基于弱关联挖掘的网络取证数据采集系统设计与实现

Design and Implementation of Network Forensics Data Acquisition System Based on Weak Association Mining

摘要:

对海量网络日志和服务器数据进行数据挖掘,获取网络取证,在分析犯罪证据方面具有较大的应用价值；传统的数据采集系统,主要增加对网络取证数据进行滤波处理模块,增加采集系统采集的准确率,存在采集时间长、效率低的问题；提出基于弱关联挖掘的网络取证数据采集系统设计方法,对网络取证数据采集系统的总体设计描述与技术指标分析；并以此为基础,设计基于弱关联规则特征提取的网络取证数据挖掘算法,实现网络取证数据的准确检测和采集；在嵌入式Linux平台上进行网络取证数据采集系统的软件开发和系统设计；实验结果表明,采用该系统对网络日志和服务器数据中犯罪证据进行取证采集,其可靠性较高,取证数据采集精度高于传统方法,展示了较好的应用价值。

Abstract:

The massive web logs to data mining and server data, access to the network forensics, based on the analysis of criminal evidence has great application value. Traditional data acquisition system, the main increase to filter network forensics data processing module, increase the accuracy of sampling system, there are long acquisition time, the problem of low efficiency. Based on weak association mining network forensics data acquisition system design method of the overall design description of network forensics data acquisition system and technical index analysis. And on this basis, the design is based on the data network forensics is feature extraction of weak association rules mining algorithm, and realize the network forensics accurate detection and data acquisition. On the embedded Linux platform for network forensics data acquisition system software development and system design. Experimental results show that the system of criminal evidence in web logs and server data to obtain evidence collection, its reliability is higher, forensics data acquisition precision is higher than the traditional method, shows a good application value.