Automated event forensics method and apparatus
By automating the acquisition and processing of multi-source evidence data in virtualized environments and using object mapping and time correction models to generate consistent evidence chains, the problem of reliance on manual operation and evidence tampering in the evidence collection process in virtualized environments is solved, and efficient and reliable evidence chain construction and storage are achieved.
Patent Information
- Application Number
- CN202610586194.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-04-29
- Publication Date
- 2026-07-24
AI Technical Summary
In a virtualized environment, existing technologies struggle to collect, compare, and stitch together multi-source evidence data in a short time, leading to reliance on manual operation in the evidence collection process. Furthermore, attackers can tamper with logs to undermine the credibility of evidence, affecting the integrity, verifiability, and traceability of the evidence.
By acquiring evidence collection trigger signals, control plane event data is obtained from the virtualization management system to determine the target object set, collect and standardize host-side and guest-side evidence data, associate them using an object mapping table, and perform time alignment based on a timeline correction model to generate an event timeline. Finally, the evidence is encapsulated into immutable evidence storage.
It achieves automated, verifiable, and traceable evidence chain data, with consistent object relationships and time benchmarks, improving the integrity and reliability of evidence collection and reducing the risk of human intervention and tampering.
Smart Images
Figure CN122451891A_ABST
Abstract
Description
Technical Field
[0001] This application relates to network security technology, and in particular to an automated incident forensics method and apparatus. Background Technology
[0002] In existing virtualization environments, incident forensics typically rely on control plane event data generated by the virtualization management system, host-side logs and configuration data generated by the virtualization host, and operating system logs and behavioral data generated inside the guest virtual machine.
[0003] Because the aforementioned multi-source evidence data differs in terms of collection interfaces, field naming, object identification methods, and time representation, and because evidence preservation and evidence chain construction need to be completed within a short period after an actual event, the evidence collection process often relies on manual login to different systems to export data, manual comparison of object relationships, and manual splicing of timelines. Furthermore, when the attack occurs at the virtualization host or management layer, the guest virtual machine may lack direct records, making it difficult to reflect the actual attack chain by relying solely on guest-side evidence, thus affecting the completeness, verifiability, and traceability of the evidence.
[0004] It's worth noting that the aforementioned problems arise because virtualization architectures are inherently layered and isolated. The host machine has higher visibility into virtual switching components, virtual disks, and the running state of virtual machines, while guest virtual machines can only perceive events from their own virtual hardware perspective. This means that attacks or control plane operations at the host level may not leave usable records on the guest side. Furthermore, the field systems and object identifiers of control plane events, host-side evidence, and guest-side evidence are inconsistent. The same guest virtual machine may appear in different forms in different data sources, such as a unique virtual machine identifier, object identifier, virtual machine configuration path, virtual disk path, or virtual network card identifier, accompanied by changes such as migration and renaming, making object mapping difficult. In addition, the time zones, time bases, and clock synchronization states used by multi-source evidence data differ, resulting in clock offsets and clock drifts, making it difficult to directly compare the sequence of events. When attackers gain host or management layer privileges, they possess strong anti-forensic capabilities and may destroy the credibility of evidence by cleaning or tampering with logs. Therefore, verifiable integrity and immutability guarantees are needed for the evidence generation and storage processes. Summary of the Invention
[0005] This application provides an automated event forensics method and apparatus for forming a verifiable, traceable chain of evidence data with consistent object relationships and a consistent time reference.
[0006] Firstly, this application provides an automated event forensics method, including: Acquire evidence collection trigger signal and respond to the evidence collection trigger signal to obtain control plane event data from the virtualization management system; The target object set is determined based on the control plane event data, and the target object set includes at least the target virtualization host machine and the target guest virtual machine; Host-side evidence data is collected for the target virtualization host machine, and guest-side evidence data is collected for the target guest virtual machine. The control plane event data, the host-side evidence data, and the guest-side evidence data are then standardized to obtain standardized evidence data. The standardized evidence data is associated with objects based on the object mapping table to obtain associated evidence data, and the associated evidence data is time-aligned based on the timeline correction model to generate an event timeline. The event timeline and the corresponding associated evidence data are subjected to evidence encapsulation processing to obtain evidence encapsulation data packets, which are then written into immutable evidence storage.
