Neural Networks for File Fragment Classification

Abstract

File fragment classification is an important step in file forensics in which filetypes are assumed based on their available content fragments. Methods typically used for this task utilize machine learning techniques on features like byte frequency distributions and fragment entropy measures. In this paper, a contribution to this field is made through exploration of novel approaches to the problem including feedforward artificial neural networks and convolution networks. Feedforward neural networks were trained with byte histograms and with byte-pair histograms, while convolution neural networks were trained with blocks consisting of 512 bytes of data obtained from the GovDocs1 dataset. The results suggest convolution neural networks are not as promising for this problem as feedforward artificial neural networks, and feedforward artificial neural networks showing great results.