All publications by year

@article{BSR14,
title = {Evaluating Detection Error Trade-offs for Bytewise Approximate Matching Algorithms},
author = {Frank Breitinger and Georgios Stivaktakis and Vassil Roussev},
url = {http://dx.doi.org/10.1016/j.diin.2014.05.002},
doi = {10.1016/j.diin.2014.05.002},
issn = {1742-2876},
year = {2014},
date = {2014-06-08},
journal = {Digital Investigation},
volume = {11},
number = {2},
pages = {81--89},
publisher = {Elsevier Science Publishers B. V.},
address = {Amsterdam, The Netherlands, The Netherlands},
abstract = {Bytewise approximate matching is a relatively new area within digital forensics, but its importance is growing quickly as practitioners are looking for fast methods to analyze the increasing amounts of data in forensic investigations. The essential idea is to complement the use of cryptographic hash functions to detect data objects with bytewise identical representation with the capability to find objects with bytewise similar representations. Unlike cryptographic hash functions, which have been studied and tested for a long time, approximate matching ones are still in their early development stages, and have been evaluated in a somewhat ad-hoc manner. Recently, the FRASH testing framework has been proposed as a vehicle for developing a set of standardized tests for approximate matching algorithms; the aim is to provide a useful guide for understanding and comparing the absolute and relative performance of different algorithms. The contribution of this work is twofold: a) expand FRASH with automated tests for quantifying approximate matching algorithm behavior with respect to precision and recall; and b) present a case study of two algorithms already in use-sdhash and ssdeep.},
note = {bf Best Paper Award},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{BB14,
title = {File Detection On Network Traffic Using Approximate Matching},
url = {https://doi.org/10.15394/jdfsl.2014.1168},
doi = {doi.org/10.15394/jdfsl.2014.1168},
year = {2014},
date = {2014-05-22},
journal = {Journal of Digital Forensics, Security and Law (JDFSL)},
volume = {9},
number = {2},
pages = {23--36},
abstract = {In recent years, Internet technologies changed enormously and allow faster Internet connections, higher data rates and mobile usage. Hence, it is possible to send huge amounts of data / files easily which is often used by insiders or attackers to steal intellectual property. As a consequence, data leakage prevention systems (DLPS) have been developed which analyze network traffic and alert in case of a data leak. Although the overall concepts of the detection techniques are known, the systems are mostly closed and commercial.
Within this paper we present a new technique for network traffic analysis based on approximate matching (a.k.a fuzzy hashing) which is very common in digital forensics to correlate similar files. This paper demonstrates how to optimize and apply them on single network packets. Our contribution is a straightforward concept which does not need a comprehensive configuration: hash the file and store the digest in the database. Within our experiments we obtained false positive rates between 10−4 and 10−5 and an algorithm throughput of over 650 Mbit/s.},
note = {bf Best Paper Award},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{BR14,
title = {Automated evaluation of approximate matching algorithms on real data},
author = {Frank Breitinger and Vassil Roussev},
url = {http://www.sciencedirect.com/science/article/pii/S1742287614000073},
doi = {10.1016/j.diin.2014.03.002},
issn = {1742-2876},
year = {2014},
date = {2014-03-13},
journal = {Digital Investigation},
volume = {11, Supplement 1},
number = {0},
pages = {S10 - S17},
abstract = {Abstract Bytewise approximate matching is a relatively new area within digital forensics, but its importance is growing quickly as practitioners are looking for fast methods to screen and analyze the increasing amounts of data in forensic investigations. The essential idea is to complement the use of cryptographic hash functions to detect data objects with bytewise identical representation with the capability to find objects with bytewise similar representations. Unlike cryptographic hash functions, which have been studied and tested for a long time, approximate matching ones are still in their early development stages and evaluation methodology is still evolving. Broadly, prior approaches have used either a human in the loop to manually evaluate the goodness of similarity matches on real world data, or controlled (pseudo-random) data to perform automated evaluation. This work's contribution is to introduce automated approximate matching evaluation on real data by relating approximate matching results to the longest common substring (LCS). Specifically, we introduce a computationally efficient LCS approximation and use it to obtain ground truth on the t5 set. Using the results, we evaluate three existing approximate matching schemes relative to LCS and analyze their performance.},
note = {Proceedings of the First Annual DFRWS Europe},
keywords = {},
pubstate = {published},
tppubtype = {article}
}

@article{BBW14,
title = {On the database lookup problem of approximate matching},
author = {Frank Breitinger and Harald Baier and Douglas White},
url = {http://www.sciencedirect.com/science/article/pii/S1742287614000061},
doi = {10.1016/j.diin.2014.03.001},
issn = {1742-2876},
year = {2014},
date = {2014-03-13},
journal = {Digital Investigation},
volume = {11, Supplement 1},
number = {0},
pages = {S1--S9},
abstract = {Abstract Investigating seized devices within digital forensics gets more and more difficult due to the increasing amount of data. Hence, a common procedure uses automated file identification which reduces the amount of data an investigator has to look at by hand. Besides identifying exact duplicates, which is mostly solved using cryptographic hash functions, it is also helpful to detect similar data by applying approximate matching. Let x denote the number of digests in a database, then the lookup for a single similarity digest has the complexity of O(x). In other words, the digest has to be compared against all digests in the database. In contrast, cryptographic hash values are stored within binary trees or hash tables and hence the lookup complexity of a single digest is O(log2(x)) or O(1), respectively. In this paper we present and evaluate a concept to extend existing approximate matching algorithms, which reduces the lookup complexity from O(x) to O(1). Therefore, instead of using multiple small Bloom filters (which is the common procedure), we demonstrate that a single, huge Bloom filter has a far better performance. Our evaluation demonstrates that current approximate matching algorithms are too slow (e.g., over 21 min to compare 4457 digests of a common file corpus against each other) while the improved version solves this challenge within seconds. Studying the precision and recall rates shows that our approach works as reliably as the original implementations. We obtain this benefit by accuracy--the comparison is now a file-against-set comparison and thus it is not possible to see which file in the database is matched.},
note = {Proceedings of the First Annual DFRWS Europe},
keywords = {},
pubstate = {published},
tppubtype = {article}
}