基于贝叶斯方法的计算机动态取证

Dynamic computer forensics based on bayes method

针对目前计算机取证技术的真实性、时效性不足等问题,提出了一种基于朴素贝叶斯的计算机动态取证方法,该方法结合了贝叶斯网络在分类算法中的优势,能够对网络攻击行为进行及时准确地识别。在此基础上,设计了一个动态取证的原型系统,利用Agent节点自动完成取证任务,并采用了安全有效的方式对证据进行完整保存。实验结果表明,该系统对入侵行为有很高的检测率,能实时取到真实有效的电子证据,并具有一定的容错能力。

Current network forensics systems have the problems of the trueness and the efficacy. In order to overcome the shortages, a method of computer forensics is proposed based on naive bayes. The new method combines the advantages of classification algorithm based on bayes network, it can identify behavior truly as soon as network intrusions take place. Based on this method, a prototype of dynamic forensics is designed, in which the evidence is captured automatically by agent node, and the evidence is saved inextenso. Experimental result shows that the system has high detection rate for intrusion, and can capture the authentic and valid electronic evidences, and has certain capability of fault tolerance.