Evaluating detection error trade-offs for bytewise approximate matching algorithms

Détails

ID Serval
serval:BIB_42AEB5C0F87F
Type
Article: article d'un périodique ou d'un magazine.
Collection
Publications
Titre
Evaluating detection error trade-offs for bytewise approximate matching algorithms
Périodique
Digital Investigation
Auteur⸱e⸱s
Breitinger Frank, Stivaktakis Georgios, Roussev Vassil
ISSN
1742-2876
Statut éditorial
Publié
Date de publication
06/2014
Volume
11
Numéro
2
Pages
81-89
Langue
anglais
Notes
Paper was accepted for ICDF2C where best paper was won and then accepted to Digital Investigation.
Résumé
Bytewise approximate matching is a relatively new area within digital forensics, but its importance is growing quickly as practitioners are looking for fast methods to analyze the increasing amounts of data in forensic investigations. The essential idea is to complement the use of cryptographic hash functions to detect data objects with bytewise identical representation with the capability to find objects with bytewise similar representations. Unlike cryptographic hash functions, which have been studied and tested for a long time, approximate matching ones are still in their early development stages, and have been evaluated in a somewhat ad-hoc manner. Recently, the FRASH testing framework has been proposed as a vehicle for developing a set of standardized tests for approximate matching algorithms; the aim is to provide a useful guide for understanding and comparing the absolute and relative performance of different algorithms. The contribution of this work is twofold: a) expand FRASH with automated tests for quantifying approximate matching algorithm behavior with respect to precision and recall; and b) present a case study of two algorithms already in use-sdhash and ssdeep.
Mots-clé
Law, Medical Laboratory Technology, Computer Science Applications
Web of science
Création de la notice
06/05/2021 12:01
Dernière modification de la notice
06/05/2021 12:46
Données d'usage