Research On File Fragment Type Detection Algorithm Based On Deep Learning In Digital Forensics

Digital forensics is one of the important research contents in the field of informat ion security,and is widely used in criminal forensics and judicial forensics.It is necessary to extract the suspect's various types of images,audio,text and other digit ized documents for the identification of the suspect's criminal facts.However,the digital information is often incomplete or maliciously damaged.How to reasonably detect the type of file fragments is t he premise of high-performance file carving.Improving the accuracy of file fragment detection,can improve the speed of file carving,and also optimize the process of digital forensics.However,there are two main problems in the research of file fragment type detection algorithms in digital forensics.One is the suspects may maliciously destroy or falsify files,which makes the original files lose the meta-informat ion and more difficult to detect the type of file fragment.For highly compressed or complex high-entropy file types,they have highly similar statistical characteristics,which makes the type detection more difficult.This paper aims at this two problems,proposing a file fragment type detection algorithm for digital forensics based on deep learning.Based on traditional machine learning,file fragment type detection can be implemented by manually extracting features through N-Gram,Shannon Entropy or Hamming Weight,etc.Because these methods tend to be based on statistical features in feature extraction and put less consideration for structural features,the accuracy of file fragment type detection is not high.First,in this paper we preprocess the common data set to remove the file metadata information,making the type detection of the original data set more challenging,which reproduces an algorithm of artificial feature extraction combined with support vector machines based on statistical feature extraction to detect file fragment.Then we propose a new method based on image conversion and deep learning of file fragment,which maps the traditional statistical features into the image space to extract more hi dden features,thus improving the accuracy of classification.Thanks to the multi-layer feature mapping,our deep convolution neural network can extract nearly 100,000 features from the non-linear connections between neurons.The file fragment type detection algorithm based on grayscale transformation and deep learning of digital images proposed in this paper has been trained and tested on the public data set Gov Docs,and has obtained good experimental results.