and normal devices according to an embodiment of the present invention; Figure 6 This is a visual schematic diagram of the decision tree path for identifying the source of a mismatched camera according to an embodiment of the present invention; Figure 7This is a schematic diagram illustrating the importance analysis of PRNU false positive key EXIF ​​features based on random forest in an embodiment of the present invention. Detailed Implementation

[0020] The specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings and experimental data, so that those skilled in the art can fully implement the present invention.

[0021] like Figure 1 As shown, the camera source identification and forensics method based on EXIF ​​metadata includes the following steps: S1: Extract the EXIF ​​metadata of the image and construct filtering rules based on prior imaging knowledge to filter out metadata related to the inherent imaging characteristics of the camera, and then remove irrelevant metadata that is not related to the physical nature of imaging and can directly reveal identity information.

[0022] Specifically, ExifTool is used to extract metadata from the images in each dataset, outputting structured data containing field names and corresponding values. The feature representation of the i-th image is defined as follows: The real label is ,in It is the number of features. Index representing features, It is the number of categories. Furthermore, let... and They represent the first The first image Fields and values ​​of the EXIF ​​metadata item.

[0023] Metadata related to the camera's inherent imaging characteristics includes exposure parameters such as aperture and ISO, optical parameters such as focal length and focus mode, and internal camera processing parameters such as white balance and metering mode.

[0024] The expression for filtering out metadata related to the camera's inherent imaging characteristics is: ; In the formula, and They represent the first The first image Fields and values ​​of the EXIF ​​metadata item.

[0025] Irrelevant metadata includes shooting time and geolocation information, device identifier, and parameters related to thumbnail and original image size.

[0026] Specifically, the excluded metadata falls into three categories: 1) Shooting time and geographic location information: The captured images reflect external environmental factors and lack consistency among devices of the same category; 2) Exclude device identifiers: These include manufacturer, model, and software version information. This type of information explicitly encodes the device identity rather than helping to infer the underlying imaging pattern; 3) Parameters related to thumbnail and original image size: Parameter attributes are usually determined by post-processing software rather than by the camera's physical imaging process.

[0027] S2: The filtered EXIF ​​metadata is categorized by type, and different types of metadata are encoded using a differentiated encoding strategy to construct the dataset.

[0028] In step S2, a differentiated encoding strategy is adopted for different types of metadata. For numerical metadata, the original value is retained or converted into a standardized numerical result; for textual metadata, ordered label encoding is used to convert it into a discrete numerical sequence.

[0029] Step S2, which involves encoding different types of metadata using a differentiated encoding strategy, includes the following sub-steps: 1) If the metadata value is a string containing a fraction or mathematical expression, calculate its numerical result; 2) If the metadata value is a string containing unit symbols, extract the numerical part and remove the non-numeric characters; 3) For missing numeric metadata fields, pre-fill with zero values.

[0030] Step S2 also includes encoding text-based metadata, including: 1) The first unique text label encountered is assigned an integer identifier that increments from 1; 2) Missing or unknown text-based metadata entries are uniformly mapped to the integer 0.

[0031] Specifically, taking the HDRPlus dataset as an example, the selected features are encoded as follows: Numerical metadata: ISO value 1129 is directly retained as 1129; shutter speed 1 / 162 is calculated as 0.00617; focal length 4.7 mm is extracted as 4.7; missing ISO fields are filled with 0.

[0032] Text-based metadata: In the YCbCrPositioning field, Co-sited is encoded as 1 and Centered as 2; in the Flash field, Off did not fire is encoded as 1 and No Flash as 2, with a missing value of 0.

[0033] After encoding, a fixed-dimensional numerical vector is generated. The image encoding result is [1129, 0.02, 4.7, 1, 1,...], ensuring that the data format is consistent.

[0034] S3: Construct a decision tree classification model based on classification and regression tree algorithms, input the dataset into the model for training and optimization, and then complete the evidence collection analysis based on the visualized decision path of the decision tree.

