File Fragment Classification Using Grayscale Image Conversion and Deep Learning in Digital Forensics

作者：Qian Chen, Qing Min Liao, Zoe L. Jiang, Junbin Fang, Siu‐Ming Yiu, Guikai Xi, Rong Li, Zhengzhong Yi, Xuan Wang, Lucas C. K. Hui, Dong Liu, En Zhang · 年份：2018 · DOI：10.1109/spw.2018.00029 · 被引用次数：47 · 研究领域：Digital and Cyber Forensics、Digital Media Forensic Detection、Advanced Malware Detection Techniques

File fragment classification is an important step in digital forensics. The most popular method is based on traditional machine learning by extracting features like N-gram, Shannon entropy or Hamming weights. However, these features are far from enough to classify file fragments. In this paper, we propose a novel scheme based on fragment-to-grayscale image conversion and deep learning to extract more hidden features and therefore improve the accuracy of classification. Benefit from the multi-layered feature maps, our deep convolution neural network (CNN) model can extract nearly ten thousands of features through the non-linear connections between neurons. Our proposed CNN model was trained and tested on the public dataset GovDocs. The experiments results show that we can achieve 70.9% accuracy in classification, which is higher than those of existing works.