The Network Coordinative Forensics Technology Base on Data Provenance

摘要：

At present there is no good security tool that can directly associate analysis to the multi-step attack en network, and reconstruct invading process to obtain the criminal evidence. So a new approach of network coordinative forensics based on data provenance was presented: Set up a log server with SYSLOG mechanism, obtain logs provenance databases with Perm rewrite technology, position multi-step attacker with, where provenance, and reconfiguration attack process with why provenance. Data provenance theory and experiment results proved that the new approach is feasible and effective.

关键词： association analysis coordinative forensics multi-step attack data provenance perm

作者: Huang Wen Wen Chun-sheng

作者单位: Network Center Hunan University of Science and Engineering Yongzhou, China

会议类型: 国际会议

会议名称: 2011 6th Joint International Information Technology and Artificial Intelligence Conference(2011年第六届IEEE联合国际信息技术与人工智能会议 IEEE ITAIC 2011)

会议地点: 重庆

会议语种:英文

页码: 557-561

在线出版日期: 2011-08-20（万方平台首次上网日期，不代表论文的发表时间）