KR102073833B1 - Electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of the plurality of files and operating method thereof - Google Patents

Abstract

Disclosed are an electronic device capable of searching for a similar file to a reference file based on distribution information of features of each of a plurality of files and an operating method thereof. According to the present invention, the electronic device and the operating method thereof, which can search for a similar file to a reference file based on distribution information of features of each of a plurality of files, are capable of supporting searching for a similar file to the reference file by, for each of a plurality of predetermined files, extracting n units of features which are divided with the border of points where the pre-set data patterns exist from a bit string constituting the data, creating distribution information on the frequency where at least one unique hash value exists, wherein the at least one unique hash value is extracted to prevent the hash values from overlapping each other in the n units of hash values corresponding to the n units of features, and calculating the similarity between the reference file and the rest files among the plurality of files based on the distribution information on the frequency where the at least one unique hash value individually exists.

Description

ELECTRONIC DEVICE CAPABLE OF SEARCHING FOR A SIMILAR FILE WITH RESPECT TO A REFERENCE FILE BASED ON DISTRIBUTION INFORMATION OF FEATURES OF EACH OF THE PLURALITY OF FILES AND OPERATING METHOD THEREOF}

The present invention relates to an electronic device and a method of operating a similar file that can be searched for a reference file based on distribution information of features of each of a plurality of files.

As cybercrime related to information and communication increases rapidly with the development of technology, digital forensics is an investigation technique that searches for clues of crime by analyzing various digital information remaining on various storage media such as PCs, laptops, mobile phones, or the Internet. Digital Forensic plays an important role.

 In these digital forensic investigations, investigators need to check all of the significant amounts of digital information to collect the main evidence of the crime, but it is inefficient because it takes too much time and effort to check large amounts of digital information one by one. The process of collecting digital information to be analyzed precisely through keyword search should be carried out first.

In this regard, in order to efficiently extract necessary information among a large amount of digital information, a technique of classifying a large amount of files produced by a device such as various storage media into similar contents may be utilized.

Conventionally, in order to classify a large number of files into files of similar contents, the text contained in a natural language processing (NLP) method or a document file is converted into an Ngram, and an engram existing in the document file is converted. The method of comparing each frequency was used.

However, these methods have limitations in that the files to be classified must be composed of language-related processes or the encoding methods are the same, so they are used in digital forensic tasks for analyzing various types of files produced from various types of digital devices. There was a bunch.

Therefore, for efficient digital forensic investigation, a study on a technique for extracting distribution information of features for each of a plurality of files and searching for similar files for a specific file is required.

Japanese Laid-Open Patent Publication No. 2015-201042 (2015.11.12.) Japanese Patent Publication No. 5598925 (2014.10.01.) Republic of Korea Patent Publication No. 10-0895102 (2009.04.20.)

An electronic device and an operation method capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to the present invention include a bit string constituting data for each of a plurality of predetermined files. At least one unique hash value extracted from the n features partitioned from the point where a predetermined data pattern exists, and the n hash values corresponding to the n features are extracted so that the hash values do not overlap each other. After generating distribution information for each existing frequency, by calculating the similarity between the reference file and the remaining files of the plurality of files based on the distribution information for the frequency of each of the at least one unique hash value In addition, the present invention aims to support the searching of similar files with respect to the reference file.

An electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to an embodiment of the present invention may be assigned to a reference file, which is one of a plurality of predetermined files from a user. When a similar file search command is received, from each of the plurality of files, n (n is a natural number of two or more) features for each of the plurality of files-the n features are the plurality of files A feature extracting unit for extracting n partial bit strings generated by dividing a bit string constituting data for each of the plurality of bit strings at a point where a predetermined data pattern exists. Applying the n features for each of the files as input to a predetermined hash function, generating n hash values for each of the plurality of files. Is a hash value generator, for each of the plurality of files, extracts at least one unique hash value from which the hash values do not overlap each other from the n hash values, and then, the at least one unique hash from the n hash values A counting unit for counting a frequency in which each value exists, and for each of the plurality of files, the frequency of the at least one unique hash value in ascending order, and then the frequency of the at least one unique hash value in ascending order A distribution information generation unit configured to generate distribution information on a frequency of the at least one unique hash value, distribution information on a frequency of the at least one unique hash value corresponding to the reference file, and the plurality of files Of the at least one unique hash value corresponding to the remaining files except for the reference file. A similarity calculator for calculating similarity between distribution information about the frequency, at least one similar file having the similarity with the reference file among the remaining files equal to or greater than a predetermined reference value, and storing the at least one similar file in a file storage; And a similar file display unit configured to display a similar file list including the at least one similar file on the screen, in response to the similar file search command for the reference file received from the user.

