FrasH: A framework to test algorithms of similarity hashing

Proceedings of the Digital Forensic Research Conference, DFRWS 2013 USA

Volumn , Issue , 2013, Pages S50-S58

  Breitinger, Frank ^a   Stivaktakis, Georgios ^a   Baier, Harald ^a  

^a DARMSTADT UNIVERSITY OF APPLIED SCIENCES   (Germany)

Author keywords

Digital forensics; sdhash; Similarity hashing; ssdeep; Test framework

Indexed keywords

COMPUTER CRIME; DIGITAL FORENSICS; ELECTRONIC CRIME COUNTERMEASURES; HASH FUNCTIONS; TESTING;

ASSESSMENT METHODOLOGIES; CRYPTOGRAPHIC HASH FUNCTIONS; EMBEDDED OBJECT; HASHING ALGORITHMS; SDHASH; SIMILARITY HASHING; SSDEEP; TEST FRAMEWORK;

COMPUTER FORENSICS;

EID: 84903310958     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1016/j.diin.2013.06.006     Document Type: Conference Paper

References (26)

1. Baier H, Breitinger F. Security aspects of piecewise hashing in computer forensics. IT Security Incident Management & IT Forensics (IMF); 2011. p. 21–36.
2. Bertoni G, Daemen J, Peeters M, Assche GV. Keccak specifications 2009.
3. Breitinger F, Åstebøl KP, Baier H, Busch C. mvhash-b – a new approach for similarity preserving hashing. IT Security Incident Management & IT Forensics (IMF); 2013.
4. Breitinger F, Baier H. A fuzzy hashing approach based on random sequences and hamming distance. In: 7th annual conference on digital forensics, security and law. ADFSL; 2012a. p. 89–100.
5. Breitinger F, Baier H. Performance issues about context-triggered piecewise hashing. In: Gladyshev P, Rogers M, editors. Digital forensics and cyber crime. Berlin Heidelberg: Springer; 2012b. p. 141–55. volume 88 of lecture notes of the institute for computer sciences, social informatics and telecommunications engineering.
6. Breitinger F, Baier H. Properties of a similarity preserving hash function and their realization in sdhash. In: 2012 information security for South Africa (ISSA 2012) 2012.
7. Breitinger F, Baier H. Similarity preserving hashing: eligible properties and a new algorithm MRSH-v2. In: 4th ICST conference on digital forensics & cyber crime (ICDF2C) 2012.
8. Chen L, Wang G. An efficient piecewise hashing method for computer forensics. In: Knowledge discovery and data mining, 2008. WKDD 2008. First international workshop on 2008. p. 635–8.
9. Dewald A, Freiling F. Is computer forensics a forensic science? In: M.-P.-I. für ausländisches und internationales Strafrecht, Freiburg U, editors. Proceedings of current issues in IT security 2012. pp. 0–0.
10. Gallagher P, Director A. Secure hash standard (SHS). Technical report national institute of standards and technologies. Federal Information Processing Standards Publication; 1995. p. 180–1.
11. Garfinkel SL. Digital forensics research: the next 10 years. Digitial Investigation 2010;7:64–73.
12. Jaccard P. Distribution de la flore alpine dans le bassin des drouces et dans quelques regions voisines. Bulletin de la Société Vaudoise des Sciences Naturelles 1901:241–72.
13. Kornblum J. Identifying almost identical files using context triggered piecewise hashing. Digital Investigation 2006;3:91–7.
14. Manber U. Finding similar files in a large file system. In: USENIX winter 1994 technical conference 1994. p. 1–10.
15. Nechvatal J, Bassham EBL, Dworkin M, Foti J, Roback E. Report on the development of the advanced encryption standard (AES) 2000. Technical Report National Institute of Standards and Technology.
16. NIST Information Technology Laboratory. National software reference library. http://www.nsrl.nist.gov; 2003–2013.
17. Noll LC. Fnv hash. http://www.isthe.com/chongo/tech/comp/fnv/index.html; 1994–2012.
18. Rabin MO. Fingerprinting by random polynomials. Technical report TR1581. Cambridge, Massachusetts: Center for Research in Computing Technology, Harvard University; 1981.
19. Roussev V. Building a better similarity trap with statistically improbable features. In: System sciences, 2009. HICSS’09. 42nd Hawaii international conference on 2009. p. 1–10.
20. Roussev V. Data fingerprinting with similarity digests. In: Chow K-P, Shenoi S, editors. Advances in digital forensics VI. Berlin Heidelberg: Springer; 2010. p. 207–26. volume 337 of IFIP advances in information and communication technology.
21. Roussev V. An evaluation of forensic similarity hashes. Digital Investigation 2011;8:34–41.
22. Roussev III V, R. GG, Marziale L. Multi-resolution similarity hashing. Digital Investigation 2007;4:105–13.
23. Roussev V, Quates C. Content triage with similarity digests: the M57 case study. Digital Investigation 2012;9:60–8.
24. Sadowski C, Levin G. Simhash: hash-based similarity detection. http://simhash.googlecode.com/svn/trunk/paper/SimHashWithBib.pdf; 2007.
25. Seo K, Lim K, Choi J, Chang K, Lee S. Detecting similar files based on hash and statistical analysis for digital forensic investigation. In: Computer science and its applications, 2009. CSA’09. 2nd International conference on 2009. p. 1–6.
26. Tridgell A. spamsum. http://www.samba.org/ftp/unpacked/junkcode/spamsum/; 2002–2009. accessed 10.04.13.