Douglas-Quaid -- Open Source Image Matching Library

TL;DR

Douglas-Quaid is an open-source, modular image matching library designed to assist security analysts in classifying and correlating images efficiently, addressing a gap in available tools.

Contribution

The paper introduces Douglas-Quaid, the first open-source library specifically tailored for visual correlation and image matching in security contexts.

Findings

Library achieves competitive speed and quality in image matching

Modular design facilitates customization and extension

Potential to automate screenshot classification reduces analyst workload

Abstract

Security analysts need to classify, search and correlate numerous images. Automatic classification tools improve the efficiency of such tasks. However, no open-source and turnkey library was found able to reach this goal. The present paper introduces an Open-Source modular library for the specific cases of visual correlation and Image Matching named Douglas-Quaid. The design of the library, chosen tradeoffs, encountered challenges, envisioned solutions as well as quality and speed results are presented in this paper. We also explore researches directions and future potential developments of the library. Our claim is that even partial automation of screenshots classification would reduce the burden on security teams and that Douglas-Quaid is a step forward in this direction.

Full text

K****eywords Threat Intelligence  $\cdot$ Phishing  $\cdot$ Dataset  $\cdot$ Open Source  $\cdot$ Security  $\cdot$ CERT  $\cdot$ Incident Response  $\cdot$ Visual Detection  $\cdot$ Automatic classification  $\cdot$ Correlation  $\cdot$ Clustering

1 Introduction

CERTs - as CIRCL - and security teams collect and process content such as images (at large from photos, screenshots of websites or screenshots of sandboxes). Datasets become larger - e.g. on average 10000 screenshots of onion domains websites are scrapped each day in AIL, an analysis tool of information leak - and analysts need to classify, search and correlate through all the images.

Automatic tools can help them in this task. Less research about image matching and image classification seems to have been conducted exclusively on websites screenshots. [1][aburrousPredictingPhishingWebsites2010a][2]. However, a classification of this kind of pictures needs to be addressed.

One of our long-term goal was to build a generic library and services which can easily be integrated in Threat Intelligence tools tools such as AIL111Analysis Information Leak framework - github.com/CIRCL/AIL-framework[3] and MISP222Malware Information Sharing Platform - github.com/MISP/MISP[4].

MISP is an open source software solution tool developed at CIRCL for collecting, storing, distributing and sharing cyber security indicators and threats about cyber-security incidents analysis.

AIL is an open source modular framework developed at CIRCL to analyze potential information leaks from unstructured data sources or streams. It can be used, for example, for data leak prevention.

A first step of this long-term goal completion had been reached with the development of an evaluation framework, provided as Carl-Hauser333github.com/CIRCL/carl-hauser and an open-source library itself, provided as Douglas-Quaid444github.com/CIRCL/douglas-quaid. This paper presents the design and the current performances of Douglas-Quaid library.

Image-matching algorithms benchmarks already exist [5][6][7] and were highly informative. They were used to choose on which algorithms to focus on. A quick-lookup mechanism for correlation was necessary and took part in this library.

1.1 Problem Statement

No open-source tool provides an easy high level interface to correlate pictures, even without conditions on technology used.

Ideally, establishing links or correlation between pictures could be fully automated, to assist analysts in their duty. Even partial automation would reduce the burden of this task on security teams. [8] states the Image-Retrieval problem as "Given a query image, finding and representing (in an ordered manner) the images depicting the same scene or objects in large unordered image collections".

The main contribution of this paper is a free and open-source library for Image-Matching with a high level API.

This paper also presents the design of this system, used algorithms, possible and expected extensions, as well as performance results.

2 Methodology and Context

2.1 Context

Douglas-Quaid had been built among other projects, related to the same problem and influencing its design choices; as shown in Figure 1.

We completed a State of Art about Image Matching algorithms available at SOTA.pdf. This State of Art allowed us to build a framework named Carl-Hauser [9], which evaluate literature’s algorithms with the most potential for our use-case.

To classify the datasets of pictures needed to evaluate algorithms performances, we built VisJS-Classificator [10] to visually classify pictures under a graph data-structure as well as a clustered data-structure, at the same time. More information about the dataset is provided in Section 2.2.

Douglas-Quaid was then built as a performance-oriented implementation of Carl-Hauser’s best Image-Matching algorithms. To date, Carl-Hauser is still more advanced than Douglas-Quaid in terms of algorithms complexity. However, the gap may shrink in near future. Douglas-Quaid is much faster than Carl-Hauser, as he is performance-oriented, rather than exploration-oriented.

