基于事件关联的电子取证实时入侵重构  

Real-time intrusion reconstruction system of computer forensics based on event correlation

作　　者：张基温[1] 朱剑[1] 

机构地区：[1]江南大学信息工程学院,江苏无锡214122

出　　处：《计算机工程与设计》2006年第22期4325-4327,共3页Computer Engineering and Design

摘　　要：针对目前电子取证入侵重构多用事后分析的方式导致分析信息不完整的问题,定义入侵事件的形式化描述和黑客攻击场景的表示,将事件关联方法引入电子取证入侵重构分析中,建立了事件关联的动态实时电子取证入侵重构系统,该系统预先了因果关联表,找出事件间的因果关联度,并消除它们的冗余关系,来获得入侵过程图。最后,通过一个实例来说明通过关联部分攻击片断来构建一个完整的攻击场景的过程。Aimed at the problem of which the information of intrusion obtained after the event is not integrated in the analysis on intrusion reconstruction of computer forensics, intrusion event and scene of intrusion is defined normally, and the method ＂event correlation＂ is introduced to intrusion reconstruction of computer forensics. The real-time intrusion reconstruction system is built based on event correlation. This system predefined a table of causality between intrusion events and got the degree of event correlation frme the table, and eliminated the redundancy between events. Thus the diagram of intrusion reconstruction is obtained in the system. In the end, an instance is given in which building an intact scene of intrusion with the method of correlation of segmental intrusion act.

关 键 词：电子取证 入侵事件 攻击场景 事件关联 入侵重构 实时系统 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]