Abstract: A similarity calculating method and apparatus are disclosed. A similarity calculating method according to an exemplary embodiment of the present invention includes extracting similarity calculating data, which is determined in advance, by receiving a communication activity record for every user; modeling a communication activity pattern for every user and common information between the users based on the extracted similarity calculating data; and calculating a similarity between users using the modeled communication activity pattern for every user and common information. The modeling includes: modeling the communication activity pattern by calculating a value of a static feature from the similarity calculating data, and modeling the common information by calculating a value of a dynamic feature from the similarity calculating data.

Abstract: A method for visualizing record data with a mobile forensic device for collecting and managing the record data including partner information when an event, such as a call or text service, occurs, includes: calculating an event occurrence frequency for each partner information using the collected record data; and classifying the partner information on the basis of a grade according to the calculated event occurrence frequency. Further, the method includes generating graphic data showing a relation between the partner information and user information of a mobile terminal on the basis of the classified grade; and displaying the graphic data.

Abstract: A forensic analysis system and method using a virtualization interface which performs a forensic investigation or analysis on a corresponding system while minimizing a change in system information and operation interference of a live computer which is being operated is provided. In the forensic analysis system which performs a forensic analysis through a connection between an investigation target computer and an analysis computer, the investigation target computer is configured to execute a collection agent installation program stored in the analysis computer, and transmit analysis target information according to a request of the analysis computer.

Abstract: Proposed is a data visualizing apparatus for visualizing data as effectual information using a correlation between forensic data collected from various sources. The proposed data visualizing apparatus may visualize, as effectual information, single-source single-data, single-source multi-data, and multi-source multi-data.

Abstract: A method for visualizing record data with a mobile forensic device for collecting and managing the record data including partner information when an event, such as a call or text service, occurs, includes: calculating an event occurrence frequency for each partner information using the collected record data; and classifying the partner information on the basis of a grade according to the calculated event occurrence frequency. Further, the method includes generating graphic data showing a relation between the partner information and user information of a mobile terminal on the basis of the classified grade; and displaying the graphic data.

Abstract: Provided is a forensic index method by distributed processing, including: generating data to be divided by dividing data to be indexed according to predetermined division setting for distributed processing; allocating the generated data to be divided to a plurality of data processing units according to the predetermined division setting, extracting an index by filtering the allocated data to be divided in the plurality of data processing units, and generating divided index data including the extracted index; and generating an index database by merging the generated divided index data.

Abstract: A similarity calculating method and apparatus are disclosed. A similarity calculating method according to an exemplary embodiment of the present invention includes extracting similarity calculating data, which is determined in advance, by receiving a communication activity record for every user; modeling a communication activity pattern for every user and common information between the users based on the extracted similarity calculating data; and calculating a similarity between users using the modeled communication activity pattern for every user and common information. The modeling includes: modeling the communication activity pattern by calculating a value of a static feature from the similarity calculating data, and modeling the common information by calculating a value of a dynamic feature from the similarity calculating data.

Abstract: A system and method for data analysis and digital forensics is provided. The system for data analysis and digital forensics may include: an online data forensic server for collecting and analyzing usage history information from an object device, which is subject to data collection, downloading and collecting data on the Internet based on the usage history information, requesting issuance of a timestamp token for the collected data, and receiving the issued timestamp token; a timestamp token issuing server for issuing the timestamp token for the collected data in response to the request for issuance of the timestamp token and proving the issued timestamp token to the online data forensic server; and a storage device for storing the collected data.

Abstract: Proposed is a data visualizing apparatus for visualizing data as effectual information using a correlation between forensic data collected from various sources. The proposed data visualizing apparatus may visualize, as effectual information, single-source single-data, single-source multi-data, and multi-source multi-data.

Abstract: Provided is a forensic index method by distributed processing, including: generating data to be divided by dividing data to be indexed according to predetermined division setting for distributed processing; allocating the generated data to be divided to a plurality of data processing units according to the predetermined division setting, extracting an index by filtering the allocated data to be divided in the plurality of data processing units, and generating divided index data including the extracted index; and generating an index database by merging the generated divided index data.

Abstract: An apparatus for creating a data table of a forensic data, includes a data parser configured to create primary data tables including unique attributes of the predetermined keywords by parsing the raw data having different formats for each forensics tool, each attribute having a unique standardized format. The apparatus further includes a data filter filtering specific fields or attributes from the primary data tables to newly create secondary data table. The apparatus further includes a data relation analyzer analyzing a relation between the data within the primary data tables to newly create secondary data tables.

Abstract: A system and method for data analysis and digital forensics is provided. The system for data analysis and digital forensics may include: an online data forensic server for collecting and analyzing usage history information from an object device, which is subject to data collection, downloading and collecting data on the Internet based on the usage history information, requesting issuance of a timestamp token for the collected data, and receiving the issued timestamp token; a timestamp token issuing server for issuing the timestamp token for the collected data in response to the request for issuance of the timestamp token and proving the issued timestamp token to the online data forensic server; and a storage device for storing the collected data.

Abstract: A remote forensics system based on a network is provided to allow for accessing a forensics analysis center from a remote area to perform forensic analysis. The network-based remote forensic system includes: one or more remote terminals performing forensic analysis on an evidence device in a remote area, through a virtual forensic tool when the evidence device is connected thereto; and an investigation center system connected to the remote terminals via a wide area network to provide the virtual forensic tool, processing a requirement of the remote terminals, and providing requirement processing results to the remote terminals.

Abstract: An apparatus for collecting evidence data includes: an online data collection unit for collecting online data from a location designated by a user; a screen capture unit for capturing shots viewed on a computer screen, as they are; a time stamping unit for calculating a message digest for the collected online data to generate a time stamp including date and time when the message digest has been generated and a signature of the time stamping unit itself; and an image generation unit for generating a forensic image for the collected online data and generating a message digest for the collected online data.

Abstract: A method for controlling an Internet information security system of a sender, for packet security in an IP level, is provided. It is determined whether to select security services of packets by referring to security policy database and security association database. Security association is negotiated with a key exchange server of a receiver. The negotiated security association is stored in a key management server. A security policy related with the security association is linked. A packet is sent by using the linked security policy and the security association.