File Classification Research Articles

A sound recognition algorithm to filter non construction site noise

Sixense Engineering have developed a new algorithm to correct the noise levels measured around construction sites, by identifying and filtering out sounds that are generated by activities outside the site (emergency services sirens, traffic horns, etc.). The idea is to go beyond the simple classification of audio files by applying the classification algorithm to all the noise events that contribute to the noise dose LAeq,T. In this innovative process, the noise dose is calculated from elementary LAeq,1min,. When noise events are detected (in terms of LAeq,1min), the corresponding audio recording (.wav file) are analysed by the sound recognition algorithm. When the algorithm identifies that the noise source is not construction related, with a high degree of confidence, the corresponding LAeq,1min is excluded from the noise dose calculation. In other words, the measured noise dose can be filtered by removing non construction related noise events produced by external sources like sirens, horns, motorbikes, birds, music, etc.

Classification of Firewall Log Files with Different Algorithms and Performance Analysis of These Algorithms

Classifying firewall log files allows analysing potential threats and deciding on appropriate rules to prevent them. Therefore, in this study, firewall log files are classified using different classification algorithms and the performance of the algorithms are evaluated using performance metrics. The dataset was prepared using the log files of a firewall. It was filtered to make it free from any personal data and consisted of 12 attributes in total and from these attributes the action attribute was selected as the class. In the performance evaluation, Simple Cart and NB tree algorithms made the best predictions, achieving an accuracy rate of 99.84%. Decision Stump had the worst prediction performance, achieving an accuracy rate of 79.68%. As the total number of instances belonging to each of the classes in the dataset was not equal, the Matthews correlation coefficient was also used as a performance metric in the evaluations. The Simple Cart, BF tree, FT tree, J48 and NB Tree algorithms achieved the highest average values. However, although the reset-both class was not predicted successfully by the others, the Simple Cart algorithm made the best predictions for it. The values of other performance metrics used in this study also support this conclusion. Therefore, the Simple Cart algorithm is recommended for use in classifying firewall log files. However, there is a need to develop a prefiltering and parsing approach to process different log files as each firewall brand creates and maintains log files in its own format. Therefore, in this study, a novel prefiltering and parsing approach has been proposed to process log files with different structures and create structured datasets using them.

Perbandingan Kinerja Sistem Operasi Network Attached Storage: Studi Kasus Truenas dan Xigmanas

Network Attached Storage (NAS) is a data storage device that operates through a computer network and provides an efficient and cost-effective storage solution due to its open-source foundation. This research compares the performance of TrueNAS and XigmaNAS as NAS operating systems in terms of data transfer speed and resource utilization over a period of 7 days. The tested parameters include file copy, file classification, file duplicate detection, CPU usage, and memory usage. The research results indicate that the average file transfer speed from server to client in TrueNAS is 7.4 Mbps, while in XigmaNAS it is 7.36 Mbps. The average file classification rate in TrueNAS is 863 files/s, whereas in XigmaNAS it is 813 files/s. The average speed of duplicate file detection in TrueNAS is 1.23 files/s, while in XigmaNAS it is 1.13 files/s. The average CPU usage in TrueNAS is 30.08%, compared to 29.38% in XigmaNAS. The average available memory for TrueNAS is 6.13 GiB, and for XigmaNAS it is 5.41 GiB. Despite the small variations and differences observed in the test results, overall, TrueNAS outperforms XigmaNAS in the analyzed aspects.

Intelligent Classification of JPEG files by Support Vector Machines with Content-based Feature Extraction

Nowadays, multimedia files play a basic role in supporting evidence analysis for making decisions about a crime through looking at files as a digital guide or evidence. Multimedia files such as JPG images are a common format because many documents and memorial images on laptops are valuable. In addition, many JPG images on Laptops are valuable and have fewer structure contents, making recovery possible when their file system is missing. However, intelligent systems for fully recovering corrupted JPG images into their original form is a challenging research issue. In this research, a support vector machine (SVM) as intelligent classifier algorithm is proposed to classify JPG or non-JEG image clusters as part of multimedia files. The SVM classifies the data clusters on three content-based feature extraction (entropy, byte frequency distribution, and rate of change approach to derive cluster features) methods to optimize the identification of JPG image content. The SVM classifier is applied using a radial basis and polynomial kernel functions in MATLAB software. The experimental results show that the accuracy of classification of the SVM classifier with the polynomial function is 96.21%, and the SVM classifier with the radial basis function is 57.58%.

