NIST SP800-168.pdf

Approximate matching is a promising technology designed to identify similarities between two digital artifacts. It is used to find objects that resemble each other or to find objects that are contained in another object. This can be very useful for filtering data for security monitoring, digital forensics, or other applications. The purpose of this document is to provide a definition and terminology to describe approximate matching in order to promote discussion, research, tool development and tool acquisition. Approximate matching has the potential to provide valuable filtering in a world inundated with information, but the technique is not widely used. The goal of the document is to provide infrastructure to support advances in approximate matching and its use in forensics and security.