基于Apriori算法的证据分析系统设计

发布时间：2018-07-17 03:54

【摘要】：伴随着计算机技术和网络技术的发展,它们在人们生活中的作用逐步增加,已成为生活中必要的一部分。尽管网络的迅速发展给人类提供了极大的快捷和便利,但是网络病毒、黑客入侵和网络犯罪等现象的出现也给人们的财产和个人信息安全带来了非常之大的负面影响,已经成为亟待人们解决的问题。网络安全问题越来越受到人们重视,而作为网络安全中的重要一环,网络取证的作用已不言而喻,而证据分析作为这个过程中最关键的一步,人们对此的研究更是下了非常大的功夫。因此本文致力于研究证据分析,并融合关联规则挖掘的算法获得证据,设计实现了一种基于Apriori算法的证据分析系统,最后在改进过程中,通过模拟攻击对该系统测试,测试结果较为满意。下面是本文内容简要概括:(1)在借鉴了国内外众多前沿的研究情况下,结合自身情况、做相关调查,对系统进行了需求分析,对研究方向做出了定位,学习了相关技术,包括wireshark抓包技术、MD5数据完整性校验技术、Webservice技术等。(2)在学习了大量数据挖掘关联规则方面的知识后,对于关联分析有了一定的理解,并对传统的关联规则方法Apriori算法提出了相应的改进,改进算法能够有效地缓解传统Apriori算法的缺点,较快地对数据进行关联分析。(3)在需求分析的基础上,设计系统的基本框架和内部详细功能。首先对系统进行了概要设计,本文将基于Apriori算法的证据分析系统分为客户端和服务器端两个子系统,客户端主要负责采集数据,服务器端主要负责分析数据。具体地说,客户端又由用户登录、数据采集、数据存储、数据上传、下载报告五个功能模块构成;其中用户登录模块根据用户输入的用户名和密码,对用户的身份进行验证;数据采集模块负责采集数据,为证据分析提供数据支持,这里主要设计采集网络数据包和用户下载文件记录;数据存储模块负责将数据采集模块采集到的数据存储到数据库中,既方便了后期的数据分析,又保留了证据;数据上传模块将数据上传到Webservice平台,方便其他用户直接调用;下载报告模块是在服务器端生成取证报告后,用户可以在客户端下载取证报告,将结果反馈给用户;服务器端由数据查看、数据分析、生成报告三个功能模块构成;其中数据查看模块主要负责查看客户端采集到的未经处理的数据;数据分析模块主要是运用各种方法对原始数据进行处理,得到需要的证据,本文主要运用改进的Apriori算法对客户端采集到的数据进行关联分析,得到证据,比如检测洪水攻击,分析用户下载文件的行为等;生成报告模块是在得到证据后,用报告的形式展示出来,呈现给用户。最后又分别对客户端和服务器端进行数据库设计,设计了数据表,保证数据的存储完整;(4)在完成需求分析和系统设计后,本文采用C/S架构模型,以VS2010作为开发软件,实现了由Apriori算法改进了的证据分析系统的各项功能,对代码进行简单介绍,并对系统界面进行展示。最后,通过测试,发现系统能够高效准确地分析出数据间的关联性,检测攻击,获得相关证据。
[Abstract]:With the development of computer technology and network technology, their role in people's life has gradually increased and has become a necessary part of life. Although the rapid development of the network provides great shortcuts and conveniences for human beings, the appearance of network viruses, hacker invading and network offense is also given to people's property and personal letter. Interest security has brought very big negative effects and has become an urgent problem to be solved. The problem of network security has been paid more and more attention. As an important part of network security, the role of network forensics has been self-evident, and evidence analysis is the most important step in this process. So this article is devoted to the research of evidence analysis and the fusion of association rules mining algorithm to obtain evidence, and design and implement an evidence analysis system based on Apriori algorithm. Finally, in the process of improvement, the test results are satisfactory by simulation attack. The following is a brief summary of the contents of this paper: (1) Referring to the research situation of many frontiers at home and abroad, combining with its own situation, doing relevant investigation, carrying out the requirement analysis to the system, making a positioning for the research direction and learning related technologies, including Wireshark packet technology, MD5 data integrity verification technology, Webservice technology, etc. (2) learning a large number of data mining association rules. After knowledge, it has a certain understanding of association analysis, and puts forward the corresponding improvement to the traditional association rule method Apriori algorithm. The improved algorithm can effectively alleviate the shortcomings of the traditional Apriori algorithm and analyze the data quickly. (3) the basic framework and internal detailed work of the system are designed on the basis of the requirement analysis. Firstly, the system is briefly designed. In this paper, the evidence analysis system based on Apriori algorithm is divided into two subsystems, the client and the server. The client is responsible for collecting data and the server is responsible for the analysis of the data. In particular, the client is logged in, data collection, data storage, data upload, and downloading reports. The user login module is responsible for the user's identity according to the user name and password entered by the user. The data acquisition module is responsible for collecting data and providing data support for the analysis of evidence. The main design is to collect the network data packets and download the records of the users, and the data storage module is responsible for collecting data. The data collected by the module is stored in the database, which not only facilitates the later data analysis, but also preserves the evidence. The data upload module uploads the data to the Webservice platform to facilitate the direct call of other users; the download report module is to generate the evidence report on the server side, and the user can download the evidence report on the client side and feed back the result feedback. The server side is composed of three functional modules, which are data view, data analysis, and report generation. The data view module is mainly responsible for checking the unprocessed data collected by the client. The data analysis module mainly uses various methods to process the original data and obtain the necessary evidence. This article mainly uses the improved Apri The ori algorithm analyses the data collected by the client and obtains the evidence, such as the detection of flood attack, the analysis of the user's behavior of downloading the file, etc. the generation report module is displayed in the form of report and presented to the user after obtaining the evidence. Finally, the database is designed and the data are designed for the customer and server end respectively. Table, ensure the integrity of data storage; (4) after the completion of the requirements analysis and system design, this paper uses the C/S architecture model and VS2010 as the development software, realizes the functions of the evidence analysis system improved by the Apriori algorithm, introduces the code and displays the system interface. Finally, through testing, the system can be found. Analyze the correlation between data efficiently and accurately, detect attacks and obtain relevant evidence.
【学位授予单位】：山东师范大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP311.13;TP393.08

【相似文献】