{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T06:04:30Z","timestamp":1783577070207,"version":"3.55.0"},"reference-count":74,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,9,11]],"date-time":"2024-09-11T00:00:00Z","timestamp":1726012800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,9,11]],"date-time":"2024-09-11T00:00:00Z","timestamp":1726012800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Cybersecurity"],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Artificial Intelligence (AI) is being applied to improve the efficiency of software systems used in various domains, especially in the health and forensic sciences. Explainable AI (XAI) is one of the fields of AI that interprets and explains the methods used in AI. One of the techniques used in XAI to provide such interpretations is by computing the relevance of the input features to the output of an AI model. File fragment classification is one of the vital issues of file carving in Cyber Forensics (CF) and becomes challenging when the filesystem <jats:italic>metadata is missing<\/jats:italic>. Other major challenges it faces are: <jats:italic>proliferation of file formats<\/jats:italic>, <jats:italic>file embeddings<\/jats:italic>, <jats:italic>automation<\/jats:italic>, We leverage and utilize interpretations provided by XAI to optimize the classification of file fragments and propose a novel sifting approach, named SIFT (Sifting File Types). SIFT employs TF-IDF to assign weight to a byte (feature), which is used to select features from a file fragment. Threshold-based LIME and SHAP (the two XAI techniques) feature relevance values are computed for the selected features to optimize file fragment classification. To improve multinomial classification, a Multilayer Perceptron model is developed and optimized with five hidden layers, each layer with <jats:inline-formula><jats:alternatives><jats:tex-math>$$i \\times n$$<\/jats:tex-math><mml:math xmlns:mml=\"http:\/\/www.w3.org\/1998\/Math\/MathML\">\n                  <mml:mrow>\n                    <mml:mi>i<\/mml:mi>\n                    <mml:mo>\u00d7<\/mml:mo>\n                    <mml:mi>n<\/mml:mi>\n                  <\/mml:mrow>\n                <\/mml:math><\/jats:alternatives><\/jats:inline-formula> neurons, where <jats:italic>i<\/jats:italic> = the layer number and <jats:italic>n<\/jats:italic> = the total number of classes in the dataset. When tested with 47,482 samples of 20 file types (classes), SIFT achieves a detection rate of 82.1% and outperforms the other state-of-the-art techniques by at least 10%. To the best of our knowledge, this is the first effort of applying XAI in CF for optimizing file fragment classification.<\/jats:p>","DOI":"10.1186\/s42400-024-00241-9","type":"journal-article","created":{"date-parts":[[2024,9,11]],"date-time":"2024-09-11T04:02:33Z","timestamp":1726027353000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":13,"title":["SIFT: Sifting file types\u2014application of explainable artificial intelligence in cyber forensics"],"prefix":"10.1186","volume":"7","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4080-8042","authenticated-orcid":false,"given":"Shahid","family":"Alam","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Alper Kamil","family":"Demir","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2024,9,11]]},"reference":[{"key":"241_CR1","doi-asserted-by":"publisher","first-page":"52138","DOI":"10.1109\/ACCESS.2018.2870052","volume":"6","author":"A Adadi","year":"2018","unstructured":"Adadi A, Berrada M (2018) Peeking inside the black-box: a survey on explainable artificial intelligence (XAI). IEEE Access 6:52138\u201352160","journal-title":"IEEE Access"},{"key":"241_CR2","doi-asserted-by":"crossref","unstructured":"AfzaliSeresht N, Liu Q, Miao Y (2019) An explainable intelligence model for security event analysis. In: AI 2019: Advances in Artificial Intelligence: 32nd Australasian Joint Conference, Adelaide, SA, Australia, December 