Understanding the effects of removing common blocks on Approximate Matching scores under different scenarios for digital forensic investigations

Details

Serval ID
serval:BIB_24B72A1DE98A
Type
Inproceedings: an article in a conference proceedings.
Collection
Publications
Title
Understanding the effects of removing common blocks on Approximate Matching scores under different scenarios for digital forensic investigations
Title of the conference
XIX Brazilian Symposium on information and computational systems security
Author(s)
Moia Vitor Hugo Galhardo Moia, Breitinger Frank, Henriques Marco Aurélio Amaral
Publisher
Brazilian Computer Society (SBC) SÃ o Paulo-SP, Brazil
Publication state
Published
Issued date
2019
Language
english
Abstract
Finding similarity in digital forensics investigations can be assisted with the use of Approximate Matching (AM) functions. These algorithms create small and compact representations of objects (similar to hashes) which can be compared to identify similarity. However, often results are biased due to common blocks (data structures found in many different files regardless of content). In this paper, we evaluate the precision and recall metrics for AM functions when removing common blocks. In detail, we analyze how the similarity score changes and impacts different investigation scenarios. Results show that many irrelevant matches can be filtered out and that a new interpretation of the score allows a better similarity detection.
Create date
06/05/2021 12:01
Last modification date
06/05/2021 12:40
Usage data