Windows下基于主机的安全日志服务器

越来越多的计算机犯罪需要进行电子取证,安全日志服务器在针对电子犯罪的监控、审计以及取证活动中发挥了重要作用。主机日志在电子取证以及入侵检测中有着不可替代的作用,通过深入分析主机日志可以发现系统的异常行为并记录下来作为日后的电子证据或进行实时的入侵检测分析。该文简要介绍了安全日志服务器系统的发展背景,分析了主机日志的构成,主机日志在计算机安全领域中的应用,详述了对主机日志信息的处理并给出了基于主机日志的安全系统的结构搭建。

Safety Log Serve Based on Host Audit Trails

Host audit trails are very important in the field of computer forensic and intrusion detection. From the analysis we can identify host abnormality and we also can store them as electronic evidence for the later lawsuit. Log server based on host audit trails is critical when supervising and auditing the computer crime. This paper describes the background of the safety log server, analyzes the structure of host audit trail, it also elaborates on the process of the log and constructs the safety log server system.