This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
36th Annual Hawaii International Conference on System Sciences (HICSS'03) - Track 9
Big Island, Hawaii
January 06-January 09
ISBN: 0-7695-1874-5
Mason McDaniel, James Madison University
M. Hossain Heydari, James Madison University

Identifying the true type of a computer file can be a difficult problem. Previous methods of file type recognition include fixed file extensions, fixed "magic numbers" stored with the files, and proprietary descriptive file wrappers. All of these methods have significant limitations. This paper proposes algorithms for automatically generating "fingerprints" of file types based on a set of known input files, then using the fingerprints to recognize the true type of unknown files based on their content, rather than metadata associated with them. Recognition is performed by three different algorithms based on: byte frequency analysis, byte frequency cross-correlation analysis, and file header/trailer analysis. Tests were run to measure the accuracy of these algorithms. The accuracy varied from 23% to 96% depending upon which algorithm was used.

These algorithms could be used by virus scanning packages, firewalls, intrusion detection systems, forensic analyses of computer hard drives, web browsers, or any other program that needs to identify the types of files for proper operation. File type detection is also important to the operating systems for correct identification and handling of files regardless of file extension.

Citation:
Mason McDaniel, M. Hossain Heydari, "Content Based File Type Detection Algorithms," hicss, vol. 9, pp.332a, 36th Annual Hawaii International Conference on System Sciences (HICSS'03) - Track 9, 2003
Usage of this product signifies your acceptance of the Terms of Use.