In addition, according to an embodiment of the present invention, an operation method of an electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of the plurality of files may be based on any one of a plurality of predetermined files. When a similar file search command is received for one reference file, n features for each of the plurality of files, the n features for each of the plurality of files, from each of the plurality of files. Extracting, from the constituent bit strings, the n partial bit strings generated by dividing at a point where a predetermined data pattern exists, and extracting the n features for each of the plurality of files. Generating n hash values for each of the plurality of files by applying as input to a set hash function, the plurality of files For each, extracting at least one unique hash value from which the hash values do not overlap each other, and counting a frequency at which each of the at least one unique hash value exists from the n hash values, For each of the plurality of files, sorting the frequencies of the at least one unique hash value in ascending order and then based on the frequencies of the at least one unique hash value sorted in ascending order of the at least one unique hash value. Generating distribution information on the frequency, distribution information on the frequency of the at least one unique hash value corresponding to the reference file, and the at least one corresponding to the remaining files other than the reference file in the plurality of files. Calculating a similarity between distribution information about a frequency of one unique hash value, wherein Selecting at least one similar file having the similarity with the reference file more than a predetermined reference value among remaining files, and storing the at least one similar file in a file storage and the reference to the reference file received from the user. In response to a similar file search command, displaying a list of similar files composed of the at least one similar file on a screen.

An electronic device and an operation method capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to the present invention include a bit string constituting data for each of a plurality of predetermined files. At least one unique hash value extracted from the n features partitioned from the point where a predetermined data pattern exists, and the n hash values corresponding to the n features are extracted so that the hash values do not overlap each other. After generating distribution information for each existing frequency, by calculating the similarity between the reference file and the remaining files of the plurality of files based on the distribution information for the frequency of each of the at least one unique hash value In addition, the present invention may support searching for a similar file with respect to the reference file.

1 is a diagram illustrating a structure of an electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to an embodiment of the present invention.
FIG. 2 is a diagram for describing an electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to an embodiment of the present disclosure.
FIG. 3 is a flowchart illustrating an operation method of an electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to an embodiment of the present disclosure.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. This description is not intended to limit the invention to the specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the invention. In describing the drawings, similar reference numerals are used for similar components, and unless otherwise defined, all terms used in the present specification, including technical or scientific terms, may be used in the art to which the present invention pertains. It has the same meaning as is commonly understood by someone who has it.

In this document, when a part is said to "include" a certain component, it means that it can further include other components, without excluding the other components unless otherwise stated. In addition, in various embodiments of the present invention, each component, functional block or means may be composed of one or more subcomponents, and the electrical, electronic and mechanical functions performed by each component are electronic Various elements or mechanical elements known as a circuit, an integrated circuit, an application specific integrated circuit (ASIC), etc. may be implemented, and may be implemented separately, or two or more may be integrated into one.

On the other hand, the steps of the blocks or flowcharts in the accompanying block diagrams are computer program instructions for performing specified functions mounted on a processor or memory of a data processing equipment such as a general purpose computer, a special purpose computer, a portable notebook computer, and a network computer. It can be interpreted as meaning. Since these computer program instructions can be stored in a memory provided in a computer device or in a computer readable memory, the functions described in the steps of the blocks in the block diagram or the flowcharts are produced as a product containing an instruction means for performing this. May be In addition, each block or step may represent a portion of a module, segment, or code that includes one or more executable instructions for executing a specified logical function (s). It should also be noted that in some alternative embodiments, the functions recited in blocks or steps may be performed in a different order. For example, two blocks or steps shown in succession may be performed substantially concurrently or in reverse order, and in some cases, some blocks or steps may be omitted.

1 is a diagram illustrating a structure of an electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to an embodiment of the present invention.

