File Fragment Type Identification with Convolutional Neural Networks
Yanchao Wang, SU Zhong-qian, Dayi Song · 2018
A fair amount of digital forensic research to date has involved the analysis of file fragments. One of the challenging tasks is to determine the type of a file fragment. Content-based methods are widely adopted and have shown their effectiveness on identifying file types. Traditional approaches to the task of file fragments classification primarily rely on elaborately designed features, such as unigram and bigram counts, as well as complexity and other byte frequency-based measures. The choice of features is a manual process, requires domain expertise and is prone to data sparsity problems. In this paper, we study the classification of file fragments using convolutional neural networks, which aims to automatically learn effective feature representations from byte sequence. We used the freely available GovDocs datasets and constructed a representative fragment collection that is likely to be of forensic interest. Our experiments show that the proposed method works very well for the identification task.