SLAMorris Final Thesis After Corrections.pdf - Cranfield University

Table 7-19: Method 4 Results for the unknown data set (Data Set 3)
Classification of each Fragment by Method(Percentage)
H1 H2 H3 H4 H5 H6 Total
No. 28 253 9028 932 60974 308473707 308544922
9.07485E- 8.19978E-
%
0.002925992 0.000302063 0.01976179 99.97691908
06 05
7.11 Comparison of Classification Methods
The methods described and implemented throughout this chapter have different
strengths and weaknesses. Each of the four methods adapted and implemented
during this research has shown to assist with the identification of thumbnail
cache file fragments. Table 7.20 shows the success and false positive rate for
each method tested on data set 2. The table shows that the structural and
syntactical method achieved 100 % success with no false positives for
categories H1 and H2; this method also achieved the highest success rate for
H4. The highest success rate for H3 was achieved by the statistical approach;
the neural network achieved the highest success rate for H5.
The Brute Force approach provides a quick way of implementing a system to
identify information; it relies on unique sequences which can be used to classify
information. The sequences are identifiable to an analyst by a brief examination
of the file type. The Brute Force method can only identify fragments containing
known sequences; this relies on the analyst selecting a sequence which occurs
in every instance of the classification they are attempting to identify. Depending
on the frequency of the keyword, it is possible to attract a substantial amount of
false-positives; whilst the amount of information is still reduced from the original
data set the analyst may need to use other methods to further refine the
potential information.
Page
196