IMPROVED BINARY DATA BLOCK CLASSIFICATION MODEL FOR FILE CARVING PROBLEMS
В’ячеслав Васильович Москаленко, Maksym Boiko · Herald of Khmelnytskyi National University Technical sciences · 2025
In this paper, we address the problem of classifying blocks of binary data as an integral stage in the file-carving process under conditions of high fragmentation. Existing models and methods exhibit high error rates depending on a variety of factors, and in real-world applications the data to be analyzed often differ from those found in training datasets. The aim of this study is to improve the effectiveness of binary-data-block classification models and to overcome the challenges involved in detecting fragments of non-target file types. To that end, we have enhanced existing file-fragment identification models by introducing an additional classifier head responsible for constructing class prototypes in a discrete feature space. During training, this auxiliary branch serves to regularize the feature space for both target and non-target file fragments. At the same time, class-specific boundaries (or containers) are established to enable the detection of data that fall outside the training distribution. Experimental evaluation of the proposed models demonstrated accuracy gains of 1.9 % to 3.1 % compared with baseline approaches, depending on the application scenario. Overall accuracy for identifying fragments of target file types partitioned into 5, 11, and 25 classes ranged from 88 % to 98 %, 53 % to 100 %, and 72 % to 100 %, respectively. Training also yielded an increase in the Hamming distance between prototype vectors in the binary feature space within the regularizing classifier head. The macro-averaged F1 scores were 91.78 %, 59.97 %, and 82.94 % for the 5-, 11-, and 25-class scenarios, respectively. The lower performance in the 11-class case appears to result from significant overlap between classes in the feature space. Thus, the introduction of a regularizing classifier branch in the proposed models leads to higher classification accuracy for binary-data blocks, although the results depend on the chosen class-partitioning scheme.