[0007] Secondly, this application provides an automated event forensics device, comprising: The acquisition response module is used to acquire the evidence acquisition trigger signal and respond to the evidence acquisition trigger signal to acquire control plane event data from the virtualization management system; An object determination module is used to determine a set of target objects based on the control plane event data, wherein the set of target objects includes at least a target virtualization host and a target guest virtual machine; The data acquisition and processing module is used to acquire host-side evidence data for the target virtualization host machine and guest-side evidence data for the target guest virtual machine, and to standardize the control plane event data, the host-side evidence data and the guest-side evidence data to obtain standardized evidence data. The association alignment module is used to associate objects with the standardized evidence data based on the object mapping table to obtain associated evidence data, and to align the associated evidence data with time based on the timeline correction model to generate an event timeline; The encapsulation storage module is used to perform evidence encapsulation processing on the event timeline and the corresponding associated evidence data to obtain an evidence encapsulation data packet, and then write the evidence encapsulation data packet into the immutable evidence storage.
[0008] Thirdly, this application provides an electronic device, comprising: Processor; and, Memory for storing the executable instructions of the processor; The processor is configured to perform any of the possible methods described in the first aspect by executing the executable instructions.
[0009] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement any of the possible methods described in the first aspect.
[0010] The automated event forensics method and apparatus provided in this application acquire and respond to forensics trigger signals, obtain control plane event data from the virtualization management system, determine a set of target objects based on the control plane event data, collect host-side evidence data for the target virtualization host machine, and collect guest-side evidence data for the target guest virtual machine. The control plane event data, host-side evidence data, and guest-side evidence data are then standardized to obtain standardized evidence data. Object association is performed on the standardized evidence data based on an object mapping table to obtain associated evidence data. The associated evidence data is then time-aligned based on a timeline correction model to generate an event timeline. Finally, evidence encapsulation processing is performed on the event timeline and the corresponding associated evidence data to obtain an evidence encapsulated data packet. This evidence encapsulated data packet is then written into an immutable evidence storage device, thereby forming a verifiable, traceable evidence chain with consistent object relationships and a consistent timeline. Attached Figure Description
[0011] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.
[0012] Figure 1 This is a flowchart illustrating an automated event forensics method according to an example embodiment of this application; Figure 2 This is a flowchart illustrating a specific implementation of S160 according to an example embodiment of this application; Figure 3 This is a schematic diagram of the structure of an automated event forensics apparatus according to an example embodiment of this application; Figure 4 This is a schematic diagram of the structure of an electronic device according to an example embodiment of this application.
[0013] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation
[0014] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.
[0015] Figure 1 This is a flowchart illustrating an automated event forensics method according to an example embodiment of this application. Figure 1 As shown, the method provided in this embodiment includes: S110, Obtain the evidence collection trigger signal.
[0016] In this step, you may first receive high-risk behavior alarms output by the detection system. These high-risk behavior alarms may include one or more of the following: abnormal login alarms for the virtualization management system, sensitive resource operation alarms, and audit policy change alarms. Then, you may generate an evidence collection trigger signal based on the high-risk behavior alarms.
[0017] S120: Respond to the evidence collection trigger signal and obtain control plane event data from the virtualization management system.
[0018] In this step, task data and event data may be obtained. The task data and event data shall include at least the operator identifier, source identifier, event type identifier, object identifier, and event timestamp.
