<figure><img src="image_1.png" /></figure>

HAL
open science

# Data Type Classification: Hierarchical Class-to-Type Modeling

Nicole Beebe, Lishu Liu, Minghe Sun

► To cite this version:

Nicole Beebe, Lishu Liu, Minghe Sun. Data Type Classification: Hierarchical Class-to-Type Modeling. 12th IFIP International Conference on Digital Forensics (DF), Jan 2016, New Delhi, India. pp.325-343, 10.1007/978-3-319-46279-0_17 . hal-01758687

HAL Id: hal-01758687

https://inria.hal.science/hal-01758687

Submitted on 4 Apr 2018

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Chapter 17

DATA TYPE CLASSIFICATION:
HIERARCHICAL CLASS-TO-TYPE
MODELING

Nicole Beebe, Lishu Liu and Minghe Sun

**Abstract** Data and file type classification research conducted over the past ten to fifteen years has been dominated by competing experiments that only vary the number of classes, types of classes, machine learning technique and input vector. There has been surprisingly little innovation on fundamental approaches to data and file type classification. This chapter focuses on the empirical testing of a hypothesized, two-level hierarchical classification model and the empirical derivation and testing of several alternative classification models. Comparative evaluations are conducted on ten classification models to identify a final winning, two-level classification model consisting of five classes and 52 lower-level data and file types. Experimental results demonstrate that the approach leads to very good class-level classification performance, improved classification performance for data and file types without high entropy (e.g., compressed and encrypted data) and reasonably-equivalent classification performance for high-entropy data and file types.

**Keywords:** Statistical classification, data types, file types, hierarchical model

# 1. Introduction

Statistical data type classification has many important applications in cyber security and digital forensics. Cyber security applications include intrusion detection, content-based firewall blocking, malware detection and analysis, and steganalysis. Data type classification can defend against many common signature obfuscation techniques and enhance the detection and blocking of undesired network traffic. It can also help map binary objects [12], which is useful in malware analysis and, possibly, steganalysis. In digital forensics, data type classification aids
fragment identification, isolation, recovery and file reassembly. Commercial and open-source tools such as *file* and *TrID* are reliant on file signatures and other magic numbers, rendering them ineffective when file headers and/or other blocks containing key magic numbers are missing or corrupted, or when their locations in the files are unknown [16]. Data type classification can also aid forensic triage efforts and improve investigative efficiency by targeting or prioritizing investigative efforts and search results [8].

This research focuses on data type classification absent reliable file signatures, filename extensions and other filesystem data that may identify the data type, either based on the file type that the data fragment used to be a part of in the case of files and composite objects, or based on the data type or primitive data type as defined by Erbacher and Mulholland [13]. It is important to note that, when reliable file signatures, filename extensions or filesystem data exist pertaining to a data fragment, traditional file signature based methods should be used over statistical or specialized [24] data type classification methods, including the hierarchical modeling approaches explored in this chapter. However, in instances where such reliable metadata and/or magic numbers do not exist, alternative data type classification methods are needed.

A fair amount of data type classification research has been conducted in the past decade, especially in the digital forensics domain. Researchers have explored a wide variety of data and file types, classification algorithms and feature sets. Several researchers have limited their multi-class size to ten or less [1–4, 6, 10, 11, 13, 18–21, 23, 26]. Fewer researchers have investigated data type classification methodologies for scenarios involving more than ten classes [9, 12, 14, 16, 17, 22, 25]. Overall, support vector machines (SVMs) have prevailed, achieving the best balance between prediction accuracy and scalability [9, 14, 16, 20]. Research has also demonstrated the great discriminatory value of *n*-grams across a wide range of data and file types [9].

An evaluation of the extant research reveals that one of the most negative influences on prediction accuracy is the number of classes in a multi-class problem. As the number of classes increases, prediction accuracy tends to decrease, as shown in Figure 1, which records empirical prediction accuracy relative to the number of classes reported in sixteen data type classification publications [1, 2, 4–6, 10–12, 14, 18, 19, 21–23, 25, 26]. Reducing the number of classes is highly advantageous. However, many data type classification use cases require the ability to classify blocks among a large number of classes. Therefore, this research empirically examines a hierarchical modeling approach proposed by Conti et al. [12]. The approach classifies data and file types first into classes and
<figure><img src="image_3.png" /><figcaption>*Figure 1. Average prediction accuracy vs. number of classes.*</figcaption></figure>

further classifies them into class-based types. This approach is expected to increase the overall prediction accuracy because each sequential classification problem becomes smaller in terms of the number of classes in each individual multi-class problem.

