Hierarchy-Based File Fragment Classification

Abstract

File fragment classification is an essential problem in digital forensics. Although several attempts had been made to solve this challenging problem, a general solution has not been found. In this work, we propose a hierarchical machine-learning-based approach with optimized support vector machines (SVM) as the base classifiers for file fragment classification. This approach consists of more general classifiers at the top level and more specialized fine-grain classifiers at the lower levels of the hierarchy. We also propose a primitive taxonomy for file types that can be used to perform hierarchical classification. We evaluate our model with a dataset of 14 file types, with 1000 fragments measuring 512 bytes from each file type derived from a subset of the publicly available Digital Corpora, the govdocs1 corpus. Our experiment shows comparable results to the present literature, with an average accuracy of 67.78% and an F1-measure of 65% using 10-fold cross-validation. We then improve on the hierarchy and find better results, with an increase in the F1-measure of 1%. Finally, we make our assessment and observations, then conclude the paper by discussing the scope of future research.

Analytical Modeling for Identification of the Machine Code Architecture of Cyberphysical Devices in Smart Homes

“…In [ 40 ], the most important problem of forensics is solved in the form of classifying parts of files. For this, it is proposed to use a hierarchical approach using a set of optimized SVMs.…”

File Fragment Classification using Content Based Analysis

“…Their results showed that as we increase the size of the fragments used for classification, the accuracy is increased. Also, if the fragment belongs to the start or the end of the file, the classification accuracy is higher as compared to a fragment taken from the middle of the file Bhatt, M [1] used a different classification technique than most others. Their approach was a mixture of clustering and classification.…”

“…Bhatt. M [1] used the Hierarchy-Based File Fragment Classification method. They classified simple file correctly but for complex file, often it failed to classify the specific type of complex file accurately.…”

“…The 13 file formats used were as follows PDF HTML BMP JPG RTF PNG DOC TXT XLS GIF XML PS CSV For any machine learning algorithm, feature extraction is the most important step. In [1] a variety of features were tested and ranked using a feature ranking metric called information gain. The results showed that Unigram Count Distribution or Byte Histogram, was the most dominating feature with an information gain score of 3.807 while other features had scores in the low 1's and 0's.…”