Testing of the hypothesis in the research of computer incidents on the basis of the analysis of attributes and their values

Abstract

In this paper, we consider the verification of the hypothesis in the research of computer incidents study, based on the analysis of attributes and their values with post-incident computer equipment. The essence of the hypothesis constitutes the ability to study computer incidents in the types of computer memory; analyzing only the attributes and their values, without taking into account the contents of the data. The paper describes the process of forming the attributes and their values post-incident computer equipment and also, describing how to create a database of existing computer incidents. In performing these computational experiments, consists of assessing the possibilities of investigating computer incidents on the basis of the analysis of attributes and their values in the created database. Forming an opinion regarding the more informative details about the computer incidents by analysis of attributes and their values from the volatile memory, NVRAM (Non Volatile Random Access Memory), network traffic complex.