人工免疫行为轮廓取证分析方法

Forensic Analysis Method of Behavior Profiling on Artificial Immunity

针对当前数据挖掘取证分析方法存在的取证分析效率低的问题,提出了采用免疫克隆算法来构建频繁长模式行为轮廓的取证分析方法。该方法以行为数据和频繁项集的候选模式分别作为抗原和抗体,以抗原对抗体的支持度作为亲和度函数,以关键属性作为约束条件,以最小支持度作为筛选条件,通过对抗体进行免疫克隆操作来构建基于频繁长模式的行为轮廓;采用审计数据遍历行为轮廓匹配对比的分析方法来检测异常数据。实验结果表明,与基于Apriori-CGA算法的取证分析方法相比,该方法的行为轮廓建立时间和异常数据检测时间均大幅降低。该方法有助于提高取证分析的效率以及确立重点调查取证的范围。

To improve the efficiency of the forensic analysis method on data mining,this paper proposes a new method for the forensic analysis of the behavior profiling on the longest frequent pattern which is constructed by immune clonal algorithm.Taking the behavior data and the candidate pattern of the frequent item sets as the antigen and the antibody respectively,the support of the antigen to the antibody as the function of affinity,the key attribute as the constraint condition,and the minimal support as the screening condition,the behavior profiling on the longest frequent pattern is built with the help of the immune clonal operation to antibody.The abnormal data are detected by the matching method that the audit data pass through the list items of the behavior profiling.The proposed method and the method on Apriori-CGA are applied in the same problem.The comparison results indicate that the setting up time of behavior profiling and the test time of abnormal data are dramaticly reduced.Therefore,the proposed method has a good ability in the efficiency of forensic analysis and electronic crime investigation.