基于变长元组的文件类型识别算法

摘要

快速准确地判断文件实体的真实类型对保护计算机信息安全具有重要意义.通过分析现有基于二进制内容的文件类型识别算法中存在的问题,提出采用变长元组描述文件的统计特征,并结合结构化文件中元组的分散度、稳定度以及条件广泛度设计出一种特征评估函数,从而更加准确地选取有效的特征.该算法不依靠特定文件类型的结构和关键标识,适用范围更为广泛.实验表明该算法能有效提高文件类型识别的查准率和查全率.%Fast and accurate identification of the true type of an arbitrary file is very important in information security.Concerning the problems of current content-based file type identification algorithms, variable-length gram was introduced for describing statistic characteristics of files' binary content, and a new evaluation function combining gram divergence, stability and conditional width was adopted for feature selection for structured file types. This algorithm does not rely on the structure and key words of any specific file types, which allows the approach to be applied more widely. The experimental results show that the proposed approach improves the precision and recall of file type identification.