检索结果-内蒙古大学图书馆

A Cross-Attention Multi-Scale Performer With Gaussian Bit-Flips for file fragment classification

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 2025年 20卷 2109-2121页

作者： Liu, Sisung Park, Jeong Gyu Kim, Hyeongsik Hong, Je Hyeong Hanyang Univ Dept Artificial Intelligence Seoul 04763 South Korea Hanyang Univ Dept Elect Engn Seoul 04763 South Korea Hanyang Univ Dept Artificial Intelligence Semicond Engn Seoul 04763 South Korea

file fragment classification is a crucial task in digital forensics and cybersecurity, and has recently achieved significant improvement through the deployment of convolutional neural networks (CNNs) compared to traditional handcrafted feature-based methods. However, CNN-based models exhibit inherent biases that can limit their effectiveness for larger datasets. To address this limitation, we propose the Cross-Attention Multi-Scale Performer (XMP) model, which integrates the attention mechanisms of transformer encoders with the feature extraction capabilities of CNNs. Compared to our conference work, we additionally introduce a new Gaussian Bit-Flip (GBFlip) method for binary data augmentation, largely inspired by bit flipping errors in digital system, improving the model performance. Furthermore, we incorporate a fine-tuning approach and demonstrate XMP adapts more effectively to diverse datasets than other CNN-based competitors without extensive hyperparameter tuning. Our experimental results on two public file fragment classification datasets show XMP surpassing other CNN-based and RCNN-based models, achieving state-of-the-art performance in file fragment classification both with and without fine-tuning. Our code is available at https://***/DominicoRyu/XMP_TIFS.

关键词： Transformers Feature extraction Data models Adaptation models Accuracy Attention mechanisms Computational modeling Training Electronic mail Data augmentation file fragment classification transformer multi-scale attention cross-attention performer

来源：评论

学校读者我要写书评

暂无评论

file fragment classification with Focus on OLE and OOXML classes 43

File Fragment Classification with Focus on OLE and OOXML cla...

引用

43rd International Convention on Information, Communication and Electronic Technology (MIPRO)

作者： Skracic, K. Rukavina, F. Milicic, K. Petrovic, J. Pale, P. Ericsson Nikola Tesla Dd Zagreb Croatia Univ Zagreb Fac Elect Engn & Comp Dept Elect Syst & Informat Proc Zagreb Croatia

ISBN: (纸本)9789532330991

classification of file fragments is a crucial step in digital forensics and determining file types based on available data fragments. Currently explored file fragment classification methods other than forensic hand-examination rely on machine learning techniques. Those methods most commonly use features based on byte frequency distribution as inputs in artificial neural networks. In this paper, some new approaches to file fragment classification are explored. Older MS Office file format files (doc, ppt, and xls), and the new MS Office format (docx, pptx, and xlsx), which were previously shown to be difficult to differentiate between, were joined into two separate higher-level classes due to similarities in the included files' structure. Different approaches to specifically differentiating between subtypes in each of those two higher-level classes are further explored in the paper. The results suggest small increases in classification accuracy can be achieved using the proposed approach.

关键词： file fragment classification file type detection OLE OOXML artificial neural network feedforward neural network

来源：评论

学校读者我要写书评

暂无评论

Sparse Coding for N-Gram Feature Extraction and Training for file fragment classification

引用

IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY 2018年第10期13卷 2553-2562页

作者： Wang, Felix Quach, Tu-Thach Wheeler, Jason Aimone, James B. James, Conrad D. Sandia Natl Labs Albuquerque NM 87123 USA

file fragment classification is an important step in the task of file carving in digital forensics. In file carving, files must be reconstructed based on their content as a result of their fragmented storage on disk or in memory. Existing methods for classification of file fragments typically use hand -engineered features, such as byte histograms or entropy measures. In this paper, we propose an approach using sparse coding that enables automated feature extraction. Sparse coding, or sparse dictionary learning, is an unsupervised learning algorithm, and is capable of extracting features based simply on how well those features can be used to reconstruct the original data. With respect to file fragments, we learn sparse dictionaries for n-grams, continuous sequences of bytes, of different sizes. These dictionaries may then be used to estimate n-gram frequencies for a given file fragment, but for significantly larger n-gram sizes than are typically found in existing methods which suffer from combinatorial explosion. To demonstrate the capability of our sparse coding approach, we used the resulting features to train standard classifiers, such as support vector machines over multiple file types. Experimentally, we achieved significantly better classification results with respect to existing methods, especially when the features were used in supplement to existing hand-engineered features.