Referring to FIG. 1, an electronic device 110 capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to an embodiment of the present invention is a feature extractor 111. , A hash value generator 112, a counter 113, a distribution information generator 114, a similarity calculator 115, a file storage 116, and a similar file display 117.

The feature extractor 111 receives n (n) for each of the plurality of files from each of the plurality of files, when a similar file search command for the reference file, which is one of a plurality of predetermined files, is received from the user. Is a natural number of two or more) features.

 Herein, the n features mean n partial bit strings generated by dividing a bit string constituting data for each of the plurality of files with respect to a point where a predetermined data pattern exists. .

For example, assuming that 'file 1' having a size of '100 KB (102400B)' among a plurality of files exists, and the preset dayton pattern is '0000000000000' (a value of 13 bits being 0 in the back), the feature extractor ( 111), when a similar file search command for a reference file, which is one of the plurality of files, is received from the user, first, a bit string constituting data for 'file 1' of the plurality of files is '0000000000000'. By dividing by the boundary where 'is present, n features can be extracted for' File 1 '.

If a point where '0000000000000' exists in the bit string constituting the data for 'File 1' exists as shown in Table 1 below, the feature extractor 111 has '6' features for 'File 1'. Can extract them.

In Table 1, the offset means a data size (Byte) from a bit string constituting data for each of the plurality of files to a point where the preset data pattern '0000000000000' is found.

In this manner, the feature extracting unit 111 may extract n features for each of the plurality of files from each of the plurality of files, and the number of features extracted from each of the plurality of files is mutually different. Can be different.

The hash value generator 112 generates the n hash values for each of the plurality of files by applying the n features of each of the plurality of files as inputs to a preset hash function.

If, as in the previous example, '6' features are extracted for 'file 1', the hash value generator 112 may select the '6' features for the 'file 1' of the plurality of files. By applying as input to a predetermined hash function, '6' hash values can be generated.

If the features 1, 3, and 5 of the '6' features shown in Table 1 are the same as each other, and the features 4 and 6 are the same, the hash value generating unit 112 may use the '6' feature. 'H1', 'H2', 'H1', 'H3', 'H1' and 'H3' may be generated as hash values corresponding to 'features'.

As such, the hash value generator 112 may generate n hash values for each of the plurality of files in the same manner as that for the 'file 1'.

The counting unit 113 extracts, from each of the plurality of files, at least one unique hash value from which the hash values do not overlap each other, and then the at least one unique hash from the n hash values. Count the frequency with which each value exists.

For example, suppose that as described above, '6' hash values such as 'H1', 'H2', 'H1', 'H3', 'H1' and 'H3' exist for 'File 1'. The counting unit 113 may include the hashes of the six hashes, such as 'H1', 'H2', 'H1', 'H3', 'H1' and 'H3', for 'File 1' among the plurality of files. From the values, 'H1', 'H2' and 'H3' may be extracted as at least one unique hash value in which the hash values do not overlap each other.

Thereafter, the counting unit 113 is the at least one unique hash value 'H1' from the '6' hash values such as 'H1', 'H2', 'H1', 'H3', 'H1' and 'H3'. The number of frequencies in which ',' H2 'and' H3 'are present can be counted.

That is, the counting unit 113 may include 'out of at least one unique hash value among the' 6 'hash values such as' H1', 'H2', 'H1', 'H3', 'H1' and 'H3'. H1 'can be counted as' 3', 'H2' is present as' 1 ',' H3 'can be counted as' 2', and in this manner each of the plurality of files For, it is possible to count a frequency in which each of the at least one unique hash value exists in the n hash values.

The distribution information generating unit 114 sorts the frequencies of the at least one unique hash value in ascending order for each of the plurality of files, and then based on the frequencies of the at least one unique hash values arranged in ascending order. Generate distribution information on the frequency of the at least one unique hash value.

For example, as in the previous example, '3', '1', and '2' are the frequencies in which each of the at least one unique hash values 'H1', 'H2', and 'H3' exists for 'File 1'. If it is assumed that the count is, the distribution information generating unit 114, for the 'file 1' of the plurality of files, the ascending frequency of the at least one unique hash value '1', '2', '3' By sorting in order, distribution information on the frequency of the at least one unique hash value as shown by reference numeral 210 of FIG. 2 may be generated.

