Towards Understanding and Detecting File Types in Encrypted Files for Law Enforcement Applications

Abstract

The (ab)use of encryption and compression in hiding illegal digital content complicates efforts by law enforcement agencies (LEAs) to procure evidence to support the elements of proof required in criminal prosecution. This reinforces the importance of designing solutions to determine the file type of an encrypted file (e.g., videos and still images in the context of illegal picture investigations), which can be used to build probable cause in a court order application to have the file decrypted. While machine learning (ML) has shown immense capabilities in several detection tasks, the suitability of ML for detecting file types in encrypted or compressed files has not been explored. Furthermore, since detecting file types in real-world LEA applications is a high-stake decision-making problem, existing ML techniques that do not provide prediction uncertainty are not as useful. In this work, we take the first step toward detecting file types in encrypted or compressed files using ML for LEA applications based on their Byte Frequency Distributions (BFD). We then compose a dataset1of BFDs of 300,000 encrypted and compressed data from 12,000 diverse files for five different file types. We conduct an in-depth analysis of our dataset and demonstrate the utility of ML techniques in detecting file types of content in encrypted and compressed files based on BFDs. Informed by these findings, we present our proposed framework, eDefender, designed to facilitate the detection of file types in encrypted and compressed files for LEA applications, by employing uncertainty quantification of detection scores based on ensembling. eDefender successfully flags directories with encrypted or compressed image/video-type files with an F1-score of 90.7%.