Surrogate hashing

Abstract

Surrogate hashing is described, including running a hashing algorithm against a portion of a file to generate a hash value, determining whether the hash value is substantially similar to a stored hash value associated with another portion of another file, the portion and the another portion being standardized, and identifying a location of the another file if the hash value is substantially similar to the stored hash value associated with the another portion of the another file.

1 . A method for file identification, comprising:
 running a first hashing algorithm against a first portion of a first file to generate a first hash value, and running a second hashing algorithm against the first portion of the first file to generate a second hash value;   determining whether the first hash value and the second hash value are substantially similar to one or more stored hash values associated with a second portion of a second file, wherein the second portion is identified by one or more attributes that are substantially similar to one or more corresponding attributes with the first portion; and   identifying a location of the second file if the first hash value and the second hash value are substantially similar to the one or more stored hash values associated with the second portion of the second file.   
     
     
         2 . The method of  claim 1 , wherein at least one of the one or more attributes is used to standardize the first portion and the second portion. 
     
     
         3 . The method of  claim 1 , wherein at least one of the one or more attributes is used to identify a standardized region of the first file, the standardized region comprising the first portion. 
     
     
         4 . The method of  claim 1 , wherein at least one of the one or more corresponding attributes is used to identify a standardized region of the second file, the standardized region comprising the second portion. 
     
     
         5 . The method of  claim 1 , wherein at least one of the one or more corresponding attributes is used to standardize the first portion and the second portion. 
     
     
         6 . The method of  claim 1 , wherein the first portion comprises the first file. 
     
     
         7 . The method of  claim 1 , wherein the second portion comprises the second file. 
     
     
         8 . A method for file identification, comprising:
 selecting a standardized first portion of a first file, and a standardized second portion of a second file;   running a first hashing algorithm against the standardized first portion of the first file to generate a first hash value, and running a second hashing algorithm against the standardized first portion of the first file to generate a second hash value;   determining whether the first hash value and the second hash value are substantially similar to one or more stored hash values associated with the standardized second portion of the second file; and   identifying a location of the second file if the first hash value and the second hash value are substantially similar to the one or more stored hash values associated with the standardized second portion of the second file.   
     
     
         9 . The method of  claim 8 , wherein selecting the standardized first portion of the first file, and the standardized second portion of the second file further comprises identifying a set of data that is substantially similar in both the standardized first portion and the standardized second portion. 
     
     
         10 . The method of  claim 8 , wherein selecting the standardized first portion of the first file, and the standardized second portion of the second file further comprises identifying a location of the standardized first portion that is substantially similar to another location of the standardized second portion. 
     
     
         11 . The method of  claim 8 , wherein the standardized first portion comprises the first file. 
     
     
         12 . The method of  claim 8 , wherein the standardized second portion comprises the second file. 
     
     
         13 . A computer program product embodied in a computer readable medium and comprising computer instructions for:
 running a first hashing algorithm against a first portion of a first file to generate a first hash value, and running a second hashing algorithm against the first portion of the first file to generate a second hash value;   determining whether the first hash value and the second hash value are substantially similar to one or more stored hash values associated with a second portion of a second file, wherein the second portion is identified by one or more attributes that are substantially similar to one or more corresponding attributes with the first portion; and   identifying a location of the second file if the first hash value and the second hash value are substantially similar to the one or more stored hash values associated with the second portion of the second file.   
     
     
         14 . A computer program product embodied in a computer readable medium and comprising computer instructions for:
 selecting a standardized first portion of a first file, and a standardized second portion of a second file;   running a first hashing algorithm against the standardized first portion of the first file to generate a first hash value, and running a second hashing algorithm against the standardized first portion of the first file to generate a second hash value;   determining whether the first hash value and the second hash value are substantially similar to one or more stored hash values associated with the standardized second portion of the second file; and   identifying a location of the second file if the first hash value and the second hash value are substantially similar to the one or more stored hash values associated with the standardized second portion of the second file.