基于布鲁姆过滤器的计算机动态取证技术研究  

RESEARCH ON DYNAMIC COMPUTER FORENSICS BASED ON BLOOM FILTERS

作　　者：鄢喜爱[1,2] 常卫东[1,2] 谭敏 

机构地区：[1]湖南警察学院信息技术系,湖南长沙410138 [2]网络犯罪侦察湖南省普通高等学校重点实验室,湖南长沙410138

出　　处：《计算机应用与软件》2016年第2期299-301,329,共4页Computer Applications and Software

基　　金：国家自然科学基金项目(61272401);公安部公安理论及软件科学研究计划项目(2013LLYJHNST040);湖南省科技厅科研项目(2014FJ3049;2013GK2013)

摘　　要：静态取证时效性不足,动态取证则可获得更为真实、实时的证据。动态取证最关键的是证据识别。证据识别本质上是对网络数据流进行分类,以判断其行为是合法还是非法。布鲁姆过滤器采用一个位串表示数据集合并有效支持元素的哈希查询,从而被广泛应用于包分类算法中。首先对标准布鲁姆过滤器算法进行分析,并对算法存在的缺陷进行改进。在此基础上,设计一个基于布鲁姆过滤器的分布式计算机动态取证系统,并采取安全有效措施对证据进行传送。实验表明:该系统能对网络攻击行为进行动态地检测,且检测准确率高、误判率低。Static forensics is short in timeliness, while dynamic forensics can achieve more authentic and real-time evidences. Evidence identification is pivotal to dynamic forensics. The essence of evidence identification is to classify the network data flow so as to judge whether the behaviours are legal or illegal. Bloom filter represents the data set with a bit string and effectively supports hash query on membership, so that it is used widely in packet classification algorithm. In this paper we first analyse the standard Bloom filter, and improve its defects. Based on these, we design a Bloom filters-based distributed dynamic computer forensics system, and employ secure and effective means to transmit evidences. Experiment shows that this system can dynamically detect network intrusion behaviours with high detection accurate rate and low false positives.

关 键 词：信息安全 计算机取证 布鲁姆过滤器 动态取证 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]