In this manner, the distribution information generator 114 may generate distribution information on the frequency of the at least one unique hash value for each of the plurality of files.

At this time, according to an embodiment of the present invention, the distribution information generator 114 may include a normalizer 118.

The normalization unit 118 extracts the maximum frequency and the minimum frequency among the frequencies of the at least one unique hash value when the distribution information on the frequency of the at least one unique hash value is generated for each of the plurality of files. The distribution information for the frequency of the at least one unique hash value is normalized by performing an operation for normalizing the frequency of each of the at least one unique hash value based on the maximum frequency and the minimum frequency.

In this case, according to an embodiment of the present invention, the normalization unit 118 is for normalization according to Equation 1 below for each frequency of the at least one unique hash value based on the maximum frequency and the minimum frequency. By performing the operation, distribution information on the frequency of the at least one unique hash value may be normalized.

는 a의 정규화 값을 의미하고, a_i는 오름차순으로 정렬된 상기 적어도 하나의 고유 해시 값 중 i번째 해시 값의 빈도수, Min은 상기 적어도 하나의 고유 해시 값의 빈도수 중 상기 최소 빈도수, Max는 상기 적어도 하나의 고유 해시 값의 빈도수 중 상기 최대 빈도수를 의미한다.here,

Is the normalized value of a, a _i is the frequency of the i th hash value of the at least one unique hash value arranged in ascending order, Min is the minimum frequency of the frequencies of the at least one unique hash value, Max is the The maximum frequency among frequencies of at least one unique hash value.

For example, when distribution information on the frequency of the at least one unique hash value is generated with respect to 'file 1' of the plurality of files as shown in the previous example, as shown by reference numeral 210 of FIG. After extracting the maximum frequency '3' and the minimum frequency '1' among the frequencies of the at least one unique hash value, the at least one unique hash value is based on the maximum frequency '3' and the minimum frequency '1'. By performing an operation for normalization according to Equation 1 for each frequency, distribution information for the frequency of the at least one unique hash value may be normalized.

Specifically, the normalization unit 118 performs an operation for normalization according to Equation 1 with respect to the frequencies '1', '2', and '3' of each of the at least one unique hash value, thereby performing '0'. By calculating the normalization values of '0.5' and '1', distribution information on the frequency of the at least one unique hash value can be normalized as indicated by reference numeral 220 of FIG. 2.

Similarly, the normalization unit 118 calculates for each of the plurality of files based on the maximum frequency and the minimum frequency of the at least one unique hash value, and normalize the frequency of each of the at least one unique hash value. By performing the above, distribution information on the frequency of the at least one unique hash value may be normalized.

The similarity calculator 115 may include distribution information about a frequency of the at least one unique hash value corresponding to the reference file, and the at least one unique hash corresponding to the remaining files except the reference file in the plurality of files. Calculate the similarity between distribution information about the frequency of values.

In this case, according to an embodiment of the present invention, the similarity calculator 115 may include distribution information on the frequency of the at least one unique hash value corresponding to the reference file, and the at least one uniqueness corresponding to the remaining files. The similarity between distribution information on the frequency of hash values may be calculated according to Equation 2 below.

는 파일 a에 대하여, 오름차순으로 정렬된 상기 적어도 하나의 고유 해시 값 중 i번째 해시 값에 대한 빈도수의 정규화 값,

는 파일 b에 대하여, 오름차순으로 정렬된 상기 적어도 하나의 고유 해시 값 중 i번째 해시 값에 대한 빈도수의 정규화 값을 의미하고, m은 파일 a에 대한 상기 적어도 하나의 고유 해시 값의 개수와 파일 b에 대한 상기 적어도 하나의 고유 해시 값의 개수 중 더 작은 수를 의미한다.here,

Is a normalized value of the frequency for the i th hash value of the at least one unique hash value sorted in ascending order, for file a,

Denotes a normalized value of a frequency for an i th hash value of the at least one unique hash value arranged in ascending order for file b, and m is the number of the at least one unique hash value for file a and file b It means a smaller number of the number of the at least one unique hash value for.

In this regard, 'file 1' described in the above example corresponds to the reference file, and among the remaining files, 'file 2' is the at least one unique hash value such as '0', '0.25', and '1'. Suppose we have normalized distribution information for the frequency of.

