基于模糊理论的实时取证模型

Real-Time Forensics Model Based on Fuzzy Theory

利用模糊理论在处理不确定性问题上的优越性,提出一种模糊实时取证模型,并开发了原型系统.可能包含入侵踪迹的信息记录都被动态地转移到安全对象M中,每种关键文件在M中都存在一个对等的映像,用来存储安全转移过来的信息记录.关键文件中信息记录mi的安全级别分为3个等级,对不同安全级别信息记录保存的时间不尽相同,以优先长时间保存那些可能存在入侵信息的记录.系统的安全性评价和实验表明,与攻击行为有关的信息记录95%以上都能动态安全地转移和智能取舍.

This paper presented a real-time forensics model based on fuzzy theory,and the prototype was implemented. The model took advantage of fuzzy theory in disposing of uncertain problems. The information records, which may be suspicious intrusion information, were dynamically transferred to a secure object ‘M＇, in which every key file had a corresponding image. To store those records longer and at first priority, the information records were of 3 various security levels. The security of the model was evaluated and testified. 95 percent of the information records, which may be suspicious intrusion information, were safely transferred to an authentic place and then could be selectively stored.