Forensics system and method based on user intention detection applied to cloud computing environment

Abstract

The invention discloses a computer forensics system and a method thereof based on user intention detection applied to a cloud computing environment. The system comprises a client end and a cloud proxyserver end. The client end is provided with an initialization driving module, a system control center and a system support module group. The cloud proxy server is deployed with forensics function module group. The invention realizes a lightweight virtual machine monitor at the client end, The forensic tools can directly utilize the convenience and flexibility brought by the hardware virtualization technology, provide tools for rapid analysis and real-time evidence acquisition, and build a cloud proxy server between the client and the server, so that the server can directly use the functions of the forensic system without reconstructing the cloud system architecture. The method overcomes the shortcomings of current forensics after the event, overcomes the flexibility shortcomings of the virtualization technology itself, has a wider application scope than the traditional security system, and ensures the credibility and accuracy of evidence collection.

Description

technical field [0001] The invention relates to the technical field of computer forensics, and relates to a computer forensics system and a forensics method based on user intention detection applied in a cloud computing environment. Background technique [0002] Traditional host-based security systems focus primarily on attack detection, identifying attacks through predefined malicious patterns or detecting anomalies that do not arise from correct input or operating environment. Unfortunately, accurately identifying the latest attack vectors has proven to be an endless loop. The replacement of attack detection methods seems to be always behind the generation of new attacks. To this end, more and more security systems introduce user intent-driven security models to ensure that the behavior of the system matches the user's intent. Since this type of model can be attack-agnostic, it can have a wider range of applications than traditional security systems. The idea of ​​defin...

AI Technical Summary

Problems solved by technology

Traditional computer forensic analysis is often forensic after the event, forensic evidence is easily lost and easily tampered

Images