基于数据挖掘的动态取证技术研究

Research on Computer Dynamic Forensics Based on Data Mining

文中针对静态取证中存在的证据真实性、有效性和及时性问题,提出将取证技术结合到防火墙、入侵检测系统中,应用数据挖掘技术和智能代理技术对所有可能的计算机犯罪行为进行实时的动态取证。重点研究了基于数据挖掘的多智能代理动态取证系统模型,以及在该模型下的基于智能代理的数据获取和基于数据挖掘的动态数据分析。这些对提高电子证据的真实性、有效性以及动态取证系统的有效性、可适应性、可扩展性、智能化具有重要的意义。

Aiming at the problems of trueness, efficacy and timeliness of evidence in static forensics, it presents that combining forensics with firewaU and intrusion detection system,applying data mining and intelligent agent tO get the electronic evidence timely. It focuses on the intelligent agent model of dynamic forensics based on data mining, the data collection based on intelligent agent and data analysis based on data mining of dynamic forensics in the model. These have meaning to raise the reality and efficiency of electronic evidence,it can raise efficiency,adaptability and extendibility of the dynamic forensics system too.