The similarity calculating unit 115 distributes information on the frequency of the at least one unique hash value, such as reference numeral 220, corresponding to the reference file 'File 1', and the remaining files except the reference file from the plurality of files. The similarity between the distribution information about the frequency of the at least one unique hash value corresponding to the data may be calculated according to Equation 2 above.

In detail, the similarity calculator 115 includes {0, 0.5, 1}, which is distribution information corresponding to 'File 1', which is the reference file, and {0, 0.25, which is distribution information corresponding to 'File 2', among the remaining files. , 1} may be calculated as 0.917 according to Equation 3 below.

In this manner, the similarity calculating unit 115 distributes distribution information on the frequency of the at least one unique hash value corresponding to the reference file and the frequency of the at least one unique hash value corresponding to the remaining files. The similarity between the information can be calculated.

The file storage unit 116 selects at least one similar file whose similarity with the reference file is greater than or equal to a preset reference value among the remaining files, and stores the at least one similar file in a file storage.

In this case, according to an embodiment of the present invention, the file storage unit 116 may convert the at least one similar file into a disk image file format and store it in the file storage.

Here, the disk image file format means a file format used when the entire hard disk is duplicated. Relatedly, image formats used in forensics include Expert Witness Compression Format (EWF) and Advanced Forensics Format (AFF). The disk image file format uses a method of copying all physical sectors of the original storage medium to the copy storage medium, rather than simply copying the copy storage medium to maintain the original state of the storage medium.

That is, the file storage unit 116 converts the at least one similar file into a disk image file format and stores the file in the file storage, so that the file storage unit 116 can be used later in the digital forensic tool.

The similar file display unit 117 displays a similar file list including the at least one similar file on the screen in response to the similar file search command for the reference file received from the user.

That is, the similar file display unit 117 displays the similar file list including the at least one similar file on the screen when the similar file search command for the reference file is received from the user, thereby providing the plurality of similar files to the user. Information about a file similar to the reference file among the files may be provided.

FIG. 3 is a flowchart illustrating an operation method of an electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to an embodiment of the present disclosure.

In operation S310, when a similar file search command for a reference file, which is one of a plurality of predetermined files, is received from the user, n features for each of the plurality of files, from each of the plurality of files, are determined. The n features extract n partial bit strings generated by dividing a bit string constituting data for each of the plurality of files with respect to a point where a predetermined data pattern exists.

In operation S320, the n features of each of the plurality of files are applied as inputs to a predetermined hash function to generate n hash values of each of the plurality of files.

In operation S330, for each of the plurality of files, at least one unique hash value from which the hash values do not overlap each other is extracted from the n hash values, and then the at least one unique hash value is extracted from the n hash values. Count the frequency with which each is present.

In operation S340, for each of the plurality of files, the frequencies of the at least one unique hash value are sorted in ascending order, and based on the frequencies of the at least one unique hash value sorted in ascending order, the at least one. Generate distribution information about the frequency of the unique hash value of.

In operation S350, distribution information about a frequency of the at least one unique hash value corresponding to the reference file and the at least one unique hash value corresponding to the remaining files except the reference file in the plurality of files may be used. Calculate the similarity between distribution information about the frequency of

In operation S360, after selecting at least one similar file having the similarity degree to the reference file among the remaining files equal to or greater than a predetermined reference value, the at least one similar file is stored in a file storage.

In operation S370, a list of similar files including the at least one similar file is displayed on the screen in response to the similar file search command for the reference file received from the user.

In this case, according to an embodiment of the present invention, in step S340, when distribution information on the frequency of the at least one unique hash value is generated for each of the plurality of files, the at least one unique hash value may be generated. After extracting the maximum frequency and the minimum frequency among the frequencies, based on the maximum frequency and the minimum frequency, by performing the operation for normalization for each frequency of the at least one unique hash value, the at least one unique hash value Normalizing distribution information about the frequency may be included.

In addition, normalizing the distribution information for the frequency of the at least one unique hash value may be performed according to Equation 1 above for each frequency of the at least one unique hash value based on the maximum frequency and the minimum frequency. By performing an operation for normalization, distribution information on the frequency of the at least one unique hash value may be normalized.

