跨网日志审计及用户行为溯源研究  

Research on Cross Network Log Audit and User Behavior Traceability

作　　者：陈林[1] 汪超 侯杰飞 虞江 左跃 CHEN Lin;WANG Chao;HOU Jiefei;YU Jiang;ZUO Yue(Westone Information Industry Inc.,Chengdu Sichuan 610041,China;The PLA Joint Logistic Support Force,Wuhan Hubei 430014,China;Unit 32683 of PLA,Shenyang Liaoning 110043,China)

机构地区：[1]成都卫士通信息产业股份有限公司,四川成都610041 [2]中国人民解放军联勤保障部队,湖北武汉430014 [3]中国人民解放军第32683部队,辽宁沈阳110043

出　　处：《信息安全与通信保密》2022年第12期1-10,共10页Information Security and Communications Privacy

摘　　要：传统安全日志审计系统功能日趋完善,可通过标准协议或安装代理软件的方式收集系统和设备的日志进行分析处理并综合展示。但传统日志审计也存在一些短板,如在跨应用域、跨网络域场景下,传统日志审计系统无法以统一身份对用户行为进行分析溯源。针对跨网数据交换场景中跨网日志审计及用户行为溯源需解决的关键问题进行了深入研究,提出了跨网日志审计系统框架,可为跨网数据交换和业务协同场景下日志审计和用户行为溯源提供参考。The functions of traditional security log audit systems are becoming more and more consummate.Logs of systems and equipments can be collected by means of standard protocols or by installing agent software,and then analyzed,processed and presented in a comprehensive manner.However,traditional log audit system also has some demerits,such as in scenarios of cross application domain and cross network domain,the traditional log audit system cannot analyze and trace user behavior with a unified identity.Aiming at the key issues to be solved for cross network log audit and user behavior traceability in the cross network data exchange scenario,this paper conducts an in-depth study and proposes a framework for cross network log audit system,which can provide a reference for log audit and user behavior traceability in the scenarios of cross network data exchange and business collaboration.

关 键 词：跨网跨域 数据交换 日志审计 行为溯源 

分 类 号：TP309.2[自动化与计算机技术—计算机系统结构]