基于时序因果关联的网络取证研究  

Research on Network Forensics Based on Cause and Effect of Time Series

作　　者：李连民[1] 曹锋[1] 吴庆涛[1] 云刚[2] LI Lian-min,CAO Feng,WU Qing-tao,YUN Gang（1.Institute of Electronic and Information Eengineering,Henan University of Science ＆ Technology,Luoyang 471003,China;2.Equipment Department,Tianjin Datang Panshan Power Generation Co.,Ltd.,Tianjing 391907,China）

机构地区：[1]河南科技大学电子信息工程学院,河南洛阳471003 [2]天津大唐国际盘山发电有限责任公司设备部,天津391907

出　　处：《电脑知识与技术》2010年第8期6172-6173,6207,共3页Computer Knowledge and Technology

基　　金：河南省重点科技攻关项目（082102210076）

摘　　要：随着网络技术的发展,网络犯罪现象越来越多。网络取证技术是当今一种热门的动态安全技术,它采用主动出击的方法,搜集犯罪证据,查出入侵的来源,有效地防范网络入侵。针对攻击过程复杂化的特点,提出一种基于时序因果关联的取证分析方法,利用系统中收集的取证数据源（Forensics Data Source,FDS）,建立多源时间序列数据集,并分为输入时间序列和输出时间序列两类,利用时序分析技术提取输出变量的攻击事件序列和输入变量的异常点（攻击征兆）序列,建立两者之间的时态关联的传递函数,采用因果关系检验,分析网络入侵证据。With the development of network,more and more network attacks appear.Network forensic is a dynamic security technology.It collects the proofs of intrusion and finds the source of attacks with the active methods,so it can prevent intrusion effectively.As complicationof attack process,the dissertation proposed forensic analysis method based cause and effect of time series.A principled approach for discovering the precursors of attack in multivariate time series obtained from honeypot data variable.The approach is rooted in time series data mining and in the application of the causality test for selecting variables that are likely contain the precursors of attack.These precursors rules relate precursor events extracted from input time series with malicious events extracted from output time series.

关 键 词：网络取证 时序因果 时序序列 取证分析 

分 类 号：TP393[自动化与计算机技术—计算机应用技术;自动化与计算机技术—计算机科学与技术]