Expediting MRSH-v2 Approximate Matching with Hierarchical Bloom Filter Trees

Digital evidence is critical in cybercrime investigations because it is used to connect individuals to illegal activity. Digital evidence is complicated, diffuse, volatile, and easily altered, and as such, it must be protected. The Chain of Custody (CoC) is a critical component of the digital evidence procedure. The aim of the CoC is to demonstrate that the evidence has not been tampered with at any point throughout the investigation. Because the uncertainty associated with digital evidence is not being assessed at the moment, it is impossible to determine the trustworthiness of CoC. As scientists, forensic examiners have a responsibility to reverse this tendency and officially confront the uncertainty inherent in any evidence upon which they base their judgments. To address these issues, this article proposes a new paradigm for ensuring the integrity of digital evidence (CoC documents). The new paradigm employed fuzzy hash within blockchain data structure to handle uncertainty introduced by errorprone tools when dealing with CoC documents. Traditional hashing techniques are designed to be sensitive to small input modifications and can only determine if the inputs are exactly the same or not. By comparing the similarity of two images, fuzzy hash functions can determine how different they are. We provide a case study for image forensics to illustrate the usefulness of this model in introducing forensic preparedness to computer systems and enabling a more effective digital investigation procedure.

show abstract

“…Approximate matching is accomplished by comparing similarity digests. A pairwise comparison of two file sets is needed to compare them [31].…”

Section: ) Approximate Matchingmentioning

confidence: 99%

“…Rather of putting each hash into the node, the sub hashes are compared to the Bloom filter to see whether they are included inside it. If a node has a certain number of consecutive hashes, this is considered a match [31].…”

Section: ) Approximate Matchingmentioning

confidence: 99%

Improving Uncertainty in Chain of Custody for Image Forensics Investigation Applications

Elgohary¹,

Darwish

Mesbah

2022

IEEE Access

View full text Add to dashboard Cite

show abstract

“…Estas estratégias utilizam alguns conceitos e processos das funções de pareamento para realizar a comparação dos arquivos de forma mais eficiente. Alguns exemplos de estratégias encontradas na literatura são MRSH-NET [Breitinger et al 2014a], MRSH-HBFT [Lillis et al 2017] e F2S2 [Winter et al 2013].…”

Section: Trabalhos Relacionadosunclassified

“…Com tal cenário estruturado, este trabalho avalia o comportamento de algumas das estratégias presentes na literatura quantoà sua capacidade de detecção de similaridade e o tempo de execução quando removemos os blocos comuns dos arquivos durante uma busca de similaridade. Inicialmente foram escolhidas duas estratégias baseadas na ferramenta sdhash disponíveis na literatura (MRSH-NET [Breitinger et al 2014a] e MRSH-HBFT [Lillis et al 2017]) para realização de experimentos. Em seguida foram realizadas implementações alternativas destas estratégias (NET-SD [Velho et al 2020] e HBFT-SD que foi modificado neste trabalho) e também modificações para remoção dos blocos comuns (NET-SD-NCF e HBFT-SD-NCF, ambos propostos neste trabalho).…”

Section: Introductionunclassified

Avaliação do impacto da remoção de características comuns em estratégias de busca de arquivos similares

Velho

Moia

Henriques

2021

Anais Do XXI Simpósio Brasileiro De Segurança Da Informação E De Sistemas Computacionais (SBSeg 2021)

View full text Add to dashboard Cite

Investigações de forense digital enfrentam um importante problema: a grande quantidade de arquivos armazenados em dispositivos apreendidos. Para analisar esses dispositivos de forma mais eficiente, utilizam-se estratégias de busca de similaridade, capazes de encontrar arquivos idênticos, ou até mesmo similares, à um dado conjunto de arquivos, usando técnicas de pareamento aproximado. No entanto, esta busca pode ser prejudicada devido a blocos comuns, como cabeçalhos, presentes em diferentes arquivos. Este trabalho objetiva avaliar o impacto da remoção de blocos comuns na performance das estratégias. Os resultados mostram uma redução significativa na taxa de falsos positivos com um aumento aceitável no tempo de execução.

show abstract

“…Hashing is a primary tool used in digital investigation [18]. Hash-based techniques are used for a variety of purposes including finding known objects and finding similar objects, i.e., similarity hashing [19]. The National Software Reference Library (NSRL 1 ) maintained by the US National Institute of Standards and Technology (NIST) contains a list of known hash values for most common OS and application packages.…”

Section: A Digital Forensic Data Reductionmentioning

confidence: 99%

Automated Artefact Relevancy Determination from Artefact Metadata and Associated Timeline Events

Scanlon

2020

2020 International Conference on Cyber Security and Protection of Digital Services (Cyber Security)

Self Cite

View full text Add to dashboard Cite

Case-hindering, multi-year digital forensic evidence backlogs have become commonplace in law enforcement agencies throughout the world. This is due to an ever-growing number of cases requiring digital forensic investigation coupled with the growing volume of data to be processed per case. Leveraging previously processed digital forensic cases and their component artefact relevancy classifications can facilitate an opportunity for training automated artificial intelligence based evidence processing systems. These can significantly aid investigators in the discovery and prioritisation of evidence. This paper presents one approach for file artefact relevancy determination building on the growing trend towards a centralised, Digital Forensics as a Service (DFaaS) paradigm. This approach enables the use of previously encountered pertinent files to classify newly discovered files in an investigation. Trained models can aid in the detection of these files during the acquisition stage, i.e., during their upload to a DFaaS system. The technique generates a relevancy score for file similarity using each artefact's filesystem metadata and associated timeline events. The approach presented is validated against three experimental usage scenarios.

show abstract

Expediting MRSH-v2 Approximate Matching with Hierarchical Bloom Filter Trees

Cited by 16 publications

References 16 publications

Improving Uncertainty in Chain of Custody for Image Forensics Investigation Applications

Improving Uncertainty in Chain of Custody for Image Forensics Investigation Applications

Avaliação do impacto da remoção de características comuns em estratégias de busca de arquivos similares

Automated Artefact Relevancy Determination from Artefact Metadata and Associated Timeline Events

Contact Info

Product

Resources

About