Study on event correlation analysis in evidence chain structure

Computer forensics has limitations in representation formalism of the electronic evidence and data missing. A method in construction of electronic evidence chain was proposed on the basis of the study and analysis of event correlation, and it makes use of Bayesian network inference algorithm, which analysis of causal relationship of the events to deal with the missing data. This method to consider the interaction between evidence events and sequence relationship, it realizes formalization of the electronic evidence and reduces data redundancy in evidence analysis, which strengthens the pertinence of data process and evidence analysis, forensics system becomes more perfect.