At this time, according to an embodiment of the present invention, in step S350, distribution information on the frequency of the at least one unique hash value corresponding to the reference file, and the at least one unique hash corresponding to the remaining files. The similarity between the distribution information about the frequency of the values can be calculated according to Equation 2 above.

Further, according to an embodiment of the present invention, in step S360, the at least one similar file may be converted into a disk image file format and stored in the file storage.

In the above, with reference to FIG. 3, an operation method of an electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to an embodiment of the present disclosure has been described. Here, an operation method of an electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to an embodiment of the present invention is described with reference to FIGS. 1 and 2. Since a configuration of an operation of the electronic device 110 capable of searching for a similar file with respect to a reference file based on the distribution information of the features of each of the files of the file may be corresponding, a detailed description thereof will be omitted.

An operation method of an electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to an embodiment of the present invention may be implemented in a storage medium for execution by combining with a computer. It can be implemented as a stored computer program.

In addition, an operation method of an electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files according to an embodiment of the present invention may be performed by combining with a computer. It may be implemented in the form of program instructions and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, and the like, alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like.

As described above, the present invention has been described by specific embodiments such as specific components and the like, but the embodiments and drawings are provided only to help a more general understanding of the present invention, and the present invention is not limited to the above embodiments. For those skilled in the art, various modifications and variations are possible from these descriptions.

Therefore, the spirit of the present invention should not be limited to the described embodiments, and all of the equivalents and equivalents of the claims, as well as the appended claims, will belong to the scope of the present invention. .

110: An electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files
111: feature extraction unit 112: hash value generation unit
113: count unit 114: distribution information generation unit
115: similarity calculator 116: file storage unit
117: pseudo file display unit 118: normalization unit

Claims (12)

When a similar file search command for a reference file, which is one of a plurality of predetermined files, is received from a user, n (n is a natural number of two or more) for each of the plurality of files is received from each of the plurality of files. Features-The n features are n partial bits generated by dividing at a point where a predetermined data pattern exists in a bit string constituting data for each of the plurality of files. Means a column extracting feature;
A hash value generator for generating n hash values for each of the plurality of files by applying the n features of each of the plurality of files as inputs to a predetermined hash function;
For each of the plurality of files, after extracting at least one unique hash value from which the hash values do not overlap each other from the n hash values, a frequency in which each of the at least one unique hash value exists in the n hash values A counting unit for counting;
For each of the plurality of files, sorting the frequencies of the at least one unique hash value in ascending order and then based on the frequencies of the at least one unique hash value sorted in ascending order of the at least one unique hash value. A distribution information generator for generating distribution information on the frequency;
Distribution information on the frequency of the at least one unique hash value corresponding to the reference file and distribution on the frequency of the at least one unique hash value corresponding to the remaining files other than the reference file in the plurality of files A similarity calculator which calculates similarity between information;
A file storage unit for storing at least one similar file in a file storage after selecting at least one similar file having the similarity degree to the reference file more than a predetermined reference value among the remaining files; And
Similar file display unit for displaying a list of similar files composed of the at least one similar file on the screen in response to the similar file search command for the reference file received from the user
Including,
The distribution information generator
For each of the plurality of files, when distribution information on the frequency of the at least one unique hash value is generated, the maximum frequency and the minimum frequency among the frequencies of the at least one unique hash value are extracted, and then the maximum frequency and the A normalizer for normalizing distribution information on the frequency of the at least one unique hash value by performing an operation for normalization on the frequency of each of the at least one unique hash value based on the minimum frequency.
An electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files including a. delete The method of claim 1,
The normalization unit
Distribution for the frequency of the at least one unique hash value by performing an operation for normalization according to Equation 1 below for the frequency of each of the at least one unique hash value based on the maximum frequency and the minimum frequency. An electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files for normalizing information.
[Equation 1]

here,

Is the normalized value of a, a _i is the frequency of the i th hash value of the at least one unique hash value arranged in ascending order, Min is the minimum frequency of the frequencies of the at least one unique hash value, Max is the The maximum frequency of the frequencies of at least one unique hash value. The method of claim 3,
The similarity calculating unit
The similarity between the distribution information on the frequency of the at least one unique hash value corresponding to the reference file and the distribution information on the frequency of the at least one unique hash value corresponding to the remaining files is expressed by Equation 2 below. An electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files to be computed accordingly.
[Equation 2]

here,

Is a normalized value of the frequency for the i th hash value of the at least one unique hash value sorted in ascending order, for file a,

