一个日志完整性检测方法  

Method for verifying log integrity

作　　者：陈黎明[1] 俞研[1] 黄皓[1] 

机构地区：[1]南京大学计算机科学与技术系

出　　处：《计算机应用》2005年第4期867-869,共3页journal of Computer Applications

摘　　要：通常入侵者在成功控制系统后会试图更改日志文件以消除入侵痕迹,隐藏入侵行为。为 了防止入侵者隐藏其入侵行为,提出了一个日志完整性检测方法,对日志的完整性进行检测,使得入 侵者不能不被发现地更改系统被其控制以前在日志文件中写入的记录,进而提供保护。并在日志完 整性受到破坏时,给出一个可信任日志记录集合以供其他程序使用。All kinds of system events are stored in logs. After a successful intrusion, the intruder will try to modify the logs to conceal the intrusion. A method for verifying and protecting log integrity was described to make all log entries generated prior to the logging system's compromise impossible for the attacker to undetectably modify. A set of trusted log entries was provided to other programs when damages are made to log integrity.

关 键 词：日志完整性 单向哈希函数 报文鉴别码 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]