Intra- and inter-sector contextual information fusion with joint self-attention for file fragment classification

• Published in: Knowledge-based systems 2024-05, Vol.291, p.111565, Article 111565
• Main Authors: Wang, Yi, Liu, Wenyang, Wu, Kejun, Yap, Kim-Hui, Chau, Lap-Pui
• Format: Article
• Language: English
• Subjects: Contextual information; File carving; File fragment classification; Memory forensics; Self-attention
• ISSN: 0950-7051; 1872-7409
• DOI: 10.1016/j.knosys.2024.111565

File fragment classification (FFC) aims to identify the file type of file fragments in memory sectors, which is of great importance in memory forensics and information security. Existing works focused on processing the bytes within sectors separately and ignoring contextual information between adjacent sectors. In this paper, we introduce a joint self-attention network (JSANet) for FFC to learn intra-sector local features and inter-sector contextual features. Specifically, we propose an end-to-end network with the byte, channel, and sector self-attention modules. Byte self-attention adaptively recognizes the intra-sector significant bytes, and channel self-attention re-calibrates the features between channels. Based on the insight that adjacent memory sectors are most likely to store a file fragment, sector self-attention leverages contextual information in neighboring sectors to enhance inter-sector feature representation. Extensive experiments on seven FFC benchmarks show the superiority of our method compared with state-of-the-art methods. Moreover, we construct VFF-16, a variable-length file fragment dataset to reflect file fragmentation. Integrated with sector self-attention, our method improves accuracy by more than 16.3% against the baseline on VFF-16, and the runtime achieves 5.1 s/GB with GPU acceleration. In addition, we extend our model to malware detection and show its applicability.