Load ownership network evidence-obtaining method and system based on Bloom filters

Abstract

The invention proposes a load ownership network evidence-obtaining method and system based on Bloom filters, and the method comprises the steps: grabbing a prepared evidence-obtaining network data flow, and carrying out the preprocessing of the network data flow; partitioning a load, and substituting partitioning contents into specified Hash functions, wherein the obtained result of each Hash function is a serial number of the corresponding Bloom filter; enabling the partitioning contents to be respectively stored in the corresponding Bloom filter according to the serial number of the corresponding Bloom filter; obtaining a field which is ready to be queried, carrying out the Hash operation of all partitioned blocks in the field one by one; judging whether all partitioned blocks in the field are respectively mapped to the position of the corresponding Bloom filter or not; and judging that the load comprises the field if all partitioned blocks in the field are respectively mapped to the position of the corresponding Bloom filter. The method can support the query of a wildcard character better, solves a problem of head block offset, a problem of alignment and a problem of continuity, reduces the false positive false alarm ratio at an acceptable data compression ratio, and improves the query speed and verification accuracy.

Description

technical field [0001] The invention relates to the technical field of network forensics, in particular to a Bloom filter-based network forensics load attribution method and system. Background technique [0002] With the rapid development of information technology, crimes on the network are becoming more and more rampant. Due to the complexity, uncertainty and diversity of network crimes, it is impossible to completely contain the occurrence of network crimes technically. Therefore, network forensics technology has gradually become a research topic. Hotspots, the traceability, tracking and disposal of cybercrime incidents are playing an increasingly important role. Therefore, the efficient storage of data traffic and the provision of accurate queries after the event have become a direction worthy of research. [0003] Payload attribution is the process of identifying the source and destination of all packets that appear on the network and contain specific fields. The paylo...

AI Technical Summary

Problems solved by technology

Existing technologies are limited to the types of queries they can respond to, resulting in inability to support wildcard queries well

Images