2\u20135, 2019, Proceedings 32, Springer, pp 315\u2013327","DOI":"10.1007\/978-3-030-35288-2_26"},{"key":"241_CR3","volume-title":"Cyber Security: Past Present and Future","author":"S Alam","year":"2022","unstructured":"Alam S (2022) Cyber Security: Past Present and Future. Lambert Academic Publishing, London, UK"},{"key":"241_CR4","doi-asserted-by":"crossref","unstructured":"Alam S (2023) Sift\u2014file fragment classification without metadata. In: 3rd International Conference on Computing and Information Technology (ICCIT), IEEE, pp 123\u2013129","DOI":"10.1109\/ICCIT58132.2023.10273945"},{"key":"241_CR5","doi-asserted-by":"crossref","unstructured":"Alam S, Altiparmak Z (2024) XAI-CF\u2013Examining the role of explainable artificial intelligence in cyber forensics. arXiv preprint arXiv:2402:02452","DOI":"10.2139\/ssrn.4833246"},{"key":"241_CR6","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2023.101805","volume":"99","author":"S Ali","year":"2023","unstructured":"Ali S, Abuhmed T, El-Sappagh S et al (2023) Explainable artificial intelligence (xai): what we know and what is left to attain trustworthy artificial intelligence. Inform Fus 99:101805","journal-title":"Inform Fus"},{"key":"241_CR7","doi-asserted-by":"publisher","first-page":"S24","DOI":"10.1016\/j.diin.2010.05.004","volume":"7","author":"S Axelsson","year":"2010","unstructured":"Axelsson S (2010) The normalised compression distance as a file fragment classifier. Digit Investig 7:S24\u2013S31","journal-title":"Digit Investig"},{"key":"241_CR8","doi-asserted-by":"crossref","unstructured":"Beebe N, Liu L, Sun M (2016) Data type classification: Hierarchical class-to-type modeling. In: IFIP International Conference on Digital Forensics, Springer, pp 325\u2013343","DOI":"10.1007\/978-3-319-46279-0_17"},{"issue":"9","key":"241_CR9","doi-asserted-by":"publisher","first-page":"1519","DOI":"10.1109\/TIFS.2013.2274728","volume":"8","author":"NL Beebe","year":"2013","unstructured":"Beebe NL, Maddox LA, Liu L et al (2013) Sceadan: using concatenated n-gram vectors for improved file and data type classification. IEEE Trans Inf Forensics Secur 8(9):1519\u20131530","journal-title":"IEEE Trans Inf Forensics Secur"},{"issue":"3","key":"241_CR10","doi-asserted-by":"publisher","first-page":"216","DOI":"10.3390\/make2030012","volume":"2","author":"M Bhatt","year":"2020","unstructured":"Bhatt M, Mishra A, Kabir MWU et al (2020) Hierarchy-based file fragment classification. Mach Learn Knowled Extract 2(3):216\u2013232","journal-title":"Mach Learn Knowled Extract"},{"issue":"3","key":"241_CR11","doi-asserted-by":"publisher","first-page":"204","DOI":"10.32620\/reks.2023.3.16","volume":"1","author":"M Boiko","year":"2023","unstructured":"Boiko M, Moskalenko V, Shovkoplias O (2023) Advanced file carving: ontology, models and methods. Radioelectron Comput Syst 1(3):204\u2013216","journal-title":"Radioelectron Comput Syst"},{"key":"241_CR12","doi-asserted-by":"crossref","unstructured":"Bouter MdLd, Pardo JL, Geradts Z, et\u00a0al (2023) Protoexplorer: Interpretable forensic analysis of deepfake videos using prototype exploration and refinement. arXiv preprint arXiv:2309:11155","DOI":"10.1177\/14738716241238476"},{"key":"241_CR13","doi-asserted-by":"publisher","first-page":"S50","DOI":"10.1016\/j.diin.2013.06.006","volume":"10","author":"F Breitinger","year":"2013","unstructured":"Breitinger F, Stivaktakis G, Baier H (2013) Frash: a framework to test algorithms of similarity hashing. Digit Investig 10:S50\u2013S58","journal-title":"Digit Investig"},{"key":"241_CR14","doi-asserted-by":"publisher","first-page":"S14","DOI":"10.1016\/j.diin.2008.05.005","volume":"5","author":"WC Calhoun","year":"2008","unstructured":"Calhoun WC, Coles D (2008) Predicting the types of file fragments. Digit Investig 5:S14\u2013S20","journal-title":"Digit Investig"},{"key":"241_CR15","doi-asserted-by":"publisher","first-page":"93575","DOI":"10.1109\/ACCESS.2022.3204171","volume":"10","author":"N Capuano","year":"2022","unstructured":"Capuano