[0019] Specifically, task and event data can be obtained by calling preset query interfaces through an interface session established with the virtualization management system. The interface session can be an HTTPS-based API session and / or a Syslog-based log subscription session. The preset query interfaces include task query interfaces and event query interfaces. Then, the task query interface is called to obtain a set of task records, and the event query interface is called to obtain a set of event records. During the retrieval process, a batch identifier and a source identifier are appended to each task record and each event record.
[0020] Next, the task record set and event record set are parsed to extract the operator identifier, source identifier, event type identifier, object identifier, and event timestamp. The operator identifier includes at least a user identifier and / or a session identifier; the source identifier includes at least a source address identifier and / or a client identifier; the event type identifier includes at least a task name identifier and / or an event name identifier; and the object identifier includes at least a virtual machine object identifier and / or a host machine object identifier and / or a data storage object identifier. After field parsing, records with missing fields are marked as field exception records, and the corresponding missing field identifier is recorded.
[0021] S130. Determine the set of target objects based on the control plane event data.
[0022] In this step, the target object set may be determined based on control plane event data, wherein the target object set includes at least the target virtualization host and the target guest virtual machine.
[0023] Optionally, a first set of object identifiers can be obtained by parsing control plane event data, and then the first set of object identifiers can be mapped to a set of target objects. The set of target objects includes one or more of the following: guest virtual machine identifier, virtualization host identifier, and storage location identifier, which correspond to the first set of object identifiers.
[0024] Specifically, this can involve parsing the fields of each event record and / or task record in the control plane event data, extracting the object identifier field, and determining the object type identifier. The object identifier field includes at least one or more of the following: virtual machine object identifier, virtualization host object identifier, data storage object identifier, and network object identifier. Then, the extracted object identifier fields are deduplicated and aggregated according to the object type identifier, and a corresponding event type identifier and event timestamp are recorded for each object identifier, thus forming a first set of object identifiers.
[0025] Next, for each object identifier in the first object identifier set, the object query interface of the virtualization management system is called to obtain the object metadata corresponding to the object identifier. The object metadata includes at least one or more of the following: guest virtual machine identifier, virtualization host identifier, and storage location identifier. Based on the object metadata, a correspondence is established between the object identifier and the guest virtual machine identifier, virtualization host identifier, and storage location identifier, and the guest virtual machine identifiers, virtualization host identifiers, and storage location identifiers with corresponding relationships are aggregated into a target object set.
[0026] Optionally, the integrity verification performed on the target object set according to the correspondence relationship as described above includes at least: verifying whether each guest virtual machine identifier has a corresponding virtualization host identifier and storage location identifier; when the verification fails, marking the corresponding guest virtual machine identifier as a mapping exception object and recording the missing identifier type; when the verification succeeds, writing the guest virtual machine identifier, virtualization host identifier, and storage location identifier into the target object set in the form of the same associated entry.
[0027] S140. Collect host-side evidence data for the target virtualization host machine and guest-side evidence data for the target guest virtual machine.
[0028] Optionally, one or more of the following can be collected: host authentication evidence, host configuration change evidence, host module and persistence evidence, host virtual machine operation evidence, and host storage access evidence. Among them, the host-side evidence data includes at least the host event timestamp, the host execution entity identifier, the host action type identifier, and the host object identifier.
[0029] Specifically, this can be achieved by executing a pre-defined evidence collection script on the target virtualization host and / or calling the host audit query interface of the virtualization management system to obtain corresponding host log files, audit records, and runtime information in parallel according to a pre-defined list of evidence types. The pre-defined list of evidence types includes at least host authentication evidence, host configuration change evidence, host module and persistence evidence, host virtual machine operation evidence, and host storage access evidence, and each type of evidence is configured with a corresponding set of collection commands, a set of log paths, and a collection time window.
