计算机取证模型研究  

Research on the Computer Forensics Model

作　　者：周敏[1] 付国瑜[1] 龚箭[1] 

机构地区：[1]重庆理工大学计算机科学与工程学院,重庆400050

出　　处：《计算机安全》2010年第1期47-48,共2页Network & Computer Security

摘　　要：在计算机犯罪发生后对现场信息进行事后的收集,难以确保证据的真实性和及时性。提出了一个基于动态采集理念的计算机取证模型,介绍了该模型的功能模块,将模糊C均值聚类算法引入到数据分析阶段,采用XML技术表示取证结果,实现了基于该模型的计算机取证原型系统。实验证明,原型系统能采集到准确、有效的电子证据。If the data was collected after the computer crime had occurred,it was difficult to ensure the authenticity and the timeliness of the evidence.A computer forensics model based on the concept of dynamic-collection was built in this paper.The work process of the model was introduced,the fuzzy C-means（FCM） clustering method was used to analyze the digital data,and the extensible Markup Language（XML）was also used to describe the forensics results.A computer forensics prototype system based on this model was implemented.Experimental results show that the accurate and efficiency digital evidence could be collected by the prototype system.

关 键 词：数字证据 取证分析 计算机取证 取证模型 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP301.6[自动化与计算机技术—计算机科学与技术]