Evidence graph and vulnerability reasoning combined network evidence collection method and system

Abstract

The invention relates to the field of digital evidence collection, and specifically relates to an evidence graph and vulnerability reasoning combined network evidence collection method and system. The method comprises the steps of collecting original data from heterogeneous data sources; storing the original data, thereby obtaining first storage data; separating evidence from the first storage data by use of a classification and recognition algorithm; marking the evidence, thereby obtaining event vectors of the evidence; establishing an evidence library according to the first storage data, the evidence and the event vectors; establishing an evidence graph according to the evidence library and an effective time sequence; and reasoning suspicious attack nodes through a VERA algorithm according to the evidence graph and simulating attack paths. Through adoption of the heterogeneous data sources, the comprehensiveness and integrity of the data sources can be ensured. The obtained evidence can be visually reflected by the VERA. According to the method, the problems that in the evidence collection process at the present stage, integrity and authenticity are poor and the obtained evidence cannot be reflected visually can be solved.

Description

technical field [0001] The invention relates to the field of digital forensics, in particular to a network forensics method and system combining evidence graphs and loophole reasoning. Background technique [0002] The frequent occurrence of computer crimes prompts the emergence and development of evidence collection. In the United States, one of the most influential countries in scientific and technological research, computer evidence has appeared in court as early as 1969, and computer forensics research has been continuously developed since then. How to obtain criminal evidence in a timely and accurate manner, ensure the legality, objectivity and relevance of evidence, and provide powerful weapons for deterring and combating computer network crimes according to law are the main contents of digital forensics research. The development of digital forensics encounters network forensics. Network forensics is a part of digital forensics. However, network forensics technology i...

AI Technical Summary

Problems solved by technology

[0006] The purpose of the present invention is to provide a network forensics method and system that combines evidence graphs and loophole reasoning to solve the problem of lack of integrity and authenticity in the current forensics process, and the obtained evidence cannot be vividly reflected

Images