## 2. Methodology

This research employed a traditional empirical approach (hypothesis testing) as well as an exploratory approach. First, the six-class, two-level hierarchy shown in Table 1 was hypothesized based on knowledge of the internal data structures and encodings within each data and file type. Next, an exploratory data analysis was conducted to derive alternative hierarchical models from the data. Finally, a comparative evaluation was performed on the prediction accuracy at the class level and the type level. To accomplish this, two clustering algorithms, k-means and expectation maximization, were employed. The k-means algorithm was used to set the number of classes (clusters) a priori equal to the number of hypothesized classes; the model was considered to be validated if the resulting type-to-class cluster distribution matched the hypothesized hierarchical model. Expectation maximization clustering was used to derive alternative hierarchical models from the data. The precision, recall and overall classification accuracy levels were measured at the class level and file/data type level to determine the winning hierarchy. Two sample sizes ($n = 20$ and $n = 50$ samples) were employed per type and
<table><caption>Table 1. Hypothesized six-class, two-level hierarchy.</caption><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>TEXT</strong></td><td><strong>PSEUDO-RANDOM</strong></td></tr><tr><td>Delimited (.csv)</td><td>Encrypted (AES256)</td></tr><tr><td>JSON (.json)</td><td>Random</td></tr><tr><td>Base64 (N/A)</td><td></td></tr><tr><td>Base85 (N/A)</td><td></td></tr><tr><td>URL Encoding (N/A)</td><td></td></tr><tr><td>Postscript (.ps)</td><td></td></tr><tr><td>Cascading Style Sheet (.css)</td><td></td></tr><tr><td>Log File (.log)</td><td></td></tr><tr><td>Plain Text (.txt)</td><td></td></tr><tr><td>JavaScript (.js)</td><td></td></tr><tr><td>Java Source Code (.java)</td><td></td></tr><tr><td>XML (.xml)</td><td></td></tr><tr><td>HTML (.html)</td><td></td></tr><tr><td>Active Server Page (.asp)</td><td></td></tr><tr><td>Rich Text Language (.rtf)</td><td></td></tr><tr><td>Thunderbird (.msf/none)</td><td></td></tr><tr><td><strong>BINARY</strong></td><td><strong>COMPRESSED-LOSSY</strong></td></tr><tr><td>Bitmap (.bmp)</td><td>MP3 (.mp3)</td></tr><tr><td>Windows Executable (.exe)</td><td>AAC (.m4a)</td></tr><tr><td>Windows Library (.dll)</td><td>JPEG (.jpg)</td></tr><tr><td>Linux Executable (.elf)</td><td>H264 (.mp4)</td></tr><tr><td><strong>BINARY/TEXT</strong></td><td>AVI (.avi)</td></tr><tr><td>MS Excel 97-2003 (.xls)</td><td>Windows Media Video (.wmv)</td></tr><tr><td>MS Word 97-2003 (.doc)</td><td>Flash Video (.flv)</td></tr><tr><td>MS PowerPoint 97-2003 (.ppt)</td><td>Shockwave Flash (.swf)</td></tr><tr><td>File System - EXT3/4</td><td>Waveform Audio (.wav)</td></tr><tr><td>File System - NTFS</td><td>Windows Media Audio (.wma)</td></tr><tr><td>File System - FAT</td><td></td></tr><tr><td></td><td><strong>COMPRESSED-LOSSLESS</strong></td></tr><tr><td></td><td>Bi-Tonal Image (.tif/.tiff)</td></tr><tr><td></td><td>GIF (.gif)</td></tr><tr><td></td><td>Portable Network Graphic (.png)</td></tr><tr><td></td><td>Bzip2 (.bz2)</td></tr><tr><td></td><td>Gzip (.gz)</td></tr><tr><td></td><td>ZIP (.zip)</td></tr><tr><td></td><td>Java Archive (.jar)</td></tr><tr><td></td><td>RPM Package Manager (.rpm)</td></tr><tr><td></td><td>PDF (.pdf)</td></tr><tr><td></td><td>MS Word 2007+ (.docx)</td></tr><tr><td></td><td>MS Excel 2007+ (.xlsex)</td></tr><tr><td></td><td>MS PowerPoint 2007+ (.pptx)</td></tr><tr><td></td><td>JBIG2 (.jb2)</td></tr><tr><td></td><td>Outlook PST (.pst)</td></tr></tbody></table>

experiments were conducted with two different file-to-class assignment methods.

All the samples were 512 B fragments extracted from full files, beginning at file offset 512. The header block was excluded to ensure that the file classifications were not biased by file signatures. File signatures remain the most reliable means to type classify files (when they are present and reliable), but this work focuses on data and file type classification absent traditional, reliable file signatures, file extensions and filesystem data. File fragments used in the experiments were randomly selected from a large corpus of files created by the authors of this chapter for their prior work [9] and augmented with additional types from [7].
<table><caption>Table 2. Data and file types in the dataset.</caption><thead><tr><th colspan="6">Data Types</th></tr></thead><tbody><tr><td>JPG<sup>1</sup></td><td>BZIP2<sup>2</sup></td><td>WMV<sup>2</sup></td><td>HTML<sup>1</sup></td><td>TXT<sup>1,2</sup></td><td></td></tr><tr><td>GIF<sup>1</sup></td><td>GZIP<sup>1</sup></td><td>MP3<sup>2</sup></td><td>XML<sup>1</sup></td><td>BASE64<sup>2</sup></td><td></td></tr><tr><td>BMP<sup>1</sup></td><td>DOC<sup>1</sup></td><td>MP4<sup>2</sup></td><td>JSON<sup>2</sup></td><td>BASE85<sup>2</sup></td><td></td></tr><tr><td>PNG<sup>1</sup></td><td>DOCX<sup>1</sup></td><td>AVI<sup>2</sup></td><td>CSV<sup>1</sup></td><td>URLENCODED<sup>2</sup></td><td></td></tr><tr><td>TIF<sup>2</sup></td><td>XLS<sup>1</sup></td><td>FLV<sup>2</sup></td><td>CSS<sup>2</sup></td><td>FAT FS DATA<sup>2</sup></td><td></td></tr><tr><td>PDF<sup>1</sup></td><td>XLSX<sup>1,2</sup></td><td>M4A<sup>2</sup></td><td>LOG<sup>1</sup></td><td>NTFS FS DATA<sup>2</sup></td><td></td></tr><tr><td>PS<sup>1</sup></td><td>PPT<sup>1</sup></td><td>JAVA<sup>1</sup></td><td>ASP<sup>2</sup></td><td>EXT3 FS DATA<sup>2</sup></td><td></td></tr><tr><td>ZIP<sup>2</sup></td><td>PPTX<sup>1</sup></td><td>JS<sup>2</sup></td><td>DLL<sup>2</sup></td><td>AES256<sup>2</sup></td><td></td></tr><tr><td>RTF<sup>2</sup></td><td>PST<sup>2</sup></td><td>JAR<sup>2</sup></td><td>ELF<sup>2</sup></td><td>RANDOM<sup>2</sup></td><td></td></tr><tr><td>SWF<sup>2</sup></td><td>RPM<sup>2</sup></td><td>JB2<sup>2</sup></td><td>EXE<sup>2</sup></td><td></td><td></td></tr><tr><td>TBIRD<sup>2</sup></td><td>WAV<sup>2</sup></td><td>WMA<sup>2</sup></td><td></td><td></td><td></td></tr></tbody></table>

The feature set included unigrams, bigrams, entropy, Kolmogorov complexity, mean byte value, Hamming weight, average contiguity between bytes and longest byte streak. Interested readers are referred to [9] for details and equations. The dataset included samples across 52 data and file types. Table 2 lists the data and file types in the dataset.

# 3. Experimentation

The experimental procedure involved several rounds of experiments to empirically test the hypothesized model, following which new models were derived empirically and evaluated comparatively. Each successive experimental round is discussed separately.

## 3.1 Hypothesized Model Testing

The first experimental round involved empirical testing of the hypothesized model. The *k*-means clustering algorithm was applied to 20 randomly-selected samples from each of the 52 data and file types. The value of *k* was set to six ($k = 6$) to see if the resulting six clusters aligned with the hypothesized file type classes. A simple voting method was used to assign types to classes such that the cluster with the most members of a single type was the winning class for the type. For example, if the cluster distribution for the *n* = 20 JPG samples was [0, 1, 10, 3, 4, 2], then the type JPG was assigned to the third class because the majority of the samples were assigned to the third cluster.