[0035] The decision tree classification model includes the following sub-steps: 1) Growth phase: Starting from the root node containing all training samples, a forward selection strategy is adopted to recursively find the optimal split in each internal node; the optimal split is determined by calculating the Gini index to measure the node impurity, and the splitting method that reduces the impurity the most is selected until the preset stopping condition is met to generate the maximum tree.

[0036] The Gini index for node impurity is calculated as follows: ; In the formula, Indicates the total number of categories. Represents a node Belongs to the category The sample proportion.

[0037] For a given candidate split s, the resulting reduction in impurity is calculated as follows: ; In the formula, and These represent the number of samples entering the left and right child nodes, respectively. and These represent the left and right child nodes generated after the split, respectively.

[0038] 2) Pruning stage: A cost complexity pruning strategy is adopted, and the model complexity is controlled by a penalty term. A series of nested subtree sequences are generated, and the subtree with the highest prediction accuracy is selected as the final model based on the independent validation set.

[0039] 3) Pruning stage: A cost complexity pruning strategy is adopted, which controls the model complexity through a penalty term, generates a series of nested subtree sequences, and selects the subtree with the highest prediction accuracy as the final model based on the independent validation set.

[0040] Cost complexity The expression is: ; In the formula, This represents the misclassification error of the subtree on the training set. This represents the penalty coefficient that balances goodness of fit with model complexity.

[0041] The final model evaluates the performance of each subtree in the sequence using an independent validation set, and selects the subtree with the highest prediction accuracy as the final optimal decision tree model.

[0042] Step S3 also includes using a random forest model to statistically verify the importance of features, in order to assist in completing the forensic analysis.

[0043] To evaluate the effectiveness of the proposed method, this invention conducted systematic experiments on three large-scale benchmark datasets, including two publicly available large-scale datasets, VISION and ForensiCam-215K, as well as the constructed dataset HDRPlus. VISION is one of the most widely used public datasets, containing 34,427 images and 1,914 videos from 35 smartphone models across 11 major brands. The images include original versions and versions compressed by social media platforms such as Facebook, YouTube, and WhatsApp. To avoid secondary compression interfering with metadata integrity, this study only used the original images, totaling 11,732 images. ForensiCam-215K is a recently constructed large-scale image forensics dataset with broad device coverage and diverse shooting modes. This dataset covers 130 modern smartphones from 10 major brands, containing over 215,000 media files, including 204,444 images and 10,652 videos. The comprehensiveness of this dataset lies not only in the number of devices and brand coverage, but also in its systematic inclusion of three main camera types and six shooting modes, enabling effective evaluation of the stability of the proposed method under different imaging conditions. The newly constructed dataset, HDRPlus, contains images taken by 28 smartphones from four brands, covering both standard dynamic range (SDR) and high dynamic range (HDR) image types. To simplify the analysis, subsequent experiments only used SDR images from this dataset.

[0044] The performance of the method was evaluated on a camera source recognition task, covering both brand and model levels to examine its generalization ability and discrimination granularity. Furthermore, to gain a deeper understanding of the reasons for the anomalies in the performance of traditional PRNU-based methods, this study further conducted an attribution analysis on error cases in the recognition results, specifically including misclassifying images that should belong to the device as other devices and misclassifying images that should not belong to the device as the device. This study independently repeated the entire process from data partitioning to model evaluation three times to obtain robust and reliable performance estimates. In each experiment, the data was randomly divided into training and test sets proportionally, and the final reported result is the average of the three independent experiments.

[0045] The recognition performance was evaluated at the brand and model levels, and compared with existing equivalence class methods. The results are shown in Table 1. Table 1

[0046] As shown in Table 1, the method of this invention significantly outperforms existing methods in terms of recognition accuracy on all three datasets, especially in terms of model-level recognition performance. To gain a deeper understanding of the decision-making mechanism of the proposed method in the brand recognition task and to verify its interpretability, this invention provides a visual analysis of the brand classification decision tree trained on the HDRPlus dataset. Figure 2 The decision tree structure corresponding to the dataset is displayed, and the results intuitively present the key metadata relied upon by the model during the classification process and its corresponding decision path. Analysis of devices exhibiting PRNU anomalies in the three datasets reveals that this issue is most prominent in the HDRPlus dataset, with the Huawei Honor 6 Plus serving as a representative case. A visualization analysis of the peak correlated energy (PCE) of this device is presented, and the results are as follows... Figure 3 As shown, the numerical distribution was highly dispersed, and some images exhibited significant anomalous correlations, indicating severe inconsistencies in the imaging fingerprints within the device. To investigate the cause of the anomaly, a decision tree model was constructed for the device, and the interpretability of the model was used to identify key metadata features that led to the instability of the PRNU.

