Audit forensics method, device and equipment based on virtual desktop infrastructure log

Abstract

The application relates to a virtual desktop infrastructure log-based audit forensics method, device and equipment. The method comprises the following steps: collecting multi-source log data in a virtual desktop infrastructure and processing the multi-source log data to obtain an event sequence; constructing a user behavior graph based on the event sequence, generating one or more behavior chains conforming to a behavior template according to a preset behavior template; inputting the behavior chain into a trained risk assessment model to output a risk assessment result; positioning a risk node with a risk reaching a predetermined degree based on the risk assessment result of the behavior chain, constructing a time window forward and / or backward with the risk node as the center, identifying node data in the time window to obtain a forensics fragment set; and applying timestamp authentication based on the forensics fragment set to obtain a timestamp certificate, and storing the forensics fragment set and the timestamp certificate into an immutable storage medium. The application can guarantee the integrity of the evidence while significantly reducing the data volume and processing cost.

Description

Technical Field

[0001] This invention relates to the field of forensics, and in particular to an audit forensics method, apparatus, electronic device, and computer program product based on virtual desktop infrastructure logs. Background Technology

[0002] With the widespread application of cloud computing and virtualization technologies, virtual desktop infrastructure systems have gradually become an important information infrastructure for enterprises and organizations. Virtual desktop infrastructure unifies the management of operating systems and applications through virtualization technology, improving resource utilization and management efficiency, but also raising new security challenges. In this environment, user actions are not limited to local operations but also involve network connections, file sharing, remote access, and other activities. Therefore, monitoring user behavior for risks, such as malicious behavior or unauthorized operations, has become a crucial task in ensuring the security and compliance of virtual desktop infrastructure.

[0003] Existing forensic methods typically employ a full-data scraping approach, which involves collecting, storing, and processing all data within the virtual desktop infrastructure. While this method comprehensively records all user actions, it also has significant drawbacks, primarily in wasted storage space and increased data processing complexity. Due to the massive volume of the full dataset, a large amount of redundant data is generated during the forensic process, placing immense pressure on storage and subsequent data analysis. Furthermore, much of the information in the forensic data is not closely related to the required high-risk behavior, resulting in low forensic efficiency and an inability to quickly locate key evidence. Summary of the Invention

[0004] In view of this, embodiments of this application provide an auditing and forensic method, apparatus, electronic device, and storage medium based on virtual desktop infrastructure logs to solve at least one technical problem.

[0005] This application provides an audit and evidence collection method based on virtual desktop infrastructure logs, comprising: collecting multi-source log data from the virtual desktop infrastructure and processing it to obtain an event sequence, wherein the multi-source log data reflects various preset operation behaviors of users in the virtual desktop environment; constructing a user behavior graph based on the event sequence, matching the user behavior graph according to a preset behavior template to generate one or more behavior chains that conform to the behavior template, wherein the behavior chain includes multiple nodes; inputting the behavior chain into a trained risk assessment model to output a risk assessment result; based on the risk assessment result of the behavior chain, locating risk nodes that have reached a predetermined level of risk, constructing a time window forward and / or backward with the risk node as the center, identifying node data within the time window to obtain a set of evidence fragments; applying for timestamp authentication based on the set of evidence fragments to obtain a timestamp certificate, and storing the set of evidence fragments and the timestamp certificate in an immutable storage medium.

[0006] The audit evidence collection method described above, centered on the risk node, constructs a time window forward and / or backward, and identifies node data within that time window to obtain a set of evidence fragments, including:

[0007] Using the occurrence time of the risk node as a reference point, a time window is constructed forward and / or backward. Within this time window, nodes that have a preset association with the risk node are extracted. Based on the risk node and the nodes to be extracted, a set of evidence fragments is obtained. The nodes to be extracted include: nodes that are associated with the risk node in terms of user identity and operational resources, and nodes that have a sequential dependency relationship in terms of operation.

[0008] The audit evidence collection method described above further includes: extracting data content associated with the node to be extracted and the event type of the risk node; and splicing multiple data contents based on the operation sequence of the behavior chain to form a set of evidence fragments.

[0009] The audit evidence collection method described above extracts the corresponding data content based on the node to be extracted and the event type of the risk node, including: if the event type is a file access operation, locating the storage location of the file in the virtual machine disk and extracting its corresponding disk cluster block; if the event type is a process call operation, identifying the activity status of the process within the time window and extracting the memory pages it occupies; if the event type is a network connection operation, extracting the TCP session information related to the connection.

[0010] As described above, the risk assessment result is characterized by a risk level. The risk assessment result is output by inputting the behavioral chain into a trained risk assessment model, including: extracting feature information based on each node in the behavioral chain; the feature information includes: whether the event type involves sensitive files, whether an external IP is connected, the user's permission level, and the time interval between consecutive operations; scoring the feature information according to the feature information and the preset risk factor weight corresponding to each feature information, and summing the scores of different dimensions of feature information to obtain a total risk assessment value; and determining the risk level based on the total risk assessment value and a preset risk level standard.

[0011] The audit and evidence collection method described above, in processing the multi-source log data to obtain an event sequence, includes: aligning the timestamps in the multi-source log data to obtain time-aligned multi-source log data; extracting fields from the aligned multi-source log data to generate structured event record fields, wherein the structured event record fields include one or more of the following: user identifier, event type, target object, and resource path; and converting the event record fields into an event sequence with semantic annotations based on a preset rule base.

[0012] The audit evidence collection method described above, which applies for timestamp authentication based on the evidence collection fragment set to obtain a timestamp certificate, and stores the evidence collection fragment set and timestamp certificate in an immutable storage medium, includes: calculating a digest value by performing a hash digest algorithm on the evidence collection fragment set; sending the digest value to a timestamp server to initiate a timestamp authentication process; generating a timestamp certificate after the authentication process is completed; and storing the evidence collection fragment set, timestamp authentication certificate, and digest value in an immutable storage medium.

