  In recent years, distinctive-dictionary construction has gained importance
due to his usefulness in data processing. Usually, one or more dictionaries are
constructed from a training data and then they are used to classify signals
that did not participate in the training process. A new dictionary construction
algorithm is introduced. It is based on a low-rank matrix factorization being
achieved by the application of the randomized LU decomposition to a training
data. This method is fast, scalable, parallelizable, consumes low memory,
outperforms SVD in these categories and works also extremely well on large
sparse matrices. In contrast to existing methods, the randomized LU
decomposition constructs an under-complete dictionary, which simplifies both
the construction and the classification processes of newly arrived signals. The
dictionary construction is generic and general that fits different
applications. We demonstrate the capabilities of this algorithm for file type
identification, which is a fundamental task in digital security arena,
performed nowadays for example by sandboxing mechanism, deep packet inspection,
firewalls and anti-virus systems. We propose a content-based method that
detects file types that neither depend on file extension nor on metadata. Such
approach is harder to deceive and we show that only a few file fragments from a
whole file are needed for a successful classification. Based on the constructed
dictionaries, we show that the proposed method can effectively identify
execution code fragments in PDF files.
  $\textbf{Keywords.}$ Dictionary construction, classification, LU
decomposition, randomized LU decomposition, content-based file detection,
computer security.
