A deep neural network based file and data fragment

The research presented in this paper provides a solution for file and data type classification which is crucial digital forensics and information security applications. Over the past fifteen years, the existing methods for file and data type classification are file extension based methods, magic byte based methods and content-based methods for file and data type classification. Extension based and magic byte based methods are impotent methods since file extension and magic bytes which is in the file header can be easily changed. Since content-based methods are resistant to changes in magic bytes and file extensions, content-based methods have been frequently investigated in the recent years. Majority of existing studies, where content-based methods are used, classify very few files and data types. Only few works classify large number of file and data types. However, these works do not cover the most used file and data types in the well-known operating systems. In this paper, a content-based file and data fragment classification method which covers the most used 15 files and data type is presented. In the classification applications, deep neural networks has been widely used in recent years, and great classification results is obtained when the used classes are sufficiently good in the training set. Therefore the proposed method uses deep neural networks for file and data type classification. The proposed method classifies 15 file and data types by using a two-level hierarchical model. In this hierarchical classification system, empirical test based on several alternative classification models are performed in the first level. It is used three classification algorithm and entropy-based four different cases. In the second level hierarchy, deep neural networks are used on the winning model. 2-gram features are extracted using 4 kilobytes and 8 kilobytes of files and data fragments, which are the smallest cluster sizes used in operating systems. These extracted features are divided into classes based on entropy using three different machine learning algorithms. In the second level, these specified classes are classified to 15 classes by using deep neural networks. The results show that the classification accuracies for 4 kilobytes and 8 kilobytes are 92.80% and 94.67% respectively. Therefore, the proposed method improves the accuracy by 6.87% than the relevant state of the art while it also includes encrypted data type (aes256) which dramatically decreases the classification accuracy since the encryption changes the file content randomly.