检索结果-南通市图书馆

computer forensics-An Essential Element of Modern IT Security

在线全文

学校读者我要写书评

暂无评论

Journal of Harbin Institute of Technology(New Series) 2014年第6期21卷 5-8页

作者： Frank Y.W.Law K.P.Chow Center for Information Security and Cryptography University of Hong Kong

computer forensics is the science of obtaining,preserving,and documenting evidence from computers,mobile devices as well as other digital electronic storage *** must be done in a manner designed to preserve the probative value of the evidence and to assure its admissibility in a legal ***,computer forensics is continually evolving as existing technologies progress and new technologies are *** example,digital investigators are required to investigate content on mobile device or data stored at the cloud *** the popularity of computers in everyday life as well as the acceleration of cybercrime rates in recent years,computer forensics is becoming an essential element of modern IT *** paper will cover the development of computer forensics in law enforcement and discuss the development in the latest live forensics skillsets.A number of interested areas of computer forensics will be also highlighted to explain how it can support IT security and civil / criminal investigation.

关键词： computer forensics cybercrime digital evidence

k-Dimensional hashing scheme for hard disk integrity verification in computer forensics

在线全文

学校读者我要写书评

暂无评论

Journal of Zhejiang University-Science C(computers and Electronics) 2011年第10期12卷 809-818页

作者： Zoe Lin JIANG Lucas Chi Kwong HUI Siu Ming YIU Kam Pui CHOW School of computer Science and Technology Harbin Institute of Technology Shenzhen Graduate School Department of computer Science The University of Hong Kong

Verifying the integrity of a hard disk is an important concern in computer forensics,as the law enforcement party needs to confirm that the data inside the hard disk have not been modified during the investigation.A typical approach is to compute a single chained hash value of all sectors in a specific ***,this technique loses the integrity of all other sectors even if only one of the sectors becomes a bad sector occasionally or is modified *** this paper we propose a k-dimensional hashing scheme,kD for short,to distribute sectors into a kD space,and to calculate multiple hash values for sectors in k dimensions as integrity *** the integrity of the sectors can be verified depending on any hash value calculated using the sectors,the probability to verify the integrity of unchanged sectors can be high even with bad/modified sectors in the hard *** show how to efficiently implement this kD hashing scheme such that the storage of hash values can be reduced while increasing the chance of an unaffected sector to be verified *** results of a 3D scheme show that both the time for computing the hash values and the storage for the hash values are reasonable.

关键词： computer forensics Digital evidence Hard disk integrity k-Dimensional hashing

Research and Review on computer forensics

在线全文

学校读者我要写书评

暂无评论

China Communications 2010年第6期7卷 37-43页

作者： Guo Hong Jin Bo Huang Daoli Key Laboratory of Information Network Security Ministry of Public Security People＇s Republic of China （The 3rd Research Institute of Ministry of Public Security） Shanghai 201204 P. R. China

With the development of Internet and information technology, the digital crimes are also on the rise. computer forensics is an emerging research area that applies computer investigation and analysis techniques to help detection of these crimes and gathering of digital evidence suitable for presentation in courts. This paper provides foundational concept of computer forensics, outlines various principles of computer forensics, discusses the model of computer forensics and presents a proposed model.

关键词： computer forensics computer crime digital evidence

Extraction and Supervision of Data of Chain of Custody in computer forensics

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

China Communications 2010年第6期7卷 52-55页

作者： Wang Yi East China University of Political Science and Law Department of Information Science and Technology Shanghai 201620. P. R. China

In case handling, electronic evidence becomes more and more popular. In order to reduce the burden of judges＇ task to determine the integrity of chain of custody, even no technique experts on the spot, this paper sug... 详细信息

关键词： electronic evidence chain of custody computer forensics

Application of Multi-level Compressed Decision Tree in computer forensics

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

Application of Multi-level Compressed Decision Tree in Compu...

Cloud Computing-Based Forensic Analysis for Collaborative Network Security Management System

2010 IEEE 2nd Symposium on Web Society

作者： Zheng Guo-Cheng~1,Liu Shu-Fen~2,Wu Long~3 1(College of computer Science and Technology,Jilin University,Changchun 130012, China) 2(College of computer Science and Technology,Jilin University,Changchun 130012, China) 3(College of computer Science and Technology,Jilin University,Changchun 130012,China)

＜正＞C4.5 algorithm need scan and sort the data repeatedly before it can construct the tree and the CART algorithm doesn’t classify the data *** Multi-level compressed algorithm overcomes the shortcomings of the above algorithms,and it optimizes the classification granularity and the scale of the tree, which highly improve the decision *** decision classification to build multi-level decision tree not only accelerates the growth of the tree,but also can get well-structured tree,which can make it easy to get rule information.