N, Fenza G, Loia V et al (2022) Explainable artificial intelligence in cybersecurity: a survey. IEEE Access 10:93575\u201393600","journal-title":"IEEE Access"},{"key":"241_CR16","doi-asserted-by":"crossref","unstructured":"Catanzaro B, Sundaram N, Keutzer K (2008) Fast support vector machine training and classification on graphics processors. In: Proceedings of the 25th international conference on Machine learning, ACM, pp 104\u2013111","DOI":"10.1145\/1390156.1390170"},{"key":"241_CR17","doi-asserted-by":"crossref","unstructured":"Chen Q, Liao Q, Jiang ZL, et\u00a0al (2018) File fragment classification using grayscale image conversion and deep learning in digital forensics. In: 2018 IEEE Security and Privacy Workshops (SPW), IEEE, pp 140\u2013147","DOI":"10.1109\/SPW.2018.00029"},{"issue":"1","key":"241_CR18","first-page":"1","volume":"1","author":"WJ Chisum","year":"2000","unstructured":"Chisum WJ, Turvey B (2000) Evidence dynamics: Locard\u2019s exchange principle & crime reconstruction. J Behav Profil 1(1):1\u201315","journal-title":"J Behav Profil"},{"key":"241_CR19","volume-title":"A visual study of primitive binary fragment types","author":"G Conti","year":"2010","unstructured":"Conti G, Bratus S, Shubina A et al (2010) A visual study of primitive binary fragment types. White Paper, Black Hat USA"},{"key":"241_CR20","doi-asserted-by":"publisher","first-page":"S3","DOI":"10.1016\/j.diin.2010.05.002","volume":"7","author":"G Conti","year":"2010","unstructured":"Conti G, Bratus S, Shubina A et al (2010) Automated mapping of large binary objects using primitive fragment type classification. Digit Investig 7:S3\u2013S12","journal-title":"Digit Investig"},{"issue":"2","key":"241_CR21","doi-asserted-by":"publisher","first-page":"95","DOI":"10.1080\/15567280802050436","volume":"2","author":"YS Dandass","year":"2008","unstructured":"Dandass YS, Necaise NJ, Thomas SR (2008) An empirical analysis of disk sector hashes for data carving. J Digit Forensic Pract 2(2):95\u2013104","journal-title":"J Digit Forensic Pract"},{"key":"241_CR22","doi-asserted-by":"crossref","unstructured":"Dhanalakshmi R, Chellappan C (2009) File format identification and information extraction. In: 2009 World Congress on Nature & Biologically Inspired Computing (NaBIC), IEEE, pp 1497\u20131501","DOI":"10.1109\/NABIC.2009.5393688"},{"key":"241_CR23","doi-asserted-by":"crossref","unstructured":"Dunsin D, Ghanem MC, Ouazzane K, et\u00a0al (2023) A comprehensive analysis of the role of artificial intelligence and machine learning in modern digital forensics and incident response. arXiv preprint arXiv:2309:07064","DOI":"10.2139\/ssrn.4554035"},{"issue":"8","key":"241_CR24","doi-asserted-by":"publisher","first-page":"861","DOI":"10.1016\/j.patrec.2005.10.010","volume":"27","author":"T Fawcett","year":"2006","unstructured":"Fawcett T (2006) An Introduction to ROC Analysis. Pattern Recogn Lett 27(8):861\u2013874","journal-title":"Pattern Recogn Lett"},{"key":"241_CR25","doi-asserted-by":"publisher","first-page":"S44","DOI":"10.1016\/j.diin.2012.05.008","volume":"9","author":"S Fitzgerald","year":"2012","unstructured":"Fitzgerald S, Mathews G, Morris C et al (2012) Using nlp techniques for file fragment classification. Digit Investig 9:S44\u2013S49","journal-title":"Digit Investig"},{"key":"241_CR26","unstructured":"Garfinkel S (2024) GovDocs. Digital Corpora, http:\/\/downloads.digitalcorpora.org\/corpora\/files\/govdocs1"},{"key":"241_CR27","doi-asserted-by":"publisher","first-page":"S13","DOI":"10.1016\/j.diin.2010.05.003","volume":"7","author":"S Garfinkel","year":"2010","unstructured":"Garfinkel S, Nelson A, White D et al (2010) Using purpose-built functions and block hashes to enable small block and sub-file forensics. Digit Investig 7:S13\u2013S23","journal-title":"Digit Investig"},{"key":"241_CR28","doi-asserted-by":"publisher","first-page":"71","DOI":"10.1016\/j.diin.2006.06.007","volume":"3","author":"SL Garfinkel","year":"2006","unstructured":"Garfinkel