Fileprints: Identifying File Types by n-gram Analysis

Li, Wei-Jen; Wang, Ke; Stolfo, Salvatore; Herzog, Benjamin

We propose a method to analyze files to categorize their type using efficient 1-gram analysis of their binary contents. Our aim is to be able to accurately identify the true type of an arbitrary file using statistical analysis of their binary contents without parsing. Consequently, we may determine the type of a file if its name does not announce its true type. The method represents each file type by a compact representation we call a fileprint, effectively a simple means of representing all members of the same file type by a set of statistical 1-gram models. The method is designed to be highly efficient so that files can be inspected with little or no buffering, and on a network appliance operating in high bandwidth environment or when streaming the file from or to disk.



  • thumnail for FilePrintPaper-revised.pdf FilePrintPaper-revised.pdf application/pdf 159 KB Download File

More About This Work

Academic Units
Computer Science
Published Here
April 30, 2010


Proceedings from the Sixth Annual IEEE Systems, Man, and Cybernetics (SMC) Information Assurance Workshop: workshop papers: June 15-17, 2005, West Point, New York (Piscataway, N.J.: IEEE, 2005), pp. 64-71.