[0013] According to another aspect of this application, an audit and evidence collection device based on virtual desktop infrastructure logs is proposed, comprising: a collection module, used to collect multi-source log data in the virtual desktop infrastructure and process it to obtain an event sequence, wherein the multi-source log data is used to reflect various preset operation behaviors of users in the virtual desktop environment; a behavior chain generation module, used to construct a user behavior graph based on the event sequence, and match the user behavior graph according to a preset behavior template to generate one or more behavior chains that conform to the behavior template, wherein the behavior chain includes multiple nodes; a risk assessment module, used to input the behavior chain into a trained risk assessment model and output a risk assessment result; an evidence fragment acquisition module, used to locate risk nodes that have reached a predetermined level of risk based on the risk assessment result of the behavior chain, construct a time window forward and / or backward with the risk node as the center, identify node data within the time window to obtain a set of evidence fragments; and a timestamp authentication module, used to apply for timestamp authentication based on the set of evidence fragments to obtain a timestamp certificate, and store the set of evidence fragments and the timestamp certificate in an immutable storage medium.

[0014] According to another aspect of this application, an electronic device is proposed, including a processor and a memory, wherein a set of computer program instructions is stored on the memory, and the auditing and forensics method based on virtual desktop infrastructure logs as described above is implemented when the processor executes the set of computer program instructions in the memory.

[0015] According to another aspect of this application, a computer program product is proposed, which includes a set of computer program instructions that, when executed by a processor, implement the auditing and forensics method based on virtual desktop infrastructure logs as described above.

[0016] This application constructs a user behavior graph and generates a behavior chain by collecting and standardizing multi-source log data, and then automatically judges the operation behavior by combining it with a risk assessment mechanism, which effectively improves the accuracy of abnormal behavior identification. At the same time, it adopts the method of extracting evidence data by time window, which significantly reduces data volume and processing cost while ensuring the integrity of evidence. Attached Figure Description

[0017] The preferred embodiments of the present invention will now be described in further detail with reference to the accompanying drawings, wherein:

[0018] Figure 1 This is a flowchart of an audit and forensics method based on virtual desktop infrastructure logs according to an embodiment of this application.

[0019] Figure 2 This is a flowchart of the method for processing multi-source log data in step S110.

[0020] Figure 3 This is a flowchart of the risk assessment model for identifying risk levels based on behavioral chains in step S130.

[0021] Figure 4 This is a flowchart of the method for obtaining a set of evidence fragments using a time window in step S140.

[0022] Figure 5 This is a flowchart of the method for applying for timestamp authentication based on the evidence fragment set to obtain a timestamp certificate in step S150.

[0023] Figure 6 This is a schematic diagram of the application timestamp authentication and verification process according to one embodiment of this application.

[0024] Figure 7 This is a schematic diagram of an audit and forensics device based on virtual desktop infrastructure logs according to an embodiment of this application.

[0025] Figure 8 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] In the following detailed description, reference can be made to the accompanying drawings, which form part of this application and illustrate specific embodiments of the present application. In the drawings, similar reference numerals describe substantially similar components in different figures. Specific embodiments of the present application are described in sufficient detail below to enable those skilled in the art to implement the technical solutions of the present application. It should be understood that other embodiments may also be utilized, or structural, logical, or electrical changes may be made to the embodiments of the present application.

[0028] Virtual Desktop Infrastructure (VDI) is a desktop delivery model based on virtualization technology. Its core idea is to centrally deploy the user's desktop operating system (including the operating system environment, applications, and data) on a server in a data center, providing it to end users remotely via a network. This application directly obtains multi-source log data through the VDI management platform's API for risk assessment.

[0029] Figure 1 This is a flowchart of an audit and forensic method based on virtual desktop infrastructure logs according to an embodiment of this application. Figure 1 As shown, the method includes:

[0030] S110, Collect multi-source log data from the virtual desktop infrastructure and process it to obtain an event sequence. The multi-source log data is used to reflect various preset operation behaviors of the user in the virtual desktop environment.

[0031] S120, construct a user behavior graph based on the event sequence, match the user behavior graph according to a preset behavior template, and generate one or more behavior chains that conform to the behavior template, wherein the behavior chain includes multiple nodes;

[0032] S130, input the behavior chain into the trained risk assessment model and output the risk assessment result;

[0033] S140, Based on the risk assessment results of the behavior chain, locate the risk node that has reached a predetermined level of risk, construct a time window forward and / or backward with the risk node as the center, and identify the node data within the time window to obtain a set of evidence fragments;

[0034] S150, apply for timestamp authentication based on the evidence fragment set to obtain a timestamp certificate, and store the evidence fragment set and timestamp certificate in an immutable storage medium.

[0035] In step S110, raw log data from multiple sources is collected from the virtual desktop infrastructure environment, including but not limited to: cloud desktop management platform logs (such as virtual machine creation / deletion, snapshot operations, etc.), virtual machine internal operation logs (such as file access, process execution, etc.), network communication logs (such as inbound and outbound connection records), and user authentication logs (such as login / logout events). Because different logs have different structures, formats, and time precisions, a standardized processing procedure is used to uniformly convert all types of logs into structured event sequences, forming standard event records containing fields such as timestamp, event type, user identifier, target object, and resource path.

[0036] This application monitors multiple log data sources and comprehensively assesses the risk level of user behavior, which helps improve the accuracy of the assessment. By standardizing multi-source log data, it provides unified and clear input data for subsequent behavior modeling, eliminating the identification difficulties caused by log heterogeneity and significantly improving the accuracy of behavior correlation analysis.

