System and method for recording equipment behaviors

Abstract

The invention discloses a system and a method for recording equipment behaviors. The system comprises an underlying drive module, an authority limiting module, a check module, a behavior recording module and a hardware recording device, wherein the underlying drive module is used for identifying and connecting the hardware recording device; the authority limiting module is used for setting authority protection for the hardware recording device; the check module is used for judging whether the hardware recording device is successfully connected or not, if not, prohibiting current equipment from executing any operation, or else, permitting the current equipment to execute operations and starting the hardware recording device; the behavior recording module is used for recording all operations executed by the current equipment after the check module checks successfully, and writing recorded information into the hardware recording device; and the hardware recording device is used for receiving and storing the recorded information transmitted by the behavior recording module. According to the technical scheme, the hardware recording device is introduced into the equipment, and can record all behavior information of the current equipment, so that subsequent evidence collection and analysis are facilitated.

Description

technical field [0001] The invention relates to the technical field of device network security evidence collection, and in particular to a device behavior recording system and method. Background technique [0002] With the rapid development of the Internet, the continuous development of information technology has brought great changes to our lives, and the network has spread to every corner of people's life and work. While the Internet brings convenience to people's work and life, there are also certain risks. [0003] At present, more and more personal or corporate computers or mobile devices are under attack. Malicious operators add, delete, and modify various file data on user devices, causing serious consequences to users. . At the same time, hackers will clean up their own illegal behavior traces, which will directly affect the follow-up forensic analysis work. Contents of the invention [0004] Aiming at the above technical problems, the present invention disclose...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the above technical problems, the present invention discloses a device behavior recording system and method, which records all behavior data by setting a hardware recording device in the current device, thereby avoiding that the behavior data cannot be extracted due to the destruction of the operating system The problem

Images