关键词： C4.5 Decision Tree computer forensics Multi-level Compression Algorithm

来源： cnki会议评论

在线全文

cnki会议

学校读者我要写书评

暂无评论

Tsinghua Science and Technology 2013年第1期18卷 40-50页

作者： Zhen Chen Fuye Han Junwei Cao Xin Jiang Shuo Chen Research Institute of Information Technology and Tsinghua National Laboratory for Information Science and Technology (TNList) Tsinghua University Department of computer Science and Technology Research Institute of Information Technology and Tsinghua National Laboratory for Information Science and Technology (TNList) Tsinghua University Department of Automation Research Institute of Information Technology and Tsinghua National Laboratory for Information Science and Technology (TNList)Tsinghua University

Internet security problems remain a major challenge with many security concerns such as Internet worms, spam, and phishing attacks. Botnets, well-organized distributed network attacks, consist of a large number of bots that generate huge volumes of spam or launch Distributed Denial of Service （DDoS） attacks on victim hosts. New emerging botnet attacks degrade the status of Internet security further. To address these problems, a practical collaborative network security management system is proposed with an effective collaborative Unified Threat Management （UTM） and traffic probers. A distributed security overlay network with a centralized security center leverages a peer-to-peer communication protocol used in the UTMs collaborative module and connects them virtually to exchange network events and security rules. Security functions for the UTM are retrofitted to share security rules. In this paper, we propose a design and implementation of a cloud-based security center for network security forensic analysis. We propose using cloud storage to keep collected traffic data and then processing it with cloud computing platforms to find the malicious attacks. As a practical example, phishing attack forensic analysis is presented and the required computing and storage resources are evaluated based on real trace data. The cloud- based security center can instruct each collaborative UTM and prober to collect events and raw traffic, send them back for deep analysis, and generate new security rules. These new security rules are enforced by collaborative UTM and the feedback events of such rules are returned to the security center. By this type of close-loop control, the collaborative network security management system can identify and address new distributed attacks more quickly and effectively.

关键词： cloud computing overlay network collaborative network security system computer forensics anti-botnet anti-phishing hadoop file system eucalyptus amazon web service

An Approach to Analyze Physical Memory Image File of Mac OS X

在线全文

学校读者我要写书评

暂无评论

Journal of Harbin Institute of Technology(New Series) 2014年第4期21卷 116-120页

作者： Li-Juan Xu Lian-Hai Wang Shandong Provincial Key Laboratory of computer Network Shandong Computer Science Center( National Supercomputer Center in Jinan)

Memory analysis is one of the key techniques in computer live forensics. Especially,the analysis of a Mac OS X operating system's memory image file plays an important role in identifying the running status of an apple computer. However,how to analyze the image file without using extra"mach-kernel"file is one of the unsolved difficulties. In this paper,we firstly compare several approaches for physical memory acquisition and analyze the effects of each approach on physical memory. Then,we discuss the traditional methods for the physical memory file analysis of Mac OS X. A novel physical memory image file analysis approach without using extra"mach-kernel"file is proposed base on the discussion. We verify the performance of the new approach on Mac OS X 10. 8. 2. The experimental results show that the proposed approach is simpler and more practical than previous ones.

关键词： computer forensics live forensics Mac OS X operating system physical memory analysis

Face and Lip Tracking For Person Identification

在线全文

学校读者我要写书评

暂无评论

China Communications 2010年第6期7卷 141-144页

作者： Zhang Ying Key Laboratory of Information Network Security Ministry of Public Security People＇s Republic of China （The Third Research Institute of Ministry of Public Security） Shanghai 201204 P. R. China

This paper addresses the issue of face and lip tracking via chromatic detector, CCL algorithm and canny edge detector. It aims to track face and lip region from static color images including frames read from videos, which is exPected to be an important part of the robust and reliable person identification in the field of computer forensics. We use the M2VTS face database and pictures took from my colleagues as the test resource. This project is based on the concept of image processing and computer version.

关键词： face recognition lip tracking computer forensics

A Method on Extracting Network Connection Information from 64- bit Windows 7 Memory Images

在线全文

维普期刊数据库

学校读者我要写书评

暂无评论

China Communications 2010年第6期7卷 44-51页

作者： Wang Lianhai Xu Lijuan Zhang Shuhui Shandong Provincial Key Laboratory of computer Network Jinan 250014 P. R. China Shandong Computer Science Center Jinan 250014 P. R. China

Memory analysis gains a weight in the area of computer live *** to get network connection information is one of the challenges in memory analysis and plays an important role in identifying sources of malicious cyber attack. It is more difficult to fred the drivers and get network connections information from a 64-bit windows 7 memory image file than from a 32-bit operating system memory image f＇de. In this paper, an approach to fred drivers and get network connection information from 64-bit windows 7 memory images is given. The method is verified on 64-bit windows 7 version 6.1.7600 and proved reliable and efficient.

关键词： computer forensics computer live forensics memory analysis digital forensics