The impact of excluding common blocks for approximate matching

Details

Serval ID
serval:BIB_203F1FD91074
Type
Article: article from journal or magazin.
Collection
Publications
Title
The impact of excluding common blocks for approximate matching
Journal
Computers & Security
Author(s)
Moia Vitor Hugo Galhardo, Breitinger Frank, Henriques Marco Aurélio Amaral
ISSN
0167-4048
Publication state
Published
Issued date
02/2020
Volume
89
Pages
101676
Language
english
Abstract
Approximate matching functions allow the identification of similarity (bytewise level) in a very efficient way, by creating and comparing compact representations of objects (a.k.a digests). However, many similarity matches occur due to common data that repeats over many different files and consist of inner structure, header and footer information, color tables, font specifications, etc.; data created by applications and not generated by users. Most of the times, this sort of information is less relevant from an investigator perspective and should be avoided. In this work, we show how the common data can be identified and filtered out by using approximate matching, as well as how they are spread over different file types and their frequency. We assess the impact on similarity when removing it (i.e., in the number of matches) and the effects on performance. Our results show that for a small price on performance, a reduction about 87% on the number of matches can be achieved when removing such data.
Keywords
General Computer Science, Law
Create date
06/05/2021 12:01
Last modification date
06/05/2021 12:43
Usage data