Denotes a normalized value of a frequency for an i th hash value of the at least one unique hash value arranged in ascending order for file b, and m is the number of the at least one unique hash value for file a and file b Means the smaller number of said at least one unique hash value for. The method of claim 1,
The file storage unit
An electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of the plurality of files stored in the file storage by converting the at least one similar file into a disk image file format. When a similar file search command for a reference file, which is one of a plurality of predetermined files, is received from a user, n (n is a natural number of two or more) for each of the plurality of files is received from each of the plurality of files. Features-The n features are n partial bits generated by dividing at a point where a predetermined data pattern exists in a bit string constituting data for each of the plurality of files. Means heat;
Applying the n features for each of the plurality of files as inputs to a predetermined hash function to generate n hash values for each of the plurality of files;
For each of the plurality of files, after extracting at least one unique hash value from which the hash values do not overlap each other from the n hash values, a frequency in which each of the at least one unique hash value exists in the n hash values Counting;
For each of the plurality of files, sorting the frequencies of the at least one unique hash value in ascending order and then based on the frequencies of the at least one unique hash value sorted in ascending order of the at least one unique hash value. Generating distribution information on the frequency;
Distribution information on the frequency of the at least one unique hash value corresponding to the reference file and distribution on the frequency of the at least one unique hash value corresponding to the remaining files other than the reference file in the plurality of files Calculating a similarity between the information;
Selecting at least one similar file whose similarity with the reference file is greater than or equal to a predetermined reference value among the remaining files, and storing the at least one similar file in a file storage; And
In response to the similar file search command for the reference file received from the user, displaying a similar file list composed of the at least one similar file on a screen;
Including,
Generating distribution information on the frequency of the at least one unique hash value
For each of the plurality of files, when distribution information on the frequency of the at least one unique hash value is generated, the maximum frequency and the minimum frequency among the frequencies of the at least one unique hash value are extracted, and then the maximum frequency and the Normalizing distribution information on the frequency of the at least one unique hash value by performing an operation for normalization on the frequency of each of the at least one unique hash value based on the minimum frequency
And a similar file search for the reference file based on distribution information of the features of each of the plurality of files. delete The method of claim 6,
Normalizing distribution information on the frequency of the at least one unique hash value
Distribution for the frequency of the at least one unique hash value by performing an operation for normalization according to Equation 1 below for the frequency of each of the at least one unique hash value based on the maximum frequency and the minimum frequency. A method of operating an electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files for normalizing information.
[Equation 1]

here,

Is the normalized value of a, a _i is the frequency of the i th hash value of the at least one unique hash value arranged in ascending order, Min is the minimum frequency of the frequencies of the at least one unique hash value, Max is the The maximum frequency of the frequencies of at least one unique hash value. The method of claim 8,
Computing the similarity between the distribution information for the frequency of the at least one unique hash value
The similarity between the distribution information about the frequency of the at least one unique hash value corresponding to the reference file and the distribution information about the frequency of the at least one unique hash value corresponding to the remaining files is expressed by Equation 2 below. A method of operating an electronic device capable of searching for a similar file with respect to a reference file based on distribution information of features of each of a plurality of files to be computed accordingly.
[Equation 2]

here,

Is a normalized value of the frequency for the i th hash value of the at least one unique hash value sorted in ascending order, for file a,

Denotes a normalized value of a frequency for an i th hash value of the at least one unique hash value arranged in ascending order for file b, and m is the number of the at least one unique hash value for file a and file b Means the smaller number of said at least one unique hash value for. The method of claim 6,
The step of storing in the file store
And converting the at least one similar file into a disk image file format and searching for a similar file with respect to a reference file based on distribution information of features of each of the plurality of files stored in the file storage. A computer readable recording medium having recorded thereon a computer program for executing the method of any one of claims 6, 8, 9 or 10 in combination with a computer. A computer program stored in a storage medium for executing the method of any one of claims 6, 8, 9 or 10 in combination with a computer.

Images