[0037] In step S120, a user behavior graph is constructed based on the event sequence and according to the temporal proximity of the events, user consistency, and operational logic. Each node in the graph represents a standardized event, and the edges between nodes represent temporal or logical chronological relationships. Subsequently, the behavior graph is matched using predefined behavior templates to generate a behavior chain with temporal sequence and logical causal relationships. For example, logging in → opening a sensitive file → launching a cloud storage program → making an external connection can constitute a potentially risky behavior chain.

[0038] In this embodiment, instead of simply using traditional "if-else" or "if-then" conditional rules to match single-point events, "behavioral pattern rules" are introduced to identify complete sequences of behaviors with logical relationships and temporal order.

[0039] In forensic analysis and security testing applications, this application focuses not on isolated events, but on complete behavioral chains composed of multiple events. For example, when an attacker performs an illegal operation, their behavior often manifests as a series of logically sequential steps. Taking a typical scenario as an example, it may include the following event sequence:

[0040] Login to the system during unusual times (such as late at night);

[0041] Then access the financial shared directory;

[0042] Next, launch the compression tool;

[0043] Create an encrypted compressed file;

[0044] Finally, connect to the external cloud storage IP.

[0045] The aforementioned series of actions constitutes a complete attack behavior template. By constructing a user behavior graph and matching it based on preset behavior template rules, the behavioral patterns corresponding to this attack chain can be automatically identified, thereby revealing potential violations or security risks.

[0046] This step identifies the "critical path" of user behavior from a large amount of disordered logs, realizing a structured expression from the original operation to the behavioral intent, and providing behavioral-level input for subsequent risk assessment.

[0047] In step S130, the constructed behavioral chain is input into a trained risk assessment model. This model can be based on rule scoring, decision trees, or lightweight classification algorithms to determine whether the behavioral chain poses a potential threat. For example, if the behavioral chain includes both accessing sensitive directories and uploading data to a public IP address, it can be identified as a "data breach" high-risk chain. These steps automatically identify high-risk behavioral chains, reducing the cost of manual intervention and enhancing the system's responsiveness and controllability to violations.

[0048] In step S140, the risk assessment result can be the risk level of the identified behavioral chain. When the risk level of a node exceeds a preset security threshold, it is considered a high-risk node (a risk node can be either the node with the highest event risk value or a key turning point that triggers the entire behavioral chain to reach a high-risk level). A time sliding window is constructed forward and / or backward, centered on the high-risk node, to capture the range of events related to the high-risk behavior. Based on the operation records within the window, corresponding disk data, memory pages, or network communication summaries are extracted from the virtual machine to generate a structured set of forensic fragments.

[0049] By using time windows to obtain evidence fragments, the volume of evidence data is significantly reduced, storage overhead is lowered, and behavioral chain context information is preserved, ensuring the integrity and interpretability of the evidence.

[0050] In step S150, a hash digest is performed on the aforementioned set of evidence fragments, and the hash digest is timestamped to obtain a timestamp certificate. This certificate proves that the evidence data existed at a certain point in time and has not been tampered with. Subsequently, the timestamp certificate and the evidence data are written together into an immutable storage medium, such as a WORM device or a blockchain platform.

[0051] The above steps provide time-based originality proof and integrity verification mechanisms for electronic evidence data, enabling the data to have legal validity and technical credibility, and can be used in scenarios such as compliance audits, internal accountability, or judicial investigations.

[0052] The method in this application collects and standardizes multi-source log data to construct user behavior graphs and generate behavior chains. It then combines these with a risk assessment mechanism to automatically determine operational behaviors, effectively improving the accuracy of abnormal behavior identification. At the same time, it uses a time window approach centered on high-risk nodes to extract evidence data, which significantly reduces data volume and processing costs while ensuring the integrity of evidence. Finally, it introduces a timestamp authentication mechanism to ensure the authenticity and immutability of electronic evidence, enhancing the credibility and applicability of this method in practice.

[0053] Figure 2 This is a flowchart illustrating the method for processing multi-source log data in step S110. For example... Figure 2As shown, the method includes:

[0054] S111, align the timestamps in the multi-source log data to obtain time-aligned multi-source log data;

[0055] S112, the aligned multi-source log data is processed by extracting fields to generate structured event record fields, which include one or more of the following: user identifier, event type, target object, and resource path.

[0056] S113, Based on a preset rule base, the event record field is converted into an event sequence with semantic annotation.

[0057] In step S111, because log data from different system components (such as virtual desktop infrastructure management platforms, virtual machine internal operating systems, network devices, or authentication systems) may differ in timestamp recording format, precision, or synchronization status, it can easily lead to the same user behavior appearing misaligned, overlapping, or inconsistent in different logs. Specifically,

[0058] This application can timestamp all log sources based on the reference time provided by a master clock server (such as NTP service). For missing or significantly offset log records, the relative time order can be inferred by combining other fields (such as operation order, IP access time, etc.). Through alignment operations, it can ensure that the same behavioral event has a consistent time representation in multi-source logs, laying the foundation for subsequent event fusion and behavioral chain construction.

[0059] In step S112, key fields are extracted from the aligned multi-source log data according to a preset parsing template to generate structured event records. The extracted fields include, but are not limited to: user identifiers (such as username, account ID, authentication token, etc.); event types (such as login, file access, remote connection, process creation, etc.); target objects (such as the accessed filename, connection IP address, executed command, etc.); and resource paths (such as file system paths, URLs, network port numbers, etc.). This application transforms complex and inconsistently formatted raw logs into data entities with a unified structure, freeing subsequent analysis processes from dependence on specific system log formats and improving the system's versatility and scalability.

[0060] For example, from a raw log entry "[2025-06-07 10:33:18] userA accessed / data / secret.docx", the following structured events can be extracted:

[0061] {

[0062] "timestamp": "2025-07-07T10:33:18",

[0063] "user": "userA",

[0064] "event_type": "file_access",

[0065] "target": " / data / secret.docx"

[0066] }

[0067] In step S113, based on a preset rule base or classification template, semantic recognition and tagging are performed on structured event records. For example, the "file_access" operation is tagged as a "resource reading event," and "remote_connect" is tagged as an "external communication event," and the events are arranged into a semantic event sequence according to their chronological order. The tagging process can logically classify events based on multiple dimensions such as event type, target object characteristics, and user role. For example, if the target object path is / secret / and the operation is file_download, the event can be tagged as "accessing sensitive files."