<footnote n="1">¹ Data Source: GovDocs [15]</footnote>

<footnote n="2">² Data Source: Other [7]</footnote>

<footnote>“FS DATA” = File System Data ($MFT, inode tables, etc.)</footnote>
<table><caption>Table 3. k-means (k = 6) clustering solution.</caption><thead><tr><td>Class</td><td>Data and File Types</td></tr></thead><tbody><tr><td>0</td><td>B85, AVI, B64, DLL, EXE, MOV, TBIRD</td></tr><tr><td>1</td><td>CSS, CSV, DOC, HTML, JAVA, JS, JSON, LOG, PST, RTF, URL, XML</td></tr><tr><td>2</td><td>AES, BMP, BZ2, DOCX, ELF, FLV, GIF, GZ, JAR, JB2, JPG, M4A, MP3, MP4, PDF, PNG, PPT, PPTX, RAND, RPM, SWF, WAV, WMV, XLSX, ZIP</td></tr><tr><td>3</td><td>EXT3</td></tr><tr><td>4</td><td>NTFS, TIF</td></tr><tr><td>5</td><td>B16, FAT, PS, TEXT, XLS</td></tr></tbody></table>

The type-to-class distribution for the k-means (k = 6) solution did not align with the hypothesized type-to-class model. This can be seen when comparing Table 3 with Table 1. In particular, the classifier was unable to separately classify lossy compressed files vs. lossless compressed files vs. random and encrypted files, which is where the majority of the deviations from the hypothesized model occurred.

## 3.2 Exploratory Cluster Analysis

The second experimental round applied expectation maximization (EM) clustering to empirically derive the classes from the data, including the number of classes. Unlike the previous round, the number of classes was not set a priori. Once again, 20 randomly-selected samples from each type were employed.

<table><caption>Table 4. Expectation maximization clustering solution.</caption><thead><tr><td>Class</td><td>Data and File Types</td></tr></thead><tbody><tr><td>0</td><td>AES, AVI, BMP, BZ2, DLL, DOCX, ELF, EXE, FLV, GIF, GZ, JAR, JB2, JPG, M4A, MOV, MP3, MP4, PDF, PNG, PPT, PPTX, RAND, RPM, SWF, WAV, WMV, XLSX, ZIP</td></tr><tr><td>1</td><td>[EMPTY]</td></tr><tr><td>2</td><td>B85, B64, FAT, PST</td></tr><tr><td>3</td><td>B16, CSS, CSV, DOC, EXT3, NTFS, HTML, JAVA, JS, JSON, LOG, PS, RTF, TBIRD, TIF, TEXT, URL, XLS, XML</td></tr></tbody></table>

The expectation maximization results in Table 4 provide intuitive classes; however, Classes 0 and 3 are disproportionately large. Also, Class 1 did not receive any members upon model convergence. Since the
<table><caption>Table 5. Sample output supporting the advanced type-to-class assignment method.</caption><thead><tr><th>Data Type</th><th>Type-to-Cluster Distribution (n=50)</th><th>Class Assignment</th></tr></thead><tbody><tr><td>EXT</td><td>[0, 0, 0, 0, 0, 37, 0, 0, 13, 0]</td><td>6</td></tr><tr><td>FAT</td><td>[0, 0, 0, 0, 0, 30, 0, 1, 19, 0]</td><td>6</td></tr><tr><td>NTFS</td><td>[0, 0, 0, 0, 0, 22, 0, 0, 28, 0]</td><td>9</td></tr></tbody></table>

primary motivation of hierarchical classification is to significantly reduce the multi-class size at all levels of the hierarchical classification process, large and empty hierarchical classes are undesirable.

In a *post hoc* treatment, Class 0 was further clustered using the *k*-means algorithm ($k = 3$). When selecting 20 instances per data and file type, only the AVI file type separated from the class, leaving two clusters (one with AVI and the other with the remaining 28 types). When selecting 50 instances per data and file type, only ELF and PDF separated out and AVI remained with the remaining 26 types.

Class 3 was clustered similarly with the *k*-means algorithm ($k = 3$). When selecting 20 instances per data and file type, only NTFS and TIF separated out, leaving the other 17 types in a single cluster. When selecting 50 instances per type, EXT3, NTFS and TIF separated out, still leaving the other 16 types in a single cluster. These findings underscore the challenge of statistically distinguishing between (classifying) lossy compressed objects, lossless compressed objects and random and encrypted data.

**Advanced Type-to-Class Assignment Procedure.** In the third experimental round, the number of randomly-selected samples per type was increased from $n = 20$ to $n = 50$ per type, and an advanced method was employed for type-to-class assignment. Instead of using a simple “maximum cluster assignment takes all” voting method, the type-to-cluster distribution matrix was clustered for the final class assignment.

To demonstrate and explain the advanced type-to-class assignment method, a partial type-to-cluster distribution matrix is shown in Table 5; this is taken from a 10-class model that resulted from expectation maximization clustering of 50 samples per type. The simple voting method classified NTFS data as Class 9 and EXT and FAT filesystem data as Class 6, despite the obvious similarity in class membership distributions. This suggests that they might be better classified as a singular class. This is just one example of several other similar situations.
<table><caption>Table 6. Expectation maximization clustered matrix approach.</caption><thead><tr><th>Class</th><th>Data and File Types</th></tr></thead><tbody><tr><td>0</td><td>CSS, EXT3, FAT, NTFS, TIF, URL, XLS</td></tr><tr><td>1</td><td>B85, B16, B64, DOC, HTML, JAR, JAVA, PDF, PPT, PS, RPM</td></tr><tr><td>2</td><td>AES, AVI, BMP, BZ2, DLL, DOCX, ELF, EXE, FLV, GIF, GZ, JB2, JPG, M4A, MOV, MP3, MP4, PNG, PPTX, PST, RAND, SWF, WAV, WMV, XLSX, ZIP</td></tr><tr><td>3</td><td>CSV, JS, JSON, LOG, RTF, TBIRD, TEXT, XML</td></tr></tbody></table>

<table><caption>Table 7. k-means (k = 6) clustered matrix approach.</caption><thead><tr><th>Class</th><th>Data and File Types</th></tr></thead><tbody><tr><td>0</td><td>B85, AVI, DOC, ELF, EXE, PDF, PPT, PST, WAV</td></tr><tr><td>1</td><td>AES, BMP, BZ2, DLL, DOCX, FLV, GIF, GZ, JAR, JB2, JPG, M4A, MOV, MP3, MP4, PNG, PPTX, RAND, RPM, SWF, WMV, XLSX, ZIP</td></tr><tr><td>2</td><td>URL</td></tr><tr><td>3</td><td>CSV, JSON, LOG, RTF, TBIRD, TEXT</td></tr><tr><td>4</td><td>EXT3, FAT, NTFS, TIF</td></tr><tr><td>5</td><td>B16, B64, CSS, HTML, JAVA, JS, PS, XLS, XML</td></tr></tbody></table>