[0030] The collected host log files, audit records, and runtime information are parsed to extract host event timestamps, host execution entity identifiers, host action type identifiers, and host object identifiers. The host execution entity identifier includes at least the host local account identifier and / or directory service account identifier and / or service process identifier; the host action type identifier includes at least one or more of the following: authentication action identifier, configuration change action identifier, module loading action identifier, virtual machine lifecycle action identifier, and storage access action identifier; and the host object identifier includes at least one or more of the following: unique host identifier, virtual switch component identifier, port group identifier, virtual machine object identifier, and data storage object identifier. The extracted results are then written into the host-side evidence data.
[0031] Furthermore, the aforementioned evidence of host configuration changes includes: evidence of virtual switch component configuration changes and / or evidence of port group configuration changes, wherein the evidence of virtual switch component configuration changes and / or evidence of port group configuration changes includes at least security policy parameter change records.
[0032] Optionally, for collecting guest-side evidence data for the target guest virtual machine, one or more of the following can be collected: guest process evidence, guest network connection evidence, guest authentication evidence, and guest critical path integrity evidence. Among them, critical path integrity evidence includes hash values for preset critical paths.
[0033] Specifically, this can be achieved by executing a pre-defined guest evidence collection script within the target guest virtual machine via a guest agent and / or by calling the guest operation interface through the virtualization management system to trigger the pre-defined guest evidence collection script. The script then collects corresponding process lists, network connection lists, authentication logs, and critical path file sets in parallel according to a pre-defined evidence type list. The pre-defined evidence type list includes at least guest process evidence, guest network connection evidence, guest authentication evidence, and guest critical path integrity evidence, and each type of evidence is configured with a corresponding set of collection commands, a set of log paths, and a collection time window.
[0034] Next, the set of critical path files corresponding to the preset critical path is obtained, and a hash calculation is performed on each file in the critical path file set to generate a file hash value. The hash calculation uses a preset hash algorithm, including SHA-256 and / or SHA-1. Then, the file hash value is associated and stored with the corresponding file path identifier, file size identifier, and file modification time identifier, thereby forming evidence of critical path integrity.
[0035] S150. Standardize the control plane event data, host-side evidence data, and guest-side evidence data to obtain standardized evidence data.
[0036] Specifically, for the above standardization process, the fields of multi-source evidence data can be uniformly named, and then the time representation of multi-source evidence data can be converted into a unified time base while retaining the original field values and source identifiers of the multi-source evidence data.
[0037] S160. Based on the object mapping table, perform object association on the standardized evidence data to obtain associated evidence data.
[0038] In automated event forensics in virtualized environments, evidence typically originates from multiple sources, including control plane event data, evidence data from the virtualization host, and evidence data from the guest virtual machine. Due to differences in object identification systems, field representation methods, collection granularity, and generation chains among different data sources, the same guest virtual machine may appear in different forms in different evidence data, such as a unique virtual machine identifier, virtual machine configuration path, virtual disk path, or virtual network card identifier. Furthermore, the correspondence between the guest virtual machine and its hosting virtualization host may dynamically change with operational actions such as migration, restart, and reconfiguration. If existing forensics processes lack a unified object mapping and association mechanism, they often rely on manual comparison of multiple source fields to establish relationships between evidence, resulting in low forensics efficiency, poor consistency in association, and difficulty in ensuring the integrity of the evidence chain.
[0039] In response, Figure 2 This is a flowchart illustrating a specific implementation of S160 according to an example embodiment of this application. For example... Figure 2 As shown, the above-mentioned S160 includes: S210. Determine a subset of associated evidence for the same guest virtual machine based on one or more of the following: virtual machine unique identifier, virtual machine configuration path, virtual disk path, and virtual network card identifier.
[0040] Specifically, this can involve extracting the virtual machine's unique identifier, virtual machine configuration path, virtual disk path, and virtual network interface card (NIC) identifier fields from standardized evidence data. The virtual machine's unique identifier is then used as the primary key, and the virtual machine configuration path, virtual disk path, and NIC identifier are used as candidate keys to create a virtual machine association index. Based on this index, matching clustering is performed on the standardized evidence data, grouping evidence records matching the same primary key and / or any candidate key into the same evidence group. In cases where a primary key is missing, the same evidence group is determined based on a candidate key matching consistency threshold. Each evidence group is then output as a subset of associated evidence for the same guest virtual machine.
