立体动态大数据的无损云取证模型仿真

Simulation of Lossless Cloud Forensics Model for 3D Dynamic Big Data

传统的云取证方法存在取证数据量大、数据储存复杂,且容易丢失,导致取证准确度较低、取证时间较长,对此提出并设计了立体动态大数据的无损取证模型。将关键且容易破坏的数据储存到数据中心,进行云取证准备,在此基础上,对证据范围、取证对象和单个服务节点的相关通信记录等涉案数据进行多次识别,将已识别的数据做物理定位,利用数据隔离法与按需收集法,对VM和物理机进行收集,分析收集到的全部证据,完成了立体动态大数据的云取证模型的构建。仿真结果表明,上述模型缩短了取证时间,且取证准确度较高,可实现实时追踪,保证了证据的完整性。

Traditionally,the cloud forensic method has massive data and complex data storage,resulting in low forensic accuracy and long forensic time.Therefore,a lossless forensic model of three-dimensional dynamic big data was designed.The key and vulnerable data were stored in the data center for cloud forensic preparation.On this basis,the data such as evidence scope,forensic object and communication record of single service node were identified for many times,and then the identified data was physically positioned.The data isolation method and the on-demand collection method were used to collect VM and physical machine,and analyze all the evidence.Thus,the construction of cloud forensic model of three-dimensional dynamic big data was completed.Simulation results show that this model can shorten the time of taking the evidence.Meanwhile,the accuracy of evidence collection is high.The real-time evidence collection can be realized,and the integrity of evidence is guaranteed.