[0068] The method described above, through three steps—time alignment, field extraction, and semantic annotation—can transform raw, multi-source, and heterogeneous log data into a well-structured, semantically clear, and time-accurate event sequence. This process significantly improves the interpretability, traceability, and automation of user behavior in audit analysis, providing a solid data foundation for subsequent behavior mapping, risk assessment, and forensic analysis.

[0069] After standardizing multi-source logs and generating event sequences, a user behavior graph is constructed based on these event sequences. The construction of the user behavior graph includes:

[0070] First, each standardized event is represented as a graph node, which includes at least one or more of the following fields: timestamp: identifying the specific time the event occurred; event type: such as login, file access, remote connection, process creation, etc.; user identity: including username, user ID, or session token, used to identify the initiator of the event; target resource: such as the accessed file path, the external IP address of the connection, the command executed, etc.

[0071] Then, the relationships between events are analyzed to construct graph-structured edges between nodes. These relationships include at least one or more of the following dimensions:

[0072] 1. Event proximity: If the time interval between two events is less than a preset threshold (e.g., 30 seconds), they can be considered to belong to the same operation process;

[0073] 2. Network source consistency: If two events have the same source IP or belong to the same user session, they can be regarded as consecutive operations in the same user link;

[0074] 3. Operational logic consistency: If the target resource of a certain event has an upstream and downstream dependency relationship with the operation result of another event (such as opening a file → uploading a file), then a causal relationship edge is constructed.

[0075] By using the above method, all event nodes are organized into a directed graph called the user behavior graph, where each edge identifies the logical or temporal dependency between events.

[0076] Finally, by using a pre-defined set of behavior rules, the node paths in the graph are traversed and matched to identify behavior chains with complete operational semantics. The rule matching process includes:

[0077] Set an operation sequence template (e.g., "Login → Open sensitive file → Upload to public IP"); find a path in the behavior graph that matches the template structure; the nodes in the matching path must meet the following requirements: consistent user, continuous time, and logically related operations; a successfully matched sequence of nodes constitutes a behavior chain.

[0078] Each behavioral chain can be uniquely identified by an ID, and its attributes can be extracted as input for subsequent risk assessment and data extraction. For example, if a behavioral graph contains the following node sequence:

[0079] [10:02] User A logs in;

[0080] [10:04] User A accesses / files / secret.docx;

[0081] [10:05] User A starts cloud.exe;

[0082] [10:06] User A connects to IP 8.8.8.8.

[0083] Figure 3 This is a flowchart illustrating the method for assessing risk results based on behavioral chains in step S130. Figure 3 As shown, the risk assessment result is characterized by risk level, and the method includes:

[0084] S131, extract feature information based on each node in the behavior chain, the feature information including: whether the event type involves sensitive files, whether an external IP is connected, user permission level, and time interval between consecutive operations;

[0085] S132, the feature information is scored according to the feature information and the preset risk factor weight corresponding to each feature information, and the scores of feature information of different dimensions are accumulated to obtain the total risk assessment value;

[0086] S133, the risk level is determined based on the total risk assessment value and the preset risk level standard.

[0087] In step S131, each event node in the behavior chain is traversed to extract multi-dimensional feature information related to risk judgment. The feature information includes, but is not limited to, the following categories:

[0088] Does the event type involve sensitive resources? For example, did it access sensitive paths (such as / secret / ), confidential files (such as .docx, .xlsx), or configuration files?

[0089] Whether to connect to an external IP: Determine whether the network connection target is an internal whitelist address or an unknown public IP address. If it is the latter, it is considered a potential risk of leakage.

[0090] User permission level: Determines the identity of the user who initiated the action, such as a regular user, an administrator account, or a privileged system account;

[0091] Time interval between consecutive operations: Used to identify batch automated operations or unusually fast instruction chains. For example, an interval of less than 1 second between two consecutive operations may indicate script-driven rather than manual operation;

[0092] Based on the above conditions, the original event records in the behavioral chain are transformed into quantifiable and scoreable multidimensional risk characteristics, forming the basic input for the assessment model.

[0093] In step S132, for each type of feature information, a preset risk factor weight library is introduced to weight and score the features across different dimensions. Each feature item is assigned a risk value based on its risk level and multiplied by the corresponding weight coefficient for that dimension. Finally, all scores are summed to obtain the total risk assessment value for the behavioral chain. A configurable risk factor scoring table is shown below:

[0094]

[0095] For example, a chain of actions may contain the following event characteristics:

[0096] Open / secret.docx;

[0097] Launch cloud.exe;

[0098] Uploaded to public IP address 8.8.8.8;

[0099] The user's identity is admin;

[0100] The operation intervals were 0.6s, 1.1s, and 0.8s, respectively.

[0101] Based on the risk factor scoring table above, the following can be calculated:

[0102] Sensitive files: 4 × 1.0 = 4;

[0103] External connections: 5 × 1.2 = 6;

[0104] Administrator status: 3 × 0.8 = 2.4;

[0105] Quick operation: 2 × 1.0 = 2;

[0106] Total risk assessment value = 14.4.

[0107] In step S133, the risk level category to which the behavioral chain belongs is determined based on the total risk assessment value and the preset risk level classification threshold (standard). For example:

[0108] Risk value ≥ 12: Marked as "High Risk";

[0109] Risk values ​​between 6 and 11: marked as "medium risk";

[0110] Risk value < 6: Marked as "low risk".

