File block classification by Support Vector Machines

Proceedings of the 2011 6th International Conference on Availability, Reliability and Security, ARES 2011

Volumn , Issue , 2011, Pages 307-312

  Sportiello, Luigi ^a   Zanero, Stefano ^a  

^a POLITECNICO DI MILANO   (Italy)

Author keywords

File block classification; File carving; Forensic analysis; Machine learning

Indexed keywords

BLOCK CLASSIFICATION; BYTE FREQUENCY DISTRIBUTIONS; CLASSIFICATION PROCESS; DATA BLOCKS; DIGITAL FORENSIC; FILE CARVING; FILE SYSTEMS; FILE TYPES; FORENSIC ANALYSIS; MACHINE-LEARNING; POTENTIAL FEATURES; RETRIEVAL PROCESS; SVM CLASSIFIERS;

FEATURE EXTRACTION; NETWORK SECURITY; SUPPORT VECTOR MACHINES;

TEACHING;

EID: 80455140412     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ARES.2011.52     Document Type: Conference Paper

References (13)

1. G. G. RichardIII and V. Roussev, "Scalpel: a frugal, high performance file carver," in Proceedings of the 2005 Digital Forensics Research Workshop (DFRWS), 2005.
2. S. L. Garfinkel, "Carving contiguous and fragmented files with fast object validation," in Proceedings of the 2007 DFRWS Conference, 2007, pp. 2-12. (Pubitemid 47081435)
3. C. J. C. Burges, "A tutorial on support vector machines for pattern recognition," Data mining and knowledge discovery, vol. 2, no. 2, pp. 121-167, 1998, Springer. (Pubitemid 128695475)
4. C. W. Hsu, C. C. Chang, and C. J. Lin, "A practical guide to support vector classification," Department of Computer Science and Information Engineering, National Taiwan University, Taiwan, 2003.
5. M. Karresand and N. Shahmehri, "Oscar-file type identification of binary data in disk clusters and RAM pages," Security and Privacy in Dynamic Environments, pp. 413-424, 2006, Springer. (Pubitemid 44920672)
6. M. Karresand and N. Shahmehri, "File type identification of data fragments by their binary structure," in IEEE Information Assurance Workshop, 2006, pp. 140-147. (Pubitemid 46028750)
7. C. Shannon, "A mathematical theory of communication," The Bell System Technical Journal, vol. 27, pp. 379-423, 1948.
8. A. Lempel and J. Ziv, "On the complexity of finite sequences," IEEE Transactions on Information Theory, vol. 22, no. 1, pp. 75-81, 1976.
9. C. C. Chang and C. J. Lin, "LIBSVM: a library for support vector machines," 2001, software available at http://www.csie.ntu.edu.tw/-cjlin/ libsvm.
10. C. Veenman, "Statistical disk cluster classification for file carving," in IEEE Third International Symposium on Information Assurance and Security, 2007, pp. 393-398.
11. W. C. Calhoun and D. Coles, "Predicting the types of file fragments," in Proceedings of the 2008 DFRWS Conference, 2008, pp. S14-S20.
12. S. Axelsson, "Using normalized compression distance for classifying file fragments," in IEEE International Conference on Availability, Reliability and Security, 2010, pp. 641-646.
13. S. Axelsson, "The normalised compression distance as a file fragment classifier," in Proceedings of the 2010 DFRWS Conference, 2010, pp. S24-S31.