论文部分内容阅读
针对证据数据完整性的问题,指出证据数据完整性评估的意义和重要性.通过考察信息系统在物理环境、网络传输、主机与系统、应用程序、管理和时间这六个方面对于证据数据完整性的影响和作用,提出了一种评估证据数据完整性的框架.运用数据融合方法对评价结果进行量化,通过分别对传统终端取证方法和面向云的取证方法的实例进行评估与量化,证实了该框架对证据数据完整性评估具有切实有效的指导作用及可操作性,结果表明使用传统终端取证工具所获取证据数据的不确定性在云环境下是传统终端取证的5倍.
In view of the integrity of evidence data, this paper points out the significance and importance of the integrity evaluation of evidence data.Through examining the integrity of evidence data in the six aspects of physical environment, network transmission, host and system, application, management and time , This paper proposes a framework to evaluate the integrity of evidence data, quantifies the evaluation results by using data fusion method, evaluates and quantifies the traditional terminal forensics methods and cloud-oriented forensics methods respectively, The framework has an effective and effective guidance and operability on the assessment of the integrity of evidence data. The results show that the uncertainty of the evidence data obtained by the traditional terminal forensics tool is 5 times higher than that of the traditional terminal in the cloud environment.