关键词： file fragment classification file carving automated feature extraction sparse coding dictionary learning unsupervised learning n-gram support vector machine

来源：评论

学校读者我要写书评

暂无评论

Byte embeddings for file fragment classification

引用

FUTURE GENERATION COMPUTER SYSTEMS-THE INTERNATIONAL JOURNAL OF ESCIENCE 2022年 127卷 448-461页

作者： Haque, Md Enamul Tozal, Mehmet Engin Univ Louisiana Lafayette Sch Comp & Informat Lafayette LA 70504 USA

In digital forensics, file carving is the process of recovering files on a storage media in part or in whole without any file system information. An important problem in file carving is the identification of fragment types. Many fragment classification studies in the literature employ inflexible and indiscernible feature selection methods such as different statistics of byte frequency distributions. Moreover, assessing the strengths and weaknesses of some approaches is difficult as they are specific to certain file types such as graphics. In this paper, we propose a novel feature generation model using byte embeddings (Byte2Vec) which map fragments to dense vector representations. The proposed model extends the word2vec and doc2vec document embedding models to bytes and fragments, respectively. We use Byte2Vec for feature extraction and k-Nearest Neighbors (kNN) for classification. We present effectiveness of Byte2Vec+kNN in file fragment classification using a publicly available digital forensics dataset and a random web search dataset. Our experimental results show that Byte2Vec+kNN reaches an accuracy rate of 72% along with 74% precision and 72% recall. Compared to the other feature extraction techniques such as n-gram, byte distributions, byte statistics, byte distances, and sparse dictionaries for byte n-gram along with different classifiers, Byte2Vec+kNN achieves an absolute improvement of 3% and 12% in accuracy and precision, respectively. (C) 2021 Elsevier B.V. All rights reserved.

关键词： file fragment classification Vector representations of bytes Byte embeddings

来源：评论

学校读者我要写书评

暂无评论

Intra- and inter-sector contextual information fusion with joint self-attention for file fragment classification

引用

KNOWLEDGE-BASED SYSTEMS 2024年 291卷

作者： Wang, Yi Liu, Wenyang Wu, Kejun Yap, Kim-Hui Chau, Lap-Pui Hong Kong Polytech Univ Dept Elect & Elect Engn Hong Kong Peoples R China Nanyang Technol Univ Sch Elect & Elect Engn Singapore 637335 Singapore

file fragment classification (FFC) aims to identify the file type of file fragments in memory sectors, which is of great importance in memory forensics and information security. Existing works focused on processing the bytes within sectors separately and ignoring contextual information between adjacent sectors. In this paper, we introduce a joint self -attention network (JSANet) for FFC to learn intra-sector local features and intersector contextual features. Specifically, we propose an end -to -end network with the byte, channel, and sector self -attention modules. Byte self -attention adaptively recognizes the intra-sector significant bytes, and channel self -attention re -calibrates the features between channels. Based on the insight that adjacent memory sectors are most likely to store a file fragment, sector self -attention leverages contextual information in neighboring sectors to enhance inter -sector feature representation. Extensive experiments on seven FFC benchmarks show the superiority of our method compared with state-of-the-art methods. Moreover, we construct VFF-16, a variablelength file fragment dataset to reflect file fragmentation. Integrated with sector self -attention, our method improves accuracy by more than 16.3% against the baseline on VFF-16, and the runtime achieves 5.1 s/GB with GPU acceleration. In addition, we extend our model to malware detection and show its applicability.

关键词： file fragment classification file carving Memory forensics Contextual information Self-attention

来源：评论

学校读者我要写书评

暂无评论

Using NLP techniques for file fragment classification

引用

DIGITAL INVESTIGATION 2012年 9卷 S44-S49页

作者： Fitzgerald, Simran Mathews, George Morris, Colin Zhulyn, Oles Univ Toronto Dept Comp Sci Toronto ON M5S 1A1 Canada

The classification of file fragments is an important problem in digital forensics. The literature does not include comprehensive work on applying machine learning techniques to this problem. In this work, we explore the use of techniques from natural language processing to classify file fragments. We take a supervised learning approach, based on the use of support vector machines combined with the bag-of-words model, where text documents are represented as unordered bags of words. This technique has been repeatedly shown to be effective and robust in classifying text documents (e.g., in distinguishing positive movie reviews from negative ones). In our approach, we represent file fragments as "bags of bytes" with feature vectors consisting of unigram and bigram counts, as well as other statistical measurements (including entropy and others). We made use of the publicly available Garfinkel data corpus to generate file fragments for training and testing. We ran a series of experiments, and found that this approach is effective in this domain as well. (c) 2012 O. Zhulyn, S. Fitzgerald & G. Mathews. Published by Elsevier Ltd. All rights reserved.

关键词： file fragment classification file carving Natural language processing Bigrams Machine learning Support vector machine Digital forensics

来源：评论

学校读者我要写书评

暂无评论

XMP: A CROSS-ATTENTION MULTI-SCALE PERFORMER FOR file fragment classification 49

XMP: A CROSS-ATTENTION MULTI-SCALE PERFORMER FOR FILE FRAGME...