<table><caption>Table 8. k-means (k = 4) clustered matrix approach.</caption><thead><tr><th>Class</th><th>Data and File Types</th></tr></thead><tbody><tr><td>0</td><td>B16, CSS, EXT3, FAT, NTFS, PS, TIF, URL, XLS</td></tr><tr><td>1</td><td>B85, AVI, DOC, ELF, EXE, PDF, PPT, PST, WAV</td></tr><tr><td>2</td><td>B64, CSV, HTML, JAVA, JS, JSON, LOG, RTF, TBIRD, TEXT, XML</td></tr><tr><td>3</td><td>AES, BMP, BZ2, DLL, DOCX, FLV, GIF, GZ, JAR, JB2, JPG, M4A, MOV, MP3, MP4, PNG, PPTX, RAND, RPM, SWF, WMV, XLSX, ZIP</td></tr></tbody></table>

Using the advanced type-to-class membership assignment procedure, the type-to-cluster distribution matrix (comprising 50 samples of each of the 52 types) was clustered. This procedure resulted in the hierarchical models shown in Tables 6 through 9 using various clustering approaches.

Examination of the hierarchical models from a face validity perspective as well as a class balance perspective reveals that the advanced type-to-class assignment method outperforms the simple voting method. Also, meta-classes from across the various experiments can be qualitatively inferred by observing common type-to-cluster classification trends
<table><caption>Table 9. k-means (k = 3) clustered matrix approach.</caption><thead><tr><th>Class</th><th>Data and File Types</th></tr></thead><tbody><tr><td>0</td><td>B64, CSV, HTML, JAVA, JS, JSON, LOG, RTF, TBIRD, TEXT, XML</td></tr><tr><td>1</td><td>B16, CSS, ELF, EXT3, FAT, NTFS, PDF, PS, TIF, URL, XLS</td></tr><tr><td>2</td><td>B85, AES, AVI, BMP, BZ2, DLL, DOC, DOCX, EXE, FLV, GIF, GZ, JAR, JB2, JPG, M4A, MOV, MP3, MP4, PNG, PPT, PPTX, PST, RAND, RPM, SWF, WAV, WMV, XLSX, ZIP</td></tr></tbody></table>

<table><caption>Table 10. Meta-classes from hierarchical models.</caption><thead><tr><th>Meta-Class</th><th>Data and File Types</th></tr></thead><tbody><tr><td>Compressed</td><td>PPTX, RAND, AES, JB2, ZIP, XLSX, JPG, DLL, BMP, GZ, SWF, DOCX, GIF, MP4, MOV, MP3, PNG, M4A, FLV, WMV, BZ2</td></tr><tr><td>Text</td><td>TBIRD, XML, RTF, LOG, TEXT, JS, JSON, CSV</td></tr><tr><td>Binary-Text</td><td>NTFS, EXT3, URL, FAT, TIF, XLS, CSS</td></tr></tbody></table>

(see Table 10). However, the 16 types fail to consistently cluster into a stable hierarchy: B64, HTML, JAVA, LOG, B16, TIF, URL, XLS, B85, AVI, DOC, EXE, GIF, GZ, JB2 and WAV. Hence, while the meta-classes shown might be useful for a two-level hierarchical model limited to its constituent 36 file and data types, further exploratory analysis is needed to derive a more appropriate hierarchical model for all 52 file and data types considered in this work.

## 3.3 Identifying the Winning Model

The purpose of the final experimental round was to run repeated experiments for more robust results, from which a winning model would be selected. Three repeated experiments were conducted and quantitative measures of model quality were evaluated comparatively. Expectation maximization clustering was performed on the same input three times. Then, the simple voting method and the advanced assignment method described previously were applied to each set of expectation maximization clustered outputs. The prediction accuracy, precision and recall were then computed and evaluated.
<table><caption>Table 11. Repeated experiments (Round 1; simple voting method).</caption><thead><tr><th>Class</th><th>Types Clustered into Class</th></tr></thead><tbody><tr><td>0</td><td>HTML, JAVA, JS</td></tr><tr><td>1</td><td>JSON</td></tr><tr><td>2</td><td>B85, B16, B64, TBIRD, URL</td></tr><tr><td>3</td><td>TIF</td></tr><tr><td>4</td><td>EXT3, FAT</td></tr><tr><td>5</td><td>CSV, LOG, PS, RTF, TEXT, XML</td></tr><tr><td>6</td><td>CSS, DOC, ELF, NTFS, XLS</td></tr><tr><td>7</td><td>AVI, BMP, DLL, EXE, JAR, MOV, WAV</td></tr><tr><td>8</td><td>AES, BZ2, DOCX, FLV, GIF, GZ, JB2, JPG, M4A, MP3, MP4, PDF, PNG, PPT, PPTX, PST, RAND, RPM, SWF, WMV, XLSX, ZIP</td></tr></tbody></table>

<table><caption>Table 12. Repeated experiments (Round 1; advanced assignment method).</caption><thead><tr><th>Class</th><th>Types Clustered into Class</th></tr></thead><tbody><tr><td>0</td><td>CSS, ELF, EXT3, FAT, NTFS, XLS</td></tr><tr><td>1</td><td>AES, BZ2, FLV, GIF, GZ, JB2, JPG, M4A, MP3, MP4, PDF, PNG, PPT, PPTX, RAND, RPM, SWF, WMV, XLSX, ZIP</td></tr><tr><td>2</td><td>B85, B16, B64, TBIRD, URL</td></tr><tr><td>3</td><td>CSV, HTML, JAVA, JS, JSON, LOG, PS, RTF, TEXT, XML</td></tr><tr><td>4</td><td>AVI, BMP, DLL, DOC, DOCX, EXE, JAR, MOV, PST, TIF, WAV</td></tr></tbody></table>

