mvHash-B - A New Approach for Similarity Preserving Hashing

Details

Serval ID
serval:BIB_3BFB4EF12FE3
Type
Inproceedings: an article in a conference proceedings.
Collection
Publications
Title
mvHash-B - A New Approach for Similarity Preserving Hashing
Title of the conference
2013 Seventh International Conference on IT Security Incident Management and IT Forensics
Author(s)
Breitinger Frank, Astebol Knut Petter, Baier Harald, Busch Christoph
Publisher
IEEE
ISBN
9781467363075
Publication state
Published
Issued date
03/2013
Language
english
Abstract
The handling of hundreds of thousands of files is a major challenge in today’s IT forensic investigations. In order to cope with this information overload, investigators use fingerprints (hash values) to identify known files automatically using blacklists or whitelists. Besides detecting exact duplicates it is helpful to locate similar files by using similarity preserving hashing (SPH), too. We present a new algorithm for similarity preserving hashing. It is based on the idea of majority voting in conjunction with run length encoding to compress the input data and uses Bloom filters to represent the fingerprint. It is therefore called mvHash-B. Our assessment shows that mvHash-B is superior to other SPHs with respect to run time efficiency: It is almost as fast as SHA-1 and thus faster than any other SPH algorithm. Additionally the hash value length is approximately 0.5% of the input length and hence outperforms most existing algorithms. Finally, we show that the robustness of mvHash-B against active manipulation is sufficient for practical purposes.
Keywords
cryptography, data compression, data structures, digital forensics, fingerprint identification, Bloom filter, IT forensic investigation, SHA-1, SPH algorithm, blacklist, data compression,
Create date
06/05/2021 11:01
Last modification date
06/05/2021 11:17
Usage data