Feature selection based file type identification algorithm

• Published in: 2010 IEEE International Conference on Intelligent Computing and Intelligent Systems Vol. 3; pp. 58 - 62
• Main Authors: Ding Cao, Junyong Luo, Meijuan Yin, Huijie Yang
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.10.2010
• Subjects: Accuracy; feature selection; file type identification; Forensics; gram frequency distribution; n-gram analysis; Security; Stability analysis
• ISBN: 9781424465828; 1424465826
• DOI: 10.1109/ICICISYS.2010.5658559

Identifying the true type of an arbitrary file is very important in information security. Methods based on file extensions or magic numbers can be easily spoofed, while a more reliable way is based on analyzing the file's binary content. We propose an algorithm to generate models for each file type based on analyzing the binary contents of a set of known input files by using n-gram analysis and design a novel feature selection evaluation function for extracting signatures from the models, then using the signatures to recognize the true type of unknown files. Our aim is not to use the structure and key words of any specific file types as this allows the approach to be applied to general file types. Experiments show that the proposed approach is promising especially when the feature selection evaluation function is applied.