Abstract:

Aimed at the problem of which the electronic forensics lack of full supervision，the electronic forensics system based on user behaviors correlation analysis was presented.The system according to the main business activities，behavior，and object constraints of application established knowledge of user behavior，based on the similarity properties of electronic evidence， electronic evidence of the original filter and integration，in WINEPI algorithm based on the realization of user behavior associated with electronic evidence.Tested using actual data show that the system can monitor the whole process of network activity and can show the supervised data as evidence in court.

Key words: electronic evidence, user behavior, correlation