基于场景重构与报警聚合的网络取证分析技术

提出一种包含报警标准化、去冗余、场景重构和报警聚合的网络取证分析方法. 通过去除失败攻击的报警, 减少了对证据分析的干扰. 在场景重构中, 通过反向关联, 减少了不必要的证据, 同时通过对孤立报警的补充, 保证了证据链的完整性. 在报警聚合中, 提出了聚合同一攻击步骤的不同报警的方法, 以抽象层和具体层两个层次重构入侵场景. 最后通过实验验证了所提出方法的有效性.

Network forensics based on scenario reconstruction and alert aggregation

A network forensics research method is proposed, which includes alert standardization, alert redundancy reduction, scenario reconstruction and alert aggregation. The interference of failed attacks to the forensics process is reduced by removing the failed alert. In the process of scenario reconstruction, with the method of inversely association, the unnecessary evidence can be removed. Moreover, isolated alerts are supplemented to ensure the integrity of evidence chain. In the process of alert aggregation, the method of merging different detailed alerts of the same step is proposed. The intrusion scenarios at the abstract layer and the specific layer are reconstructed respectively. Finally, experiments verify the effectiveness of the proposed method.