The Usage of Template Mining in Log File Classification

The Usage of Template Mining in Log File Classification

CLASSIFICATION OF INSTRUMENT SOUNDS WITH IMAGE CLASSIFICATION ALGORITHMS

Classification of audio files using CNN (Convolutional Neural Network) algorithm is an important application in the field of audio processing and artificial intelligence. This process aims to automatically classify audio files into different classes and can be used in speech recognition, emotional analysis, voice-based control systems and many other applications. The aim of this study is to perform spectrum transformation of instrumental sounds and classify them using image classification algorithms. The dataset contains a total of 1500 data from five different instruments. Audio files were processed, and signal and spectrogram images of each audio file were obtained. DenseNet121, ResNet and CNN algorithms were tested in experimental studies. The most successful results belong to the CNN algorithm with 99.34%.

Combining AI and AM – Improving approximate matching through transformer networks

Approximate matching is a well-known concept in digital forensics to determine the similarity between digital artifacts. An important use case of approximate matching is the reliable and efficient detection of case-relevant data structures on a blacklist (e.g., malware or corporate secrets), if only fragments of the original are available. For instance, if only a cluster of indexed malware is still present during the digital forensic investigation, the approximate matching algorithm shall be able to assign the fragment to the blacklisted malware. However, traditional approximate matching functions like TLSH and ssdeep fail to detect files based on their fragments if the presented piece is relatively small compared to the overall file size (e.g., like one-third of the total file). A second well-known issue with traditional approximate matching algorithms is the lack of scaling due to the ever-increasing lookup databases. In this paper, we propose an improved matching algorithm based on transformer-based models from the field of natural language processing. We call our approach Deep Learning Approximate Matching (DLAM). As a concept from artificial intelligence, DLAM gets knowledge of characteristic blacklisted patterns during its training phase. Then DLAM is able to detect the patterns in a typically much larger file, that is DLAM focuses on the use case of fragment detection. Our evaluation is inspired by two widespread blacklist use cases: the detection of malware (e.g., in JavaScript) and corporate secrets (e.g., pdf or office documents). We reveal that DLAM has three key advantages compared to the prominent conventional approaches TLSH and ssdeep. First, it makes the tedious extraction of known to be bad parts obsolete, which is necessary until now before any search for them with approximate matching algorithms. This allows efficient classification of files on a much larger scale, which is important due to exponentially increasing data to be investigated. Second, depending on the use case, DLAM achieves a similar (in case of mrsh-cf and mrsh-v2) or even significantly higher accuracy (in case of ssdeep and TLSH) in recovering fragments of blacklisted files. For instance, in the case of JavaScript files, our assessment shows that DLAM provides an accuracy of 93% on our test corpus, while TLSH and ssdeep show a classification accuracy of only 50%. Third, we show that DLAM enables the detection of file correlations in the output of TLSH and ssdeep even for fragment sizes, where the respective matching function of TLSH and ssdeep fails.

Hybrid Approach of Big Data File Classification Based on Threat Analysis for Enhancing Security

Hybrid Approach of Big Data File Classification Based on Threat Analysis for Enhancing Security

Evaluation of Procedures and Policies used in Controlling Personnel Records at University of Eldoret, Kenya

The role records control is to ensure that records are available at the point of use, has up-to-date information, reliable, checked and have statutory requirements for records and documents that require access. Records control procedures define the role of personnel records by limiting staff numbers, monitoring performance and protecting the rights of individual staff. In Kenya, proper record-keeping is mandated in law. However, it has been noted that challenges of personnel records control in Kenyan universities are common, and with dire consequences. Therefore, the study investigated the personnel records control procedures and policies at University of Eldoret’s Central Registry. Descriptive research design was adopted. The study targeted all the 10 employees of the Central Registry. Therefore, census sampling techniques were used to identify all the staff as respondents. Observation, interviews and questionnaires were used to collect data and results were presented by use of pie charts and bar graphs. Qualitative data was analysed thematically and presented in narrative form. The study found that the University of Eldoret’s Central Registry has in place standardized personnel records control procedures. These procedures include file registration, file classification, file plans, foliating of records, file transit sheets, and records inventories. However, there was no file colour coding to ease identification and retrieval of files. Further, the Registry does not have records management policies in place. From the findings and conclusion, it is recommended that the Central Registry management should adopt colour coding as one of the main procedures for controlling records. Additionally, the University should develop a records control and management policy.