SL (2006) Forensic feature extraction and cross-drive analysis. Digit Investig 3:71\u201381","journal-title":"Digit Investig"},{"key":"241_CR29","doi-asserted-by":"publisher","first-page":"S95","DOI":"10.1016\/j.diin.2015.05.001","volume":"14","author":"SL Garfinkel","year":"2015","unstructured":"Garfinkel SL, McCarrin M (2015) Hash-based carving: Searching media for complete files and file fragments with sector hashing and hashdb. Digit Investig 14:S95\u2013S105","journal-title":"Digit Investig"},{"key":"241_CR30","unstructured":"Ghaleb M, Saaim K, Felemban M, et\u00a0al (2023) File fragment classification using light-weight convolutional neural networks. arXiv preprint arXiv:2305:00656"},{"key":"241_CR31","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2023.101945","volume":"100","author":"J G\u00f3rriz","year":"2023","unstructured":"G\u00f3rriz J, \u00c1lvarez-Ill\u00e1n I, \u00c1lvarez-Marquina A et al (2023) Computational approaches to explainable artificial intelligence: advances in theory, applications and trends. Inform Fus 100:101945","journal-title":"Inform Fus"},{"key":"241_CR32","doi-asserted-by":"crossref","unstructured":"Hall SW, Sakzad A, Minagar S (2022) A proof of concept implementation of explainable artificial intelligence (xai) in digital forensics. In: International Conference on Network and System Security, Springer, pp 66\u201385","DOI":"10.1007\/978-3-031-23020-2_4"},{"key":"241_CR33","doi-asserted-by":"publisher","first-page":"448","DOI":"10.1016\/j.future.2021.09.019","volume":"127","author":"ME Haque","year":"2022","unstructured":"Haque ME, Tozal ME (2022) Byte embeddings for file fragment classification. Futur Gener Comput Syst 127:448\u2013461","journal-title":"Futur Gener Comput Syst"},{"key":"241_CR34","doi-asserted-by":"crossref","unstructured":"Hassija V, Chamola V, Mahapatra A, et\u00a0al (2023) Interpreting black-box models: a review on explainable artificial intelligence. Cogn Comput pp 1\u201330","DOI":"10.1007\/s12559-023-10179-8"},{"key":"241_CR35","doi-asserted-by":"publisher","first-page":"73","DOI":"10.1016\/j.chemolab.2016.03.031","volume":"155","author":"E Heidari","year":"2016","unstructured":"Heidari E, Sobati MA, Movahedirad S (2016) Accurate prediction of nanofluid viscosity using a multilayer perceptron artificial neural network (mlp-ann). Chemom Intell Lab Syst 155:73\u201385","journal-title":"Chemom Intell Lab Syst"},{"issue":"8","key":"241_CR36","first-page":"2","volume":"14","author":"G Hinton","year":"2012","unstructured":"Hinton G, Srivastava N, Swersky K (2012) Neural networks for machine learning lecture 6a overview of mini-batch gradient descent. Cited on 14(8):2","journal-title":"Cited on"},{"key":"241_CR37","doi-asserted-by":"publisher","first-page":"1096257","DOI":"10.3389\/fcomp.2023.1096257","volume":"5","author":"RR Hoffman","year":"2023","unstructured":"Hoffman RR, Mueller ST, Klein G et al (2023) Measures for explainable ai: explanation goodness, user satisfaction, mental models, curiosity, trust, and human-ai performance. Front Comput Sci 5:1096257","journal-title":"Front Comput Sci"},{"issue":"5","key":"241_CR38","doi-asserted-by":"publisher","first-page":"359","DOI":"10.1016\/0893-6080(89)90020-8","volume":"2","author":"K Hornik","year":"1989","unstructured":"Hornik K, Stinchcombe M, White H (1989) Multilayer feedforward networks are universal approximators. Neural Netw 2(5):359\u2013366","journal-title":"Neural Netw"},{"issue":"3","key":"241_CR39","doi-asserted-by":"publisher","first-page":"1353","DOI":"10.3390\/app12031353","volume":"12","author":"MR Islam","year":"2022","unstructured":"Islam MR, Ahmed MU, Barua S et al (2022) A systematic review of explainable artificial intelligence in terms of different application domains and tasks. Appl Sci 12(3):1353","journal-title":"Appl Sci"},{"key":"241_CR40","doi-asserted-by":"crossref","unstructured":"Jayakumar K, Skandhakumar N (2022) A visually interpretable forensic deepfake detection tool