Identifying almost identical files using context triggered piecewise hashing

By Jesse D. Kornblum. Digital Investigation. The International Journal of Digital Forensics and Incident Response, 2006

567 citations recorded by the source corpus.

Homologous files share identical sets of bits in the same order. Because such files are not completely identical, traditional techniques such as cryptographic hashing cannot be used to identify them. This paper introduces a new technique for constructing hash signatures by combining a number of traditional hashes whose boundaries are determined by the context of the input. These signatures can be used to identify modified versions of known files even if data has been inserted, modified, or deleted in the new files. The description of this method is followed by a brief analysis of its performance and some sample applications to computer forensics.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Signal Processing

View Paper: https://www.semanticscholar.org/paper/051da9a3595d63de898482840cc668c2cd23f277

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Signal Processing

Citations in the corpus

CryptoLock (and Drop It): Stopping Ransomware Attacks on User Data (2016, background): “Such meaningful changes to content can be captured through the use of similarity-preserving hash functions [27], [40].”
Android Security: A Survey of Issues, Malware Penetration, and Defenses (2015, background): “a signature fuzzy hashing [128] signature from the opcode.”
Detecting repackaged smartphone applications in third-party android marketplaces (2012, background): “[33] materializes a similar concept for digital forensic analysis by identifying similar text documents.”
NEZHA: Efficient Domain-Independent Differential Testing (2017, methodology): “Moreover, it reports the file similarity of reported discrepancies using context-triggered piece-wise fuzzy hashing [45].”
High-performance content-based phishing attack detection (2011, methodology): “Context-triggered piecewise hashing is an algorithm implemented by Kornblum [21] as a forensic tool for determining whether files are similar enough to be considered the same.”