<table><caption>Table 13. Repeated experiments (Round 2; simple voting method).</caption><thead><tr><th>Class</th><th>Types Clustered into Class</th></tr></thead><tbody><tr><td>0</td><td>CSS, NTFS, XLS</td></tr><tr><td>1</td><td>B85, ELF, MOV, WAV</td></tr><tr><td>2</td><td>AES, AVI, BMP, BZ2, DLL, DOC, DOCX, EXE, FLV, GIF, GZ, JAR, JB2, JPG, M4A, MP3, MP4, PDF, PNG, PPT, PPTX, PST, RAND, RPM, SWF, WMV, XLSX, ZIP</td></tr><tr><td>3</td><td>CSV, JSON, LOG</td></tr><tr><td>4</td><td>EXT3, FAT</td></tr><tr><td>5</td><td>URL</td></tr><tr><td>6</td><td>TIF</td></tr><tr><td>7</td><td>B16, B64, HTML, JAVA, JS, PS, RTF, TBIRD, TEXT, XML</td></tr></tbody></table>

Tables 11 through 16 present the results of the repeated experiments. The results of each experiment were evaluated considering face validity
<table><caption>Table 14. Repeated experiments (Round 2; advanced assignment method).</caption><thead><tr><th>Class</th><th>Types Clustered into Class</th></tr></thead><tbody><tr><td>0</td><td>B16, B64, CSV, HTML, JAVA, JS, JSON, LOG, PS, RTF, TBIRD, TEXT, XML</td></tr><tr><td>1</td><td>B85, AVI, BMP, CSS, DLL, DOC, ELF, EXE, EXT3, FAT, NTFS, MOV, PDF, TIF, URL, WAV, XLS</td></tr><tr><td>2</td><td>AES, BZ2, DOCX, FLV, GIF, GZ, JAR, JB2, JPG, M4A, MP3, MP4, PNG, PPT, PPTX, PST, RAND, RPM, SWF, WMV, XLSX, ZIP</td></tr></tbody></table>

<table><caption>Table 15. Repeated experiments (Round 3; simple voting method).</caption><thead><tr><th>Class</th><th>Types Clustered into Class</th></tr></thead><tbody><tr><td>0</td><td>CSS, ELF, NTFS, XLS</td></tr><tr><td>1</td><td>B85, B16, B64, CSV, HTML, JAVA, JS, JSON, LOG, PS, RTF, TBIRD, TEXT, URL, XML</td></tr><tr><td>2</td><td>AES, AVI, BMP, BZ2, DLL, DOC, DOCX, EXE, FLV, GIF, GZ, JAR, JB2, JPG, M4A, MOV, MP3, MP4, PDF, PNG, PPT, PPTX, PST, RAND, RPM, SWF, WAV, WMV, XLSX, ZIP</td></tr><tr><td>3</td><td>EXT3, FAT, TIF</td></tr></tbody></table>

<table><caption>Table 16. Repeated experiments (Round 3; advanced assignment method).</caption><thead><tr><th>Class</th><th>Types Clustered into Class</th></tr></thead><tbody><tr><td>0</td><td>B85, B16, B64, CSV, HTML, JAVA, JS, JSON, LOG, PS, RTF, TBIRD, TEXT, URL, XML</td></tr><tr><td>1</td><td>BMP, CSS, DLL, DOC, ELF, EXE, EXT3, FAT, NTFS, PDF, TIF, XLS</td></tr><tr><td>2</td><td>AES, AVI, BZ2, DOCX, FLV, GIF, GZ, JAR, JB2, JPG, M4A, MOV, MP3, MP4, PNG, PPT, PPTX, PST, RAND, RPM, SWF, WAV, WMV, XLSX, ZIP</td></tr></tbody></table>

and quantitative measures (overall model classification accuracy as well as type-level precision and recall). This validated the interim conclusion that the advanced type-to-class distribution matrix clustering approach outperforms the simple voting method for type-to-class assignment.

Upon comparing the quantitative measures across the three experiments for the type-to-class distribution matrix clustering method, it
<table><caption>Table 17. Winning hierarchical model.</caption><thead><tr><td>Class: Title</td><td>File and Data Types Assigned to Class</td></tr></thead><tbody><tr><td>0: Binary-Text</td><td>CSS, ELF, EXT3, FAT, NTFS, XLS</td></tr><tr><td>1: Compressed-Random</td><td>AES, BZ2, FLV, GIF, GZ, JB2, JPG, M4A, MP3, MP4, PDF, PNG, PPT, PPTX, RAND, RPM, SWF, WMV, XLSX, ZIP</td></tr><tr><td>2: Encoded Text</td><td>B85, B16, B64, TBIRD, URL</td></tr><tr><td>3: Unencoded Text</td><td>CSV, HTML, JAVA, JS, JSON, LOG, PS, RTF, TEXT, XML</td></tr><tr><td>4: Binary-Compressed</td><td>AVI, BMP, DLL, DOC, DOCX, EXE, JAR, MOV, PST, TIF, WAV</td></tr></tbody></table>

can be concluded that the hierarchy shown in Table 12 is the winning hierarchy. Table 17 redemonstrates the winning hierarchy with rough class descriptive titles. Note that the titles should be used with caution because they do not describe all the constituent file types in an ideal manner.

<table><caption>Table 18. Performance measures – Class-level classification.</caption><thead><tr><td>Model</td><td>Train Time</td><td>Predict Time</td><td>Accuracy (No. Obs.)</td><td>C</td></tr></thead><tbody><tr><td>Hypothesized</td><td>3m30.570s</td><td>0m08.705s</td><td>76.51% (62,426)</td><td>64</td></tr><tr><td>Table 12</td><td>2m22.398s</td><td>0m12.317s</td><td>88.88% (62,322)</td><td>512</td></tr><tr><td>Table 16</td><td>1m13.641s</td><td>0m11.018s</td><td>94.40% (62,081)</td><td>1,024</td></tr></tbody></table>

Table 18 presents the comparative sample-to-class classification prediction accuracy and train/test run times for the hypothesized model and the two top-performing empirically-derived models, the Table 12 model and the Table 16 model. Tables 19 through 21 provide similar data for the two models; however, the values pertain to type-level, within-class classification.