[0111] The aforementioned method, through multi-dimensional feature extraction and scoring of events at nodes in the behavioral chain, can assess the risk level of user behavior in a clear and interpretable manner, effectively avoiding subjective errors inherent in traditional manual judgment. This method offers good flexibility and scalability, applicable to rule-based scenarios and also suitable for use in conjunction with model-based methods, thereby significantly improving security awareness and response efficiency in cloud desktop environments.

[0112] According to one embodiment of this application, the risk assessment model can not only score individual event nodes independently, but also comprehensively analyze the sequence characteristics of the entire behavior chain. For example, by comparing with a baseline established based on the user's historical operation patterns, the model can detect abnormal deviations in the frequency and regularity of the current behavior chain; for example, when there is an operation process of gradually escalating privileges in the behavior chain, the model can identify potential signs of unauthorized access; for example, if the behavior chain includes operations with the intention of evading auditing, such as clearing logs, using encryption tools, or obfuscation tools, the model can also determine them as high-risk behaviors.

[0113] By comprehensively considering the overall characteristics of the sequence, this application can reveal more complex and covert threat patterns at the behavioral chain level, rather than being limited to identifying isolated anomalies of individual events, thereby significantly improving the accuracy and comprehensiveness of risk assessment.

[0114] Figure 4 This is a flowchart illustrating the method for obtaining the set of evidence fragments using a time window in step S140. For example... Figure 4 As shown, the method includes:

[0115] S141, using the occurrence time of the risk node as a reference point, construct a time window forward and / or backward, and extract nodes that have a preset association with the risk node within the time window. The nodes to be extracted include: nodes that are associated with the risk node in terms of user identity and operation resources, and nodes that have a sequential dependency relationship in terms of operation.

[0116] S142, Extract the data content associated with the node to be extracted and the event type of the risk node that has reached a predetermined level of risk;

[0117] S143, the multiple data contents are spliced ​​together based on the operation sequence of the behavior chain to form a set of evidence fragments.

[0118] In step S141, a node whose risk reaches a predetermined level is considered a high-risk node, meaning its risk value exceeds a preset threshold. The risk value can be obtained through a predefined rule base or scoring mechanism. For example:

[0119] "Accessing sensitive files": +4 points;

[0120] "Connecting to a non-whitelisted public IP address": +5 points;

[0121] "Execute command with administrator privileges": +3 points.

[0122] A node is considered a high-risk node when its risk value is ≥4.

[0123] Relationships include, but are not limited to, the following two types:

[0124] Association in user identity or operational resources: If the preceding and following nodes belong to the same user identity as the risk node, or involve the same operational resources (such as the same server, database, shared file directory, etc.), then it is determined that the node is associated with the risk node.

[0125] Operational dependencies: If there are logical dependencies between nodes, such as the "access sensitive file" operation can only be performed after the "decryption" operation, or the "upload compressed package" operation can only be performed after the "establish external connection" operation, then it can be determined that the node is associated with a risk node.

[0126] Within the time window, underlying raw data can be extracted by calling the virtualization management platform interface or virtual machine agent, thereby forming a set of forensic fragments. Specifically:

[0127] Calling the virtualization management platform interface

[0128] By calling the API of a virtualization management platform (such as vCenter or Citrix Director), a snapshot operation is performed on the target virtual machine. Subsequently, the generated snapshot files (such as the virtual disk file .vmdk and the memory file .vmem) are mounted offline, and then analyzed and data extracted. This method is non-intrusive to business virtual machines and will not affect their normal operation.

[0129] Virtual machine agent

[0130] Virtual machine agents are lightweight agent programs pre-deployed within the target virtual machine. When the auditing system issues an evidence collection command, the agent program directly captures the required data at the virtual machine's operating system level and sends it back to the evidence collection and analysis module. This method enables higher accuracy and more real-time data acquisition.

[0131] The purpose of this step is to filter out the key operational nodes (high-risk nodes and nodes to be extracted) from the behavioral chain, and to obtain a set of evidence fragments based on the nodes with evidence significance.

[0132] In step S142, for high-risk nodes and nodes to be extracted, the corresponding original data content is found and extracted according to their event types.

[0133] In step S143, to reconstruct the operation process and preserve the behavioral context, this step logically concatenates multiple extracted data fragments according to the chronological order and causal path of the original behavioral chain, forming a structured set of evidence fragments. Each evidence fragment can be verified independently, and after concatenation, they constitute a complete and continuous chain of behavioral evidence. This concatenation operation not only preserves the order of operation execution but also ensures contextual interpretability during subsequent analysis or evidence presentation.

[0134] The aforementioned method can accurately identify key behavioral nodes and their associated operations from complex, multi-node user behavior chains, extracting and structurally assembling data around high-risk behaviors to achieve the goal of obtaining evidence with limited data, strong correlation, and high fidelity. Compared to traditional full-data snapshots or non-selective extraction methods, this method effectively reduces data volume, improves evidence collection efficiency, and enhances the usability and credibility of evidence in auditing, security compliance, and judicial scenarios.

[0135] According to one embodiment of this application, step S142, which involves extracting the data content associated with the node to be extracted and the high-risk node based on their event types, further includes:

[0136] If the event type is a file access operation, locate the storage location of the file in the virtual machine disk and extract its corresponding disk cluster block;

[0137] When the event type is a file access operation (such as open, edit, copy, etc.), the target file path information recorded in the node is first parsed (e.g., / files / secret.docx). Subsequently, based on the file system structure of the virtual machine image, that is, by parsing the file system metadata (such as the MFT record in the NTFS file system or the inode information in the Linux system), the physical storage location of the file on the disk is determined, specifically including the file's starting offset, the disk cluster block number to which it belongs, etc.

