摘要
针对证据数据完整性的问题,指出证据数据完整性评估的意义和重要性.通过考察信息系统在物理环境、网络传输、主机与系统、应用程序、管理和时间这六个方面对于证据数据完整性的影响和作用,提出了一种评估证据数据完整性的框架.运用数据融合方法对评价结果进行量化,通过分别对传统终端取证方法和面向云的取证方法的实例进行评估与量化,证实了该框架对证据数据完整性评估具有切实有效的指导作用及可操作性,结果表明使用传统终端取证工具所获取证据数据的不确定性在云环境下是传统终端取证的5倍.
As cloud computing makes many challenges for digital forensics,the problem of evidence data integrity was focused on,the essentiality to evaluate the evidence data integrity in cloud forensics was pointed out.By researching the information system in the aspects of physical environment,network and transmission,computer and system,application,management and time,a framework was proposed to evaluate the evidence data integrity,and data fusion method was used for description of the evidence data integrity in quantization pattern.To confirm the validity of this framework and method,the evaluations had been done towards traditional computer forensic and one of could forensic methods respectively.The result shows that the evaluation framework and method are adaptive for cloud forensics,that the uncertainty of evidence for cloud forensics is 5times larger than tradition forensics by using traditional forensic tools.
作者
胡波
韩臻
黄伟庆
孙德刚
Hu Bo Han Zhen Huang Weiqing Sun Degang(School of Computer and Information Technology, Beijing Jiaotong University, Beijing 100044, China Institute of Information Engineering, Chinese Academy of Science, Beijing 100093, China)
出处
《华中科技大学学报（自然科学版）》
EI
CAS
CSCD
北大核心
2016年第11期82-86,96,共6页
Journal of Huazhong University of Science and Technology(Natural Science Edition)
基金
国家自然科学基金资助项目(61502486)
中国科学院信息工程研究所创新基金资助项目
关键词
云取证
数据完整性
评估框架
数字调查
数据融合
cloud forensic
data integrity
evaluation framework
digital investigation
data fusion