## 4. Winning Model Discussion

The hierarchical model shown in Table 16 exhibits superior performance when prediction accuracy is considered only at the class level. The class-level classification accuracy of the theoretical model is 76.51%. The classification accuracy for the model shown in Table 12 (i.e., the model selected as the winning hierarchy) is 88.88%. The accuracy improves to 94.40% for the model shown in Table 16.
<table><caption>Table 19. Performance measures – Type-level classification (Hypothesized model).</caption><thead><tr><th>Class</th><th>Train Time</th><th>Predict Time</th><th>Accuracy (No. Obs.)</th><th>C</th></tr></thead><tbody><tr><td>1</td><td>0m34.001s</td><td>0m2.471s</td><td>95.21% (19,638)</td><td>512</td></tr><tr><td>2</td><td>0m07.526s</td><td>0m0.047s</td><td>0.00% (9)</td><td>1,024</td></tr><tr><td>3</td><td>0m13.168s</td><td>0m0.414s</td><td>65.54% (5,613)</td><td>64</td></tr><tr><td>4</td><td>0m48.827s</td><td>0m1.853s</td><td>75.60% (5,291)</td><td>32</td></tr><tr><td>5</td><td>0m08.798s</td><td>0m0.732s</td><td>85.85% (3,902)</td><td>128</td></tr><tr><td>6</td><td>1m25.891s</td><td>0m5.594s</td><td>23.17% (27,973)</td><td>32</td></tr></tbody></table>

<table><caption>Table 20. Performance measures – Type-level classification (Table 12 model).</caption><thead><tr><th>Model</th><th>Train Time</th><th>Predict Time</th><th>Accuracy (No. Obs.)</th><th>C</th></tr></thead><tbody><tr><td>0</td><td>0m05.469s</td><td>0m00.661s</td><td>71.10% (7,453)</td><td>32</td></tr><tr><td>1</td><td>2m12.123s</td><td>0m10.278s</td><td>24.81% (28,081)</td><td>512</td></tr><tr><td>2</td><td>0m05.003s</td><td>0m00.982s</td><td>97.96% (5,918)</td><td>512</td></tr><tr><td>3</td><td>0m11.236s</td><td>0m00.752s</td><td>90.88% (12,609)</td><td>512</td></tr><tr><td>4</td><td>1m13.674s</td><td>0m01.882s</td><td>85.64% (8,261)</td><td>512</td></tr></tbody></table>

<table><caption>Table 21. Performance measures – Type-level classification (Table 16 model).</caption><thead><tr><th>Model</th><th>Train Time</th><th>Predict Time</th><th>Accuracy (No. Obs.)</th><th>C</th></tr></thead><tbody><tr><td>0</td><td>0m31.645s</td><td>0m02.387s</td><td>94.25% (18,509)</td><td>1,024</td></tr><tr><td>1</td><td>1m18.770s</td><td>0m01.267s</td><td>77.71% (11,855)</td><td>64</td></tr><tr><td>2</td><td>4m29.957s</td><td>0m11.186s</td><td>35.59% (31,717)</td><td>32</td></tr></tbody></table>

While the class-level classification accuracy of the model selected as the winning model (Table 12) is not maximal (it is less than that of the model shown in Table 16), its average within-class, type-level classification accuracy values exceed those of the other candidate models. The average type-level classification accuracy values are: theoretical model – 57.56%; winning model (Table 12) – 74.08%; and the model shown in Table 16 – 69.18%. These differing results are presented because some use cases may prefer to sacrifice type-level classification accuracy for class-level classification accuracy, while others may prefer the converse.

In selecting the model reflected by Table 12 as the winning model, the fact that 25 high-entropy file types classified in the most poorly-performing class in the Table 16 model was considered. Since this is
one of only three classes in the model, having such a large, poorly-performing class is problematic. In contrast, the Table 12 model contains five classes and the most poorly-performing class (also characterized by high-entropy file types) only contains 20 file types. This is important because a hierarchical classification system that contains a singular, large, poorly-performing, high-entropy class among very few classes is only effective at the class level; its utility for type-level classification would be very limited. Therefore, it is important to minimize the number of file types in such a class. Hence, the Table 12 hierarchy is preferred to the Table 16 hierarchy – it contains more classes and fewer constituent file types in the characteristically poorly-performing, high-entropy class.

Hierarchical models with more classes are also favored because they provide greater analytical granularity at the class level than models with more types in fewer classes. For example, a possible application of class-level classification is network-based data triage and prioritization of limited deep packet inspection resources. Inbound packet payloads could be classified and marked for deep packet inspection consideration if the packet payload is classified at the class level in a particular category. Accordingly, the Table 12 model is favored over the Table 16 model.

Specific file types classified in the poorly-performing, high-entropy class for the Table 12 model were also examined. The only file type that may be better served by being in a different class is PDF. In contrast, in the Table 16 model, six file types may be better served by being in a different class: AVI, WAV, DOCX, JAR, MOV and PST.

Finally, the file-level recall and precision were comparatively evaluated for the experiments involving the top-two candidate hierarchical models – the Table 12 and Table 16 models (see Tables 22 and 23). The results are not compelling for one model over the other, but it is clear that the Table 12 model slightly outperforms the Table 16 model on average. Considering both recall and precision as equally important, the Table 12 model yields better results than the Table 16 model in a slight majority of cases (where there is a difference at all).

