基于模糊认知图的多源异构证据智能化分析关键技术研究

With the rapid development of Mobile Internet, Cloud Computing and Internet of Things, digital evidences show massive, multi-source heterogeneous characteristics. Since traditional evidence analysis methods, which require much manual work, have low degree of automation and poor ability of reasoning, they can hardly satisfy the national requirement to fight against network crimes in new information age. To improve automation of evidence analysis and ability of reasoning for massive multi-source heterogeneous evidence，this proposal studies key technologies and the model of intelligence analysis for multi-source heterogeneous evidence based on fuzzy cognitive map. This proposal mainly focuses on developing novel methods based on memory（RAM） analysis and probabilistic-FCM(Fuzzy Cognitive Map) to solve the malicious code detection problem in static electronic criminal scenarios. This research will help to improve the efficiency and degree of automation for analyzing the malicious code. Moreover, this research will have a positive effect on combating cyber crimes as well as safeguarding national security.

移动互联网、云计算、物联网的飞速发展使得电子证据呈现海量、多源异构的特点。传统的证据分析需要大量人工参与，自动化程度低、推理分析能力差，已难以满足新信息时代国家打击网络犯罪的要求。本课题研究基于模糊认知图的多源异构证据智能化分析关键技术及模型， 重点研究基于内存分析和概率模糊认知图的恶意程序判定方法，解决静态电子犯罪场景中恶意程序难以判定的问题。本课题的研究可有效提高当前对恶意代码的检测能力，对打击网络犯罪、维护国家安全有积极促进作用。

本项目从静态犯罪场景中内存的提取和分析、APT等恶意程序的检测、恶意行为的传播三个方面研究计算取证中恶意行为的分析检测判定问题，取得如下成果：1. 提出了内存镜像中对象的提取分析方法，先获取内核对象句柄表，之后通过分析获取内核对象数据结构及对象信息，为计算机取证领域中信息安全事件和各类计算机犯罪案件调查取证提供基础；2. 提出了于内存分析和FCM的APT木马取证分析方法，为静态犯罪场景中恶意代码的检测提供新的思路，并研发了特种木马检测系统；3. 提出了相依网络保护机制，避免相依网络上级联失效与病毒传播共演化过程的出现；提出了系统的理论框架用于计算不同攻击下的临界阈值，及攻击后的网络最大连通分支的尺寸，这些推动了对恶意行为的传播规律发现。本研究共发表研究论文5篇（SCI收录3篇，EI收录2篇），申请专利3项，获得软件著作权1项。