SLAMorris Final Thesis After Corrections.pdf - Cranfield University

approximately half the data in Data Set 1; using a random number generator
half the fragments from each file type were selected. For the thumbnail cache,
half the records for each classification of thumbnail cache data were selected.
Where the number of fragments in a category was odd, the number of selected
fragments was rounded up.
For methods 1 and 2, the training phase focused on determining which rules for
classifying fragments were accepting false positives. After each time the
methods were run, the logs were analysed to ascertain which rules were falsely
classifying fragments. For example, was a specific structure used to classify a
fragment also being detected in other file types? Once the rules generating
false positives were identified the individual method could be adapted to
strengthen the rule. This provided an opportunity to refine the classification
rules based on the thumbnail cache information identified in Chapters 5 and 6.
For the statistical and Neural Network methods, the training is described in their
individual sections.
After the models had been trained using the training set data, the models were
tested against the testing set. The testing set comprised the remainder of the
files from Data set 1, and all the files in Data sets 2 and 3. The files in Data sets
1 and 2 had known classifications. In data set 3 the number of fragments in
each classification was unknown; therefore the only information provided by
each models for this data set was the number of correctly identified thumbnail
cache fragments and the number of false positive identifications.
Page
174