[0047] To establish an interpretable correlation between EXIF ​​metadata and PRNU stability, all sample images from the Huawei Honor 6 Plus were categorized into three classes based on Peak Correlation Energy (PCE): uniformly content-based FLAT images, images with PCE values ​​below a threshold of 60, and images with PCE values ​​above 60. Specifically, these three image classes were assigned labels 0, 1, and 2, respectively. FLAT images are typically used as reference frames in PRNU analysis, low-PCE images represent anomalous images where PRNU extraction or matching failed, while high-PCE images represent normal images with consistent PRNU patterns. Based on this classification framework, this invention employs the proposed type-aware encoding method for feature representation and trains a decision tree classifier to predict the category of an image based on its EXIF ​​metadata, thereby revealing the intrinsic correlation between imaging metadata and PRNU stability. The decision tree model achieved an average accuracy of 85.6% on this task, validating the model's effectiveness and demonstrating a correlation between EXIF ​​metadata and PRNU stability.

[0048] To validate the findings of the decision tree model and further quantify the impact weights of different EXIF ​​metadata features on PRNU underreporting, this invention constructs a random forest classifier to analyze the same task. By integrating multiple decision trees and calculating the average reduction in impurity of features within the forest, random forests provide a more robust assessment of feature importance, effectively overcoming the overfitting and randomness bias that may exist with a single decision tree.

[0049] For image samples from Huawei Honor 6 Plus devices (FLAT, low PCE, high PCE), the Random Forest model achieved an average classification accuracy of 84.36%. This result is comparable to the performance of the Decision Tree model, further confirming the feasibility of using EXIF ​​metadata to predict PRNU stability categories.

[0050] like Figure 4 As shown, the random forest model outputs the global importance score of each metadata feature, providing a quantitative basis for the impact of different imaging parameters on sensor noise fingerprint extraction. Analysis of the feature importance scores reveals that exposure control-related metadata features dominate. Among them, LightValue has the highest importance score, consistent with the decision tree model's finding that it is used as the root node feature to distinguish between FLAT and NAT images, further confirming that lighting conditions are a fundamental physical factor affecting PRNU expression. ExposureTime and ShutterSpeed, following closely behind, also have high importance, indicating that overexposure or underexposure can weaken sensor noise signals. Notably, ImageDescription and ISO have significantly higher importance scores than most other features. This reveals the complex impact of the camera's internal image processing pipeline on PRNU stability. The imaging mode represented by ImageDescription is directly related to a series of interconnected algorithmic processes, potentially covering native sensor noise through multi-frame synthesis, local optimization, and other operations; the increase in ISO is accompanied by sensor gain amplification, which, while enhancing the signal, may also change the statistical characteristics of noise, thus interfering with PRNU reliability.

[0051] In contrast, features related to file storage, such as Compression and YCbCrSubSampling, have lower importance, indicating that these late-encoding factors have a weak direct impact on PRNU stability in the classification task defined in this paper. Furthermore, most other EXIF ​​attributes have an importance score of zero in this model, suggesting that they do not show a significant statistical association with PRNU underreporting in the current dataset.

[0052] Feature importance analysis of random forests not only quantitatively confirms the key metadata identified by the decision tree model, but also further reveals the overall importance of the exposure control parameter group. This provides a more comprehensive explanation for the attribution of missed detections: in the era of computational photography, the automated exposure strategies and complex scene mode processing of camera systems are key factors leading to inconsistencies in the internal PRNU fingerprints of the device, thus causing missed detections. This invention combines the interpretable paths of decision trees with the global importance ranking of random forests to jointly construct a hierarchical and verifiable attribution analysis framework.