2.2 Datasets

Tests, performances and speed evaluation were conducted using real sets of pictures. These datasets were extracted from CIRCL’s tools, such as AIL and URLAbuse. Two main datasets were used : circl-ail-dataset-01 of 470+ pictures and circl-phishing-dataset-01 of 37000+ pictures.

Phishing datasets and AIL datasets are available for research purposes at circl.lu/opendata/datasets/circl-phishing-dataset-01 and circl.lu/opendata/datasets/circl-ail-dataset-01. More details about these datasets in [11].

3 Design

Carl-Hauser framework allowed us to know the pros and cons of each algorithm and approach. It acted as a precursory of Douglas-Quaid library.

3.1 Hypothesis, constraints and goals

We set main assumptions and goals as well as standard software design expectations (maintainability, quality of code, documentation …). These constraints were :

• •

No Open-Source Image-Matching library with High-level API were found. API calls should be kept to minimum and as simple as "store a picture", "request similar pictures", etc.

• •

From Carl-Hauser, we found out that chosen algorithms are complementary. An approach with a unique or a hardcoded set of algorithms would be restrictive. Core algorithms should be modular.

• •

Nature of pictures varies. Even if the goal is to match screenshots, nature of these screenshots varies : phishing websites, infected virtual-machines, onion domain websites … Therefore, the behavior of the library needs to be altered easily, an easily specialized for one use.

• •

Technologies should easily interact with other Open-Source tools developed at CIRCL, if possible.

• •

The library must scale up, especially for read/request accesses. A request should be answered quite quickly, to be usable to automate processes as well as used by analysts.

3.2 Software Overview

Like Carl-Hauser, Douglas-Quaid has therefore been implemented from scratch. Similar good practices were followed [12][13].

Douglas-Quaid can be considered as a less algorithmically complex version of Carl-Hauser. Carl-Hauser is a research platform that evaluates very heterogeneous treatments, while Douglas-Quaid only implements the most robust versions of Carl-Hauser algorithms.

Core database, processing and results storage can be distributed on different machines, as Douglas-Quaid is built as a client and multi-tier server architecture. The REST API constitutes the main mean of interaction with Douglas-Quaid’s server. Entirely Local dynamic server instantiation is available, for instance to automatically evaluate optimal parameters.

the storage uses Redis, which is an in-memory database. Only set of feature - not images - are stored in memory (about 45KB/image added). The reactivity of Redis was chosen at the expense of the "infinite" scalability of the library. Three Redis databases are parts of the server: a test database (optimization measures, unit tests, etc.), a cache database (used to queue initial or intermediate requests, etc.) and a storage database (stores the main data structure).

The treatments are monothreaded, per worker. A variable number of workers can be started, potentially bounded by Redis to handle their requests. Each worker has a specific task, that he performs in a loop. Queuing structures are used to assign tasks to workers. Hot-shutting down and hot-adding of workers can be performed as needed. For example, during a data addition phase (write intensive), many "add" workers can be started simultaneously. Access to the add queue is protected to ensure that jobs are handled only once. A double addition would in any case not be an issue for the main data structure.

The query results are stored in the cache database, waiting for the client who ordered it to pick it up. Most intermediate data have an expiration time, avoiding a constant and uncontrolled increase in the memory used in case of issues with workers.

The API is simplistic and the complexity moved to the server side. Each implemented algorithm can be enabled or disabled and has specific parameters. The choice of these parameters is difficult, but is solved by a calibration algorithm. Process followed by this calibration algorithm is presented by Figure 9.

The library therefore only needs:

• •

a subset of the production dataset (for example, 20 to 40 images sampled from a complete dataset);

• •

a "ground truth" file to define the ideal result expected;

• •

the target rates of false positive/true positive, false negative/true negative (at least two of them).

The calibration algorithm will seek to optimize the internal parameters of Douglas-Quaid with these inputs. The calibration algorithm is described in Section 4.5. The main advantage is therefore the absence of obscure parameters (example: a threshold between 0 and 1) to be provided without knowledge of the internal mechanisms of the library.

The main data structure is described in Section 4.1 and is not required to understand the general architecture of the library. This data structure simply makes it possible to obtain an expected sub-linear complexity in the number of images stored in the database, at best equal to the number of existing clusters. At best, the number of clusters and so the search complexity will be of $O(\sqrt{nbpicturesindatabase})$.

If a parameter change takes place during the production phase, all data must be reloaded into the library. This operation is not implemented by a method to "recalculate" data structures to avoid adding an additional layer of complexity, which could generate artifacts. In order to improve maintainability, a change in core parameters must be followed by a restart (and flush) of the server.

