基于用户行为关联分析的电子取证系统研究  

Electronic Forensics System Based on User Behaviors Correlation Analysis

作　　者：苏红[1,2] 万国根[3] 

机构地区：[1]四川大学数学学院,成都610065 [2]公安部第三研究所,上海200031 [3]清华大学网络行为研究所,北京100084

出　　处：《电信科学》2010年第12期72-78,共7页Telecommunications Science

基　　金：国家发改委信息安全基金资助专项"面向主动防御的电子取证系统"

摘　　要：针对目前电子取证缺乏全程监督的问题提出了一种基于用户行为关联分析的电子取证系统。该系统根据业务活动主体、行为和客体约束关系建立用户行为知识库,基于电子证据属性相似度,对原始电子证据进行过滤和融合,在WINEPI算法的基础上,实现电子证据的用户行为关联。使用实际数据测试表明,该系统能够对用户网络活动过程进行全程监督,并可以把取证过程的监督数据作为呈堂的证据。Aimed at the problem of which the electronic forensics lack of full supervision, the electronic forensics system based on user behaviors correlation analysis was presented. The system according to the main business activities, behavior, and object constraints of application established knowledge of user behavior, based on the similarity properties of electronic evidence, electronic evidence of the original filter and integration, in WINEPI algorithm based on the realization of user behavior associated with electronic evidence. Tested using actual data show that the system can monitor the whole process of network activity and can show the supervised data as evidence in court.

关 键 词：电子取证 关联分析 用户行为 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]