Host-based Behavioral Analysis Forensics Technology Research

In recent years, the high-tech criminal such as Fraud, tampering, theft of electronic data is growing. Computer Forensics has became a research hotspot. At currently, Computer forensics research concentrates at electronic data recovery and analysis of massive information and data mining association. However, Analysis of host-specific behavior is less.In this paper, the forensics framework on behavior of a host-based is proposed, and the critical technologies of the framework are researched. The trace left by the user's operator is analysised and researched, and the object of operator includes the browser, USB devices and file . Base on the result, the procedure of user's operator is recontructed in the target machine. Through the recovery, collection, formatting,orting and multi-granularity, multi-level analysis, reconstruction the suspect's behavior in the process of host, the electronic evidence of judicial is presented .On the basis of the relevant research, the software on host-based forensic system is development. The result of experiment show that the framework is feasible, the objective of reconstruction user behavior is .attainable.