基于证据推理网络的实时网络入侵取证方法  

A Real-Time Network Intrusion Forensics Method Based on Evidence Reasoning Network

作　　者：田志宏[1] 余翔湛[1] 张宏莉[1] 方滨兴[1] 

机构地区：[1]哈尔滨工业大学计算机科学与技术学院,哈尔滨150001

出　　处：《计算机学报》2014年第5期1184-1194,共11页Chinese Journal of Computers

基　　金：国家自然科学基金(60903166;61170262);国家"八六三"高技术研究发展计划项目基金(2012AA012506)资助~~

摘　　要：在分析现有网络入侵取证系统所存在问题的基础上,提出了一种基于证据推理网络的实时网络入侵取证方法NetForensic,将弱点关联性的概念引入网络入侵取证领域,根据网络系统的弱点知识和环境信息构建了证据推理网络,利用证据推理网络所提供的多阶段攻击推理能力,NetForensic实现了高效实时攻击流程重构.实验数据表明,NetForensic给出的证据链完整可信,且具备实时推理的能力,为快速有效的调查取证提供了有力保证.Based on the analysis of problems about the existing network intrusion forensicssystems,this paper proposed a real-time network intrusion forensics method according to theevidence reasoning network （NetForensic）.This method connected the concept of vulnerabilitycorrelation with the field of network intrusion forensics.It built the evidence reasoning networkon the basis of the network system vulnerabilities and environmental information.At the sametime,NetForensic realized the attack scenario reconstruction and with high efficiency in use of thereasoning ability of multi-staged attacks provided by the evidence reasoning network.Experimentaldata shows that NetForensic has supplied a complete and credible chain of evidence and it also hasthe capacity for real-time reasoning.All of these provide a strong guarantee for the rapid andeffective evidence investigation.

关 键 词：入侵取证 证据推理网络 弱点 证据链 信息安全 网络安全 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]