计算机入侵取证中的入侵事件重构技术研究

针对计算机入侵取证中计算机证据具有易删改、易丢失、来源众多、内容繁杂等特点,论述入侵事件重构技术的最新发展状况,从系统应用层对象/事件和操作系统层对象/事件2个方面分析入侵重构的主要证据来源,介绍现有入侵事件重构中主流的重构工具,研究常用的入侵事件重构方法,包括基于时间戳的日志分析、语义完整性检查、基于操作系统层对象的依赖追踪技术、基于有限状态机模型的事件重构模型等,总结各种方法的优缺点。在重构效率、重构误报率、证据可信度、证据真实性和重构环境等方面对入侵事件重构方法进行比较,讨论入侵事件重构技术未来的研究前景。

Research on Intrusion Event Reconstruction Technology of Computer Intrusion Forensic

According to characteristics of computer intrusion forensic evidence, such as easy revise, easy loss, numerous sources, multifarious content, this paper discusses the current developing states about intrusion event reconstruction, analyzes intrusion event reconstruction source from the system layer object/event and the operate system layer object/event, and introduces the main intrusion event reconstruction tools. It reviews the existing methods for intrusion event reconstruction, including log analysis based on timestamp, semantic integrity checking, tracking technologies based on operate system layer object, event reconstruction models based on finite state machine and so on, evaluates their performance in terms of several metrics, such as reconstruction efficiency, false positives rate, credibility of evidence, authenticity of evidence, reconstruction environment, and summarizes the pros and cons of each method. Some important future research directions in the field of intrusion event reconstruction of computer intrusion forensic are discussed.