The technical documentation of Douglas-Quaid is available at https://github.com/Vincent-CIRCL/douglas-quaid/blob/master/docs/code_doc/core_doc.pdf

3.3 Software design

The software architecture of the library is shown in a simplified way in Figure 4.

3.3.1 Client side

On the client side of the application we find a few main blocks :

• •

API (Application programming interface), with a Simple API and an Extended API.

• –

The Simple API presents the essential elements of the API, low level, to talk with the server. It gives small and essentials methods to exchange information with the server-side API.

• –

The Extended API presents higher level methods to interact with the server-side API, which performs batch operation on folder for example.

• •

CLI (Command-line interface) for client side. It’s a python script that can be launched with arguments (-h to get the help for details) to perform each action without need of a full custom python script.

• •

Similarity Graph extractor and Storage graph extractor. Two denomination are used in the library : similarity and storage graph. Both are different and should not be mistaken. More information provided about these graph in 3.3.3

• •

Example of client side API usage.

3.3.2 Server side

On the server side we find a few application blocks. It is composed of some classes to handle API calls, some to handle how to interact with the database, some to compute and extract features out of pictures, some to extract distances out of features, some to handle workers and processes, some to handle export and import …

• •

Server Side API : This set of classes handle the reception and the processing of user’s requests. It answers to API call, defines and instantiates server side endpoints for each API call, handles SSL. Can interact and call relevant functions elsewhere on the server-side.

• •

A Queuing system : the API can queue a job that will be performed by a backend worker. It uses a Queuing system within a Redis database. These workers handles the transformation of a picture into a set of features, and handle the comparison between stored and requested set of features. The queuing system is also used to store results to be fetched by clients.

• •

A Storage database with specifics data structures, to reach a square root search complexity in number of pictures stored.

• •

A server’s minimal core of Singletons handles launch, verification and stop of databases, workers and processes. These launchers propagates inputted configuration files on launch, to alter workers behavior.

The entry points to launch Douglas-Quaid server are :

• •

Standard Server Launch : ready to answer request in production environment

• •

Calibrator : Behavior explained in Section 4.5

• •

Scalability Evaluator : Which is a set of classes used to evaluate the scalability of the application. Add and request pictures, measuring response time. It stores results in JSON and save it as a graph. It can evaluate the scalability on the database with default configuration or with different thresholds for cluster creation, which are specified in the configuration file.

• •

Test instance launcher : Provides an unified way to create a test instance of the server. Point the storage and cache database (and sockets) to a test database, that won’t modify production data. Allows to overwrite default configuration files. Operates with an overwritten version of database Default Configuration, modifying path of scripts and sockets. Create a running instance of douglas-quaid, all linked on a unique test database. Modify the behavior of the core launcher handler, to use only one database.

3.3.3 Graphs

Two denomination are used in the library : similarity and storage graphs. Both are different and should not be mistaken:

• •

Storage graphs : Graphs and clusters as it is stored in Redis. (Datastructure to improve requests performance). The storage graph refers to the set of clusters and their content, used in the database, to store pictures. It is a visualization of "how is the database" and can be analyzed to see if the database will be efficient or not. Classes on client side with this name are able to extract this graph from the server. Details about storage graph are given in Section 4.1.

• •

Similarity graphs : Graphs computed from many requests, that show which picture is close to which picture. This is not the way it is stored in the database, but a condensed view of all requests that can be made on the database. The similarity graph refers to the distance between pictures, and the graph its constitutes, if we extract each picture of the database and its nearest neighbor, as a client. It is a visualization of "what the database says" and can be analyzed to see if the library output is correct or not. Classes on client side with this name are able to extract this graph from the server.

3.4 Algorithms

Few Image matching libraries were tested, including :

• •

ImageHash555github.com/JohannesBuchner/imagehash which includes a wide list of fuzzy hash algorithm such as AHash, DHash, PHash, WHash, … The purpose of these algorithms is to map input files (here, images) into a limited hash space, such that two "similar" images have similar hashes. Their objective is therefore distinct from traditional hash algorithms, which seek to maximize the difference between hashes for even a minimal difference (ultimately, 1 bit) in the input file.

• •

TLSH666github.com/trendmicro/tlsh[14] is also a fuzzy hashing algorithm, available in its own library.

• •

OpenCV777github.com/opencv/opencv is an open source computer vision and machine learning software library, which provides a common infrastructure for computer vision applications. Relevant algorithms are available within it, such as SIFT [15][16] (Scale-invariant Feature Transform), SURF [17] (Speeded Up Robust Features), ORB [18] (Oriented FAST and Rotated BRIEF), … These algorithms use key point descriptors, a way to condense distributed and locally relevant information, into a vector or set of vectors. These vectors can then be compared. However, we focused on open-source implementations and avoided patented implementation. SIFT and SURF were therefore outside of the scope. Thanks to a large performance overview [19] we chose to primarily focus on ORB.

