Images (typically JPEG) are used as evidence against cyber perpetrators. Typically the file is carved using standard patterns. Many concentrate on carving JPEG files and overlook the important of thumbnail in assistin...Images (typically JPEG) are used as evidence against cyber perpetrators. Typically the file is carved using standard patterns. Many concentrate on carving JPEG files and overlook the important of thumbnail in assisting forensic investigation. However, a new unique pattern is used to detect thumbnail/s and embedded JPEG file. This paper is to introduce a tool call PattrecCarv to recognize thumbnail/s or embedded JPEG files using unique hex patterns (UHP). A tool called PattrecCarv is developed to automatically carve thumbnail/s and embedded JPEG files using DFRWS 2006 and DFRWS 2007 datasets. The tool successfully recovers 11.5% more thumbnails and embedded JPEG files than PredClus.展开更多
许多系统把数据访问请求当作是独立的事件。实际上,数据请求并非完全随机,而是由用户或程序的行为驱动的,不同的用户或程序存在不同的访问模式。LS(Last Successor)模型简单,但非常有效,然而它的预测结果严重依赖于用户或程序的访问顺...许多系统把数据访问请求当作是独立的事件。实际上,数据请求并非完全随机,而是由用户或程序的行为驱动的,不同的用户或程序存在不同的访问模式。LS(Last Successor)模型简单,但非常有效,然而它的预测结果严重依赖于用户或程序的访问顺序。提出了ULNS(User-based Last N Successors)文件预测模型,利用用户信息来提高预测精确度,并综合LS模型来改进算法的可适用度。实验结果表明,该预测模型具有较好的整体性能。展开更多
文摘Images (typically JPEG) are used as evidence against cyber perpetrators. Typically the file is carved using standard patterns. Many concentrate on carving JPEG files and overlook the important of thumbnail in assisting forensic investigation. However, a new unique pattern is used to detect thumbnail/s and embedded JPEG file. This paper is to introduce a tool call PattrecCarv to recognize thumbnail/s or embedded JPEG files using unique hex patterns (UHP). A tool called PattrecCarv is developed to automatically carve thumbnail/s and embedded JPEG files using DFRWS 2006 and DFRWS 2007 datasets. The tool successfully recovers 11.5% more thumbnails and embedded JPEG files than PredClus.
基金国家自然科学基金( the National Natural Science Foundation of China under Grant No.90412017)
文摘许多系统把数据访问请求当作是独立的事件。实际上,数据请求并非完全随机,而是由用户或程序的行为驱动的,不同的用户或程序存在不同的访问模式。LS(Last Successor)模型简单,但非常有效,然而它的预测结果严重依赖于用户或程序的访问顺序。提出了ULNS(User-based Last N Successors)文件预测模型,利用用户信息来提高预测精确度,并综合LS模型来改进算法的可适用度。实验结果表明,该预测模型具有较好的整体性能。