## 5. Limitations and Future Research

Given the alternative findings on the impact of feature vector selection [9], it is unknown if feature vector selection will impact hierarchical modeling. Future research should explore the impact of varying feature vectors, either to reliably converge on a winning hierarchy or to determine if different hierarchical models require different input feature vectors or whether different features are better predictors for different classes. Future research should also explore the impact of reduced di-
<table><caption>Table 22. Comparative type-level recall and precision.</caption><thead><tr><th>Type</th><th>Table 12 Recall</th><th>Table 12 Precision</th><th>Table 16 Recall</th><th>Table 16 Precision</th></tr></thead><tbody><tr><td>TXT</td><td>0.979</td><td>0.793</td><td>0.968</td><td>0.830</td></tr><tr><td>CSV</td><td>0.988</td><td>0.979</td><td>0.986</td><td>0.962</td></tr><tr><td>LOG</td><td>0.985</td><td>0.933</td><td>0.990</td><td>0.933</td></tr><tr><td>HTML</td><td>0.897</td><td>0.749</td><td>0.901</td><td>0.874</td></tr><tr><td>XML</td><td>0.943</td><td>0.970</td><td>0.945</td><td>0.974</td></tr><tr><td>JSON</td><td>0.984</td><td>0.993</td><td>0.974</td><td>0.998</td></tr><tr><td>JS</td><td>0.935</td><td>0.904</td><td>0.940</td><td>0.908</td></tr><tr><td>JAVA</td><td>0.961</td><td>0.890</td><td>0.972</td><td>0.918</td></tr><tr><td>CSS</td><td>1.000</td><td>0.979</td><td>1.000</td><td>0.978</td></tr><tr><td>B64</td><td>1.000</td><td>0.983</td><td>1.000</td><td>0.987</td></tr><tr><td>B85</td><td>1.000</td><td>0.975</td><td>1.000</td><td>0.961</td></tr><tr><td>B16</td><td>1.000</td><td>0.975</td><td>0.999</td><td>0.976</td></tr><tr><td>URL</td><td>1.000</td><td>0.999</td><td>1.000</td><td>0.998</td></tr><tr><td>PS</td><td>0.986</td><td>0.944</td><td>0.983</td><td>0.942</td></tr><tr><td>RTF</td><td>0.998</td><td>0.979</td><td>0.974</td><td>0.978</td></tr><tr><td>TBIRD</td><td>1.000</td><td>0.950</td><td>0.976</td><td>0.924</td></tr><tr><td>PST</td><td>0.934</td><td>0.971</td><td>0.456</td><td>0.473</td></tr><tr><td>PNG</td><td>0.007</td><td>0.105</td><td>0.001</td><td>0.500</td></tr><tr><td>GIF</td><td>0.876</td><td>0.326</td><td>0.873</td><td>0.338</td></tr><tr><td>TIF</td><td>0.964</td><td>0.837</td><td>0.982</td><td>0.826</td></tr><tr><td>JB2</td><td>0.318</td><td>0.134</td><td>0.006</td><td>0.167</td></tr><tr><td>GZ</td><td>0.047</td><td>0.206</td><td>0.001</td><td>0.048</td></tr><tr><td>ZIP</td><td>0.003</td><td>0.500</td><td>0.001</td><td>1.000</td></tr><tr><td>JAR</td><td>0.963</td><td>0.736</td><td>0.380</td><td>0.385</td></tr><tr><td>RPM</td><td>0.527</td><td>0.148</td><td>0.330</td><td>0.188</td></tr><tr><td>BZ2</td><td>0.304</td><td>0.236</td><td>0.751</td><td>0.196</td></tr><tr><td>PDF</td><td>0.438</td><td>0.333</td><td>0.995</td><td>0.977</td></tr><tr><td>DOCX</td><td>0.975</td><td>0.757</td><td>0.560</td><td>0.613</td></tr><tr><td>XLSX</td><td>0.499</td><td>0.639</td><td>0.525</td><td>0.474</td></tr><tr><td>PPTX</td><td>0.000</td><td>0.000</td><td>0.003</td><td>0.250</td></tr><tr><td>JPG</td><td>0.507</td><td>0.242</td><td>0.649</td><td>0.236</td></tr><tr><td>MP3</td><td>0.910</td><td>0.324</td><td>0.679</td><td>0.438</td></tr><tr><td>M4A</td><td>0.544</td><td>0.182</td><td>0.084</td><td>0.221</td></tr><tr><td>MP4</td><td>0.403</td><td>0.387</td><td>0.598</td><td>0.240</td></tr><tr><td>AVI</td><td>0.931</td><td>0.863</td><td>0.828</td><td>0.614</td></tr><tr><td>WMV</td><td>0.020</td><td>0.571</td><td>0.614</td><td>0.199</td></tr><tr><td>FLV</td><td>0.479</td><td>0.223</td><td>0.313</td><td>0.406</td></tr></tbody></table>

mension feature vectors [2, 3] on hierarchical classification modeling, considering the trade-off between computational costs and classification accuracy. Finally, research should consider replicating the findings pre-
<table><caption>Table 23. Comparative type-level recall and precision (cont'd.).</caption><thead><tr><th>Type</th><th>Table 12 Recall</th><th>Table 12 Precision</th><th>Table 16 Recall</th><th>Table 16 Precision</th></tr></thead><tbody><tr><td>WAV</td><td>0.981</td><td>0.896</td><td>0.947</td><td>0.780</td></tr><tr><td>MOV</td><td>0.997</td><td>0.963</td><td>0.971</td><td>0.961</td></tr><tr><td>DOC</td><td>0.774</td><td>0.599</td><td>0.747</td><td>0.662</td></tr><tr><td>XLS</td><td>0.943</td><td>0.893</td><td>0.875</td><td>0.962</td></tr><tr><td>PPT</td><td>0.001</td><td>0.023</td><td>0.003</td><td>0.094</td></tr><tr><td>FAT</td><td>0.308</td><td>0.773</td><td>0.285</td><td>0.819</td></tr><tr><td>NTFS</td><td>0.735</td><td>0.854</td><td>0.713</td><td>0.948</td></tr><tr><td>EXT3</td><td>0.975</td><td>0.449</td><td>0.958</td><td>0.458</td></tr><tr><td>EXE</td><td>0.766</td><td>0.764</td><td>0.703</td><td>0.678</td></tr><tr><td>DLL</td><td>0.857</td><td>0.806</td><td>0.827</td><td>0.842</td></tr><tr><td>ELF</td><td>0.927</td><td>0.723</td><td>0.877</td><td>0.856</td></tr><tr><td>BMP</td><td>0.882</td><td>0.929</td><td>0.870</td><td>0.904</td></tr><tr><td>AES</td><td>0.038</td><td>0.109</td><td>0.000</td><td>0.000</td></tr><tr><td>RAND</td><td>0.000</td><td>0.000</td><td>0.002</td><td>0.063</td></tr></tbody></table>

presented in this work with alternate samples and/or more files per type during experimentation. This work would likely have to be facilitated by distributed computing given the computational costs associated with high-dimension vectors (65,500+ dimensions) and a large number of (2,600) observations (50 types × 52 files per type).

## 6. Conclusions

This research demonstrates the utility of a multi-step approach for improving data and file type classification performance. The approach provides a means to classify inputs at the class level, which is faster than type-level classification (when the number of total types is held constant), and class-level classification may be adequate in some applications. It can also improve type-level classification by simply reducing the multi-class size of the sub-classification problems (once again, when the number of total types is held constant). In other applications, class-level classification may serve as a useful triage step to direct limited deep packet inspection resources or when applying specialized classification techniques, such as those advocated in [24]. In fact, one might contend that the optimal classification approach is a hybrid approach (combining statistical and specialized approaches) selected during the multi-level class-to-type hierarchical classification process. For example, a quick n-gram-based statistical classification for detecting an input
as compressed (class-level) followed by specialized techniques for distin-
guishing between a PDF fragment from a PPTX fragment (type-level)
may be the optimal approach, despite the body of research that takes a
“one-size-fits-all,” non-hierarchical, type-level classification approach.