Usually, you may need to see (through VisJS-Classificator for example, as the export format is compatible) what the Similarity Graph looks like. Except for debugging, Storage Graph does not need to be extracted in production settings.

4 Challenges

4.1 Main data-structure

The main data-structure is composed of cluster of pictures. Each cluster is the representation of a graph, with edges representing distances between pictures. As the exact graph is not needed, we don’t store it under this format. Each cluster of picture is represented as a sorted set of pictures. Semantically we are working with graphs, while we are practically working with sets.

The higher in the set a picture is, the most representative the picture is. Pictures in sorted sets are sorted by their representativeness of the whole set of pictures. Therefore, we have a sorted list of representative pictures of each cluster. Strictly, the representativeness is computed as a centrality measure of a given picture in the similarity graph.

When a picture is added in the database or a request is made, algorithms perform a comparison of the picture with all most central (representative) picture(s) of each cluster. Therefore, instead of making a comparison of one pictures to all pictures of the database ($O(\textit{nb picture in db})$), it compares the picture with all clusters ($O(\textit{nb clusters}*\textit{nb most representative picture per cluster to test (PARAMETER)})$).

The picture will be matched to a cluster (strictly, the representative picture of the cluster) or not.

If the picture match a representative picture of a cluster, we compare the request picture with all pictures of this cluster. Therefore, instead of running $O(\textit{nb picture in db})$ comparisons, we run $O(\textit{nb clusters}+\textit{nb matched clusters}*\textit{nb pictures in each looked-up cluster})$. This improves performances by decreasing number of performed comparisons. At best, the number of comparisons will be $O(\sqrt{\textit{number of pictures stored}})$

Clusters are composed of somewhat-similar pictures. Tricky thing is the algorithm which says "This picture is too distant, it must be in a new cluster" or "This picture is close enough and is in the same cluster". Mainly based on a threshold, it impacts the performance of the library (time-wise) and less/not on the quality of match.

4.2 Distances

Distances are needed but insufficient to represent link between pictures. Heterogeneity of algorithm’s output is a problem, as the following will show.

Please note that distances are considered here as normalized euclidean distance, which means that a 0 distance is equivalent to "two totally similar pictures", and a 1 distance is equivalent to "two totally different pictures". Let’s consider an edge case.

If you consider two algorithms:

• •

For algorithm A, a match is meaningful if the returned distance is below $0.25$. It is a mismatch if the distance if upper than $0.25$. Noted as $t1$ on Figure 7.

• •

For algorithm B, a match is meaningful if the returned distance is below $0.85$. It is a mismatch if the distance if upper than $0.85$. Noted as $t2$ on Figure 7.

Consider two comparison :

• •

Algorithm A gives a distance of $0.2$ (match for itself), algorithm B gives a distance of $0.8$ (match for itself). Noted as $d1$ and $d2$ on Figure 7.

• •

Algorithm A gives a distance of $0.3$ (mismatch for itself), algorithm B gives a distance of $0.7$ (match for itself). Noted as $da$ and $db$ on Figure 7.

Min, max, mean ($0.5$) are equal in both cases. However, in first case, all algorithms agreed that both pictures are "a match". In second case, one algorithms considered it as a "mismatch". We do not even consider "gray zone" in this example, but only strict thresholds. This problem exists because each algorithm has its own "range of values" in which a match is a meaningful match. Normalization could have been a solution, but we have chosen a more human-readable solution : decisions.

4.3 Decisions

We choose to work with human-readable decisions in addition to distances. Decisions are not a simple threshold over distance.

Each algorithm computes a distance between pictures. Each algorithm has it’s own way to compute this distance. All algorithms output a value within range ’[0-1]’.

For example : A-HASH outputs a distance of $0.4$ between picture A and B

Each algorithm can then computes a decision. Using thresholds on its own distance output, it gives a YES/MAYBE/NO decision.

Continuing example : *A-HASH outputs a decision ’YES (it matches)’ between picture A and B, because distance between picture A and B is $0.4$, which is less than the ’yes-to-maybe threshold’ of A-HASH. *

Decisions may help to decide which other algorithms to launch. That’s why a "YES" or "MAYBE" decision can come after a "NO" decision in a distance-sorted list.

A word about precision: given the precision of enabled algorithm ($1/400$th precision for TLSH, $1/500$th precision for ORB), we can consider that any distance more precise than $1/250$th ($0.004$) precision would not be relevant.

