AUTOMATED FORENSIC DOCUMENT SIGNATURES

• US 20100287196A1
• Filed: 06/24/2010
• Published: 11/11/2010
• Est. Priority Date: 12/21/2007
• Status: Active Grant

• Current Assignee: Georgetown University
• Original Assignee: Georgetown University
• Inventors: Maloof, Marcus A., SHIELDS, Thomas Clay, Frieder, Ophir
• Granted Patent: US 8,438,174 B2
• Time in Patent Office: Days
• US Class Current: 707/769
• CPC Class Codes: G06F 16/31 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/70 of video data
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 16/9035 Filtering based on additional data, e.g. user or group profiles
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G10L 15/26 Speech to text systems G10L15/08 takes precedence
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04N 21/44008 involving operations for analysing video streams, e.g. detecting features or characteristics in the video stream arrangements characterised by components specially adapted for monitoring, identification or recognition of video in broadcast systems H04H60/59

Abstract

Methods and systems are provided for a proactive approach for computer forensic investigations. The invention allows organizations anticipating the need for forensic analysis to prepare in advance. Forensic signatures are created including a digital fingerprint and other information associated with a file. In one aspect, informational signatures are created, which may assist in determining what information is included in a file. In another aspect, the digital fingerprint may represent contents of the file and is resistant to minor modification of the file. In another aspect, fingerprints can be compared in parallel on different computers.

Claims

1. A method of generating a signature of a video, comprising the steps of:

detecting scene changes of the video;

segmenting the video into a plurality of segments corresponding to each scene change;

extracting a representation from each segment;

forming a digital fingerprint based on the representation; and

creating a signature by combining the digital fingerprint with predetermined metadata of the video.

2. A method of claim 1, wherein the representation includes one or more frames of each segment.

3. A method of claim 1, wherein the representation includes length information of each segment.

4. A method of claim 1, wherein the representation includes a subtitle and caption text of each segment.

5. A method of generating a signature for an audio file, comprising the steps of:

determining whether the audio includes music or speech;

generating, if the audio includes speech, a transcript of the speech;

extracting a representation from the transcript;

forming a digital fingerprint based on the representation; and

creating a signature by combining the digital fingerprint with predetermined metadata of the audio.

6. A method of generating a signature of a digital file, comprising the steps of:

selecting a token indicating an informational object;

generating a digital fingerprint of the digital file using the selected token; and

creating the signature that includes the digital fingerprint and meta data of the digital file.

7. A method of claim 6, further comprising the steps of:

extracting a plurality of tokens from the digital file according to the selected token; and

inserting the extracted plurality of tokens into a data structure that probabilistically determines whether a token is inserted before.

8. The method of claim 6, wherein the selected token includes a token selected from the group consisting essentially of:

an email address, a name, an account number, and a social security number.

9. A method of matching a forensic signature of a digital file, comprising the steps of:

receiving, by a master apparatus, a list of query signatures;

generating, by the master apparatus, a plurality of sub-lists of query signatures;

transmitting, by the master apparatus, a sub-list to a slave apparatus;

matching, by a slave apparatus, the query signatures with signatures in database according to digital fingerprints included in the query signatures and generating a plurality of matching lists for each digital fingerprints;

merging, by the slave apparatus, the plurality of matching lists and generating a final list;

calculating, by the slave apparatus, a score for each matched signature in the final list according to a closeness between the matched signature and the query signature; and

transmitting, by the slave apparatus, the final list and the score to the master apparatus.

10. A computer-readable transitory storage medium storing an executable program, when executed, causing a computer system to execute a method of generating a signature of a video, comprising the steps of:

detecting scene changes of the video;

segmenting the video into a plurality of segments corresponding to each scene change;

extracting a representation from each segment;

forming a digital fingerprint based on the representation; and

creating a signature by combining the digital fingerprint with predetermined metadata of the video.

11. A computer-readable transitory storage medium storing an executable program, when executed, causing a computer system to execute a method of generating a signature for an audio file, comprising the steps of:

determining whether the audio includes music or speech;

generating, if the audio includes speech, a transcript of the speech;

extracting a representation from the transcript;

forming a digital fingerprint based on the representation; and

creating a signature by combining the digital fingerprint with predetermined metadata of the audio.

12. A computer-readable transitory storage medium storing an executable program, when executed, causing a computer system to execute a method of generating a signature of a digital file, comprising the steps of:

selecting a token indicating an informational object;

generating a digital fingerprint of the digital file using the selected token; and

creating the signature that includes the digital fingerprint and meta data of the digital file.

13. A computer-readable transitory storage medium storing an executable program, when executed, causing a computer system to execute a method of matching a forensic signature of a digital file, comprising the steps of:

receiving, by a master apparatus, a list of query signatures;

generating, by the master apparatus, a plurality of sub-lists of query signatures;

transmitting, by the master apparatus, a sub-list to a slave apparatus;

matching, by a slave apparatus, the query signatures with signatures in database according to digital fingerprints included in the query signatures and generating a plurality of matching lists for each digital fingerprints;

merging, by the slave apparatus, the plurality of matching lists and generating a final list;

calculating, by the slave apparatus, a score for each matched signature in the final list according to a closeness between the matched signature and the query signature; and

transmitting, by the slave apparatus, the final list and the score to the master apparatus.