On the database lookup problem of approximate matching

Digital Investigation

Volumn 11, Issue SUPPL. 1, 2014, Pages

  Breitinger, Frank ^a,b   Baier, Harald ^a   White, Douglas ^b  

^a DARMSTADT UNIVERSITY OF APPLIED SCIENCES   (Germany)

^b NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY   (United States)

Author keywords

Approximate matching; Blacklisting; Bloom filter; Digital forensics; Indexing; mrsh v2; sdhash

Indexed keywords

BINARY TREES; CRYPTOGRAPHY; DATA STRUCTURES; DIGITAL DEVICES; DIGITAL FORENSICS; ELECTRONIC CRIME COUNTERMEASURES; HASH FUNCTIONS; INDEXING (OF INFORMATION);

APPROXIMATE MATCHING; BLACKLISTING; BLOOM FILTERS; MRSH-V2; SDHASH;

DATABASE SYSTEMS;

EID: 84899629862     PISSN: 17422876     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.diin.2014.03.001     Document Type: Article

References (18)

1. Bloom BH. Space/time trade-offs in hash coding with allowable errors. Commun ACM 1970;13:422-6.
2. Breitinger F, Baier H. Similarity preserving hashing: eligible properties and a new algorithm mrsh-v2. In: Rogers M, Seigfried-Spellar K, editors. Digital forensics and cyber crime. Lecture notes of the institute for computer sciences, social informatics and telecommunications engineering, vol. 114. Berlin Heidelberg: Springer; 2013. pp. 167-82.
3. Breitinger F, Guttman B, McCarrin M, Roussev V. Approximate matching: definition and terminology. NIST Publication; 2014.
4. Breitinger F, Liu H, Winter C, Baier H, Rybalchenko A, Steinebach M. Towards a process model for hash functions in digital forensics. In: 5th International Conference on Digital Forensics & Cyber Crime; 2013a.
5. Breitinger F, Stivaktakis G, Baier H. FRASH: a framework to test algorithms of similarity hashing. In: 13th Digital Forensics Research Conference (DFRWS'13); 2013b. Monterey.
6. Breitinger F, Stivaktakis G, Roussev V. Evaluating detection error tradeoffs for bytewise approximate matching algorithms. In: 5th ICST Conference on Digital Forensics & Cyber Crime (ICDF2C); 2013c.
7. Broder A, Mitzenmacher M. Network applications of bloom filters: a survey. Internet Math 2005;1:485-509.
8. Gallagher P, Director A. Secure Hash Standard (SHS). Technical Report National Institute of Standards and Technologies, Federal Information Processing Standards Publication; 1995. pp. 180-1.
9. Kornblum J. Identifying almost identical files using context triggered piecewise hashing. Digit Investig 2006;3:91-7.
10. Mullin J. Optimal semijoins for distributed database systems. IEEE Trans Softw Eng 1990;16:558-60.
11. NIST Information Technology Laboratory. National software reference library http://www.nsrl.nist.gov; 2013.
12. Noll LC. Fnv hash. http://www.isthe.com/chongo/tech/comp/fnv/index.html; 1994-2012.
13. Roussev V. Data fingerprinting with similarity digests. In: Chow K-P, Shenoi S, editors. Advances in digital forensics VI. IFIP advances in information and communication technology, vol. 337. Berlin Heidelberg: Springer; 2010. pp. 207-26.
14. Roussev V. An evaluation of forensic similarity hashes. Digit Investig 2011;8:34-41.
15. Roussev V. Managing terabyte-scale investigations with similarity digests. In: Peterson G, Shenoi S, editors. Advances in digital forensics VIII. IFIP advances in information and communication technology, vol. 383. Berlin Heidelberg: Springer; 2012. pp. 19-34.
16. Roussev V, Richard III GG, Marziale L. Multi-resolution similarity hashing. Digit Investig 2007;4:105-13.
17. Tridgell A. spamsum. http://www.samba.org/ftp/unpacked/junkcode/spamsum/; 2002-2009. Accessed 29.11.13.
18. Winter C, Schneider M, Yannikos Y. F2s2: fast forensic similarity search through indexing piecewise hash signatures. Digit Investig 2013; 10(4):361-71.