适用于云取证的证据数据完整性评估方法  

Evaluation method of evidence data integrity adaptive for cloud forensics

作　　者：胡波[1,2] 韩臻[1] 黄伟庆[2] 孙德刚[2] Hu Bo Han Zhen Huang Weiqing Sun Degang(School of Computer and Information Technology, Beijing Jiaotong University, Beijing 100044, China Institute of Information Engineering, Chinese Academy of Science, Beijing 100093, China)

机构地区：[1]北京交通大学计算机与信息技术学院,北京100044 [2]中国科学院信息工程研究所,北京100093

出　　处：《华中科技大学学报（自然科学版）》2016年第11期82-86,96,共6页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：国家自然科学基金资助项目(61502486);中国科学院信息工程研究所创新基金资助项目

摘　　要：针对证据数据完整性的问题,指出证据数据完整性评估的意义和重要性.通过考察信息系统在物理环境、网络传输、主机与系统、应用程序、管理和时间这六个方面对于证据数据完整性的影响和作用,提出了一种评估证据数据完整性的框架.运用数据融合方法对评价结果进行量化,通过分别对传统终端取证方法和面向云的取证方法的实例进行评估与量化,证实了该框架对证据数据完整性评估具有切实有效的指导作用及可操作性,结果表明使用传统终端取证工具所获取证据数据的不确定性在云环境下是传统终端取证的5倍.As cloud computing makes many challenges for digital forensics,the problem of evidence data integrity was focused on,the essentiality to evaluate the evidence data integrity in cloud forensics was pointed out.By researching the information system in the aspects of physical environment,network and transmission,computer and system,application,management and time,a framework was proposed to evaluate the evidence data integrity,and data fusion method was used for description of the evidence data integrity in quantization pattern.To confirm the validity of this framework and method,the evaluations had been done towards traditional computer forensic and one of could forensic methods respectively.The result shows that the evaluation framework and method are adaptive for cloud forensics,that the uncertainty of evidence for cloud forensics is 5times larger than tradition forensics by using traditional forensic tools.

关 键 词：云取证 数据完整性 评估框架 数字调查 数据融合 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]