Fileprints: Identifying File Types by n-gram Analysis
We propose a method to analyze files to categorize their type using efficient 1-gram analysis of their binary contents. Our aim is to be able to accurately identify the true type of an arbitrary file using statistical analysis of their binary contents without parsing. Consequently, we may determine the type of a file if its name does not announce its true type. The method represents each file type by a compact representation we call a fileprint, effectively a simple means of representing all members of the same file type by a set of statistical 1-gram models. The method is designed to be highly efficient so that files can be inspected with little or no buffering, and on a network appliance operating in high bandwidth environment or when streaming the file from or to disk.
- FilePrintPaper-revised.pdf application/pdf 159 KB Download File
Also Published In
More About This Work
- Academic Units
- Computer Science
- Published Here
- April 30, 2010
Proceedings from the Sixth Annual IEEE Systems, Man, and Cybernetics (SMC) Information Assurance Workshop: workshop papers: June 15-17, 2005, West Point, New York (Piscataway, N.J.: IEEE, 2005), pp. 64-71.