Abstract:Multimedia file fragment classification (MFFC) aims to identify file fragment types, e.g., image/video, audio, and text without system metadata. It is of vital importance in multimedia storage and communication. Existing MFFC methods typically treat fragments as 1D byte sequences and emphasize the relations between separate bytes (interbytes) for classification. However, the more informative relations inside bytes (intrabytes) are overlooked and seldom investigated. By looking inside bytes, the bit-level details of file fragments can be accessed, enabling a more accurate classification. Motivated by this, we first propose Byte2Image, a novel visual representation model that incorporates previously overlooked intrabyte information into file fragments and reinterprets these fragments as 2D grayscale images. This model involves a sliding byte window to reveal the intrabyte information and a rowwise stacking of intrabyte ngrams for embedding fragments into a 2D space. Thus, complex interbyte and intrabyte correlations can be mined simultaneously using powerful vision networks. Additionally, we propose an end-to-end dual-branch network ByteNet to enhance robust correlation mining and feature representation. ByteNet makes full use of the raw 1D byte sequence and the converted 2D image through a shallow byte branch feature extraction (BBFE) and a deep image branch feature extraction (IBFE) network. In particular, the BBFE, composed of a single fully-connected layer, adaptively recognizes the co-occurrence of several some specific bytes within the raw byte sequence, while the IBFE, built on a vision Transformer, effectively mines the complex interbyte and intrabyte correlations from the converted image. Experiments on the two representative benchmarks, including 14 cases, validate that our proposed method outperforms state-of-the-art approaches on different cases by up to 12.2%.

File Fragment Classification Using Grayscale Image Conversion and Deep Learning in Digital Forensics

A File Fragment Classification Method Based on Grayscale Image.

File Fragment Type Classification Using Light-Weight Convolutional Neural Networks

File Fragment Classification using Light-Weight Convolutional Neural Networks

Multiple Heterogeneous JPEG Image Hierarchical Forensic

A Byte Sequence is Worth an Image: CNN for File Fragment Classification Using Bit Shift and n-Gram Embeddings

Hierarchy-Based File Fragment Classification

Automated Diatom Searching in the Digital Scanning Electron Microscopy Images of Drowning Cases Using the Deep Neural Networks

Digital Whole-Slide Image Analysis for Automated Diatom Test in Forensic Cases of Drowning Using a Convolutional Neural Network Algorithm.

Forensic Scanner Identification Using Machine Learning

A multi-purpose image forensic method using densely connected convolutional neural networks

Review of Image Forensic Techniques Based on Deep Learning

ByteNet: Rethinking Multimedia File Fragment Classification through Visual Perspectives

Digital Forensics for Malware Classification: An Approach for Binary Code to Pixel Vector Transition

A Robust Image Forensic Framework Utilizing Multi-Colorspace Enriched Vision Transformer for Distinguishing Natural and Computer-Generated Images

Digital Forensics Use Case for Glaucoma Detection Using Transfer Learning Based on Deep Convolutional Neural Networks

File fragment recognition based on content and statistical features

Deep Learning for Quantitative Dynamic Fragmentation Analysis

Deep-BIF: Blind Image Forensics Based on Deep Learning

Hybrid Malware Classification Method Using Segmentation-Based Fractal Texture Analysis and Deep Convolution Neural Network Features

Deep Multi-scale Discriminative Networks for Double JPEG Compression Forensics