[0041] S220. Determine the association between the guest virtual machine and the corresponding virtualization host machine based on the host machine's unique identifier and host machine association identifier.
[0042] Specifically, this involves retrieving the mapping records between the unique identifiers of guest virtual machines and the unique identifiers of the host machine from the object mapping table, and extracting the unique identifier and associated identifier fields of the host machine from the standardized evidence data. A consistency check is then performed between the host machine associated identifier and the mapping records in the object mapping table to determine the association between the guest virtual machine and the virtualization host. If the consistency check fails, the corresponding association is marked as an abnormal association, and the reason for the abnormality is recorded. If the consistency check succeeds, the association record containing the unique identifier of the guest virtual machine, the unique identifier of the host machine, and the associated identifier of the host machine is output.
[0043] S230. Output the association results, including the basis for object association.
[0044] Specifically, this can involve generating association result entries for associated evidence data. Each association result entry should include at least the unique identifier of the guest virtual machine, the unique identifier of the host machine, the basis for object association, and the association confidence level. The basis for object association includes the primary key field identifier and / or candidate key field identifier and their matching results. The association confidence level is calculated based on the number of matched fields, the satisfaction of field consistency thresholds, and consistency verification results. The association result entries are then output after establishing a reference relationship with the corresponding associated evidence data.
[0045] In S160 above, an object mapping table serves as the cross-source object identity resolution layer. It maps and normalizes object identifiers such as virtual machine unique identifiers, virtual machine configuration paths, virtual disk paths, and virtual network card identifiers appearing in standardized evidence data, enabling different representations of the same object from different sources to be resolved into the same logical object. Based on this, the consistency determination and verification of the relationship between the guest virtual machine and the host machine are performed using the host machine unique identifier and host machine association identifier, offsetting the uncertainty brought about by the dynamic changes in the bearer relationship in the virtualization environment. In the output stage, the key fields used for association and their matching / verification results are output along with the association results as the basis for object association. This makes the association process interpretable, verifiable, and traceable, thereby providing stable object consistency support for time alignment, timeline construction, and evidence encapsulation in automated forensics.
[0046] This allows for the automatic merging of evidence records scattered across different data sources and expressed with different identifiers into a subset of associated evidence from the same guest virtual machine, reducing manual comparison costs and minimizing missed associations. Furthermore, by utilizing the unique host machine identifier and host machine association identifier to determine the bearing relationship between the guest virtual machine and the virtualization host machine, the consistency and traceability of object relationships can be maintained even in the event of migration or dynamic scheduling, reducing the probability of incorrect associations. In addition, the output includes association results containing the basis for object associations, ensuring that each association has field-level evidence and verifiability. This provides a consistent object boundary and interpretation chain for subsequent timeline correction, evidence encapsulation, and immutable evidence preservation, thereby improving the integrity and admissibility of the evidence chain.
[0047] S170. Based on the timeline correction model, the associated evidence data is time-aligned to generate an event timeline.
[0048] Optionally, the aforementioned timeline correction model is used to estimate clock drift between multi-source evidence data. Correspondingly, in this step, drift parameters can be calculated based on at least one type of cross-source comparison event, the timestamps of the associated evidence data can be corrected according to the drift parameters, and then an event timeline containing the correction basis can be generated. The cross-source comparison events include one or more of authentication events, resource operation events, and network session events.
[0049] Specifically, this can involve filtering event records belonging to cross-source comparison events from associated evidence data and constructing cross-source event pairs for each cross-source comparison event. Each cross-source event pair includes a first event timestamp from a first evidence source and a second event timestamp from a second evidence source. Then, the time difference sequence between the first and second event timestamps is calculated, and a least-squares fit is used based on the time difference sequence to obtain clock offset parameters and clock drift rate parameters. The drift parameters include at least clock offset parameters and / or clock drift rate parameters.
