151313 20251017144618.0 doi 10.1016/j.fsidi.2021.301120 sideral 124080 ART-2021-124080 eng Martín-Pérez, M. Universidad de Zaragoza (orcid)0000-0003-1666-5325 Bringing order to approximate matching: Classification and attacks on similarity digest algorithms 2021 Access copy available to the general public Unrestricted Fuzzy hashing or similarity hashing (a.k.a. bytewise approximate matching) converts digital artifacts into an intermediate representation to allow an efficient (fast) identification of similar objects, e.g., for blacklisting. They gained a lot of popularity over the past decade with new algorithms being developed and released to the digital forensics community. When releasing algorithms (e.g., as part of a scientific article), they are frequently compared with other algorithms to outline the benefits and sometimes also the weaknesses of the proposed approach. However, given the wide variety of algorithms and approaches, it is impossible to provide direct comparisons with all existing algorithms. In this paper, we present the first classification of approximate matching algorithms which allows an easier description and comparisons. Therefore, we first reviewed existing literature to understand the techniques various algorithms use and to familiarize ourselves with the common terminology. Our findings allowed us to develop a categorization relying heavily on the terminology proposed by NIST SP 800-168. In addition to the categorization, this article presents an abstract set of attacks against algorithms and why they are feasible. Lastly, we detail the characteristics needed to build robust algorithms to prevent attacks. We believe that this article helps newcomers, practitioners, and experts alike to better compare algorithms, understand their potential, as well as characteristics and implications they may have on forensic investigations. info:eu-repo/grantAgreement/ES/DGA/T21-20R-DISCO info:eu-repo/grantAgreement/ES/MICIU/Medrese-RTI2018-098543-B-I00 info:eu-repo/grantAgreement/ES/MINECO-INCIBE/INCIBEC-2015-02486 info:eu-repo/grantAgreement/ES/MINECO-INCIBE/INCIBEI-2015-27300 info:eu-repo/semantics/openAccess by-nc-nd https://creativecommons.org/licenses/by-nc-nd/4.0/deed.es 1.805 2021 COMPUTER SCIENCE, INTERDISCIPLINARY APPLICATIONS 94 / 112 = 0.839 2021 Q4 T3 COMPUTER SCIENCE, INFORMATION SYSTEMS 131 / 163 = 0.804 2021 Q4 T3 1.23 2021 Computer Science Applications 2021 Q1 Pathology and Forensic Medicine 2021 Q1 Medical Laboratory Technology 2021 Q1 Information Systems 2021 Q1 5.0 2021 info:eu-repo/semantics/article info:eu-repo/semantics/publishedVersion Rodríguez, R.J. Universidad de Zaragoza (orcid)0000-0001-7982-0359 Breitinger, F. 5007 570 Universidad de Zaragoza Dpto. Informát.Ingenie.Sistms. Área Lenguajes y Sistemas Inf. 36, Suplem. (2021), 301120 [9 pp.] Forensic sci. int. digital invest. Forensic science international. Digital investigation 2666-2825 334204 http://zaguan.unizar.es/record/151313/files/texto_completo.pdf Versión publicada 2676072 http://zaguan.unizar.es/record/151313/files/texto_completo.jpg?subformat=icon icon Versión publicada oai:zaguan.unizar.es:151313 articulos driver 2025-10-17-14:20:38 ARTICLE