4.4 Merging distances and decisions

When comparing two pictures, enabled algorithms are called. Each provides a distance and a decision. An additional merging algorithm do merge these distances and do merge these decisions.

Distances can be merged with distinct approaches :

• •

Max of all distances;

• •

Mean of all distances;

• •

Min of all distances;

• •

Harmonic mean;

• •

Weighted mean of all distances, etc.

Decisions can be merged with distinct approaches (See Figure 8):

• •

Pareto rule (if 80% algorithms give the same decision, we output this decision);

• •

Majority rule (most prevalent decision is returned);

• •

Weighted majority;

• •

Pyramidal (we check for high weight algorithms, and if unsure, we check others).

4.5 Self-Calibration

The calibration algorithm needs a set of pictures, a ground truth file (a JSON specifying the clustered version of these pictures) and some directives (Minimum true positive rate, acceptable false positive rate, minimum true negative rate, acceptable false negative rate) in order to create a configuration file with thresholds as close as possible to the expected performances.

This calibration dataset needs to be sampled from the future production dataset. Due to heavy and repeated computations, the number of sampled pictures should not exceed 100 in order for the calibration to be computed in relevant time. Exact computation time heavily depends on the enabled algorithms, hardware specifications and dataset.

Internally, the calibration algorithm will send pictures to the database, will extract the similarity graph and will evaluate this similarity graph in comparison of the ground truth reference provided.

As a comparison between a graph and a list of cluster of pictures is not trivial, we prune the graph (of distances) with a threshold. Then, we can convert the graph into clusters and compare clusters to ground truth clusters. This gives us some metrics (True Positive rate, False Positive rate, etc.) for this specific threshold. We can generate an evolution graph of these metrics. See Figure 9. All algorithms generate the same pattern :

• •

False positive rate of matches increases as threshold increases. There are more and more wrong matches as we increase the acceptable distance for a match to be considered as a match.

• •

False Negative rate of matches decreases as threshold increases. At the opposite, there are less and less matches marked as "wrong" wrongly, as we increase the acceptable distance for a match to be considered as a match.

• •

True positive rate of matches increases as threshold increases. There are more and more matches marked as matches, which are effectively true.

• •

True Negative rate of matches decreases as threshold increases. At the opposite, there are less and less matches that are marked as no-matches. Therefore, the number of matches marked as "no-matches" and that are truly not matches diminishes.

Thanks to these pattern, we can automatically find the best thresholds that optimizes this or that metric (e.g. 10% and no more false positives, etc.) as asked by the user in the very beginning. See Figure 10 which shows how thresholds are set from a True Positive rate, False Negative Rate, etc. graph.

These thresholds will then represent which decision is related to which distance for a specific algorithm. For example, a distance between two pictures below the "yes-to-maybe threshold" (Figure 10, left picture, leftmost threshold, green area) will generate a "YES" decision. A distance between the "yes-to-maybe-threshold" and the "maybe-to-no-threshold" (Figure 10, left picture, yellow area) will generate a "MAYBE" decision. Finally, a distance greater than the "maybe-to-no-threshold" will generate a "NO" decision (Figure 10,left picture, red area).

If the original graph had been generated from a configuration enabling only one algorithm, we then have extracted two thresholds for this specific algorithm. If more than one algorithm were activated, we then have two thresholds for the whole output of the library. This is not used and not relevant in our setting. So, the calibration algorithm extract only thresholds per-algorithm to build the future configuration file of the server.

5 Results

Performance’s related issues were encountered :

• •

Cluster’s representative picture re-evaluation is done right after the picture addition. Therefore, the time to perform the operation adds up to adding time. This overhead could be removed from calculation by deporting the reevaluation in off-time, by adding this reevaluation job to a queue and add a new worker to complete it.

• •

Clusters number and their sizes is not deterministic. Therefore, the time taken to perform operations is not deterministic but is bounded by $O(\textit{time to compare feature}*\textit{nb cluster}+\textit{nb good cluster}*\textit{nb pictures in each of those clusters})$

5.1 Quality

We present the performances in two ways.

• •

a visualization of similarity graph with VisJS-Classificator as shown in Figures 11, 12(a).

• •

a quantified analysis as shown in Figures 12(b) and 13.

The visualization with VisJS-Classificator presents a graph of pictures. Each edge between two pictures represents a match. Decision and distance are written on each edge. For more information, please see [10]. One can easily spot issues with this view.

Figures 12(b) and 13 present values from a confusion matrix. Figure 12(b) shows that if we rely only on distances and put a threshold to evaluate the "goodness" of matches, we can at best reach a 80% accuracy, 80% F1 score with 80% true negative, 80% true positive, 20% false positive and 20% false negative (threshold at 0.075, roughly).