[0050] Next, a corresponding evidence source identifier is determined for each evidence record in the associated evidence data, and a drift parameter corresponding to that evidence source identifier is selected. The event timestamp of the evidence record is corrected according to a correction function to obtain a corrected timestamp, where the correction function satisfies: Corrected timestamp = Event timestamp + Clock offset parameter + Clock drift rate parameter × (Event timestamp - Reference timestamp). The corrected timestamp is then written into the associated evidence data as the unified time reference timestamp for the evidence record.
[0051] Finally, the associated evidence data is sorted according to the unified time base timestamp and a timeline entry sequence is generated; a correction basis field is written for each timeline entry, which includes at least the evidence source identifier, drift parameter, reference timestamp, and the cross-source comparison event type identifier; and the timeline entry sequence is output as an event timeline after establishing a reference relationship with the corresponding associated evidence data.
[0052] S180. Perform evidence encapsulation processing on the event timeline and corresponding related evidence data to obtain an evidence encapsulation data package.
[0053] Specifically, a hash digest can be generated from the associated evidence data, a digital signature can be performed on the hash digest to obtain a signature value, and a timestamp can be performed on the signature value to obtain a timestamp token. Then, the event timeline, associated evidence data, hash digest, signature value, and timestamp token are encapsulated into an evidence encapsulation data package.
[0054] S190. Encapsulate the evidence into a data packet and write it into an immutable evidence storage.
[0055] Optionally, the evidence encapsulation data packet can be written to an object storage with an immutable policy, wherein the immutable policy includes a WORM policy and / or an object locking policy.
[0056] Specifically, this involves generating object key identifiers for the evidence encapsulation data packets. These object key identifiers include at least a case identifier, a target object identifier, and an encapsulation time identifier. The evidence encapsulation data packets are written to object storage as objects via the object storage write interface. After writing, the object's version identifier and / or object ETag identifier are retrieved and recorded, thus forming a write receipt record. A reference relationship is established between the write receipt record and the hash digest of the evidence encapsulation data packets, and this reference is stored.
[0057] Next, before writing the evidence encapsulation data packet, retain period parameters and retention mode parameters are configured for the object key identifier. The retention mode parameters include compliance retention mode and / or governance retention mode. Then, the retain period parameters are written to the object locking metadata to prevent the object from being overwritten, deleted, or having its retention period shortened for the period indicated by the retain period parameters. After the write is completed, the object locking metadata is read to verify that the immutability policy has taken effect.
[0058] In this embodiment, by acquiring and responding to the evidence acquisition trigger signal, control plane event data is obtained from the virtualization management system. Based on the control plane event data, a set of target objects is determined. Host-side evidence data is collected for the target virtualization host machine, and guest-side evidence data is collected for the target guest virtual machine. The control plane event data, host-side evidence data, and guest-side evidence data are standardized to obtain standardized evidence data. Based on the object mapping table, the standardized evidence data is associated with objects to obtain associated evidence data. The associated evidence data is time-aligned based on the timeline correction model to generate an event timeline. Then, evidence encapsulation processing is performed on the event timeline and the corresponding associated evidence data to obtain an evidence encapsulated data packet. The evidence encapsulated data packet is written into an immutable evidence storage, thereby forming a verifiable, traceable evidence chain data with consistent object relationships and a consistent time reference.
