基于模糊C均值聚类的动态取证分析技术

Analyzing Dynamic Forensics Data Base on Fuzzy C-means Clustering

实施动态取证的关键是如何从海量的数据中实时挖掘有效犯罪入侵证据信息。基于已有取证数据分析方法的不足,提出利用模糊C均值聚类方法对证据信息记录进行实时分析,从而发现犯罪攻击异常的网络行为模式。通过对CUP99数据集的检测试验表明该方法不但可行而且准确性及效率较高。

the key of dynamic forensics is how mining effective crime evidence information from the magnanimous data on real-time.In view of the disadvantages of the existing dynamic forensics methods,fuzzy C-means(FCM) clustering method is used to analyze record in order to detect anomaly network crime behavior patterns.Experimental results on the CUP99 data set data show that this method can not only feasible but also improve the accuracy and efficiency.