Figure 13 presents the same kind of chart for each matches subset : YES, YES and MAYBE, MAYBE, and NO matches.

• •

On Figure 13(a) (YES only), we see that all merged distances are below 0.2. We see that if we do not put any threshold and so accept all YES matches as matches, regardless of their distances, we get a 80% accuracy.

• •

On Figure 13(b) (YES and MAYBE only), we see that if we do not put any threshold and so accept all YES or MAYBE matches as matches, regardless of their distances, we get a 75% accuracy.

• •

On Figure 13(c) (MAYBE only), we see that if we do not put any threshold and so accept all MAYBE matches as matches, regardless of their distances, we get a 65% accuracy.

• •

On Figure 13(d) (NO only), we see that if we do not put any threshold and so accept all NO matches as matches, regardless of their distances, we get a 35% accuracy.

5.2 Speed

One of our findings is that ORB (OpenCV2 descriptors matcher) is the most time-intensive operation during adding of a picture to the database. This "Are these descriptors matching ?" operation is called several time during the addition of a picture to the database. Solutions to this issue are :

• •

Reducing the time needed to match descriptors together. As this function is part of OpenCV2 library, this is not an easy solution. Decreasing the number of descriptors per picture is a partial solution, but with a cost in picture’s description’s quality.

• •

Reducing the number of calls to OpenCV2 matcher. This is intrinsically related to the database’s data-structures. This would ask to modify the internal storage structure of pictures, for example for a tree-like structure or a hash-table-like structure. Due to other constraints (ability to combine algorithm outputs, etc.) this would ask for major changes in the library design.

• •

Removing ORB algorithm. This is the most straightforward solution. However, we would loose a complementary and pertinent matching algorithm. A potential replacement for this loss would be an ORB-BoW algorithm. Carl-Hauser showed that this version of the algorithm, using a boolean vector of presence/non-presence of a finite amount of descriptor only, is as fast as its fuzzy-hashes counterparts.

Please note that the evaluation of speed is performed as follow :

• •

A folder of picture is divided in "boxes" of incremental sizes, logarithmic or not.

E.g. a first box of 10 pictures, a second of 25, a third of 40, etc.

• •

For each boxe size :

• –

We put aside 10 pictures that will serve as request pictures.

• –

We also put aside $N$ pictures, the exact number being the current box size.

• –

We send the $N$ pictures in the adding queue to the database, and wait until they are added.

• –

We request the 10 pictures, and wait until they have ready results.

One issue encountered was the cache remembering which picture has already been requested, which is a side-effect of the data-structure used. Therefore, at each iteration, we need to empty the cache or we need to request new pictures. The later was chosen for its simplicity of implementation.

6 Future work

6.1 Potential extensions

Some elements can be added to the current state of the Douglas-Quaid library.

• •

Add a "on demand" algorithm calculation mechanism. Some algorithms need a lot (relative to others) of time to compute an output between two pictures. These algorithms (RANSAC, ORB with some modifications, etc.) may need to be triggered only for very special purposes, and very sparsely. For example, we could envision an "inverse pyramidal matching": when the most trusted algorithm outputs a "MAYBE", it triggers the computation of one of these computation-intensive algorithms.

• •

New core algorithms could be added, as :

• –

OCR and Cosinus Distance: It would be possible to add an algorithm to store raw text as an additional feature vector, and then use cosinus distance between these set of words. Standard methods (e.g. Tesseract) could be used for the OCR, as well as State of art approach (Machine Learning with ConvNets, LTSM …). The last ones may however be patented and can’t fit into the project license requirements.

• –

Manual matching: A tricky algorithm could be added to the library to allow a human to perform "manual" comparisons. This very simple algorithm would only check in an aside database if a human comparison was made. If so, and if the human stored "These two pictures are similar", then the algorithm outputs a 0-distance and a "YES" decision (perfect match). If the human stored "These two pictures are not at all similar", then the algorithm output a 1-distance and a "NO" decision. Otherwise, it outputs a 0.5-distance and a "MAYBE" decision. By giving this algorithm the highest weight and choosing a pyramidal decision process, this would bypass all other algorithms in "YES" and "NO" cases and put human decision above all. A HCI would be needed for the human to perform these comparisons, as well as an aside data-structure to store human’s decisions.

