面向网络取证的网络攻击追踪溯源技术分析

首先定位网络攻击事件的源头,然后进行有效的电子数据证据的收集,是网络取证的任务之一.定位网络攻击事件源头需要使用网络攻击追踪溯源技术.然而,现有的网络攻击追踪溯源技术研究工作主要从防御的角度来展开,以通过定位攻击源及时阻断攻击为主要目标,较少会考虑到网络取证的要求,从而导致会在网络攻击追踪溯源过程中产生的大量有价值的数...

Analysis of Cyber Attack Traceback Techniques from the Perspective of Network Forensics

Locating the source of cyber attack and then collecting electronic evidence is one of the tasks of network forensics. Therefore, cyber attack traceback techniques are used to locate the source of cyber attack. However, current research on cyber attack traceback is mainly conducted from a defensive prospective, targeting at blocking cyber attack as soon as possible via locating the cyber attack source, and rarely considers cyber evidence acquirement. As a result, the large amount of valuable electronic evidence generated during the process of cyber attack traceback cannot be used in prosecutions, and their value in network forensics cannot be fully exploited. Therefore, a set of forensic capability metrics is proposed to assess the forensic capabilities of cyber attack traceback techniques. The latest cyber attack traceback technologies, including cyber attack traceback based on Software defined network, are summarized and analyzed. We analyzed their forensic capabilities and provided some suggestions for improvement. A specific forensics process model for cyber attack traceback is proposed, providing reference for research on cyber attack traceback technology targeting at network forensics.