Automated forensic document signatures

• US 8,438,174 B2
• Filed: 06/24/2010
• Issued: 05/07/2013
• Est. Priority Date: 12/21/2007
• Status: Active Grant

• Current Assignee: Georgetown University
• Original Assignee: Georgetown University
• Inventors: Shields, Thomas Clay, Frieder, Ophir, Maloof, Marcus A.
• Primary Examiner(s): Trujillo, James
• Assistant Examiner(s): Spieler, William
• Application Number:
  US12/822,722
• Publication Number:
  US 20100287196A1
• Time in Patent Office: 1,048 Days
• Field of Search: 713/180, 713/186, 707/741, 707/914
• US Class Current: 707/755
• CPC Class Codes: G06F 16/31 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06F 16/70 of video data
• CPC Class Codes: G06F 16/903 Querying for retrieval from the web G06F16/953
• CPC Class Codes: G06F 16/9035 Filtering based on additional data, e.g. user or group profiles
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G10L 15/26 Speech to text systems G10L15/08 takes precedence
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04N 21/44008 involving operations for analysing video streams, e.g. detecting features or characteristics in the video stream arrangements characterised by components specially adapted for monitoring, identification or recognition of video in broadcast systems H04H60/59

Abstract

Methods and systems are provided for a proactive approach for computer forensic investigations. The invention allows organizations anticipating the need for forensic analysis to prepare in advance. Forensic signatures are created including a digital fingerprint and other information associated with a file. In one aspect, informational signatures are created, which may assist in determining what information is included in a file. In another aspect, the digital fingerprint may represent contents of the file and is resistant to minor modification of the file. In another aspect, fingerprints can be compared in parallel on different computers.

Claims

1. A method of generating forensic evidence of a digital file, comprising:

selecting a token indicating an informational object;

generating a digital fingerprint of the digital file using the selected token; and

creating the signature that includes the digital fingerprint and meta data of the digital file,

wherein the informational object has semantic meanings, represents specific contents of the digital file and represents more information than a collection of computer-generated symbols, and

wherein the signature is proactively generated for computer forensic evidence of the digital file and configured to allow a forensic analysis with the computer forensic evidence, and

wherein a computer operation that changes the informational object causes proactive updating of the signature.

7. A method of claim 1, further comprising:

extracting a plurality of tokens from the digital file according to the selected token; and

inserting the extracted plurality of tokens into a data structure that probabilistically determines whether a token was previously inserted.

8. The method of claim 1, wherein the selected token includes a token selected from the group consisting essentially of:

an email address, a name, an account number, and a social security number.

2. A method of generating forensic evidence of a video, comprising

detecting scene changes of the video;

segmenting the video into a plurality of segments corresponding to each scene change;

extracting a representation from each segment

forming a digital fingerprint based on the representations; and

creating a signature by combining the digital fingerprint with predetermined metadata of the video,

wherein the signature is proactively generated for computer forensic evidence of the video and configured to allow a forensic analysis with the computer forensic evidence, and

wherein a computer operation the video causes proactive updating of the signature.

3. A method of claim 2, wherein the representation includes one or more frames of each segment.

4. A method of claim 2, wherein the representation includes length information of each segment.

5. A method of claim 2, wherein the representation includes a subtitle and caption text of each segment.

6. A method of generating forensic evidence for an audio file, comprising:

determining whether the audio includes music or speech;

generating, if the audio includes speech, a transcript of the speech;

extracting a representation from the transcript;

forming a digital fingerprint based on the representation; and

creating a signature by combining the digital fingerprint with predetermined metadata of the audio,

wherein the signature is proactively generated for computer forensic evidence of the audio and configured to allow a forensic analysis with the computer forensic evidence, and

wherein a computer operation that changes the audio file causes proactive updating of the signature.

9. A computer-readable non-transitory storage medium storing an executable program, when executed, causing a computer system to execute a method of generating forensic evidence of a digital file, comprising :

selecting a token indicating an informational object;

generating a digital fingerprint of the digital file using the selected token; and

creating the signature that includes the digital fingerprint and meta data of the digital file,

wherein the informational object has semantic meanings, represents specific contents of the digital file and represents more information than a collection of computer-generated symbols, and

wherein the signature is proactively for computer forensic evidence of the digital file and configured to allow a forensic analysis with the computer forensic evidence,

a computer operation that charges the informational object causes proactive updating of the signature.

10. A computer-readable non-transitory storage medium storing an executable program, when executed, causing a computer system to execute a method of generating forensic evidence of a video, comprising:

detecting scene changes of the video;

segmenting the video into a plurality of segments corresponding to each scene change;

extracting a representation from each segment;

forming a digital fingerprint based on the representation; and

creating a signature by combining the digital fingerprint with predetermined metadata of the video,

wherein the signature is proactively generated for computer forensic evidence of the video and configured to allow a forensic analysis with the computer forensic evidence, and

a computer operation that changes the video causes proactive updating of the signature.

11. A computer-read-able non-transitory storage medium storing an executable program, when executed, causing a computer system to execute a method of generating forensic evidence for an audio file, comprising:

determining whether the audio includes music or speech;

generating, if the audio includes speech, a transcript of the speech;

extracting a representation from the transcript;

forming a digital fingerprint based on the representation; and

creating a signature by combining the digital fingerprint with predetermined metadata of the audio,

wherein the signature is proactively generated for computer forensic evidence of the audio and configured to allow a forensic analysis with the computer forensic evidence,

a computer operation that changes the audio file causes proactive updating of the signature.