Logo des Repositoriums

P140 - IMF 2008 – IT-Incident Management & IT Forensics

https://dl.gi.de/handle/20.500.12116/23586
Auflistung nach:

Auflistung P140 - IMF 2008 – IT-Incident Management & IT Forensics nach Autor:in "Debbabi, Mourad"

1 - 2 von 2
  • Konferenzbeitrag
    File type analysis using signal processing techniques and machine learning vs. file Unix Utility for forensic analysis
    (IMF 2008 – IT Incident Management & IT Forensics, 2008) Mokhov, Serguei A.; Debbabi, Mourad
    The Unix file utility determines file types of regular files by examining usually the first 512 bytes of the file that often contain some magic header information or typical header information for binary files or common text file fragments; otherwise, it defers to the OS-dependent stat () system call. It combines that heuristics with the common file extensions to give the final result of classification. While file is fast and small, and its magic database is "serviceable" by expert users, for it to recognize new file types, perhaps with much finer granularity it requires code and/or magic database updates and a patch release from the core developers to recognize new file types correctly. We propose an alternative file-like utility in determining file types with much greater flexibility that can learn new types on the user's side and be integrated into forensic toolkits as a plug-in that relies on the file-like utility and uses signal processing techniques to compute the "spectral signatures" of file types. We present the work-in-progress of the design and implementation of such a tool based on MARF's collection of algorithms and the selection of the best combination and the integration of the tool into a forensic toolkit to enhance the tool, called fileType with the automatic machine learning capabilities of the new file types. We compare the advantages and disadvantages of our approach with the file utility in terms of various metrics and apply the new tool to learn known stego files to attempt to classify potential unknown stego files and compare the results with stegdetect.
  • Konferenzbeitrag
    Formally specifying operational semantics ans language constructs of forensic lucid
    (IMF 2008 – IT Incident Management & IT Forensics, 2008) Mokhov, Serguei A.; Paquet, Joey; Debbabi, Mourad
    The Forensic Lucid programming language is being developed for intensional cyberforensic case specification and analysis, including the syntax and operational semantics. In significant part, the language is based on ist predecessor and codecessor Lucid dialects, such as GIPL, Indexical Lucid, Lucx, Objective Lucid, and JOOIP bound by the intensional higher-order logic that is behind them. This work continues to formally specify the operational semantics of the Forensic Lucid language extending the previous ralated work.