using anchors. In: 2022 7th international conference on information technology research (ICITR), IEEE, pp 1\u20136","DOI":"10.1109\/ICITR57877.2022.9993294"},{"issue":"2","key":"241_CR41","doi-asserted-by":"publisher","first-page":"337","DOI":"10.1177\/00187208211013988","volume":"65","author":"AD Kaplan","year":"2023","unstructured":"Kaplan AD, Kessler TT, Brill JC et al (2023) Trust in artificial intelligence: meta-analytic findings. Hum Factors 65(2):337\u2013359","journal-title":"Hum Factors"},{"key":"241_CR42","doi-asserted-by":"crossref","unstructured":"Karresand M, Shahmehri N (2006a) File type identification of data fragments by their binary structure. In: Proceedings of the IEEE Information Assurance Workshop, IEEE, pp 140\u2013147","DOI":"10.1109\/IAW.2006.1652088"},{"key":"241_CR43","doi-asserted-by":"crossref","unstructured":"Karresand M, Shahmehri N (2006b) Oscar\u2013file type identification of binary data in disk clusters and ram pages. In: IFIP International Information Security Conference, Springer, pp 413\u2013424","DOI":"10.1007\/0-387-33406-8_35"},{"issue":"2","key":"241_CR44","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3491209","volume":"55","author":"D Kaur","year":"2022","unstructured":"Kaur D, Uslu S, Rittichier KJ et al (2022) Trustworthy artificial intelligence: a review. ACM Comput Surv 55(2):1\u201338","journal-title":"ACM Comput Surv"},{"issue":"3","key":"241_CR45","doi-asserted-by":"publisher","first-page":"493","DOI":"10.1007\/s10869-022-09829-9","volume":"38","author":"M Langer","year":"2023","unstructured":"Langer M, K\u00f6nig CJ, Back C et al (2023) Trust in artificial intelligence: comparing trust processes between human and automated trustees in light of unfair bias. J Bus Psychol 38(3):493\u2013508","journal-title":"J Bus Psychol"},{"key":"241_CR46","doi-asserted-by":"publisher","DOI":"10.1016\/j.chb.2022.107539","volume":"139","author":"B Leichtmann","year":"2023","unstructured":"Leichtmann B, Humer C, Hinterreiter A et al (2023) Effects of explainable artificial intelligence on trust and human behavior in a high-risk decision task. Comput Hum Behav 139:107539","journal-title":"Comput Hum Behav"},{"key":"241_CR47","unstructured":"Li Q, Ong A, Suganthan P, et\u00a0al (2011) A novel support vector machine approach to high entropy data fragment classification. In: Proceedings of the South African Information Security Multi-Conf (SAISMC), University of Plymouth, pp 236\u2013247"},{"key":"241_CR48","unstructured":"Li WJ, Wang K, Stolfo SJ, et\u00a0al (2005) Fileprints: Identifying file types by n-gram analysis. In: Proceedings from the Sixth Annual IEEE SMC Information Assurance Workshop, IEEE, pp 64\u201371"},{"key":"241_CR49","doi-asserted-by":"crossref","unstructured":"Lillis D, Breitinger F, Scanlon M (2017) Expediting mrsh-v2 approximate matching with hierarchical bloom filter trees. In: International Conference on Digital Forensics and Cyber Crime, Springer, pp 144\u2013157","DOI":"10.1007\/978-3-319-73697-6_11"},{"key":"241_CR50","doi-asserted-by":"crossref","unstructured":"Liu W, Wang Y, Wu K, et\u00a0al (2023) A byte sequence is worth an image: Cnn for file fragment classification using bit shift and n-gram embeddings. arXiv preprint arXiv:2304:06983","DOI":"10.1109\/AICAS57966.2023.10168636"},{"key":"241_CR51","unstructured":"Lundberg SM, Lee SI (2017) A unified approach to interpreting model predictions. Adv Neural Inform Process Syst. 30"},{"key":"241_CR52","doi-asserted-by":"crossref","unstructured":"Mahajan A, Shah D, Jafar G (2021) Explainable ai approach towards toxic comment classification. In: Emerging Technologies in Data Mining and Information Security: Proceedings of IEMIS 2020, Volume 2, Springer, pp 849\u2013858","DOI":"10.1007\/978-981-33-4367-2_81"},{"issue":"1","key":"241_CR53","doi-asserted-by":"crossref","first-page":"100","DOI":"10.1017\/S1351324909005129","volume":"16","author":"C Manning","year":"2010","unstructured":"Manning C, Raghavan P, Sch\u00fctze H (2010) Introduction to information retrieval. Nat Lang Eng 16(1):100\u2013103","journal-title":"Nat Lang Eng"},{"key":"241_CR54","doi-asserted-by":"crossref","unstructured":"McDaniel M, Heydari MH (2003) Content based file type detection algorithms. In: 36th Annual Hawaii international conference on system sciences, 2003. Proceedings of the, IEEE, pp 10\u2013pp","DOI":"10.1109\/HICSS.2003.1174905"},{"key":"241_CR55","doi-asserted-by":"publisher","first-page":"28","DOI":"10.1109\/TIFS.2020.3004266","volume":"16","author":"G Mittal","year":"2020","unstructured":"Mittal G, Korus P, Memon N (2020) Fifty: large-scale file fragment type identification using convolutional neural networks. IEEE Trans Inf Forensics Secur 16:28\u201341","journal-title":"IEEE Trans Inf Forensics Secur"},{"issue":"5","key":"241_CR56","doi-asserted-by":"publisher","first-page":"1102","DOI":"10.3390\/electronics12051102","volume":"12","author":"VD P\u0103v\u0103loaia","year":"2023","unstructured":"P\u0103v\u0103loaia VD, Necula SC (2023) Artificial intelligence as a disruptive technology\u2013a systematic literature review. Electronics 12(5):1102","journal-title":"Electronics"},{"issue":"4","key":"241_CR57","doi-asserted-by":"publisher","first-page":"372","DOI":"10.1016\/j.diin.2013.08.004","volume":"10","author":"P Penrose","year":"2013","unstructured":"Penrose P, Macfarlane R, Buchanan WJ (2013) Approaches to the classification of high entropy file fragments. Digit Investig 10(4):372\u2013384","journal-title":"Digit Investig"},{"key":"241_CR58","doi-asserted-by":"crossref","unstructured":"Ribeiro MT, Singh S, Guestrin C (2016) \u201cWhy should i trust you?\u201d explaining the predictions of any classifier. In: Proceedings of the 22nd ACM SIGKDD international conference on knowledge discovery and data mining, ACM, pp 1135\u20131144","DOI":"10.1145\/2939672.2939778"},{"key":"241_CR59","doi-asserted-by":"publisher","first-page":"S60","DOI":"10.1016\/j.diin.2012.05.012","volume":"9","author":"V Roussev","year":"2012","unstructured":"Roussev V, Quates C (2012) Content triage with similarity digests: The m57 case study. Digit Investig 9:S60\u2013S68","journal-title":"Digit Investig"},{"key":"241_CR60","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2023.110273","volume":"263","author":"W Saeed","year":"2023","unstructured":"Saeed W, Omlin C (2023) Explainable ai (xai): a systematic meta-survey of current challenges and future opportunities. Knowl-Based Syst 263:110273","journal-title":"Knowl-Based Syst"},{"key":"241_CR61","doi-asserted-by":"crossref","unstructured":"Saxena I, Usha G, Vinoth N, et\u00a0al (2023) The future of artificial intelligence in digital forensics: A revolutionary approach. In: Artificial Intelligence and Blockchain in Digital Forensics. River Publishers, pp 133\u2013151","DOI":"10.1201\/9781003374671-9"},{"key":"241_CR62","doi-asserted-by":"crossref","unstructured":"Schwalbe G, Finzel B (2023) A comprehensive taxonomy for explainable artificial intelligence: a systematic survey of surveys on methods and concepts. Data Mining and Knowledge Discovery pp 1\u201359","DOI":"10.1007\/s10618-022-00867-8"},{"key":"241_CR63","doi-asserted-by":"publisher","first-page":"301121","DOI":"10.1016\/j.fsidi.2021.301121","volume":"36","author":"J Sester","year":"2021","unstructured":"Sester J, Hayes D, Scanlon M et al (2021) A comparative study of support vector machine and neural networks for file type identification using n-gram analysis. Forensic Sci Int Digital Investig 36:301121","journal-title":"Forensic Sci Int Digital Investig"},{"key":"241_CR64","doi-asserted-by":"crossref","unstructured":"Skra\u010di\u0107 K, Petrovi\u0107 J, Pale P (2023) Bytercnn: Enhancing file fragment type identification with recurrent and convolutional neural networks. IEEE Access","DOI":"10.1109\/ACCESS.2023.3340441"},{"issue":"1","key":"241_CR65","doi-asserted-by":"publisher","first-page":"11","DOI":"10.1108\/eb026526","volume":"28","author":"K Sparck Jones","year":"1972","unstructured":"Sparck