[0059] Specifically, the above embodiments use control plane event data as the main line of evidence collection. A first set of object identifiers is formed by parsing fields such as event type identifier, object identifier, and event timestamp. This set is then mapped to a target object set containing guest virtual machine identifiers, virtualization host machine identifiers, and storage location identifiers, thus providing a unified object entry point for evidence collection on both the host and guest sides. Subsequently, the control plane event data, host-side evidence data, and guest-side evidence data undergo unified field naming and unified time base conversion, while retaining the original field values and their source identifiers to maintain traceability. Then, an object mapping table is used to match cross-source stable features such as virtual machine unique identifiers, virtual machine configuration paths, virtual disk paths, and virtual network card identifiers, enabling the determination of associated evidence subsets of the same guest virtual machine and the association between the guest virtual machine and its corresponding virtualization host machine. Furthermore, a timeline correction model is used to estimate multi-source clock offset and drift parameters using cross-source comparison events and correct the timestamps of each source, aligning the associated evidence data on a unified timeline and generating an event timeline containing the correction basis. Finally, a hash digest is generated for the associated evidence data, and digital signature and timestamp processing are performed. The event timeline and associated evidence data are encapsulated into an evidence encapsulation data package and written into an object storage with an immutable policy. This prevents the evidence from being overwritten or deleted at the storage level and allows for integrity verification based on the hash digest and signature value, thereby achieving automated, verifiable, and traceable evidence chain construction and storage.
[0060] Figure 3 This is a schematic diagram of the structure of an automated event forensics apparatus according to an example embodiment of this application. Figure 3 As shown, the automated event forensics device 300 provided in this embodiment includes: The acquisition response module 310 is used to acquire the evidence acquisition trigger signal and respond to the evidence acquisition trigger signal to acquire control plane event data from the virtualization management system; The object determination module 320 is used to determine a set of target objects based on the control plane event data, wherein the set of target objects includes at least a target virtualization host machine and a target guest virtual machine. The data acquisition and processing module 330 is used to acquire host-side evidence data for the target virtualization host machine and guest-side evidence data for the target guest virtual machine, and to standardize the control plane event data, the host-side evidence data and the guest-side evidence data to obtain standardized evidence data. The association alignment module 340 is used to perform object association on the standardized evidence data based on the object mapping table to obtain associated evidence data, and to perform time alignment on the associated evidence data based on the timeline correction model to generate an event timeline; The encapsulation storage module 350 is used to perform evidence encapsulation processing on the event timeline and the corresponding associated evidence data to obtain an evidence encapsulation data packet, and then write the evidence encapsulation data packet into the immutable evidence storage.
[0061] Figure 4 This is a schematic diagram of the structure of an electronic device according to an example embodiment of this application. For example... Figure 4 As shown, the electronic device 400 provided in this embodiment includes: a processor 401 and a memory 402; wherein: Memory 402 is used to store computer programs, and the memory may also be flash memory.
[0062] Processor 401 is used to execute the execution instructions stored in the memory to implement the various steps in the above method. For details, please refer to the relevant descriptions in the preceding method embodiments.
[0063] Alternatively, the memory 402 can be either standalone or integrated with the processor 401.
[0064] When the memory 402 is a device independent of the processor 401, the electronic device 400 may further include: Bus 403 is used to connect the memory 402 and the processor 401.
[0065] This embodiment also provides a readable storage medium storing a computer program, which, when executed by at least one processor of an electronic device, enables the electronic device to perform the methods provided in the various embodiments described above.
[0066] This embodiment also provides a program product including a computer program stored in a readable storage medium. At least one processor of an electronic device can read the computer program from the readable storage medium, and the at least one processor executes the computer program to cause the electronic device to perform the methods provided in the various embodiments described above.
[0067] Other embodiments of this application will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this application that follow the general principles of this application and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope and spirit of this application are indicated by the claims.
[0068] It should be understood that this application is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this application is limited only by the appended claims.
Claims
1. An automated event forensics method, characterized in that, include: Acquire evidence collection trigger signal and respond to the evidence collection trigger signal to obtain control plane event data from the virtualization management system; The target object set is determined based on the control plane event data, and the target object set includes at least the target virtualization host machine and the target guest virtual machine; Host-side evidence data is collected for the target virtualization host machine, and guest-side evidence data is collected for the target guest virtual machine. The control plane event data, the host-side evidence data, and the guest-side evidence data are then standardized to obtain standardized evidence data. Based on the object mapping table, the standardized evidence data is associated with objects to obtain associated evidence data. Then, based on the timeline correction model, the associated evidence data is time-aligned to generate an event timeline. The event timeline and the corresponding associated evidence data are subjected to evidence encapsulation processing to obtain evidence encapsulation data packets, which are then written into immutable evidence storage.
