事件关联在证据链构造中的研究  

Research on Event Correlation in Construction of Evidence Chain

作　　者：刘栋[1,2] 宁玉富[1,2] 

机构地区：[1]山东青年政治学院,山东济南250103 [2]山东省高校信息安全与智能控制重点实验室,山东济南250103

出　　处：《计算机技术与发展》2016年第12期107-110,116,共5页Computer Technology and Development

基　　金：国家自然科学基金资助项目(60873247)

摘　　要：在电子取证工作中,往往忽略对电子证据信息的预处理,从而导致电子证据冗余较大,计算分析较复杂。为解决计算机取证中存在电子证据形式化表示的困难以及数据缺失的问题,在对事件关联技术进行研究和深入分析的基础上,利用贝叶斯网络理论,提出一种基于事件关联的证据链构造方法。该方法考虑事件之间的相互影响以及序列关系,分析缺失数据的因果关系,拟合完整证据链,实现了形式化表示电子证据,并降低了证据分析的数据冗余,从而有针对性地进行数据处理和证据分析,完善了取证体制。通过实验结果分析得出,该方法实现了证据的形式化表示,减少了证据分析的数据量。The electronic evidence data preproeessing is easily neglected in electronic forensics work,leading to heavy redundancy for electronic evidence and complex calculation. Since the electronic evidence is difficult to represent formalized, and there exist missing data. A method for constructing electronic evidence chain is proposed on the basis of the study and analysis of event correlation and Bayesian network. Considering the interaction between evidence events and sequence relationship,it can be analysis of causal relationship of the events to deal with the missing data. It realizes the electronic evidence represented and reduces the data redundancy of evidence analysis, thus consummating the evidence collection system and making the data process and evidence analysis be more target-oriented. The experimental results show that the method realizes the representation of evidence and reduces the computation.

关 键 词：计算机取证 事件关联 贝叶斯网络 证据链 电子证据 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]