[0138] If the event type is a process call operation, then identify the activity status of the process within the time window and extract the memory pages it occupies;

[0139] When the event type is a process call operation (such as starting an application or executing a command), the running state of the process within the event's time window is first identified, including the process ID (PID), memory image address, and number of threads. Based on the identified process information, the key memory pages occupied by the process are further located, which may include code segments, data segments, stack information, or open handle resource pages. A snapshot of these memory page contents is copied for subsequent reconstruction of the process's memory state at the time the event occurred.

[0140] For example, if a user calls cloud.exe within a high-risk behavior chain, the memory page data of that process during its active time can be extracted to analyze whether specific plugins are loaded, whether sensitive content is cached, etc. This enables on-site recording of running program behavior, providing data support for scenarios such as behavioral intent analysis and malicious behavior tracing.

[0141] If the event type is a network connection operation, extract the TCP session information associated with that connection, including the connection object, the transmitted content summary, etc.

[0142] When the event type is a network connection operation (such as accessing a remote IP, uploading a file, etc.), the TCP session information involved in the connection behavior will be extracted, including: the IP addresses and port numbers of both parties to the connection (such as source IP, destination IP, port number); session establishment time and duration; summary information of the network transmission content (such as file name, byte stream characteristic value, etc.); whether it hits a known blacklist address or suspicious communication pattern.

[0143] For example, if a node in the behavior chain is "connected to public IP: 8.8.8.8", the handshake record and data digest of that TCP connection will be retrieved to determine whether there is data leakage, cross-border transmission, or illegal communication. This step extracts key communication information in a digest format without violating user privacy, enabling technical identification and tracing of network behavior.

[0144] The aforementioned method significantly improves forensic efficiency by performing targeted data extraction operations on key nodes in the behavioral chain, avoiding the redundant overhead of full data scraping. This application extracts only disk cluster blocks, memory pages, and network session digests directly related to high-risk behaviors, effectively compressing data volume. Each forensic fragment is strongly associated with a specific behavioral node, possessing clear context and causal relationships, enhancing the interpretability and credibility of the evidence. Furthermore, this application supports rapid location and data reconstruction for three typical high-risk behaviors: file access, process calls, and network connections, improving the response speed and forensic accuracy of security incidents.

[0145] Figure 5 This is a flowchart of the method for applying for timestamp authentication based on the evidence fragment set to obtain a timestamp certificate in step S150. Figure 5 As shown, the method includes

[0146] S151, Calculate the digest value by performing a hash digest algorithm on the set of evidence fragments;

[0147] S152, the digest value is sent to the timestamp server to initiate the timestamp authentication process, and a timestamp certificate is generated after the authentication process is completed;

[0148] S153, the evidence fragment set, timestamp authentication certificate and digest value are stored in an immutable storage medium, the immutable storage medium including: WORM hard disk and blockchain structure.

[0149] In step S151, a hash algorithm is performed on the generated set of evidence fragments to generate a unique corresponding data digest value. The set of evidence fragments typically includes structured data files such as disk cluster blocks, memory page snapshots, and TCP session digests. The hash algorithm can be an algorithm with collision resistance, such as SHA-256 or SM3.

[0150] This digest value is irreversible and unique, and can accurately identify the content status of the evidence data. Once even a single byte of the data is modified, its corresponding digest value will change, thus becoming the core basis for verifying integrity.

[0151] In step S152, the aforementioned digest value is submitted to a timestamp server (such as a timestamp service center, TSA) to apply for timestamp authentication. This step can generate a legally valid proof of the time existence of a specific version of the forensic data, proving that the data existed at a certain point in time and has not been altered.

[0152] In step S153, after authentication is completed, the following three items are jointly written into the immutable storage medium: the collection of evidence fragments (original data content); the corresponding digest value (Hash); and the timestamp authentication certificate (a .tsa file issued by the TSA).

[0153] Immutable storage media is a storage technology in which data, once written, cannot be modified or deleted without authorization within a preset lifespan. Its specific implementations may include: write-once-read-many (WORM) media, or storage systems that adopt distributed consensus and chain data structures (such as blockchain).

[0154] Among them, WORM hard drives (Write Once, Read Many) contain data that cannot be modified or deleted after it is written, making them suitable for compliant scenarios;

[0155] Blockchain-structured storage system: Through a chain structure and consensus mechanism, it ensures that evidence cannot be tampered with once it is written to the network, making it suitable for judicial or arbitration evidence presentation scenarios.

[0156] The auditing system in this application can connect to the management APIs provided by virtual desktop infrastructures (such as vCenter and Citrix Director) through standardized interfaces. It collects and records key management operation logs in the virtual desktop environment in real time as evidence fragment data and writes them to tamper-proof storage media to ensure the integrity and traceability of operation records. Key management operation logs can be divided into four types based on operation type: virtual machine creation, snapshot operation, virtual machine migration, and permission change.

[0157] Virtual machine creation refers to the act of creating, cloning, or deploying virtual desktops in batches on the platform. Operation logs for this type of operation can reflect information such as the virtual machine's creation time, creator, template source, and host, which helps in auditing for potential risks such as unauthorized virtual desktop creation or unauthorized access to high-privilege environments.

[0158] Snapshot operations include the creation, deletion, and rollback of virtual machine snapshots. Snapshots record the state of a virtual machine at a specific point in time. If used to evade behavioral tracking (e.g., rolling back after completing sensitive operations), they may conceal data tampering or malicious behavior. Therefore, the auditing system should fully record the snapshot operation time, object, and executor information for behavioral reconstruction and data consistency verification.

[0159] Virtual machine migration includes cold migration, hot migration (vMotion), and storage migration. These operations may cause changes in the virtual machine's running node, affecting the accuracy of log collection points and forensic paths. By recording migration behavior and source / target host information, the virtual machine's running trajectory can be tracked, identifying any risky operations that bypass security monitoring nodes.

[0160] Permission changes involve adding, modifying, or revoking user or service account permissions. These events are closely related to unauthorized actions. The auditing system should capture information such as the object of the permission change, the content of the change, and the time of the change. This allows for cross-checking of user permissions during sensitive operations to identify potential abuse or escalation of privileges.