[0053] Of the three datasets used in this invention, significant false positives were observed in the ForensiCam-215K dataset. Specifically, the false positive rates for devices D024_Vivo_X60Pro and D095_Vivo_X60 were extremely high, reaching 0.96 and 1.00, respectively. These two anomalous devices were first compared with normal devices of the same brand, and the peak correlation energy (PCE) distribution of the four devices was visualized and analyzed. The results are as follows... Figure 5 As shown. Figure 5 The results clearly show that the PCE values ​​of devices D024 and D095 both exceeded the threshold of 60 in both negative and positive sample matching, indicating that they possess highly similar and indistinguishable PRNU features. Based on this finding, attribution analysis was conducted to explore the underlying reasons for this similarity. To analyze this anomaly, images captured by the anomalous device were labeled as category 1, while images captured by normal devices of the same brand were labeled as category 2. The EXIF ​​metadata of all images was converted into type-aware word embedding features and fed into a decision tree classifier for training. The interpretability of the model was then used to identify the cause of the anomaly. This decision tree model achieved 100% average accuracy in distinguishing between anomalous and normal devices, demonstrating its ability to completely differentiate between the two categories.

[0054] like Figure 6 As shown, a visual analysis of the decision tree was performed. Figure 6 As shown in the left figure, the SceneCaptureType metadata plays a decisive role at the root node: all images from mismatched devices are labeled as Portrait, while images from normal devices are labeled as Standard or the field is missing. Systematic validation of the dataset shows that this anomalous value pattern is unique to D024 and D095. This finding is consistent with existing research conclusions. Furthermore, by Figure 6As shown in the right figure, the software metadata provides crucial discrimination criteria in subsequent nodes. Specifically, the software metadata of all mismatched devices is uniformly marked as SAMSUNG, while normal devices are marked as MediaTek Camera Application or that the metadata is missing. These results demonstrate that the present invention can effectively explore the underlying causes of abnormal behavior.

[0055] This invention demonstrates that the proposed EXIF ​​metadata analysis method can not only diagnose anomalies within devices but also explain mismatch behavior between devices. By leveraging high-level semantic information such as SceneCaptureType and Software, this method transforms the difficult-to-capture pixel-domain correlation problem into interpretable imaging context differences. This step highlights the complementary value and enormous potential of EXIF ​​metadata in building more reliable and interpretable camera origin identification tasks.

[0056] To deepen our understanding of false positives and quantify the relative importance of different metadata features, a random forest model was further constructed based on decision tree analysis. Unlike decision trees, which aim to reveal specific decision paths, random forests, through ensemble learning and feature importance assessment, can quantify the contribution of each EXIF ​​feature to the task of distinguishing between anomalous and normal matching devices from a global perspective, thus providing more robust statistical evidence.

[0057] Based on the same data partitioning and type-aware word embedding features, the random forest model also achieved 100% accuracy in the binary classification task. This is consistent with its ability to completely separate the two types of devices, and confirms the strong discriminative power of the extracted features. More importantly, feature importance analysis can be performed using the random forest model, such as... Figure 7 As shown, a quantitative ranking of key metadata features influencing PRNU consistency and false positives was obtained. The analysis results first empirically support the core features identified by the decision tree analysis: Software and SceneCaptureType rank highly in importance scores. This statistically confirms the systematic consistency in software stacks and scene processing modes across devices, which is one of the root causes of PRNU feature confusion and subsequent false positives. Furthermore, feature importance analysis reveals other important EXIF ​​features besides the aforementioned two, including Megapixels, ExposureProgram, and Contrast. False positives are not caused by a single metadata field, but are more likely the result of the combined effect of parameter settings and algorithm processing at multiple stages of the camera's internal imaging pipeline. These shared or highly similar internal processing parameters produce indistinguishable imaging artifacts on different devices, ultimately manifesting as indistinguishable fingerprint similarity at the PRNU matching level.