Jones K (1972) A statistical interpretation of term specificity and its application in retrieval. J Document 28(1):11\u201321","journal-title":"J Document"},{"key":"241_CR66","doi-asserted-by":"crossref","unstructured":"Sportiello L, Zanero S (2011) File block classification by support vector machine. In: 2011 Sixth international conference on availability, reliability and security, IEEE, pp 307\u2013312","DOI":"10.1109\/ARES.2011.52"},{"key":"241_CR67","doi-asserted-by":"crossref","unstructured":"Sportiello L, Zanero S (2012) Context-based file block classification. In: IFIP international conference on digital forensics, Springer, pp 67\u201382","DOI":"10.1007\/978-3-642-33962-2_5"},{"key":"241_CR68","doi-asserted-by":"crossref","unstructured":"Thi NN, Cao VL, Le-Khac NA (2017) One-class collective anomaly detection based on lstm-rnns. In: Transactions on Large-Scale Data-and Knowledge-Centered Systems XXXVI, Springer, pp 73\u201385","DOI":"10.1007\/978-3-662-56266-6_4"},{"key":"241_CR69","unstructured":"TinyOS (2023) Open source operating system designed for low-power wireless devices. http:\/\/www.tinyos.net\/, [Online; 2024\/04\/13 10:12:31]"},{"key":"241_CR70","doi-asserted-by":"crossref","unstructured":"Veenman CJ (2007) Statistical disk cluster classification for file carving. In: Third international symposium on information assurance and security, IEEE, pp 393\u2013398","DOI":"10.1109\/ISIAS.2007.4299805"},{"key":"241_CR71","doi-asserted-by":"publisher","first-page":"89","DOI":"10.1016\/j.inffus.2021.05.009","volume":"76","author":"G Vilone","year":"2021","unstructured":"Vilone G, Longo L (2021) Notions of explainability and evaluation approaches for explainable artificial intelligence. Inform Fus 76:89\u2013106","journal-title":"Inform Fus"},{"issue":"10","key":"241_CR72","doi-asserted-by":"publisher","first-page":"2553","DOI":"10.1109\/TIFS.2018.2823697","volume":"13","author":"F Wang","year":"2018","unstructured":"Wang F, Quach TT, Wheeler J et al (2018) Sparse coding for n-gram feature extraction and training for file fragment classification. IEEE Trans Inf Forensics Secur 13(10):2553\u20132562","journal-title":"IEEE Trans Inf Forensics Secur"},{"issue":"8","key":"241_CR73","doi-asserted-by":"publisher","first-page":"1863","DOI":"10.4304\/jcp.9.8.1863-1870","volume":"9","author":"T Xu","year":"2014","unstructured":"Xu T, Xu M, Ren Y et al (2014) A file fragment classification method based on grayscale image. J Comput 9(8):1863\u20131870","journal-title":"J Comput"},{"key":"241_CR74","doi-asserted-by":"crossref","unstructured":"Zhu N, Liu Y, Wang K, et\u00a0al (2023) File fragment type identification based on cnn and lstm. In: Proceedings of the 2023 7th International Conference on Digital Signal Processing, pp 16\u201322","DOI":"10.1145\/3585542.3585545"}],"container-title":["Cybersecurity"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00241-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1186\/s42400-024-00241-9\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1186\/s42400-024-00241-9.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,11]],"date-time":"2024-09-11T04:09:59Z","timestamp":1726027799000},"score":1,"resource":{"primary":{"URL":"https:\/\/cybersecurity.springeropen.com\/articles\/10.1186\/s42400-024-00241-9"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,9,11]]},"references-count":74,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2024,12]]}},"alternative-id":["241"],"URL":"https:\/\/doi.org\/10.1186\/s42400-024-00241-9","relation":{},"ISSN":["2523-3246"],"issn-type":[{"value":"2523-3246","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,9,11]]},"assertion":[{"value":"2 January 2024","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"10 April 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"11 September 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no potential competing interests.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"52"}}