Expediting MRSH-v2 Approximate Matching with Hierarchical Bloom Filter Trees

Authors

David Lillis, University College Dublin
Frank Breitinger, University of New HavenFollow
Mark Scanlon, University College Dublin

Author URLs

Professor Breitinger's Faculty Profile

Professor Breitinger's web page

UNH Cyber Forensics Research and Education Group (UNHcFREG)

Professor Breitinger's Full Bibliography

Document Type

Book Chapter

Publication Date

1-6-2018

Subject: LCSH

Computer crimes--Investigation, Computer forensics, Hashing (Computer science), Mobile device forensics

Disciplines

Computer Engineering | Computer Sciences | Electrical and Computer Engineering | Forensic Science and Technology | Information Security

Abstract

Bytewise approximate matching algorithms have in recent years shown significant promise in de- tecting files that are similar at the byte level. This is very useful for digital forensic investigators, who are regularly faced with the problem of searching through a seized device for pertinent data. A common scenario is where an investigator is in possession of a collection of "known-illegal" files (e.g. a collection of child abuse material) and wishes to find whether copies of these are stored on the seized device. Approximate matching addresses shortcomings in traditional hashing, which can only find identical files, by also being able to deal with cases of merged files, embedded files, partial files, or if a file has been changed in any way. Most approximate matching algorithms work by comparing pairs of files, which is not a scalable approach when faced with large corpora. This paper demonstrates the effectiveness of using a "Hierarchical Bloom Filter Tree" (HBFT) data structure to reduce the running time of collection-against-collection matching, with a specific focus on the MRSH-v2 algorithm. Three experiments are discussed, which explore the effects of different configurations of HBFTs. The proposed approach dramatically reduces the number of pairwise comparisons required, and demonstrates substantial speed gains, while maintaining effectiveness.

Comments

Find the book in a library

Purchase the book or chapter

DOI

10.1007/978-3-319-73697-6_11

Repository Citation

Lillis, David; Breitinger, Frank; and Scanlon, Mark, "Expediting MRSH-v2 Approximate Matching with Hierarchical Bloom Filter Trees" (2018). Electrical & Computer Engineering and Computer Science Faculty Publications. 75.
https://digitalcommons.newhaven.edu/electricalcomputerengineering-facpubs/75

Publisher Citation

Lillis D., Breitinger F., Scanlon M. (2018) Expediting MRSH-v2 Approximate Matching with Hierarchical Bloom Filter Trees. In: Matoušek P., Schmiedecker M. (eds) Digital Forensics and Cyber Crime. ICDF2C 2017. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 216. Berlin: Springer International Publishing, pp. 144-157. ISBN: 978-3-319-73696-9