<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-deep-fake-detection
description: >-
  Detect AI-generated or manipulated media using Error Level Analysis (ELA),
  facial landmark analysis, metadata forensics, and frequency domain inspection.
  Verify media authenticity for investigations.
domain: cybersecurity
subdomain: investigation-attribution
tags:
  - deepfake-detection
  - media-forensics
  - error-level-analysis
  - image-manipulation
  - osint
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1566"]
---

# Performing Deep Fake Detection

## Overview

Deepfake detection identifies AI-generated or manipulated images, video, and
audio using forensic analysis techniques. Includes Error Level Analysis (ELA),
facial landmark inconsistencies, metadata anomalies, and frequency domain
artifacts. Critical for media verification in investigations.

## Prerequisites

| Requirement | Install |
|---|---|
| Python 3.10+ | Agent tooling |
| Pillow | `pip install Pillow` |
| ExifTool | `sudo apt install libimage-exiftool-perl` |
| ffmpeg | `sudo apt install ffmpeg` |

## Key Concepts

### Detection Techniques

| Technique | What It Detects |
|---|---|
| **Error Level Analysis** | JPEG compression inconsistencies from editing |
| **Facial landmarks** | Asymmetries, impossible geometry in AI faces |
| **Metadata analysis** | Missing/inconsistent EXIF, editing software traces |
| **Frequency analysis** | GAN artifacts in spectral domain |
| **Pixel analysis** | Clone detection, resampling artifacts |
| **Temporal analysis** | Frame-to-frame inconsistencies in video |

### Error Level Analysis (ELA)

```
1. Re-save JPEG at known quality level (e.g., 95%)
2. Compute pixel-level difference between original and re-saved
3. Uniform ELA = likely unmodified
4. Bright spots in ELA = regions saved at different quality (edited)
```

### AI-Generated Image Indicators

```
- Asymmetric earrings, glasses, or accessories
- Blurred or inconsistent background at face boundary
- Teeth irregularities (too uniform or missing detail)
- Hair artifacts at edges
- Inconsistent lighting between face and background
- Warped text in background
```

## Quick Reference

```bash
# Run ELA analysis
node agent.js ela --input suspect_image.jpg --quality 95

# Check metadata for manipulation signs
node agent.js metadata-check --input image.jpg

# Extract video frames for analysis
node agent.js video-frames --input video.mp4 --interval 1

# Analyze facial landmarks
node agent.js face-check --input portrait.jpg
```

## Workflow

```
1. COLLECT    — Obtain original-quality media (avoid screenshots)
2. METADATA   — Extract and analyze EXIF/metadata for anomalies
3. ELA        — Run Error Level Analysis for compression artifacts
4. VISUAL     — Check for AI generation indicators
5. FREQUENCY  — Analyze spectral domain for GAN fingerprints
6. TEMPORAL   — For video, check frame-to-frame consistency
7. PROVENANCE — Trace media to earliest known source
8. DOCUMENT   — Record analysis with confidence assessment
```

## Detection

```yaml
title: Deep Fake Detection Detection
id: b80b15cc-7f35-44d1-a25a-8e0a70c2e3ab
status: experimental
description: Detects suspicious activity related to performing deep fake detection techniques in investigation attribution context
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Initiated: "true"
  condition: selection
level: medium
tags:
  - attack.t1566
  - attack.command_and_control
falsepositives:
  - Threat intelligence enrichment services querying external APIs
```

## Verification

```bash
python3 -c "from PIL import Image; print('Pillow OK')"
exiftool -ver
node agent.js --self-test
```

## References

- [FotoForensics](https://fotoforensics.com/)
- [Bellingcat Media Verification Guide](https://www.bellingcat.com/resources/)
- [InVID Verification Plugin](https://www.invid-project.eu/)
- [Hive Moderation AI Detection](https://hivemoderation.com/)
