이라경, 송현민,

Vol. 34, No. 6, pp. 1459-1469, 12월. 2024
10.13089/JKIISC.2024.34.6.1459, Full Text:
Keywords: digital forensic, filepath, Windows, Machine Learning, Word Embedding
Abstract

In the field of digital forensics, particularly in Windows forensics, rapidly distinguishing between normal and suspicious files is a critical challenge. Analyzing the vast amount of files present in a system can be time-consuming and costly. This study proposes a method to identify suspicious files using natural language processing techniques based solely on file paths. To achieve this, the study utilizes the New Technology File System (NTFS) Master File Table (MFT) to obtain paths for all files in the Windows file system. The file paths are converted into vectors that capture their structural characteristics using a word embedding model, which is commonly used in natural language processing. These vectors are then compared using machine learning techniques to classify abnormal file paths. Experiments conducted with data collected from real-world environments demonstrated that the detection model can effectively identify abnormal file paths with an accuracy of up to 94%

Statistics
Cite this article