• –

ORB, RANSAC and geometrical verification: As tested in Carl-Hauser, RANSAC is a very computation-intensive but relevant algorithm. From it, we can extract the transformation matrix between two pictures (strictly, the transformation matrix to apply to the position of the key-points of the first picture in order to match the position of the key-points in the second picture). This remove most of the false-positive pictures, for a high computational cost. This would need to be performed only when doubting about the quality of the match and would need deeper modifications in the library as just "a new algorithm block". This would however be a relevant algorithm to add, as "standard algorithm" for small databases of pictures (e.g. matching a specific logo in request pictures).

• –

ORB BoW - Bag of Word approach: As tested in Carl-Hauser, the Bag-Of-Word approach constitutes a good trade-off between a time-efficient matching and its relative quality compared to ORB-alone algorithm. The principle is pretty simple. We compute a k-means over the list of all keypoints and their descriptors of all pictures currently in the database. This gives us $k$ representative descriptors (each being a "mean" of a group of original descriptors). Now, instead of keeping a descriptors list (each being a real value) per picture, we only keep a boolean array, which essentially says "the $i\textit{-th of }k$ descriptor is present in this picture". This boolean array can be processed as a hash, with Hamming distance for instance. The main costs is to create this dictionary and to maintain it. A lot of various pictures are needed to create the first dictionary. At some point, if the dataset in the production database evolves too much (if it becomes too distant with the original dataset on which the actual dictionary had been computed), the dictionary would need to be recomputed (on the actual set of pictures present on the database, larger than the initial one). The feature vector of each picture would also need to be recomputed. The complexity of such operation would be $O(\textit{nb pictures in database})$, which is not an issue. On a software engineering side, choosing when to recompute the dictionary would however be an issue as well as the choice of the size of the dictionary (the number of "words" or "boolean switches"). This issue is strongly linked to the choice of k for a k-means, and so one solution could be an affinity propagation approach.

• –

Machine-Learning and/or BlackBox algorithm: Machine Learning with ConvNets, LTSM … and most recent approaches could fit in as a new algorithm block. A very simple approach with Decision Trees for decision making or/and decision merging and/or distance merging could be an easy very first approach.

• –

ORB and KMeans : As explained in [2], it seems that grouping keypoints by their position by performing k-means, and checking the similarity of these groups of keypoints between two pictures, give relevant results. However, ORB-alone is computation intensive and adding overhead computation over it may forbid its usage. Like RANSAC, this could however be relevant for small database settings and/or as a final computation.

• –

Random algorithm : We could use a random matching algorithm (giving a random value between 0 and 1 and a random decision) to have a reference for all algorithms. That’s only informative and not a primary issue.

• •

Add precomputation (text hider … ) : As tested in Carl-Hauser, we know that some pre-computations can improve the output quality of some algorithms (e.g. Text hider for fuzzy-hashes). We may want a way to enable or disable some specific pre- or post-computations for specific algorithms.

• •

Compare video or GIFs : even if videos are only ordered list of pictures, we could think about finding the most relevant pictures in these videos, and then perform the matching on this set of representative pictures. This would need heavy modification to the library.

• •

Auto-tagging : by storing arbitrary data along with picture’s feature, we could give back the data stored along matched pictures with request’s result. This could allow, for instance, to store tags about pictures, and so transform Douglas-Quaid into an auto-tagging system. It could returns tags from a request picture, if added pictures were tagged. This system could be built as a wrapper around Douglas-Quaid too.

• •

Direct integration with VisJS-Classificator : Visualization of the links between pictures could be presented with a graph view. Calls to VisJS-Classificator API could be performed when some key computations are performed in Douglas-Quaid to trigger graph modification.

• •

Metrics to evaluate the state of the database : the quality of the matching, the performances of the request system, the quality of the clustering inside the main data-structure, etc. could be evaluated at any time.

• •

Handling duplicates : Duplicated pictures (same cryptographic hash) are already structurally handled by the library. If two same pictures are requested or added, the will have the same ID and so be "already computed". However, client is not alerted about the previous presence of this specific picture.

• •

Dynamic threshold modification : Internal threshold of the library are set once and for all at the library first launch. Any post modification would probably generate artifacts in matching. We recommend to flush the server and add again all stored pictures if thresholds are modified. However, one may want to "do it live". A trade off is that original pictures are needed to perform such operation. Therefore, "doing it live" would need to have an accessible copy of all pictures ever stored in database until re-computation time, which is only optional for now.

• •

Dynamic features modification : The problem is similar for enabled features. A recomputation of all features of pictures with missing algorithms is needed when we change which algorithms are enabled. So, we would need the original files.

6.2 Planned extensions

Problems presented previously lead to a list of future possible developments :

• •

Extending provided datasets to support research effort

• •

Improving scalability of the library

7 Conclusion

7.1 Summary

Our Image-Matching library named Douglas-Quaid is available at github.com/CIRCL/douglas-quaid. This research paper proposes that even partial automation of screenshots classification would reduce the burden on security teams and that Douglas-Quaid is a step forward in this direction.