Building a model of the Earth's gravitational field within the Caribbean Sea based on satellite altimetry data

Methods for processing measurement information collected over the past 30 years by altimetry spacecraft with various measurement technologies and orbit characteristics are systematized and described. The description and classification of measurement information files is given. Based on the removal-recovery method, a software package for determining the characteristics of the gravitational field and the figure of the Earth by satellite altimetry has been developed. On the example of a geologically complex and seismically active region (the Caribbean Sea), a model of the gravity field (gravity anomalies) was constructed and its accuracy characteristics were evaluated. The calculated standard deviation of gravity anomalies from the data of the EGM2008 global model does not exceed 4 mGal in the open sea and 14 mGal in the coastal zone, which corresponds to the international level. At the moment, a digital interactive gravity model of the Global Ocean is used to solve applied problems of geophysics and geology, in particular, to forecast oil and gas fields.

Classification of Image Files of Lung X-Ray Results with Architecture Convolution Neural Network (CNN)

In the last decade, the use of artificial intelligence (AI) is increasing, Convolution Neural Network (CNN) architecture as one of them has helped the world to process Big Data (big data), by conducting a training process from a large number of image datasets, and then being able to learn its characteristics and then select according to its classification. The use of the python programming language as a means to classify an image file with CNN architecture is very good and has very high accuracy. Keras is a module that has been prepared by python programming language developers to support self-learning artificial intelligence that also supports CNN architecture. In CNN programming with python language, it is mentioned that the more parameters are tested, the better the artificial intelligence gives output. Therefore, the objective this test is to prove whether the more parameters given to the system can provide better output with the method used is to provide input dataset training. The results of the study can be from the number of parameters learned 1,059,106 with an average time of 135 ms, then the machine can classify the image correctly by 87.88%. if the machine learns with more parameters of 3,824,486 with an average time of 780 ms, then the machine can guess close to 100%. The results of the study can be seen that the more the machine learns with its artificial intelligence capabilities, the more proficient the machine will be.

Leveraging Adversarial Samples for Enhanced Classification of Malicious and Evasive PDF Files

The Portable Document Format (PDF) is considered one of the most popular formats due to its flexibility and portability across platforms. Although people have used machine learning techniques to detect malware in PDF files, the problem with these models is their weak resistance against evasion attacks, which constitutes a major security threat. The goal of this study is to introduce three machine learning-based systems that enhance malware detection in the presence of evasion attacks by substantially relying on evasive data to train malware and evasion detection models. To evaluate the robustness of the proposed systems, we used two testing datasets, a real dataset containing around 100,000 PDF samples and an evasive dataset containing 500,000 samples that we generated. We compared the results of the proposed systems to a baseline model that was not adversarially trained. When tested against the evasive dataset, the proposed systems provided an increase of around 80% in the f1-score compared to the baseline. This proves the value of the proposed approaches towards the ability to deal with evasive attacks.

Automated Music Genre Classification through Deep Learning Techniques

Music Genre Classification (MGC) automatically categorizes music into different genres based on various musical attributes and features in a small number of music files. This is a crucial problem in the field of music information retrieval as it provides a way to organize and analyse large amounts of music files. MGC can be performed using conventional machine learning algorithms such as SVM, k-nearest neighbours, Decision trees, and neural networks. These algorithms learn to recognize different musical features and attributes to categorize the music files into different genres. The literature shows that the performance of conventional machine learning algorithms is inferior to deep learning algorithms such as CNN, RNN, etc., in various applications. Hence, the CNN algorithm is adapted to implement the classification of music files. This aims to classify music genres using CNN deep learning techniques. The performance of the algorithms for MGC can be evaluated using metrics such as accuracy, precision, recall, and F1-score. Additionally, the impact of different features and algorithms on the performance of MGC can be studied and compared. It has applications in areas such as automated music recommendation systems, music education, and music production. An accuracy of 83% is achieved by using CNN to accomplish the task of MGC.

Android Malware Detection Using ResNet-50 Stacking

There has been an increase in attacks on mobile devices, such as smartphones and tablets, due to their growing popularity. Mobile malware is one of the most dangerous threats, causing both security breaches and financial losses. Mobile malware is likely to continue to evolve and proliferate to carry out a variety of cybercrimes on mobile devices. Mobile malware specifically targets Android operating system as it has grown in popularity. The rapid proliferation of Android malware apps poses a significant security risk to users, making static and manual analysis of malicious files difficult. Therefore, efficient identification and classification of Android malicious files is crucial. Several Convolutional Neural Network (CNN) based methods have been proposed in this regard; however, there is still room for performance improvement. In this work, we propose a transfer learning and stacking approach to efficiently detect the Android malware files by utilizing two well-known machine learning models, ResNet-50 and Support Vector Machine (SVM). The proposed model is trained on the DREBIN dataset by transforming malicious APK files into grayscale images. Our model yields higher performance measures than state-of-the-art works on the DREBIN dataset, where the reported measures are accuracy, recall, precision, and F1 measures of 97.8%, 95.8%, 95.7%, and 95.7%, respectively.

