CAJ | 학술논문

在计算机取证领域，数据碎片的取证分析已成为获取数字证据的一种重要手段。本文针对取证中数据碎片的取证问题提出了一种新的基于内容特征的数据碎片类型识别算法，该方法首先对数据碎片进行分块主成分分析PCA 后，对 PCA 特征向量进行线性鉴别分析 LDA 获取组合特征向量，然后利用 K 最邻近 KNN 算法和序列最小优化SMO 算法组成融合分类器，运用获取的组合特征向量对数据碎片进行分类识别。实验表明，该算法与其他相关算法相比，具有较高的识别准确率和识别速率，取得了良好的识别效果。
재계산궤취증영역，수거쇄편적취증분석이성위획취수자증거적일충중요수단。본문침대취증중수거쇄편적취증문제제출료일충신적기우내용특정적수거쇄편류형식별산법，해방법수선대수거쇄편진행분괴주성분분석PCA 후，대 PCA 특정향량진행선성감별분석 LDA 획취조합특정향량，연후이용 K 최린근 KNN 산법화서렬최소우화SMO 산법조성융합분류기，운용획취적조합특정향량대수거쇄편진행분류식별。실험표명，해산법여기타상관산법상비，구유교고적식별준학솔화식별속솔，취득료량호적식별효과。
In the computer forensics field, the forensic analysis of data fragment has become an important means to obtain digital evidence. Aiming at the problem of data fragment forensics, this paper proposes a novel algorithm of data classification identification based on the content feature. Firstly, it makes principal component analysis (PCA) of each blocks in the data fragment; secondly, it makes linear discriminant analysis (LDA) of each PCA feature vector so as to get the combinational feature vector; finally, the author identifies the type of data fragment with the combinational fea-ture vector by using the fusion classifier of k nearest neighbor (KNN) algorithm and sequential minimal optimization algorithm (SMO). Experimental results have shown that compared with the related algorithms the proposed algorithm has better identification accuracy and identification rate which achieves better identification results.