The original algorithms evaluation framework named Carl-Hauser is available at github.com/CIRCL/carl-hauser.

The datasets used to conduct tests are available at : circl.lu/opendata/circl-ail-dataset-01 and circl.lu/opendata/circl-phishing-dataset-01

Research results were presented along with encountered issues. Algorithmic modifications are still being performed to solve met issues and improve overall quality of the library. This library is intended to be used in Open Source tools or for research purposes.

7.2 Contact information

If you have a complains related to the dataset or the processing over it, please contact us. We aim to be transparent, not only about how we process but also about rights that are linked to such information and processing. You can contact us at circl.lu/contact/ for request about the dataset itself, regarding elements of the dataset, or extension requests. You can contact us at same address or on github for feedback about the benchmarking framework, methodology or relevant ideas/inquiries.

Part I Appendices

8 Detailed view of the Library

The exact implementation differs on some points with the idealized overview presented in the paper’s body.

For example, the queuing system is more complex than just one queue of jobs. It is divided in many smaller queues for each kind of jobs. Workers are of different types depending on the process step in the pipeline. Other mechanisms are presents, as refreshing and re-evaluation algorithms to prevent path-(upload)-dependent behaviors. Algorithms-specific classes are modular and aside from the rest of the application. Adding an algorithm (OCR, human-matching, ML, …) would only take two files creations, ask for modification of two more files and less than 100 lines of "context management". See Figure 15 for the detailed view of the library processes.

The library classes model is shown in Figure 16 and presents which classes is using which other classes.

9 Client API Usage example

Part II Glossary

Glossary

AIL AIL, for Analysis Information Leak framework, is a deep-web crawler, which will analyze the loaded content of the pages to detect possible information leaks. AIL is a modular environment for analyzing potential information leaks from unstructured data sources such as Pastebin texts, similar services or unstructured data flows. The LIA framework is flexible and can be extended to support other functionalities to extract or process sensitive information (e.g. data leak prevention). [20] for reference, translated from [AILFrameworkAnalysis2019a][3]

Carl-Hauser Open-Source Framework for testing algorithms for correlation, distance and image analysis. Strongly linked to: Douglas-Quaid. Translated from [21]

CASES CyberSecurity Awareness and Security Enhancement Services is an initiative of the Luxembourg government that provides awareness activities, web resources and other tools such as MONARC, focusing on understanding the information security issues facing SMEs. Translated from [CASESLU]

Douglas-Quaid Free software for correlation, distance and image analysis. Strongly linked to: Carl-Hauser. Translated from [22]

Image-Matching Image matching is a classic problem in scene analysis: if you give a reference image of an object, you have to decide if it exists in a scene image being analyzed, and find its location if it does. The measurement of similarity between two images is an objective of Image-Matching. Translated from [23]

Image-Retrieval An image search system is one of the solutions that can be used to navigate, search and retrieve images from a large database of digital images. Translated from [24]

MISP MISP, for Malware (or Magic) Information Sharing Platform, is as its name suggests a platform for sharing security events (broader than just malware). MISP is an open source software solution that enables the collection, storage, distribution and sharing of cybersecurity indicators and threats related to the analysis of cybersecurity incidents and malware. MISP is designed by and for incident analysts, security and ICT professionals or malware reversers to support their daily operations and effectively share structured information. The objective of the MISP is to promote the sharing of structured information within the IT security community. MISP provides functionalities to support the exchange of information but also the consumption of this information by Network Intrusion Detection Systems (NIDS), LIDS but also log analysis tools, SIEMs. Translated from [25][4]

Redis Redis is an open-source in-memory database (under BSD license), used as a database, cache and message broker. It supports data structures such as strings, hashes, lists, sets, sets, sets sorted with queries by range, bitmaps, geospatial indexes with queries by radius. Redis integrates replication, Lua scripting, transactions and different levels of disk persistence, and offers high availability via Redis Sentinel and automatic partitioning with Redis Cluster. Translated from [26]

URLAbuse URLAbuse is a static website verification tool, which can give an indicative opinion on the probability that the evaluated site is a phishing site. URL Abuse is a free and versatile software for URL verification, analysis and blacklist creation. URLAbuse consists of a web interface where requests are submitted asynchronously and a back-end system to process URLs in a modular way. Translated from [27]

VisJS-Classificator Classifier for image matching and grouping. Fast and visual. Uses VISjs and Socket.io to allow the classification/matching of images, manually, in real time in multi-user mode. translated from [28]