[0161] By auditing and storing the aforementioned management operation logs, we can gain a comprehensive understanding of the key change processes in the virtual desktop infrastructure environment and provide trusted log support for critical behaviors, thus providing strong data support for compliance review, security audit, and subsequent forensic analysis.

[0162] Figure 6 This is a schematic diagram illustrating the application timestamp authentication and verification process according to one embodiment of this application. Figure 6 As shown, the application process for timestamp authentication includes:

[0163] (1) Submit the digest value generated based on the evidence fragment set as timestamp application data to the TSA;

[0164] (2) After receiving the digest, the TSA certification authority records the time of receipt and binds it to the digest value;

[0165] (3) The TSA digitally signs the time information and digest value to generate a timestamp file (such as .tsa format), which is the timestamp certificate;

[0166] (4) Receive the returned timestamp certificate and establish a binding relationship with the original digest.

[0167] If originality verification of this set of evidence fragments is required in the future, the digest value of this set of evidence fragments will be recalculated to obtain digest value 1, and then compared with digest value 2 in the stored timestamp certificate:

[0168] If the summary value 1 and the summary value 2 are the same, it means that the evidence has never been tampered with since the timestamp was issued;

[0169] If the digest value 1 and the digest value 2 are inconsistent, it means that the data has been changed after issuance, the timestamp is invalid, and the evidence is not credible.

[0170] This mechanism addresses the key technical challenges of traditional electronic evidence, namely, the uncertainty of its generation time and the inability to confirm the authenticity of its content.

[0171] As described above, by combining digest generation, timestamp authentication, and immutable storage, the above method establishes a strongly bound path of original proof for key forensic data, significantly enhancing the credibility of electronic evidence in compliance, auditing, and judicial applications. Combined with timestamp services, this application can objectively, stably, and technically confirm the existence, integrity, and generation time of forensic data without relying on subjective explanations.

[0172] Corresponding to the method embodiments of this application, this application also provides an auditing and forensics apparatus based on virtual desktop infrastructure logs, such as... Figure 7 As shown, the audit evidence collection device 100 includes:

[0173] The acquisition module 101 is used to acquire multi-source log data in the virtual desktop infrastructure and process it to obtain an event sequence. The multi-source log data is used to reflect various preset operation behaviors of users in the virtual desktop environment.

[0174] The behavior chain generation module 102 is used to construct a user behavior graph based on the event sequence, match the user behavior graph according to a preset behavior template, and generate one or more behavior chains that conform to the behavior template, wherein the behavior chain includes multiple nodes.

[0175] The risk level determination module 103 is used to input the behavior chain into the trained risk assessment model and output the risk assessment result.

[0176] The evidence fragment acquisition module 104 is used to locate risk nodes that have reached a predetermined level of risk based on the risk assessment results of the behavior chain, construct a time window forward and / or backward with the risk node as the center, and identify node data within the time window to obtain a set of evidence fragments.

[0177] The timestamp authentication module 105 is used to apply for timestamp authentication based on the evidence fragment set to obtain a timestamp certificate, and to store the evidence fragment set and the timestamp certificate in an immutable storage medium.

[0178] Figure 8 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of this application. The electronic device can be implemented as a server or other various terminal devices, such as desktop personal computers, tablet computers, laptop computers, mobile phones, etc., including a processor 601 and a memory 602. The memory 602 stores a program instruction set. When the processor 601 executes the program instruction set in the memory 602, it implements any of the aforementioned audit and forensics methods based on virtual desktop infrastructure logs.

[0179] Specifically, the processor 601 may include a central processing unit (CPU), an application specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of the present invention.

[0180] Memory 602 may include mass storage for data or instructions. For example, and not limitingly, memory 602 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 602 may include removable or non-removable (or fixed) media. Where appropriate, memory 602 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 602 is non-volatile solid-state memory.

[0181] Memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the auditing and forensics method based on virtual desktop infrastructure logs provided by this invention.

[0182] In one example, the electronic device may also include a communication interface 603 and a bus 604. The processor 601, memory 602, and communication interface 603 are connected via bus 604 and communicate with each other. Communication interface 603 is primarily used to enable communication between modules, devices, units, and / or equipment in the embodiments of the present invention. Bus 604 includes hardware, software, or both, coupling components of the online data traffic metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) Interconnect, Industry Standard Architecture (ISA) bus, Infinite Bandwidth Interconnect, Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 604 may include one or more buses. Although specific buses are described and illustrated in the embodiments of the present invention, the present invention is contemplated by any suitable bus or interconnect.

[0183] The present invention also provides a computer-readable storage medium storing computer program instructions thereon, which, when executed by a processor, implement any of the audit and forensic methods based on virtual desktop infrastructure logs in the foregoing embodiments. The computer-readable storage medium can be any medium that can tangibly contain or store computer-executable instructions for use by or in conjunction with an instruction execution system, apparatus, or device. The storage medium can be a transient computer-readable storage medium or a non-transitory computer-readable storage medium. Non-transitory computer-readable storage media may include, but are not limited to, magnetic storage devices, optical storage devices, and / or semiconductor storage devices. Examples of such storage devices include, for example, magnetic disks, optical discs based on CD, DVD, or Blu-ray technology, and persistent solid-state storage such as flash memory and solid-state drives.

[0184] This invention also provides a computer program product comprising a set of computer program instructions, which, when executed by a processor, implement any of the auditing and forensic methods based on virtual desktop infrastructure logs described in the foregoing embodiments. The computer program product includes, but is not limited to, application installation packages, application plugins, and mini-programs that can run within certain applications, all published on websites or in app stores.

[0185] It should be clarified that the present invention is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present invention is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of the present invention.