SDOT: Secure Hash, Semantic Keyword Extraction, and Dynamic Operator Pattern-Based Three-Tier Forensic Classification Framework

Most traditional digital forensic techniques identify irrelevant files in a corpus using keyword search, frequent hashes, frequent paths, and frequent size methods. These methods are based on Message Digest and Secure Hash Algorithm-1, which result in a hash collision. The threshold criteria of files based on frequent sizes will lead to imprecise threshold values that result in an increased evaluation of irrelevant files. The blacklisted keywords used in forensic search are based on literal and non-lexical, thus resulting in increased false-positive search results and failure to disambiguate unstructured text. Due to this, many extraneous files are also being considered for further investigations, exacerbating the time lag. Moreover, the non-availability of standardized forensic labeled data results in <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$(O(2^{n}))$ </tex-math></inline-formula> time complexity during the file classification process. This research proposes a three-tier Keyword Metadata Pattern framework to overcome these significant concerns. Initially, Secure Hash algorithm-256 hash for the entire corpus is constructed along with custom regex and stop-words module to overcome hash collision, imprecise threshold values, and eliminate recurrent files. Then blacklisted keywords are constructed by identifying vectorized words that have proximity to overcome traditional keyword search’s drawbacks and to overcome false positive results. Dynamic forensic relevant patterns based on massive password datasets are designed to search for unique, relevant patterns to identify the significant files and overcome the time lag. Based on tier-2 results, files are preliminarily classified automatically in O(log n) complexity, and the system is trained with a machine learning model. Finally, when experimentally evaluated, the overall proposed system was found to be very effective, outperforming the existing two-tier model in terms of finding relevant files by automated labeling and classification in O(nlog n) complexity. Our proposed model could eliminate 223K irrelevant files and reduce the corpus by 4.1% in tier-1, identify 16.06% of sensitive files in tier-2, and classify files with 91% precision, 95% sensitivity, 91% accuracy, and 0.11% Hamming loss compared to the two-tier system.

Stacking ensemble-based HIDS framework for detecting anomalous system processes in Windows based operating systems using multiple word embedding

Globally, more than 80% of end-user devices run on Microsoft’s Windows-based operating systems. Therefore, majority of the cyber-attack payloads are crafted explicitly for exploiting various vulnerabilities that exist across different software modules of Windows-based operating systems. To address this security issue, a stacking ensemble-based HIDS framework for detecting anomalous system processes is proposed in this paper. The proposed HIDS framework analyzes the process files comprising sequence of dll instruction calls made by various application and system processes to the Windows operating system’s kernel for detecting anomalous processes. The framework initially transforms the system process files comprising sequence of dll invocations into their corresponding n-gram feature vectors. It then uses two different state-of-the-art word embedding techniques namely, Word2Vec and GloVe to learn the contextual inter-dependencies between n-gram terms of the feature vectors, and generate fixed length word embedding vectors for each n-gram terms. These learned numeric word embedding vectors along with the n-gram feature vectors corresponding to the system process files are then provided as input to train an ensemble-based classifier model comprising LSTM, Bi-LSTM, GRU and Bi-GRU based base-level classifiers, and a fully connected neural network based meta-level classifier for classification of system process files as either normal or anomalous. The proposed HIDS framework is capable of detecting wide range of Windows-based attacks with high accuracy and precision. Experimental results show that the proposed HIDS framework achieves high accuracy and precision of 91.00% and 93.30%, respectively on the benchmark binary class Australian Defense Force Academy Windows Dataset (ADFA-WD) dataset. It also achieves an accuracy and precision of 68.70% and 67.80%, respectively on the multi-class ADFA-WD dataset, which are significantly higher than other similar HIDS frameworks proposed in the literature.