[0058] In summary, this invention constructs a multi-faceted and multi-layered false alarm attribution analysis framework by integrating the interpretability path analysis of the decision tree model with the global feature importance quantification assessment of the random forest model. The decision tree clearly reveals the decisive roles of SceneCaptureType and Software as the root and key nodes, respectively; while the random forest statistically verifies these key features and further broadens the understanding of potential influencing factors, indicating that false alarms may be a systemic phenomenon caused by the commonalities of parameters across multiple stages of the imaging process.

[0059] The above embodiments are merely preferred technical solutions of the present invention and should not be considered as limitations on the present invention. The scope of protection of the present invention should be the technical solution described in the claims, including equivalent substitutions of the technical features described in the claims. That is, equivalent substitutions and improvements within this scope are also within the scope of protection of the present invention.

Claims

1. A camera source identification and forensic analysis method based on EXIF ​​metadata, characterized in that, Includes the following steps: S1: Extract the EXIF ​​metadata of the image and construct filtering rules based on prior imaging knowledge to filter out metadata related to the inherent imaging characteristics of the camera, and then remove irrelevant metadata that is not related to the physical essence of imaging and can directly reveal identity information. S2: The filtered EXIF ​​metadata is categorized by type, and different types of metadata are encoded using a differentiated encoding strategy to construct the dataset; S3: Construct a decision tree classification model based on classification and regression tree algorithms, input the dataset into the model for training and optimization, and then complete the evidence collection analysis based on the visualized decision path of the decision tree.

2. The camera source identification and forensic analysis method based on EXIF ​​metadata according to claim 1, characterized in that, In step S1, the metadata related to the inherent imaging characteristics of the camera includes exposure parameters such as aperture and ISO, optical parameters such as focal length and focus mode, and camera internal processing parameters such as white balance and metering mode.

3. The camera source identification and forensic analysis method based on EXIF ​​metadata according to claim 1, characterized in that, In step S1, the irrelevant metadata includes shooting time and geographic location information, device identifier, and parameters related to thumbnail and original image size.

4. The camera source identification and forensic analysis method based on EXIF ​​metadata according to claim 1, characterized in that, In step S2, a differentiated encoding strategy is adopted for different types of metadata. For numerical metadata, the original value is retained or converted into a standardized numerical result; for textual metadata, ordered label encoding is used to convert it into a discrete numerical sequence.

5. The camera source identification and forensic analysis method based on EXIF ​​metadata according to claim 1, characterized in that, Step S2, which involves encoding different types of metadata using a differentiated encoding strategy, includes the following sub-steps: 1) If the metadata value is a string containing a fraction or mathematical expression, calculate its numerical result; 2) If the metadata value is a string containing unit symbols, extract the numerical part and remove the non-numeric characters; 3) For missing numeric metadata fields, pre-fill with zero values.

6. The camera source identification and forensic analysis based on EXIF ​​metadata according to claim 1, characterized in that, Step S2 further includes encoding text-based metadata, including: 1) The first unique text label encountered is assigned an integer identifier that increments from 1; 2) Missing or unknown text-based metadata entries are uniformly mapped to the integer 0.

7. The camera source identification and forensic analysis method based on EXIF ​​metadata according to claim 1, characterized in that, In step S3, the decision tree classification model includes the following sub-steps: 1) Growth stage: Starting from the root node containing all training samples, a forward selection strategy is adopted to recursively find the optimal split in each internal node; the optimal split is determined by calculating the Gini index to measure the node impurity, and the splitting method that reduces the impurity to the greatest extent is selected until the preset stopping condition is met to generate the maximum tree. 2) Pruning stage: A cost complexity pruning strategy is adopted, and the model complexity is controlled by a penalty term. A series of nested subtree sequences are generated, and the subtree with the highest prediction accuracy is selected as the final model based on the independent validation set. 3) Pruning stage: A cost complexity pruning strategy is adopted, which controls the model complexity through a penalty term, generates a series of nested subtree sequences, and selects the subtree with the highest prediction accuracy as the final model based on the independent validation set.

8. The camera source identification and forensic analysis method based on EXIF ​​metadata according to claim 1, characterized in that, Step S3 further includes using a random forest model to statistically verify the importance of features, thereby assisting in the completion of evidence collection analysis.

Images