用于近似匹配的分层Bloom Filter树
Hierarchical Bloom Filter Trees for Approximate Matching
摘要：
字节近似匹配算法近年来在检测字节级相似的文件方面显示出了重要的前景。这对于数字取证调查人员非常有用，他们经常面临通过被扣押的设备搜索相关数据的问题。一种常见的情况是，调查人员拥有一批“已知非法”文件（例如虐待儿童材料），并希望查明这些文件的副本是否存储在被查获的设备上。近似匹配解决了传统散列的缺点，它只能找到相同的文件，也能够处理合并文件，嵌入文件，部分文件，或者如果文件以任何方式被更改的情况。大多数近似匹配算法通过比较成对的文件来工作，当面对大型语料库时，这不是一种可伸缩的方法。本文证明了使用“分层布隆过滤树”（HBFT）数据结构，以减少集合对集合匹配的运行时间的有效性，具体集中在MRSH-v2算法。三个实验进行了讨论，探讨不同配置的HBFT的效果。所提出的方法大大减少了所需的成对比较的数量，并证明了显着的速度增益，同时保持有效性。
英文摘要：
Bytewise approximate matching algorithms have in recent years shown significant promise in de- tecting files that are similar at the byte level. This is very useful for digital forensic investigators, who are regularly faced with the problem of searching through a seized device for pertinent data. A common scenario is where an investigator is in possession of a collection of "known-illegal" files (e.g. a collection of child abuse material) and wishes to find whether copies of these are stored on the seized device. Approximate matching addresses shortcomings in traditional hashing, which can only find identical files, by also being able to deal with cases of merged files, embedded files, partial files, or if a file has been changed in any way. Most approximate matching algorithms work by comparing pairs of files, which is not a scalable approach when faced with large corpora. This paper demonstrates the effectiveness of using a "Hierarchical Bloom Filter Tree" (HBFT) data structure to reduce the running time of collection-against-collection matching, with a specific focus on the MRSH-v2 algorithm. Three experiments are discussed, which explore the effects of different configurations of HBFTs. The proposed approach dramatically reduces the number of pairwise comparisons required, and demonstrates substantial speed gains, while maintaining effectiveness.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
