By Topic

Practical Applications of Bloom Filters to the NIST RDS and Hard Drive Triage

Sign In

Cookies must be enabled to login.After enabling cookies , please use refresh or reload or ctrl+f5 on the browser for the login options.

Formats Non-Member Member
$33 $13
Learn how you can qualify for the best price for this item!
Become an IEEE Member or Subscribe to
IEEE Xplore for exclusive pricing!
close button

puzzle piece

IEEE membership options for an individual and IEEE Xplore subscriptions for an organization offer the most affordable access to essential journal articles, conference papers, standards, eBooks, and eLearning courses.

Learn more about:

IEEE membership

IEEE Xplore subscriptions

3 Author(s)
Paul Farrell ; Naval Postgrad. Sch., Monterey, CA ; Simson L. Garfinkel ; Douglas White

Much effort has been expended in recent years to create large sets of hash codes from known files. Distributing these sets has become more difficult as these sets grow larger. Meanwhile the value of these sets for eliminating the need to analyze "known goods'' has decreased as hard drives have dramatically increased in storage capacity. This paper evaluates the use of bloom filters (BFs) to distribute the National Software Reference Library's (NSRL) Reference Data Set (RDS)version 2.19, with 13 million SHA-1 hashes. We present an open source reference BF implementation and validate it against a large collection of disk images. We discuss the tuning of the filters, evaluate discuss how they can be used to enable new forensic functionality, and present a novel attack against bloom filters.

Published in:

Computer Security Applications Conference, 2008. ACSAC 2008. Annual

Date of Conference:

8-12 Dec. 2008