F2S2: Fast forensic similarity search through indexing piecewise hash signatures

Digital Investigation

Volumn 10, Issue 4, 2013, Pages 361-371

  Winter, Christian ^a   Schneider, Markus ^a   Yannikos, York ^a  

^a FRAUNHOFER INSTITUTE FOR SECURE INFORMATION TECHNOLOGY SIT   (Germany)

Author keywords

Digital forensics; Indexing; n Gram; Piecewise hashing; Similarity search; ssdeep

Indexed keywords

INDEXING (OF INFORMATION);

BRUTE FORCE; FORENSIC INVESTIGATION; HASH SIGNATURE; N-GRAMS; PIECE-WISE; SIMILARITY QUERY; SIMILARITY SEARCH; SSDEEP;

DIGITAL FORENSICS;

EID: 84889096979     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2013.08.003     Document Type: Article

References (30)

1. S.F. Altschul, W. Gish, W. Miller, E.W. Myers, and D.J. Lipman Basic local alignment search tool Journal of Molecular Biology 215 3 1990 403 410
2. H. Baier, and F. Breitinger Security aspects of piecewise hashing in computer forensics IMF 2011 2011 IEEE Computer Society 21 36
3. L. Boytsov Indexing methods for approximate dictionary searching: comparative analysis ACM Journal on Experimental Algorithmics 16 1 2011 1:1-1:91
4. T. Bozkaya, and M. Ozsoyoglu Indexing large metric spaces for similarity search queries ACM Transactions on Database Systems 24 3 1999 361 404
5. F. Breitinger, K.P. Åstebøl, H. Baier, and C. Busch mvHash-B - a new approach for similarity preserving hashing IMF 2013 2013 IEEE Computer Society
6. F. Breitinger, and H. Baier Performance issues about context-triggered piecewise hashing Digital forensics and cyber crime LNICST vol. 88 2012 Springer 141 155
7. F. Breitinger, and H. Baier A fuzzy hashing approach based on random sequences and hamming distance Proceedings of the 2012 ADFSL conference 2012 Association of Digital Forensics, Security and Law 89 100
8. F. Breitinger, and H. Baier Similarity preserving hashing: eligible properties and a new algorithm MRSH-v2 ICDF2C 2012 2012 Institute for Computer Sciences, Social Informatics and Telecommunications Engineering
9. E. Chávez, G. Navarro, R. Baeza-Yates, and J.L. Marroquín Searching in metric spaces ACM Computing Surveys 33 3 2001 273 321
10. S.S. Chawathe Effective whitelisting for filesystem forensics IEEE International conference on intelligence and security informatics (ISI 2009) 2009 IEEE 131 136
11. L. Chen, and G.Y. Wang An efficient piecewise hashing method for computer forensics First international workshop on knowledge discovery and data mining 2008 IEEE Computer Society 635 638
12. P. Deutsch, and J.L. Gailly ZLIB compressed data format specification version 3.3. RFC 1950 1996 Network Working Group http://tools.ietf.org/html/ rfc1950
13. J. Haitsma, and T. Kalker A highly robust audio fingerprinting system ISMIR 2002 2002 IRCAM - Centre Pompidou 107 115
14. T. Kohonen, and E. Reuhkala A very fast associative method for the recognition and correction of misspelt words, based on redundant hash addressing Proceedings of the fourth international joint conference on pattern recognition 1979 IEEE 807 809
15. J. Kornblum Identifying almost identical files using context triggered piecewise hashing Digital Investigation 3 Suppl. 2006 S91 S97
16. J. Kornblum ssdeep 2006 http://ssdeep.sourceforge.net
17. D.J. Lipman, and W.R. Pearson Rapid and sensitive protein similarity searches Science 227 4693 1985 1435 1441
18. A. Marsye, and M. Adriani Searching polyphonic Indonesian folksongs based on n-gram indexing technique Information retrieval technology LNCS vol. 5839 2009 Springer 387 396
19. D. Montanari, and P.L. Puglisi Near duplicate document detection for large information flows Multidisciplinary research and practice for information systems LNCS vol. 7465 2012 Springer 203 217
20. G. Navarro, R. Baeza-Yates, E. Sutinen, and J. Tarhio Indexing methods for approximate string matching IEEE Data Engineering Bulletin 24 4 2001 19 27
21. NIST Information Technology Laboratory. National Software Reference Library. http://www.nsrl.nist.gov; 2003-2013.
22. NIST Information Technology Laboratory ssdeep Datasets 2010 http://www.nsrl.nist.gov/ssdeep.htm
23. L.C. Noll FNV hash 1994 2012 http://www.isthe.com/chongo/tech/comp/fnv/ index.html
24. Y. Ogawa, and T. Matsuda An efficient document retrieval method using n-gram indexing Systems and Computers in Japan 33 2 2002 54 63
25. V. Roussev Data fingerprinting with similarity digest Advances in digital forensics VI IFIP AICT vol. 337 2010 Springer 207 226
26. V. Roussev sdhash 2010 http://roussev.net/sdhash
27. V. Roussev An evaluation of forensic similarity hashes Digital Investigation 8 Suppl. 2011 S34 S41
28. V. Roussev, Y. Chen, T. Bourg, and G.G. Richard III. md5bloom: forensic filesystem hashing revisited Digital Investigation 3 Suppl. 2006 S82 S90
29. V. Roussev, G.G. Richard III., and L. Marziale Multi-resolution similarity hashing Digital Investigation 4 Suppl. 2007 S105 S113
30. J. Zhang, K. Pan, Y. Yu, and X. Jingdong iCTPH: an approach to publish and lookup CTPH digests in Chord Algorithms and architectures for parallel processing LNCS vol. 6082 2010 Springer 244 253