| 基于攻击特征的自动证据筛选技术 |
| |
| 引用本文： | 伏 晓, 谢 立. 基于攻击特征的自动证据筛选技术[J]. 计算机研究与发展, 2011, 48(6): 964-973. |
| |
| 作者姓名： | 伏晓 谢立 |
| |
| 作者单位： | 1(南京大学软件学院 南京 210093) 2(南京大学计算机科学与技术系 南京 210093) (fuxiao1225@hotmail.com) |
| |
| 基金项目： | 江苏省自然科学基金项目(BK2007136); 江苏省高技术研究计划基金项目(BG2005029) |
| |
| 摘 要： | 为了自动获得入侵证据,提出一种基于攻击特征的自动证据筛选方法.其原理是首先根据被调查攻击的特征重构出攻击行为细节,并从中抽取筛选证据需要的“特征信息”.然后,再根据候选数据与这些特征信息的匹配程度筛选出该攻击相关的证据.基于DARPA 2000的实验表明这种方法具有很高的准确率,其完备性更是接近100%.而与现有方法的比较则显示出这种方法能克服现有方法人工干预较多、效率低下、仅能筛选特定证据类型、不适合处理复杂攻击等诸多缺陷.
|
| 关 键 词： | 入侵取证 证据筛选 攻击特征 特征信息 依赖追踪 |
Filtering Intrusion Forensic Data Based on Attack Signatures |
| |
| Fu Xiao, Xie Li. Filtering Intrusion Forensic Data Based on Attack Signatures[J]. Journal of Computer Research and Development, 2011, 48(6): 964-973. |
| |
| Authors: | Fu Xiao Xie Li |
| |
| Affiliation: | 1(Software Institute, Nanjing University, Nanjing 210093) 2(Department of Computer Science and Technology, Nanjing University, Nanjing 210093) |
| |
| Abstract: | Computer forensics is a new field on computer evidences process.This field is very important and practical,so it has drawn more and more attention in recent years.Intrusion forensics is a specific area of computer forensics,and has been applied to computer intrusion activities.It is a hot area because a large proportion of the computer crimes are intrusion activities.When investigating intrusion activities,one key step is obtaining intrusion evidences.In order to get this kind of evidences automatically,an ... |
| |
| Keywords: | intrusion forensics evidence filtering attack feature attack signature dependency tracking |
| 本文献已被 CNKI 万方数据 等数据库收录！ |
| 点击此处可从《计算机研究与发展》浏览原始摘要信息 |
|
点击此处可从《计算机研究与发展》下载全文 |
