A New Approach for Creating Forensic Hashsets

Abstract : The large amounts of data that have to be processed and analyzed by forensic investigators is a growing challenge. Using hashsets of known files to identify and filter irrelevant files in forensic investigations is not as effective as it could be, especially in non-English speaking countries. This paper describes the application of data mining techniques to identify irrelevant files from a sample of computers from a country or geographical region. The hashsets corresponding to these files are augmented with an optimized subset of effective hash values chosen from a conventional hash database. Experiments using real evidence demonstrate that the resulting augmented hashset yields 30.69% better filtering results than a conventional hashset although it has approximately half as many (51.83%) hash values.
Type de document :
Communication dans un congrès
Gilbert Peterson; Sujeet Shenoi. 8th International Conference on Digital Forensics (DF), Jan 2012, Pretoria, South Africa. Springer, IFIP Advances in Information and Communication Technology, AICT-383, pp.83-97, 2012, Advances in Digital Forensics VIII. 〈10.1007/978-3-642-33962-2_6〉
Liste complète des métadonnées

https://hal.inria.fr/hal-01523710
Contributeur : Hal Ifip <>
Soumis le : mardi 16 mai 2017 - 17:10:19
Dernière modification le : vendredi 1 décembre 2017 - 01:16:43
Document(s) archivé(s) le : vendredi 18 août 2017 - 00:24:50

Fichier

978-3-642-33962-2_6_Chapter.pd...
Fichiers produits par l'(les) auteur(s)

Licence


Distributed under a Creative Commons Paternité 4.0 International License

Identifiants

Citation

Marcelo Ruback, Bruno Hoelz, Celia Ralha. A New Approach for Creating Forensic Hashsets. Gilbert Peterson; Sujeet Shenoi. 8th International Conference on Digital Forensics (DF), Jan 2012, Pretoria, South Africa. Springer, IFIP Advances in Information and Communication Technology, AICT-383, pp.83-97, 2012, Advances in Digital Forensics VIII. 〈10.1007/978-3-642-33962-2_6〉. 〈hal-01523710〉

Partager

Métriques

Consultations de la notice

70

Téléchargements de fichiers

15