Digital forensic file fragment classification method based on digital image transformation and deep learning

Abstract

The invention provides a digital forensic file fragment classification method based on digital image conversion and deep learning. Firstly, file fragments are converted to grayscale images, and then deep learning is utilized to extract more hidden features of the images to improve performance of file fragment classification. The more hidden features include different texture features, random features and compressibility used for classification. Deep learning uses a modified and optimized CNN model. A first convolutional layer of the model uses a 1x1 ratio convolutional kernel, and the same uses many pipes to enable a network structure to be complicated. All layers have different-numbers-and-scales filtering kernels, and thus feature maps best matching the classification model are obtainedby training through gradient descents and reverse training. According to the method, high-dimensional features of the file fragments are extracted through utilizing the advantages of local connectionand weight sharing of a CNN, and the scheme can also realize high-precision fragment classification for files such as composite files and compressed files which are not easy to classify in previous schemes.

Description

technical field [0001] The invention relates to the technical field of digital forensics, in particular to a method for classifying fragments of digital forensics files. Background technique [0002] Classification of file fragments plays an important role in digital forensics, figure 1 It is an early step in the process of digital forensics. Correctly classifying file fragments is a necessary step to support effective file engraving. The accuracy of file fragment classification directly affects the efficiency and performance of file engraving. [0003] Traditional file fragment classification methods include the use of complete file extensions, file metadata, byte frequency distribution features (BFD) or byte frequency correlation features (BFC), linear discriminant analysis (LDA), Fisher linear discriminant (FLD) and the longest common subsequence, extraction of N-gram, Shannon entropy, Hamming weight and byte and other methods with statistical laws, support vector machin...

AI Technical Summary

Problems solved by technology

[0003] Traditional file fragment classification methods include using full file extensions, file metadata, byte frequency distribution features (BFD) or byte frequency correlation features (BFC), linear discriminant analysis (LDA), Fisher linear discriminant (FLD) and the longest common subsequence, extraction of N-gram, Shannon entropy, Hamming weight and byte and other methods with statistical regularity, support vector machine (SVM), etc., but in practical applications, there are unsatisfactory classification results and the degree of automation Problems with low classification accuracy

Images