自动化进程日志取证分析工具设计  

Automated Process Log Forensics Analysis Tools

作　　者：唐善武 张以政 朱周洁 岳扬 杨建强 TANG Shanwu;ZHANG Yizheng;ZHU Zhoujie;YUE Yang;YANG Jianqiang(School of Computer Engineering,Hubei University of Arts and Science,Xiangyang,China,441053)

机构地区：[1]湖北文理学院计算机工程学院,湖北襄阳441053

出　　处：《福建电脑》2023年第1期93-96,共4页Journal of Fujian Computer

摘　　要：日志分析工作耗时且繁琐,尽管已有的日志分析工具提供了某些过滤或搜索功能,但它们并不具备任何原生的数据分析能力,也没有提供过滤大量合法进程活动的功能。本文基于Windows的PowerShell脚本,设计了一款能够自动化分析进程日志的工具。该工具弥补了已有日志分析工具的上述不足,能够帮助取证分析人员快速定位异常进程或程序。Log analysis is time-consuming and cumbersome.Although existing log analysis tools provide some filtering or searching functions,they do not have any native data analysis capabilities,nor do they provide the ability to filter a large number of legitimate process activities.Based on Windows PowerShell script,a tool that can automatically analyze process logs is designed.This tool makes up for the above-mentioned shortcomings of existing log analysis tools,and can help forensic analysts to quickly locate abnormal processes or programs.

关 键 词：POWERSHELL 日志分析 取证 安全 

分 类 号：TP309.5[自动化与计算机技术—计算机系统结构]