Nowadays, network is playing a important role in our daily life. Meanwhile, thesecurity problem is far more than before. In this background, forensic research thataims at network is becoming a focus. And with the new technology like cloudcomputing, it is seems that forensic problem has some new solution. Cloud computinghas well ability for dealing with big data and it provide us with a brand newcomputing service mode and data storage service mode. In this article, cloudcomputing is bring into network flow forensic problem. Firstly, some basicknowledge of digital forensic and cloud computing is introduced for clearcomprehension; Secondly, it gives a detailed description of map-reduce and Yarnarchitecture and create a network flow forensic model which is based on cloudcomputing. In the analyze layer, a modified distributed SVM algorithm is proposed,and the experiment test its validity and correctness. At last, the work is summarizedand some future work of forensic research which is based on cloud computingenvironment is proposed. |