Neural Networks for File Fragment Classification

Vulinović, Kristijan; Ivković, Lucija; Petrović, Juraj; Skračić, Kristian; Pale, Predrag

doi:10.23919/mipro.2019.8756878

Cited by 13 publications

(4 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Its authors used support vector machines (SVM) to classify file fragments using unigram and bigram (1-gram and 2-gram) features and achieved the classification accuracy of 73.8% across 38 different file types. N-Grams or n-gram-derived features remain frequently used in the newer approaches [27], [28] and can also be used to perform a detailed comparison of different classification approaches. For example, Seste et al [29] perform a detailed comparison of support-vector machines and neural networks applied for identifying file fragment types, by focusing on the n-gram analysis as a feature for the two different classifiers.…”

Section: B Approaches To File Fragment Type Identificationmentioning

confidence: 99%

ByteRCNN: Enhancing File Fragment Type Identification With Recurrent and Convolutional Neural Networks

Skračić,

Petrović,

Pale

2023

IEEE Access

Self Cite

View full text Add to dashboard Cite

File fragment type identification is an important step in file carving and data recovery. Machine learning techniques, especially neural networks, have been utilized for this problem, some with very promising results. This paper presents a novel neural network architecture for identifying file fragment types using a combination of byte embeddings as well as recurrent and convolutional elements. The corresponding classification model, ByteRCNN, has been trained on the publicly available file fragment FiFTy dataset and evaluated in closed-set and open-set recognition settings using FiFTy and other available file fragment datasets. Evaluation results have demonstrated that ByteRCNN can compete with state-of-the-art models described in literature in terms of classification accuracy, with 71.1% average accuracy on 512-byte fragments and 83.9% average accuracy on 4,096-byte fragments from the FiFTy dataset. When evaluated on other publicly available datasets in closed-set and open-set recognition settings, ByteRCNN similarly or slightly better than the FiFTy classification model. Obtained results overall suggest that ByteRCNN is a competitive file fragment classification model, but they also reveal that there is still plenty of space for further improving file type identification methods using more complex datasets or in open-set recognition settings. ByteRCNN is publicly available at [GitHub, after publication].

show abstract

Section: B Approaches To File Fragment Type Identificationmentioning

confidence: 99%

ByteRCNN: Enhancing File Fragment Type Identification With Recurrent and Convolutional Neural Networks

Skračić,

Petrović,

Pale

2023

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…ML has been widely applied to digital forensic investigation for data discovery [23,115], device triage [72,73], network forensics [81], etc. Flach [33] outlined the ML ingredients as: tasks, the problems that can be solved; models, the output of ML; and features, the workhorses of ML.…”

Section: Machine Learningmentioning

confidence: 99%

“…The average classification accuracy achieved was 70.9%. Vulinovic et al [115]. Vulinović et al [115] applied a CNN model using 1D convolution on the original byte block.…”

Section: Applications Of Ai In Df 31 Data Discovery and Recoverymentioning

confidence: 99%

See 1 more Smart Citation

SoK

Hargreaves

Sheppard

et al. 2020

Proceedings of the 15th International Conference on Availability, Reliability and Security

View full text Add to dashboard Cite

Multi-year digital forensic backlogs have become commonplace in law enforcement agencies throughout the globe. Digital forensic investigators are overloaded with the volume of cases requiring their expertise compounded by the volume of data to be processed. Artificial intelligence is often seen as the solution to many big data problems. This paper summarises existing artificial intelligence based tools and approaches in digital forensics. Automated evidence processing leveraging artificial intelligence based techniques shows great promise in expediting the digital forensic analysis process while increasing case processing capacities. For each application of artificial intelligence highlighted, a number of current challenges and future potential impact is discussed.

show abstract