2. The method according to claim 1, characterized in that, The acquisition of the evidence collection trigger signal includes: Receive high-risk behavior alarms output by the detection system; The high-risk behavior alarms include one or more of the following: abnormal login alarms, sensitive resource operation alarms, and audit policy change alarms for the virtualization management system. The evidence collection trigger signal is generated based on the high-risk behavior alarm.
3. The method according to claim 1, characterized in that, The process of obtaining control plane event data from the virtualization management system includes: Obtain task data and event data; The task data and the event data include at least the operator identifier, source identifier, event type identifier, object identifier, and event timestamp.
4. The method according to claim 1, characterized in that, Determining the target object set based on the control plane event data includes: The first object identifier set is obtained by parsing the control plane event data; Map the first set of object identifiers to the target set of objects; The target object set includes one or more of the guest virtual machine identifier, virtualization host identifier, and storage location identifier that correspond to the first object identifier set.
5. The method according to claim 1, characterized in that, The collection of host-side evidence data for the target virtualized host machine includes: Collect one or more of the following: host authentication evidence, host configuration change evidence, host module and persistence evidence, host virtual machine operation evidence, and host storage access evidence; The host-side evidence data includes at least the host event timestamp, the host execution entity identifier, the host action type identifier, and the host object identifier.
6. The method according to claim 1, characterized in that, The collection of guest-side evidence data for the target guest virtual machine includes: Collect one or more of the following: guest process evidence, guest network connection evidence, guest authentication evidence, and guest critical path integrity evidence; The evidence of critical path integrity includes hash values for a preset critical path.
7. The method according to claim 1, characterized in that, The standardization process includes: Use standardized naming conventions for fields in multi-source evidence data; Transform the temporal representation of multi-source evidence data into a unified time reference; Preserve the original field values and source identifiers of multi-source evidence data.
8. The method according to claim 1, characterized in that, The timeline correction model is used to estimate clock drift between multi-source evidence data; Correspondingly, the time alignment of the associated evidence data based on the timeline correction model includes: Calculate drift parameters based on at least one type of cross-source control event; The timestamps of the associated evidence data are corrected based on the drift parameters; Generate the timeline of events that includes the basis for the correction.
9. The method according to claim 1, characterized in that, The evidence encapsulation process includes: Generate a hash digest of the associated evidence data; Perform digital signature processing on the hash digest to obtain the signature value; Perform timestamp processing on the signature value to obtain a timestamp token; The event timeline, the associated evidence data, the hash digest, the signature value, and the timestamp token are encapsulated into the evidence encapsulation data package.
10. An automated event evidence collection device, characterized in that, include: The acquisition response module is used to acquire the evidence acquisition trigger signal and respond to the evidence acquisition trigger signal to acquire control plane event data from the virtualization management system; An object determination module is used to determine a set of target objects based on the control plane event data, wherein the set of target objects includes at least a target virtualization host and a target guest virtual machine; The data acquisition and processing module is used to acquire host-side evidence data for the target virtualization host machine and guest-side evidence data for the target guest virtual machine, and to standardize the control plane event data, the host-side evidence data and the guest-side evidence data to obtain standardized evidence data. The association alignment module is used to associate objects with the standardized evidence data based on the object mapping table to obtain associated evidence data, and to align the associated evidence data with time based on the timeline correction model to generate an event timeline; The encapsulation storage module is used to perform evidence encapsulation processing on the event timeline and the corresponding associated evidence data to obtain an evidence encapsulation data packet, and then write the evidence encapsulation data packet into the immutable evidence storage.