gp-fileprints ahmed kattan, edgar galva n-lo pez, riccardo poli and michael o’neill file types...

GP-Fileprints

Ahmed Kattan, Edgar Galva n-Lo pez, Riccardo Poli and Michael O’Neill ́� ́�

File Types Detection Using Genetic Programming

A.I. Esparcia-Alcazar et al. (Eds.): EuroGP 2010, LNCS 6021, pp. 134–145, 2010.

©Springer-Verlag Berlin Heidelberg 2010

A.I. Esparcia-Alcazar et al. (Eds.): EuroGP 2010, LNCS 6021, pp. 134–145, 2010. ©Springer-Verlag Berlin Heidelberg 2010

2

The Problem

• Information growth is exponential. • Many file types.

• Different data have different structures.

• There are no universal standards for file types and there are thousands of file types. Increase security risk.

JPG PDF


3

The solution

Identify the file contents by analysing the raw binary streams and without the need of any other meta data!


4

Why this is useful ?

• Email spam filter.• Virus detection.• Forensic analysis.• Network security.• Quick hard disk scan.


5

Some of the previous works• McDaniel, M., Heydari, M.H.: Content based file type detection algorithms.

In: HICSS 2003: Proceedings of the 36th Annual Hawaii International Conference on System Sciences (HICSS 2003) - Track 9, Washington, DC, USA, p. 332.1. IEEE Computer Society, Los Alamitos (2003)

• Proposed an approach for automatically generating “fingerprints” for files.

• Three algorithms to build fingerprints: 1. Byte Frequency Analysis (BFA).2. Byte Frequency Cross-Correlation (BFC).3. File Header/Trailer (FHT) algorithm.

• Experiments: (30 file-type fingerprints using four test files for each file)• Results: They reported that BFA and BFC showed poor

performance (i.e., an accuracy in the range of 27.5% and 45.83%) compared to FHT algorithm (which had an accuracy of 95.83%).


6

Some of the previous works• Li, W.-J., Stolfo, S.J., Herzog, B.: Fileprints: Identifying file types by n-gram

analysis. In: Proceedings of the 2005 IEEEWorkshop on Information Assurance, pp. 64–71 (2005).

• Proposed to analyse the data using n-grams to identify multiple centroids – fingerprints – for each file type.

• Three different techniques: 1. Truncation. 2. Multi-centroids. 3. Exemplar files.

• The authors reported some problems when classifying similar data types such as GIF and JPG. Also, some difficulties appeared when classifying PDF and MS office file types, as some embedded images and figures mislead the algorithms.


7

Some of the previous works• Karresand, M., Shahmehri, N.: Oscar – file type identification of binary data

in disk clusters and ram pages. In: Security and Privacy in Dynamic Environments, pp. 413–424. Springer, Boston (2006)

• Proposed file type identification method called Oscar. • For each data fragment they calculated:

1- Byte Frequency Distribution (BFD).2- Mean 3- Standard deviation.

When these measures are put together, they form a model which is used to identify unknown data fragments.

• Results: The authors reported that their approach, tested using only JPEG files, gave a 99.2% detection rate. The slowest implementation of the algorithm scans a 72.2MB in approximately 2.5 seconds and this scales linearly.


8

None of the previous methods used evolutionary algorithms, including GP, to solve the problem of identifying file types

from their raw binary streams.


9

In this Research

The question that we investigate is whether it is possible for GP to extract certain regularities from the raw byte-series of files and correlate them with particular data types without the need of any other meta data.


10

The Approach

• Each individual has a multi-tree representation


11

Function set

Function InputMedian, Mean,

Average deviation, Standard deviation,

Vaiance, Skew, Kurtosis Entropy

Vector of Integers (0-255)

+, -, /, *, Sin, Cos, Sqrt, log

Real number


12

Splitter tree

• The main job of the splitter trees is to split the given raw byte-series into smaller segments based on their statistical features in such a way that each segment is composed of statistically uniform data.

• Why ? • Files with complex structures that store data of different types

simultaneously.• A single game file might contain executable code, text, pictures

and background music. • OpenOffice’s ODT, Microsoft’s DOCX or a ZIP file, are in fact

archives containing inhomogeneous data.


