A method for obtaining evidence, server and firewall

Abstract

The embodiment of the invention discloses an evidence obtaining method, a server and a firewall for improving the evidence obtaining accuracy and the evidence obtaining efficiency. The method provided by the embodiment of the invention comprises the following steps: obtaining the IP of a client; obtaining a security log related to the IP of the client; determining a first IP associated with the IP of the client and a first security log related to the IP in the security log; obtaining an invasion rule, and matching the invasion rule with the first security log; and extracting the first IP corresponding to the invasion rule and the first security log in the case of matching success. The invention further provides a server and a firewall for improving the evidence obtaining accuracy and the evidence obtaining efficiency.

Description

technical field [0001] The invention relates to the field of communication security, in particular to a method for obtaining evidence, a server and a firewall. Background technique [0002] With the rapid development of the Internet, the online transaction volume of enterprises and individual users is increasing day by day, and network operation has become a new fashion in society. However, while the Internet facilitates information exchange, it also provides a "safe way" for viruses to infect and spread rapidly. The virus reaches the other end from one end of the network and runs it without any protective measures on the computer, resulting in network paralysis. The system collapse poses a serious threat to the security and development of the information society and causes huge losses. To solve this problem and meet users' requirements for network security, a secure and efficient network security solution is needed. [0003] At present, in the face of security incidents r...

AI Technical Summary

Problems solved by technology

[0004] With this security forensics method, security experts generally need about 2 days of work to analyze a user’s network and corresponding security events, resulting in low processing efficiency. If a large number of user security events occur, it is impossible to efficiently respond to all users.

Images