Design and Analysis of Machine Learning Based Technique for Malware Identification and Classification of Portable Document Format Files

Modern day antivirus software, which is available commercially, is incapable of providing the protection from the malicious portable document format (PDF) files and thus considered as a threat to system security. In order to mitigate the same to some extent, a new PDF malware classification system based on machine learning (ML) is introduced in this paper. The novelty of this system is that it will be inspecting the given PDF file both statistically and dynamically, which in turn will increase the accuracy of finding the correct nature of the document. This method is nonsignature-based and hence can possibly distinguish obscure and zero-day malware. The experiment is carried out for this system by deploying five different classifier algorithms to find out the best fit for the system. The best fit approach is analyzed by calculating the true positive rate (TPR), precision, false positive rate (FPR), false negative rate (FNR), and F1-score for each of these classifier algorithms. Comparison of this work is carried out with previously existing PDF classification systems. A malicious attack on to the proposed system is also implemented, which will in turn obfuscate the malicious code inside the PDF file by making it hidden during the parsing phase by the PDF parser. It has been inferred that the proposed approach achieved F1-measure of 0.986 by using the random forest (RF) classifier in comparison to state-of-the-art where F1-measure was 0.978. Thus, our approach is quite effective in the identification of the malwares when embedded in the PDF file in comparison to the existing systems.

A novel file system supporting rich file classification

Existing implementations of file systems often seem to be made on an ad hoc and implicit basis. This paper aims to enhance the organization of files and retrieval of files by modifying the traditional hierarchical file system to improve built-in query support and bulk metadata updates supported at the file system level. We introduce tags in a hierarchy of file collections and use links to allow file retrieval from multiple paths as files exist in multiple directories simultaneously. By using a series of modest changes to the hierarchical file system, we propose a novel Linked Tree Tags (LTTs) model. These changes include using multiple tags instead of names, collections instead of directories, exposing a query language at the Application Programming Interface (API) level, and allowing controlled file links. We assess our model's expressive capability and demonstrate that LTTs overcome traditional file systems' limits and provide users with the to manage their files easily.

Analisis Sentimen Opini Pengguna Twitter Terhadap Perusahaan Jasa Ekspedisi Menggunakan Algoritma Naïve Bayes Berbasis PSO

Expeditions are used in the process of delivering goods or selling them remotely. Twitter has become a social media for information sharing and opinions, including those on the expeditionary services both negative and positive. The solution for the problem which occurs is that of sentiment analysis, helpful in grouping the data and predicting the tweet. The aim of the research to predict sentient tweeted data using a file classification method, naive bayes's algorithm calculated the value of the tweets of the Anteraja expedition service that had the results accuracy 87,77%, precision 76,67%, recall 52,27%. JNE with accuracy 81,48%, precision 71,43%, dan recall 62,50%. JNT with accuracy 91,46%, precision 48,15%, recall 86,67%. Shopee Express with accuracy 92,68%, precision 9,09%, recall 16,67% and Sicepat with accuracy 91,50%, presision 100,00% dan recall 38,10%. Particle Swarm Optimization (PSO) serves to increase the value of the results of the nave Bayes classification with the results of Anteraja accuracy 91,70%, precision 82,05%, recall 72,73%. JNE accuracy 93,83%, precision 88,00%, recall 91,67%. JNT accuracy 92,18%, precision 70,97%, recall 81,48%. Shopee Express accuracy 94%, precision 20,00%, recall 33,33% and Sicepat accuracy 95,42%, precision 93,75%, recall 71,43%. From the results of naïve bayes research and Particle Swarm Optimization (PSO) it can be compared that Particle Swarm Optimization (PSO) is proven to be able to increase the value of nave Bayes.

On the vulnerability of anti-malware solutions to DNS attacks

Anti-malware agents typically communicate with their remote services to share information about suspicious files. These remote services use their up-to-date information and global context (view) to help classify the files and instruct their agents to take a predetermined action (e.g., delete or quarantine). In this study, we provide a security analysis of a specific form of communication between anti-malware agents and their services, which takes place entirely over the insecure DNS protocol. These services, which we denote DNS anti-malware list (DNSAML) services, affect the classification of files scanned by anti-malware agents, therefore potentially putting their consumers at risk due to known integrity and confidentiality flaws of the DNS protocol. By analyzing a large-scale DNS traffic dataset made available to the authors by a well-known CDN provider, we identify anti-malware solutions that seem to make use of DNSAML services. We found that these solutions, deployed on almost three million machines worldwide, exchange hundreds of millions of DNS requests daily. These requests carry sensitive file scan information, often - as we demonstrate - without any additional safeguards to compensate for the insecurities of the DNS protocol. As a result, these anti-malware solutions that use DNSAML are vulnerable to DNS attacks. For instance, an attacker capable of tampering with DNS queries gains the ability to alter the classification of scanned files, without a presence on the scanning machine. We showcase three attacks applicable to at least three anti-malware solutions that could result in the disclosure of sensitive information and improper behavior by the anti-malware agent, such as ignoring detected threats. Finally, we propose and review a set of countermeasures for anti-malware solution providers to prevent attacks stemming from the use of DNSAML services.