一种高效的局域网内共享文件操作监控审计方法  

AN EFFICIENT MONITORING AND AUDIT METHOD FOR SHARED FILES OPERATION IN LAN

作　　者：鲍远松[1] 代真虎[1] 黄明[1] 黄松鑫[1] 

机构地区：[1]上海宝信软件股份有限公司研发部,上海201203

出　　处：《计算机应用与软件》2012年第8期286-288,共3页Computer Applications and Software

摘　　要：局域网内通过共享方式分发文件通常是最普遍、最简单和最高效的一种方式,但是目前针对共享文件操作缺乏有效的追踪审计手段,给内网中的信息保护带来了严重的安全隐患,诸如员工私自共享机密文件造成泄密、恶意篡改共享文件造成信息丢失、通过共享方式恶意传病毒木马等问题防不胜防。通过对文件共享操作原理深入研究,设计并实现了基于文件过滤驱动和中间层网络驱动的共享文件操作监控审计方法,可实时高效地监控用户共享文件操作并记录所有操作信息,为管理员提供了强有力的监管手段,有效地保护了局域网内的信息安全。The files distribution in LAN in sharing mode is usually a most common, simplest and efficient method. However, at present there lacks the effectively following up and auditing means in light of the operation of shared files, such method has incurred serious security perils in regard to information protection of the intranet, the problems such as the unauthorised sharing of confidential files between employees which causes information leakage, the malicious tampering of the sharing files which results in information loss, and the viciously transferring of Trojans virus through shared means, etc. are so hard to prevent. Through in-depth studying on the principle of shared files operation, a monitoring and audit approach, based on the file system filter driver and the intermediate network driver, has been designed and implemented for shared file operations in this paper. It is able to efficiently monitor users＂ shared files operation timely and to record all operating information, which provides the administrators a powerful supervision means and the effective protection with regard to information security in LAN.

关 键 词：文件过滤驱动 中间层网络驱动 共享文件操作 监控审计 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]