This research has empirically tested and invalidated the hypothesized
six-class, two-level hierarchy and has used exploratory analysis to empir-
ically derive a winning two-level, five-class hierarchical model. A total
of 52 file and data types were considered and file header blocks were
excluded from the procedure to ensure that the file signatures did not
bias the classification results. File header blocks were also excluded be-
cause the research focused on classifying file fragments absent reliable
file signatures, file extensions or other filesystem data. The experimental
results demonstrate that a two-level (class and type) classification hierar-
chical model is both feasible and advantageous. Moreover, the approach
leads to very good class-level classification performance, improved clas-
sification performance for data and file types not exhibiting high entropy
(e.g., compressed and encrypted data) and reasonably equivalent classi-
fication performance for high-entropy data and file types.

Note that the views expressed in this chapter do not necessarily re-
flect the official policies of the Naval Postgraduate School nor does the
mention of trade names, commercial practices or organizations imply an
endorsement by the U.S. Government.

**Acknowledgement**

This research was supported by the Naval Postgraduate School As-
sistance Grant/Agreement No. N00244-13-1-0027 awarded by the NAV-
SUP Fleet Logistics Center San Diego (NAVSUP FLC San Diego).

**References**

[1] I. Ahmed, K. Lhee, H. Shin and M. Hong, On improving the accu-
racy and performance of content-based file type identification, *Proceedings of the Fourteenth Australasian Conference on Information Security and Privacy*, pp. 44–59, 2009.

[2] I. Ahmed, K. Lhee, H. Shin and M. Hong, Fast file type identifi-
cation, *Proceedings of the ACM Symposium on Applied Computing*,
pp. 1601–1602, 2010.

[3] I. Ahmed, K. Lhee, H. Shin and M. Hong, Fast content-based file type identification, in *Advances in Digital Forensics VII*, G. Peterson and S. Shenoi (Eds.), Springer, Heidelberg, Germany, pp. 65–75, 2011.
[4] M. Amirani, M. Toorani and A. Beheshti, A new approach to content-based file type detection, *Proceedings of the IEEE Symposium on Computers and Communications*, pp. 1103-1108, 2008.

[5] M. Amirani, M. Toorani and S. Mihandoost, Feature-based type identification of file fragments, *Security and Communication Networks*, vol. 6(1), pp. 115-128, 2013.

[6] S. Axelsson, Using normalized compression distance for classifying file fragments, *Proceedings of the International Conference on Availability, Reliability and Security*, pp. 641-646, 2010.

[7] N. Beebe, UTSA Filetypes 1 Data Set, Department of Information Systems and Cyber Security, University of Texas at San Antonio, San Antonio, Texas (digitalcorpora.org/corp/files/filetypes1), 2016.

[8] N. Beebe and L. Liu, Ranking algorithms for digital forensic string search hits, *Digital Investigation*, vol. 11(S2), pp. S124-S132, 2014.

[9] N. Beebe, L. Maddox, L. Liu and M. Sun, Sceadan: Using concatenated *n*-gram vectors for improved file and data type classification, *IEEE Transactions on Information Forensics and Security*, vol. 8(9), pp. 1519-1530, 2013.

[10] W. Calhoun and D. Coles, Predicting the types of file fragments, *Digital Investigation*, vol. 5(S), pp. S14-S20, 2008.

[11] D. Cao, J. Luo, M. Yin and H. Yang, Feature-selection-based file type identification algorithm, *Proceedings of the IEEE International Conference on Intelligent Computing and Intelligent Systems*, vol. 3, pp. 58-62, 2010.

[12] G. Conti, S. Bratus, A. Shubina, B. Sangster, R. Ragsdale, M. Süpan, A. Lichtenberg and R. Perez-Alemany, Automated mapping of large binary objects using primitive fragment type classification, *Digital Investigation*, vol. 7(S), pp. S3-S12, 2010.

[13] R. Erbacher and J. Mulholland, Identification and localization of data types within large-scale filesystems, *Proceedings of the Second International Workshop on Systematic Approaches to Digital Forensic Engineering*, pp. 55-70, 2007.

[14] S. Fitzgerald, G. Mathews, C. Morris and O. Zhulyn, Using NLP techniques for file fragment classification, *Digital Investigation*, vol. 9(S), pp. S44-S49, 2012.

[15] S. Garfinkel, P. Farrell, V. Roussev and G. Dinolt, Bringing science to digital forensics with standardized forensic corpora, *Digital Investigation*, vol. 6(S), pp. S2-S11, 2009.
[16] S. Gopal, Y. Yang, K. Salomatin and J. Carbonell, Statistical learning for file type identification, *Proceedings of the Tenth International Conference on Machine Learning and Applications*, vol. 1, pp. 68–73, 2011.

[17] G. Hall and W. Davis, Sliding Window Measurement for File Type Identification, Technical Report, Department of Computer Science, Texas State University-San Marcos, San Marcos, Texas, 2006.

[18] M. Karresand and N. Shahmehri, File type identification of data fragments by their binary structure, *Proceedings of the IEEE Information Assurance Workshop*, pp. 140–147, 2006.

[19] M. Karresand and N. Shahmehri, Oscar – File type identification of binary data in disk clusters and RAM pages, *Proceedings of the Twenty-First IFIP TC-11 International Conference on Information Security*, pp. 413–424, 2006.

[20] Q. Li, A. Ong, P. Suganthan and V. Thing, A novel support vector machine approach to high-entropy data fragment classification, *Proceedings of the South African Information Security Multi-Conference*, 2011.

[21] W. Li, K. Wang, S. Stolfo and B. Herzog, Fileprints: Identifying file types by *n*-gram analysis, *Proceedings of the Sixth Annual IEEE SMC Information Assurance Workshop*, pp. 64–71, 2005.

[22] M. McDaniel and M. Heydari, Content-based file type detection algorithms, *Proceedings of the Thirty-Sixth Annual Hawaii International Conference on System Sciences*, 2003.

[23] S. Moody and R. Erbacher, SADI – Statistical analysis for data type identification, *Proceedings of the Third International Workshop on Systematic Approaches to Digital Forensic Engineering*, pp. 41–54, 2008.

[24] V. Roussev and S. Garfinkel, File fragment classification – The case for specialized approaches, *Proceedings of the Fourth IEEE International Workshop on Systematic Approaches to Digital Forensic Engineering*, pp. 3–14, 2009.

[25] C. Veenman, Statistical disk cluster classification for file carving, *Proceedings of the Third International Symposium on Information Assurance and Security*, pp. 393–398, 2007.

[26] L. Zhang and G. White, An approach to detect executable content for anomaly-based network intrusion detection, *Proceedings of the IEEE International Symposium on Parallel and Distributed Processing*, 2007.