Yes, using this stuff for forensics is a major direction this is moving into — Sequitur being linear time means we can build up a combined grammar from a couple hundred sample “bad hard drives”, subtract collisions against known “good hard drives”, and then find similarities against unknown drives.

There’s also some other algorithms in plagiarism detection that may generate nicer grammars.

Oh, and I only drink at Defcon…OK, Shmoocon and Toorcon too. Thank you, Hikari.

Glad you got to see Dan talk. His presentations are always very insightful and animated; he’s obviously genuinely excited about all this stuff, and he has traditionally been a very out-of-the-box thinker who has created some amazingly creative and novel attacks and abuses. And yes, he seems to always be at least somewhat drunk for his presentations (or in the process of drinking). :)

I am pretty sure when you talk about grammar styles for forensics, you’d delving into the area of linguistics, similar to handwriting specialists in the FBI or something. Definitely out of our league, and I swear I’ve heard mutterings of similar thoughts in the securitybasics mailing list from Secfocus a year ago about similar stuff…

Let us know next time you are going to any good presentations and we will try to join ya.