File Fragment Type Identification Based on CNN and LSTM

Liu, Yang; Wang, Kun; Ma, Chao

doi:10.1145/3585542.3585545

Cited by 2 publications

(3 citation statements)

References 20 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As shown in Table 3, the ByteRCNN model outperforms models [1], [19]- [21] in all FiFTy scenarios except in two cases: in scenario #5 for 4,096-byte fragments, in which all five compared models perform within the 99.3±0.1% accuracy range, and in scenario #6 for 4,096-byte fragments, in which all five compared models perform within the 99.5±0.1% accuracy range. The ByteRCNN performance is second only to ResNet18 [22], which generally performs better than ByteRCNN, except in case of scenario #1 and scenario #6.…”

Section: A Performance Evaluation On Fifty Datasetmentioning

confidence: 86%

“…Ghaleb et al [20] experimented with several convolutional neural network architectures and managed to outperform the original FiFTy classifiers in 4 out of 6 FiFTy scenarios for 512-byte fragments, and in 1 out of 6 FiFTy scenarios for 4,096 byte fragments (DSC-SE model [20]). Zhu et al [21] managed to obtain results that are similar to or in some cases better than the results of the original FiFTy scenario #1 classifier by using convolutional neural networks to learn higher level representations of file fragments as well as by using a long short-term memory network (LSTM) to classify them. Finally, Liu et al [22] managed to outperform FiFTy classifiers in nearly all FiFTY scenarios by interpreting file fragments as 2-dimensional grey-scale images.…”

Section: B Approaches To File Fragment Type Identificationmentioning

confidence: 99%

“…It is worth noting that the ByteRCNN model performs very well across all six scenarios, thus avoiding the need to train or use multiple models, and that it has the highest performance among all compared models in case of scenario #1 which consist of the highest number of classes (75) among all scenarios. Table 4 shows accuracy breakdown for each of the 75 classes included in FiFTy scenario #1 for ByteRCNN, CNN-LSTM [21], and FiFTy [1], as researchers in [19], [20], [22] did not disclose per-class classification accuracies of their models. When compared to FiFTy and CNN-LSTM, ByteRCNN provides the best classification accuracy for 65 out of 75 classes for 512-byte and 46 out of 75 classes for 4,096-byte fragments.…”

Section: A Performance Evaluation On Fifty Datasetmentioning

confidence: 99%

See 2 more Smart Citations

ByteRCNN: Enhancing File Fragment Type Identification With Recurrent and Convolutional Neural Networks

Skračić,

Petrović,

Pale

2023

IEEE Access

View full text Add to dashboard Cite

File fragment type identification is an important step in file carving and data recovery. Machine learning techniques, especially neural networks, have been utilized for this problem, some with very promising results. This paper presents a novel neural network architecture for identifying file fragment types using a combination of byte embeddings as well as recurrent and convolutional elements. The corresponding classification model, ByteRCNN, has been trained on the publicly available file fragment FiFTy dataset and evaluated in closed-set and open-set recognition settings using FiFTy and other available file fragment datasets. Evaluation results have demonstrated that ByteRCNN can compete with state-of-the-art models described in literature in terms of classification accuracy, with 71.1% average accuracy on 512-byte fragments and 83.9% average accuracy on 4,096-byte fragments from the FiFTy dataset. When evaluated on other publicly available datasets in closed-set and open-set recognition settings, ByteRCNN similarly or slightly better than the FiFTy classification model. Obtained results overall suggest that ByteRCNN is a competitive file fragment classification model, but they also reveal that there is still plenty of space for further improving file type identification methods using more complex datasets or in open-set recognition settings. ByteRCNN is publicly available at [GitHub, after publication].

show abstract