Neural Networks for File Fragment Classification
Neural Networks for File Fragment Classification
Abstract - File fragment classification is an important step in file forensics in which filetypes are assumed based on their available content fragments. Methods typically used for this task utilize machine learning techniques on features like byte frequency distributions and fragment entropy measures. In this paper, a contribution to this field is made through exploration of novel approaches to the problem including feedforward artificial neural networks and convolution networks. Feedforward neural networks were trained with byte histograms and with byte-pair histograms, while convolution neural networks were trained with blocks consisting of 512 bytes of data obtained from the GovDocs1 dataset. The results suggest convolution neural networks are not as promising for this problem as feedforward artificial neural networks, and feedforward artificial neural networks showing great results.
file fragment classification ; file type detection ; artificial neural network ; convolutional neural network ; feed forward neural network ; file type forensics, file type detection, convolutional neural network, file type forensics, feed forward neural network, file fragment classification, artificial neural network
file fragment classification ; file type detection ; artificial neural network ; convolutional neural network ; feed forward neural network ; file type forensics, file type detection, convolutional neural network, file type forensics, feed forward neural network, file fragment classification, artificial neural network
selected citations These citations are derived from selected sources.This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).8 popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.Top 10% influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).Average impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.Top 10%
Citations provided by BIP!Popularity provided by BIP!