Matches in SemOpenAlex for { <https://semopenalex.org/work/W2000993643> ?p ?o ?g. }
Showing items 1 to 48 of
48
with 100 items per page.
- W2000993643 abstract "Abstract The National Software Reference Library (NSRL) is an essential data source for forensic investigators, providing in its Reference Data Set (RDS) a set of hash values of known software. However, the NSRL RDS has not previously been tested against a broad spectrum of real-world data. The current work did this using a corpus of 36 million files on 2337 drives from 21 countries. These experiments answered a number of important questions about the NSRL RDS, including what fraction of files it recognizes of different types. NSRL coverage by vendor/product was also tested, finding 51% of the vendor/product names in our corpus had no hash values at all in NSRL. It is shown that coverage or “recall” of the NSRL can be improved with additions from our corpus such as frequently-occurring files and files whose paths were found previously in NSRL with a different hash value. This provided 937,570 new hash values which should be uncontroversial additions to NSRL. Several additional tests investigated the accuracy of the NSRL data. Experiments testing the hash values saw no evidence of errors. Tests of file sizes showed them to be consistent except for a few cases. On the other hand, the product types assigned by NSRL can be disputed, and it failed to recognize any of a sample of virus-infected files. The file names provided by NSRL had numerous discrepancies with the file names found in the corpus, so the discrepancies were categorized; among other things, there were apparent spelling and punctuation errors. Some file names suggest that NSRL hash values were computed on deleted files, not a safe practice. The tests had the secondary benefit of helping identify occasional errors in the metadata obtained from drive imaging on deleted files in our corpus. This research has provided much data useful in improving NSRL and the forensic tools that depend upon it. It also provides a general methodology and software for testing hash sets against corpora." @default.
- W2000993643 created "2016-06-24" @default.
- W2000993643 creator A5019584512 @default.
- W2000993643 date "2012-08-01" @default.
- W2000993643 modified "2023-09-25" @default.
- W2000993643 title "Testing the National Software Reference Library" @default.
- W2000993643 cites W1777157359 @default.
- W2000993643 cites W1986288430 @default.
- W2000993643 cites W2018809585 @default.
- W2000993643 cites W2054018023 @default.
- W2000993643 cites W2072898163 @default.
- W2000993643 cites W2076342816 @default.
- W2000993643 cites W2119296542 @default.
- W2000993643 cites W2125767749 @default.
- W2000993643 cites W2160127232 @default.
- W2000993643 doi "https://doi.org/10.1016/j.diin.2012.05.009" @default.
- W2000993643 hasPublicationYear "2012" @default.
- W2000993643 type Work @default.
- W2000993643 sameAs 2000993643 @default.
- W2000993643 citedByCount "6" @default.
- W2000993643 countsByYear W20009936432014 @default.
- W2000993643 countsByYear W20009936432015 @default.
- W2000993643 countsByYear W20009936432016 @default.
- W2000993643 countsByYear W20009936432017 @default.
- W2000993643 countsByYear W20009936432018 @default.
- W2000993643 crossrefType "journal-article" @default.
- W2000993643 hasAuthorship W2000993643A5019584512 @default.
- W2000993643 hasBestOaLocation W20009936431 @default.
- W2000993643 hasConcept C111919701 @default.
- W2000993643 hasConcept C177264268 @default.
- W2000993643 hasConcept C199360897 @default.
- W2000993643 hasConcept C2777904410 @default.
- W2000993643 hasConcept C41008148 @default.
- W2000993643 hasConcept C99138194 @default.
- W2000993643 hasConceptScore W2000993643C111919701 @default.
- W2000993643 hasConceptScore W2000993643C177264268 @default.
- W2000993643 hasConceptScore W2000993643C199360897 @default.
- W2000993643 hasConceptScore W2000993643C2777904410 @default.
- W2000993643 hasConceptScore W2000993643C41008148 @default.
- W2000993643 hasConceptScore W2000993643C99138194 @default.
- W2000993643 hasLocation W20009936431 @default.
- W2000993643 hasOpenAccess W2000993643 @default.
- W2000993643 hasPrimaryLocation W20009936431 @default.
- W2000993643 hasRelatedWork W2013567328 @default.
- W2000993643 isParatext "false" @default.
- W2000993643 isRetracted "false" @default.
- W2000993643 magId "2000993643" @default.
- W2000993643 workType "article" @default.