基于贝叶斯方法的计算机动态取证  

Dynamic computer forensics based on bayes method

作　　者：鄢喜爱[1,2] 杨金民[1] 常卫东[2] 

机构地区：[1]湖南大学软件学院,湖南长沙410082 [2]湖南公安高等专科学校计算机系,湖南长沙410138

出　　处：《计算机工程与设计》2009年第20期4614-4616,4627,共4页Computer Engineering and Design

基　　金：国家自然科学基金项目(60473031);公安部应用创新计划基金项目(2006YYCXHNST024)

摘　　要：针对目前计算机取证技术的真实性、时效性不足等问题,提出了一种基于朴素贝叶斯的计算机动态取证方法,该方法结合了贝叶斯网络在分类算法中的优势,能够对网络攻击行为进行及时准确地识别。在此基础上,设计了一个动态取证的原型系统,利用Agent节点自动完成取证任务,并采用了安全有效的方式对证据进行完整保存。实验结果表明,该系统对入侵行为有很高的检测率,能实时取到真实有效的电子证据,并具有一定的容错能力。Current network forensics systems have the problems of the trueness and the efficacy. In order to overcome the shortages, a method of computer forensics is proposed based on naive bayes. The new method combines the advantages of classification algorithm based on bayes network, it can identify behavior truly as soon as network intrusions take place. Based on this method, a prototype of dynamic forensics is designed, in which the evidence is captured automatically by agent node, and the evidence is saved inextenso. Experimental result shows that the system has high detection rate for intrusion, and can capture the authentic and valid electronic evidences, and has certain capability of fault tolerance.

关 键 词：网络安全 计算机取证 朴素贝叶斯 动态取证 容错 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]