[0186] The above embodiments are for illustrative purposes only and are not intended to limit the invention. Those skilled in the art can make various changes and modifications without departing from the scope of the invention. Therefore, all equivalent technical solutions should also fall within the scope of the invention.

Claims

1. A method for auditing and obtaining evidence based on virtual desktop infrastructure logs, characterized in that, include: Multi-source log data is collected from the virtual desktop infrastructure and processed to obtain an event sequence. The multi-source log data is used to reflect various preset operation behaviors of users in the virtual desktop environment. A user behavior graph is constructed based on the event sequence. According to a preset behavior template, the user behavior graph is matched to generate one or more behavior chains that conform to the behavior template. The behavior chain includes multiple nodes. The method also includes: representing the standardized events as graph nodes; constructing graph structure edges between nodes based on the correlation between events; and matching the node paths in the graph through a preset set of behavior rules to identify behavior chains with complete operational semantics. The behavioral chain is input into the trained risk assessment model, which then outputs the risk assessment result. Based on the risk assessment results of the behavioral chain, risk nodes that have reached a predetermined level of risk are located. A time window is constructed forward and / or backward from this risk node as the center. Node data within this time window is identified to obtain a set of evidence fragments. Specifically, a time window is constructed forward and / or backward from the occurrence time of the risk node as the reference point. Within this time window, nodes with a predetermined association with the risk node are extracted. Based on the risk node and the nodes to be extracted, a set of evidence fragments is obtained. The nodes to be extracted include: nodes associated with the risk node in terms of user identity and operational resources, and nodes with sequential operational dependencies. Apply for timestamp authentication based on the evidence fragment set to obtain a timestamp certificate, and store the evidence fragment set and timestamp certificate in an immutable storage medium.

2. The audit evidence collection method according to claim 1, characterized in that, Further includes: Extract the corresponding data content based on the node to be extracted and the event type of the risk node; Multiple data contents are spliced ​​together based on the operational sequence of the behavioral chain to form a set of evidence fragments.

3. The audit evidence collection method according to claim 1, characterized in that: Based on the node to be extracted and the event type of the risk node, the data content associated with it is extracted, including: If the event type is a file access operation, locate the storage location of the file in the virtual machine disk and extract its corresponding disk cluster block; If the event type is a process call operation, then identify the activity status of the process within the time window and extract the memory pages it occupies; If the event type is a network connection operation, extract the TCP session information associated with that connection.

4. The audit evidence collection method according to claim 1, characterized in that, The risk assessment results are represented by risk levels. The risk assessment results, output by inputting the behavioral chain into the trained risk assessment model, include: Based on each node in the behavior chain, feature information is extracted, including: whether the event type involves sensitive files, whether an external IP is connected, user permission level, and time interval between consecutive operations; Based on the feature information and the preset risk factor weight corresponding to each feature information, the feature information is scored, and the scores of feature information in different dimensions are weighted and accumulated to obtain the total risk assessment value. The risk level is determined based on the total risk assessment value and the preset risk level classification standards.

5. The audit evidence collection method according to claim 1, characterized in that, The event sequence obtained by processing the multi-source log data includes: Align the timestamps in the multi-source log data to obtain time-aligned multi-source log data; The aligned multi-source log data is processed by extracting fields to generate structured event record fields, which include one or more of the following: user identifier, event type, target object, and resource path. The event record fields are converted into event sequences with semantic annotations based on a preset rule base.

6. The audit evidence collection method according to claim 1, characterized in that, Applying for timestamp authentication based on the set of evidence fragments to obtain a timestamp certificate, and storing the set of evidence fragments and the timestamp certificate in an immutable storage medium includes: The hash digest algorithm is used to calculate the digest value of the evidence fragment set; The digest value is sent to the timestamp server to initiate the timestamp authentication process. After the authentication process is completed, a timestamp certificate is generated. The evidence fragment set, timestamp authentication certificate, and digest value are stored in an immutable storage medium.

7. An auditing and forensic device based on virtual desktop infrastructure logs, characterized in that, include: The acquisition module is used to collect multi-source log data from the virtual desktop infrastructure and process it to obtain an event sequence. The multi-source log data is used to reflect various preset operation behaviors of users in the virtual desktop environment. The behavior chain generation module is used to construct a user behavior graph based on the event sequence, match the user behavior graph according to a preset behavior template, and generate one or more behavior chains that conform to the behavior template. The behavior chain includes multiple nodes. It also includes: representing standardized events as graph nodes; constructing graph structure edges between nodes based on the correlation between events; and matching the node paths in the graph through a preset set of behavior rules to identify behavior chains with complete operational semantics. The risk assessment module is used to input the behavior chain into the trained risk assessment model and output the risk assessment result; The evidence fragment acquisition module is used to locate risk nodes that have reached a predetermined level of risk based on the risk assessment results of the behavior chain, construct a time window forward and / or backward with the risk node as the center, identify node data within the time window to obtain a set of evidence fragments, wherein the time window is constructed forward and / or backward with the occurrence time of the risk node as the reference point, and extract nodes to be extracted within the time window that have a preset association with the risk node; and obtain a set of evidence fragments based on the risk node and the nodes to be extracted, wherein the nodes to be extracted include: nodes that are associated with the risk node in terms of user identity and operational resources, and nodes that have a sequential dependency relationship in terms of operation; The timestamp authentication module is used to apply for timestamp authentication based on the evidence fragment set to obtain a timestamp certificate, and to store the evidence fragment set and the timestamp certificate in an immutable storage medium.

8. An electronic device, characterized in that, This includes a processor and a memory, the memory storing a set of computer program instructions, which, when executed by the processor, implement the auditing and forensics method based on virtual desktop infrastructure logs as described in any one of claims 1-6.

9. A computer program product, characterized in that, It includes a set of computer program instructions that, when executed by a processor, implement the auditing and forensics method based on virtual desktop infrastructure logs as described in any one of claims 1-6.

Images