Size-agnostic file fragment classification via fixed byte slicing

초록

File fragment classification is an essential task of identifying the file type given an incomplete binary file fragment. Despite their importance, existing deep-learning methods face two key limitations: (1) extensive hyperparameter tuning for varying fragment sizes and (2) considerably degraded inference performance when tested on fragment sizes different from those used during training. To address these challenges, we propose the byte-segment convolution and attention network (ByteSCAN) that introduces a fixed-slicing approach. Fixed slicing divides the binary data into overlapping segments of uniform size, enabling consistent feature extraction with a moderately deep convolutional neural network (CNN) and efficient feature integration through a self-attention layer. Experiments on two public datasets show that ByteSCAN outperforms previously published methods in terms of competitive training time and efficient inference while also demonstrating adaptability to varying fragment sizes. The code is available at https://github.com/SpatialAILab/ByteSCAN.

키워드