Windows环境下隐秘信息取证系统研究-信息安全专业论文.docxVIP

I I 摘要 随着计算机网络的高速发展，从事计算机犯罪的活动逐渐增多，计算机取证技术的发展 得到了越来越多的关注，为了满足各种各样的取证场景的需求，功能丰富、操作实用的取证 工具已成为行业的必需，由于 Windows 环境用户使用基数大，研究并设计出基于 Windows 环境的隐秘信息取证系统。论文对此进行研究，具有较强的理论意义和实际应用价值。 论文将传统的电子证据提取技术与数据挖掘技术相结合，提出集电子证据收集、电子证 据分类和电子证据展示于一体的取证系统模型。 本文首先深度分析主流浏览器内核机制，从计算机取证角度对浏览器痕迹提取技术进行 研究，提取大量有效的 Web 电子文档隐秘信息；与此同时，还进行了电子邮件取证的相关研 究，对邮件系统构成以及邮件编码格式进行了深入分析，从电子邮件取证角度对邮件头隐秘 信息进行真伪性鉴定分析。 针对电子证据的数据量巨大且杂乱无章的特性，论文研究了基于朴素贝叶斯算法的文本 分类模型，并以网页文本分类以及邮件分类实验为例，设计融合分类思想的取证模型。论文 通过多学习器与单学习器性能的仿真对比，融入了具备更高分类性能的集成学习分类思想， 大大提高了取证精度以及取证效率，有效地将计算机取证技术与数据挖掘领域的分类技术进 行了融合，最终实现杂乱无章的海量电子证据的有效分类，提高取证效率。 关键词: 计算机取证；电子证据；数据挖掘；分类技术； 集成学习 II II Abstract Computer crime activities have been gradually increased by the rapid development of computer network. The development of computer forensics technology has attracted more and more attention. In order to meet the needs of different forensic scenes, the industry needs feature-rich and practical forensic tools. Based on huge users of windows operate system, we do research on forensics system of unrevealed information based on Windows OS environment. The research has both strong theoretical and practical values. In this paper, we do research on computer forensics technology and fields of data mining classification techniques. This paper proposed a model of forensics system integrating electronic evidence collection, electronic evidence classification and electronic evidence display together. Firstly, this paper deeply analyzes on mainstream browser kernel mechanism, does research on browser trace extraction technology from the perspective of computer forensics, and extracts large number of effective Web electronic document information. This paper also focuses on the e-mail forensics, mail system composition and mail encoding format and identifies the authenticity of mail header information from the perspective of e-mail forensics. For the great amount of data of electronic evidence and chaotic characteristics, this paper also does research on the text categorization