Dynamic user behavior-based cloud forensics method and dynamic user behavior-based cloud forensics system

Abstract

The invention discloses a dynamic user behavior-based cloud forensics method and a dynamic user behavior-based cloud forensics system; the formalized definition of dynamic user behavior is put forward as basis; and the method comprises the steps of: collecting dynamic user behavior and behavior data, and storing the behavior data as primary evidence data; carrying out data integration, data cleaning and data mining to form forensic analysis data, and storing the forensic analysis data into a data analysis library (key value database); using Map Reduce to carry out correlation analysis, sequence pattern analysis and isolated point analysis on the forensic analysis data, and digging out the potential user behavior patterns and the possible aggressive behavior to form forensic evidence; and displaying the forensic evidence in a visual way. The high performance computing power of cloud computing and large-scale distributed-memory environment are applied into computer forensic analysis, so that various problems in cloud computing forensics can be solved.

Description

technical field [0001] The invention belongs to the technical field of computers, and relates to a cloud evidence collection method and system based on dynamic user behavior. Background technique [0002] Computer forensics is the process of using various computer software and hardware knowledge and discrimination techniques to identify, store, analyze and submit digital evidence for computer intrusion, destruction, attack, fraud and other criminal acts in a legally compliant manner. It is the most direct weapon to combat computer and network crimes and ensure information security. It is an important branch of network security technology. It can not only be used for network security protection and emergency response, but also can intervene in judicial procedures when necessary. Legal proceedings provide admissible evidence. Since computer forensics was proposed in 1991, after more than ten years of continuous in-depth research and development, research in this direction at ...

AI Technical Summary

Problems solved by technology

In the absence of huge loopholes in the encryption algorithm and security authentication system, exhaustive enumeration has become the only way to crack passwords, but the amount of calculation generated by exhaustive enumeration is also beyond the reach of ordinary computing technology

Images