13

Function

Function Function

Function FunctionFunctionFunction

Terminal Terminal Terminal Terminal Terminal Terminal Terminal Terminal

if fsplitter(prevWindows)−fsplitter (currWindows) > then Splitelse Move (S) //slide the window by S steps


14

Fileprint Tree

• The main job of the fileprint tree is to identify a unique signature for each file.

• These signatures are meant to be similar for files of the same type and different for files of different types.

• The outputs of the fileprint tree are easier to classify into different classes.


15

Fileprint Tree

ffileprint(Si) = a

v =(a0, a1,..., ai)

V= (v0,v1,...vn)

• Each segment

• Each file

• All training files

GP-fileprint


16

Feature-extraction Trees

• The main job of the feature-extraction trees in our GP representation is to extract features from the GP-fingerprints identified by the fileprint tree and to project them onto a two-dimensional Euclidian space.


17


Function

Function Function


Terminal Terminal Terminal Terminal Terminal Terminal Terminal Terminal

Function

Function Function


Terminal Terminal Terminal Terminal

X Y

GP-fileprint 1 GP-fileprint 2


18



19


0

1

2

3

4

5

6

7

0 1 2 3 4 5 6 7 8

y

xCluster 1 Cluster 2

EXE PDF


20

Fitness Evaluation

• Measure the classification accuracy of the training examples.

• Quality of the clusters:1. Homogeneity.2. Clusters separation.


21

Homogeneity

• Label the clusters according to the dominant data type.

𝑓homogeneity = σ 𝐻ሺ𝑐𝑖ሻ− 𝜖𝑘𝑖=1 𝑘

Function rates Homogeneity i th Cluster Penalty value

Total number of clusters


22

Cluster separation

• Modified Davis Bouldin Index (DBI)

𝐷𝐵𝐼= σ 𝑠𝑡𝑑ሾ𝑑𝑖𝑠ሺ𝑐𝑖,𝑑0ሻ,…,𝑑𝑖𝑠ሺ𝑐𝑖,𝑑𝑛ሻሿ𝑘𝑖=1 𝑑𝑖𝑠(𝑐0,𝑐1,…𝑐𝑘)

Standard deviation Distance between cluster’s centiod and data members

Distance between all cluster’s centiods


23

Classifying Unseen Data

• The final output is: • Splitter tree. • Fileprint tree.• Two feature-extraction trees. • Clusters’ members.

• Unseen data goes through the same process.• New GP-fileprints are classified based on the majority

class labels of their K-nearest neighbors.

𝑤= 1𝑑𝑖𝑠𝑡𝑎𝑛𝑐𝑒(𝑥𝑖,𝑧𝑖)


24

Search Operators

• For each tree in each individual • Select an operator with predefined probability

• In the crossover, a restriction is applied so that splitter and fileprint trees can only be crossed over with their equivalent tree type. However, the system is able to freely crossover feature-extractions trees at any position.

𝑇𝑐𝑖


25

Experimental Setup

Parameter Value

Population size 100

Generations 30

Crossover 50%

Mutation 50%

Elitism 20%

Tournament size 5


26

Experimental Setup

• Four parts• 10 GP runs for each part.• 10 different training files from each type. • 30 different testing files from each type.


27

Results

• Same training sets.• Same primitive sets as our GP system.• For Neural Networks and Bayes Network systems we

performed 10 different runs for each data set, as we did for our GP system.


28

Results Summary


29

Conclusions

• A system based on genetic programming to evolve programs that can identify file contents without making use of any meta data has been proposed.

• The proposed system used multi-tree representation, each tree performed sub-task of the main job.

• The system used special technique to apply the search operators.

• Results outperformed other state of the art classification techniques.


30

Conclusions

• The major disadvantage of the system is the slow training process (measured by hours).

• Resulting programs are entirely practical, being able to process tens of megabytes of data in seconds.

• The proposed algorithm can be trained according to the user needs. • Identify files with special contents

• Pictures with illegal contents.• EXE that perform illegal task on a network.• Capture particular data on high traffic network.


31

Future works

• Extend the work to larger and more varied data sets.• Integrate solutions in spam filters and anti-virus

software.• Investigate different dimensions of feature-extraction

trees.• Try more sophisticated clustering techniques.


32

Thank ́you ́for ́paying ́attention!

gp-fileprints ahmed kattan, edgar galva n-lo pez, riccardo poli and michael o’neill file types...

Documents

file contents

file extensions

file trailers

filetype fingerprints

thousands of file types

file type identification

file type detection

bfa algorithm