Research on Real-Time Network Forensics Based on Improved Data Mining Algorithm
Xu Chang, Shan Shan Pei, Na Su · Applied Mechanics and Materials · 2013
According to the characteristics of high precision and massive amounts of data processing during real-time network forensic, combining the defects of traditional Apriori algorithm which scan data sets more times, the paper improved Apriori algorithm, the data set is divided into parallel processing blocks, and then use dynamic itemsets counting method weight each block to construct tree, and depth-first search the tree, mark the data set which is divided out of the data block, and dynamic evaluation all the items set which has counted in order to acquire frequent itemsets, reducing the number of scanning, improved data processing capability of network forensics, use K-mediods algorithm for secondary mining to improve the accuracy, reduce network data loss, improve legal effect of network crime evidence.