  Approximate matching (AM) is a concept in digital forensics to determine the
similarity between digital artifacts. An important use case of AM is the
reliable and efficient detection of case-relevant data structures on a
blacklist, if only fragments of the original are available. For instance, if
only a cluster of indexed malware is still present during the digital forensic
investigation, the AM algorithm shall be able to assign the fragment to the
blacklisted malware. However, traditional AM functions like TLSH and ssdeep
fail to detect files based on their fragments if the presented piece is
relatively small compared to the overall file size. A second well-known issue
with traditional AM algorithms is the lack of scaling due to the
ever-increasing lookup databases. We propose an improved matching algorithm
based on transformer models from the field of natural language processing. We
call our approach Deep Learning Approximate Matching (DLAM). As a concept from
artificial intelligence (AI), DLAM gets knowledge of characteristic blacklisted
patterns during its training phase. Then DLAM is able to detect the patterns in
a typically much larger file, that is DLAM focuses on the use case of fragment
detection. We reveal that DLAM has three key advantages compared to the
prominent conventional approaches TLSH and ssdeep. First, it makes the tedious
extraction of known to be bad parts obsolete, which is necessary until now
before any search for them with AM algorithms. This allows efficient
classification of files on a much larger scale, which is important due to
exponentially increasing data to be investigated. Second, depending on the use
case, DLAM achieves a similar or even significantly higher accuracy in
recovering fragments of blacklisted files. Third, we show that DLAM enables the
detection of file correlations in the output of TLSH and ssdeep even for small
fragment sizes.
