Hidden Markov Model Based On Genetic Algorithm And Its Application In Evidence Fusion

The great rapid development of network technology has brought people to a efficient and convenient world. At the same time, it is becoming more important to protect the safety of computer network system. Network forensics has attracted more attention. But the evidence fusion is an important process of the network evidence. Accurately produce the chain of evidence is the key to improve the network forensic evidence of efficacy by evidence fusion process.The paper has introduced the research status of network forensics evidence fusion domestic and overseas. Research and Implementation Based on Hidden Markov model(HMM) evidence fusion method. It also described the principle of HMM and its three basic problems and solving algorithm. The structure of HMM used in the chain of evidence tested and verified by the Lincoln Laboratory data. The introduction of Genetic Algorithm(GA) is to optimization HMM of the initial parameter sensitivity.The mainly research contents are as follows:(1) In order to solve the traditional HMM training algorithm may converge to a local optimal solution. Interval variable deviation for adaptive artificial induced gene guided evolutionary genetic algorithm is introduced. The genetic process by maintaining population diversity is to achieve global search and improve the quality of the individual HMM.(2) To solve the global convergence of genetic algorithm, affected by the interaction genetic operation. A method to measure the diversity of the population in the macro and micro point of view was putted forward. This method was applied to the HMM parameters training process.Method of evidence chain structure HMM parameters training improved method used in network forensics in evidence fusion to infer the most likely sequence element evidence chain of evidence. In this way, reduced the convergence of the genetic algorithm by the mutual interaction between the genetic manipulation, which made the chain of evidence is more accurate.(3) The improvement of HMM is applied to network forensics. The application of HMM is to the network forensics evidence of improved fusion module. Collected suspected evidences that we may need, suspected evidence to element evidence, using the improved HMM evidence fusion algorithm to calculate the melting element evidence sequence. Make the original evidence back to the evidence. Then the chain of evidence was calculated. In the last report evidence in the form of a chart showed the chain of evidence.