引用

49th IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP)

作者： Park, Jeong Gyu Liu, Sisung Hong, Je Hyeong Hanyang Univ Dept Elect Engn Seoul South Korea Hanyang Univ Dept Artificial Intelligence Seoul South Korea

ISBN: (纸本)9798350344868;9798350344851

file fragment classification (FFC) is the task of identifying the file type given a small fraction of binary data, and serves a crucial role in digital forensics and cybersecurity. Recent studies have adopted convolutional neural networks (CNNs) for this problem, significantly improving the accuracy over the traditional methods relying on handcrafted features. In this paper, we aim to expand on the recent performance gain by better leveraging the large amount of digital files available for training. We propose to achieve this by employing a Transformer encoder-based network known for its weak inductive bias suited for large-scale training. Our model, XMP, is inspired by the CrossViT architecture for image recognition and utilizes multi-scale self and cross-attentions between CNN features extracted from the byte n-grams of input binary data. Experimental results on the latest public dataset show XMP achieving state-of-the-art accuracies in almost all scenarios without need for additional preprocessing of binary data such as bit shifting, demonstrating the effectiveness of the Transformer-based architecture for FFC. The benefit of each proposed component is assessed through ablation study. Our code is available at ***/pank40/xmp.

关键词： file fragment classification Transformer multi-scale attention cross-attention performer

来源：评论

学校读者我要写书评

暂无评论

Neural Networks for file fragment classification 42

Neural Networks for File Fragment Classification

引用

42nd International Convention on Information and Communication Technology, Electronics and Microelectronics (MIPRO)

作者： Vulinovic, Kristijan Ivkovic, Lucija Petrovic, Juraj Skracic, Kristian Pale, Predrag Univ Zagreb Fac Elect Engn & Comp Unska 3 Zagreb 10000 Croatia

ISBN: (纸本)9789532330984

file fragment classification is an important step in file forensics in which filetypes are assumed based on their available content fragments. Methods typically used for this task utilize machine learning techniques on features like byte frequency distributions and fragment entropy measures. In this paper, a contribution to this field is made through exploration of novel approaches to the problem including feedforward artificial neural networks and convolution networks. Feedforward neural networks were trained with byte histograms and with byte-pair histograms, while convolution neural networks were trained with blocks consisting of 512 bytes of data obtained from the GovDocs1 dataset. The results suggest convolution neural networks are not as promising for this problem as feedforward artificial neural networks, and feedforward artificial neural networks showing great results.

关键词： file fragment classification file type detection artificial neural network convolutional neural network feed forward neural network file type forensics

来源：评论

学校读者我要写书评

暂无评论

ITC-MNP: a diverse dataset for image file fragment classification

引用

BMC RESEARCH NOTES 2024年第1期17卷 1-3页

作者： Tavassoli, Behnam Naghshbandi, Zhino Teimouri, Mehdi Univ Tehran Informat Theory & Coding ITC Lab Tehran Iran

ObjectivesImage file fragment classification is a critical area of study in digital forensics. However, many publicly available datasets in this field are derived from a single source, often lacking consideration of the diversity in image settings and content. To demonstrate the effectiveness of a given methodology, it is essential to evaluate it using datasets that are sampled from varied data sources. Therefore, providing a sufficiently diverse dataset is crucial to enable a realistic assessment of any proposed *** descriptionThe dataset includes image file fragments of 4096 bytes from five formats (JPG, BMP, GIF, PNG, and TIFF), each processed with different conversion settings. The source images are categorized into three content types: Nature, People, and Medical. In total, the dataset contains 501,000 fragments. These fragments consist of file headers and incomplete end-of-file fragments, completed with random bytes to approximate how operating systems handle data when file sizes are not multiples of the sector size. This approach aims to simulate typical scenarios where fragments are recovered from a hard drive, though it may not capture all real-world complexities such as data corruption and complex file structures.

关键词： file fragment classification file type identification Image file fragment Dataset

来源：评论

学校读者我要写书评

暂无评论

Hybrid Feature Selection Method for Improving file fragment classification 1

引用

39th SGAI International Conference on Techniques and Applications of Artificial Intelligence (AI)

作者： Algurashi, Alia Wang, Wenjia Univ East Anglia Norwich Norfolk England

ISBN: (数字)9783030348854

ISBN: (纸本)9783030348854;9783030348847

Identifying types of file fragments in isolation from their context is an essential task in digital forensic analysis and can be done with several methods. One common approach is to extract various types of features from file fragments as inputs for classification algorithms. However, this approach suffers from dimensionality curse as the number of the extracted features is too high, which causes the learning and classification to be both inefficient and inaccurate. This paper proposes a hybrid method to address this issue by using filters and wrappers to significantly reduce the number of features and also improve the accuracy of file type classification. First, it uses and combines three appropriate filters to filter out a large number of irrelevant and/or less important features, and then some wrappers to reduce the number of features further to the most salient ones. Our method was tested on some benchmark datasets - Gov-Docs, and the experimental results indicated that our method was able to not only reduce the number of features from 66,313 to 11-32, but also improve the accuracy of the classification, compared with other methods that used all the features.

关键词： file fragment classification Feature selection Filters Wrappers Hybrid method Forensics

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：