数据挖掘在动态取证系统中的应用研究  

Application Research on Dynamic Forensics Using Data Mining

作　　者：叶小涛[1] 玄绪强[2] 吕爱丽[1] 

机构地区：[1]河南理工大学现代教育技术中心 [2]中国人民解放军第91913部队

出　　处：《计算机安全》2008年第10期6-8,17,共4页Network & Computer Security

摘　　要：传统的取证技术是一种静态方法,该文从动态取证的角度去解决静态取证所面临的问题,研究了计算机动态取证的相关技术,提出了一个计算机动态取证系统模型并对相关模块进行设计。根据动态取证的特点,提出将数据挖掘技术应用于动态取证系统中,针对基本挖掘算法在取证分析实际应用中存在的不足,提出了相应的算法改进方法,通过实验分析,证明了改进算法在计算机动态取证应用中的有效性。Current solutions for computer forensics are mostly static methods; this paper uses dynamic forensics to solve the problems of static forensics. The thesis studies some association technologies, brings forward a design model to the computer dynamic forensics system, and gives detail design to the modules. According to the features of dynamic forensics, this paper raises the method of applying data mining into the dynamic forensics, however, these methods cannot be used to analyze digital evidence directly. So, relative improvements of basic algorithms and methods of pattern analysis are put forward, and experiment is performed to prove the feasibility.

关 键 词：计算机取证 数据挖掘 动态取证 关联分析 

分 类 号：TP311.13[自动化与计算机技术—计算机软件与理论] TP309[自动化与计算机技术—计算机科学与技术]