Network forensics method and device based on alarm aggregation

Abstract

The invention belongs to the technical field of network security, in particular to a network forensics method and a network forensics device based on alarm aggregation. And the intrusion detection data of the key nodes of the network are obtained, and the intrusion detection data are used as the alarm evidence set of the forensic analysis of the network; The alarm evidence in the alarm evidence set is mapped to the attack graph, and the alarm evidence chain is obtained. Clustering the alarm evidence chain to construct the network intrusion scene and recover the network crime scene. The invention aims at the problems of missing report and false report existing in the network forensics by using the intrusion detection system, and can accurately and completely display the intrusion panorama of the attacker and improve the network forensics efficiency through the alarm evidence mapping, the evidence chain generation, the evidence chain clustering and the intrusion scene construction. Alarmdata related to intrusion scenes become important electronic evidence, which has strong practicability and operability, and provides reliable basis for collecting network data evidence, returning tothe crime scene and litigation cases.

Description

technical field [0001] The invention belongs to the technical field of network security, in particular to a method and device for network evidence collection based on alarm aggregation. Background technique [0002] With the continuous improvement of the level of network attacks and the rapid change of attack tools and attack methods, the use of computer networks to commit crimes is becoming more and more serious. Network forensics is of great significance to combating network crimes. Network forensics is essentially dynamic forensics, that is, it intercepts when an attack event is in progress or during the transmission of evidence data, and reconstructs the criminal scene of network attack by collecting network alarm evidence data to provide accurate and effective evidence for litigation cases. [0003] At present, there are two main methods of network forensics: one is based on honey traps, and the other is based on the analysis of intrusion detection system alarm evidence...

AI Technical Summary

Problems solved by technology

However, limited by the accuracy of the intrusion detection system, it affects the accuracy of the network forensics results. How to eliminate the influence of false positives and negative evidences on the forensics results is a difficult problem for these methods.

Images