The invention discloses an EDR-oriented
traceability model and a method of a behavior chain preservation mechanism of the EDR-oriented
traceability model. According to the method,
traceability analysis of
network attack behaviors is realized through functional modules such as data collection,
threat detection, forensic analysis, archiving storage and
attack traceability, and behavior chains are stored as electronic forensic evidences. The method comprises the following specific steps: collecting data such as
system logs, operation logs and memory mirror images from
terminal equipment through an EDR
system and a GRR tool; a
threat detection
algorithm and MITRE ATTamp which are built in the EDR are utilized; the CK framework performs real-time behavior analysis, discovers potential threats and triggers a response; analyzing a memory
mirror image and file data in combination with a third-party evidence obtaining tool, and reconstructing an
attack behavior chain; through a
hybrid mechanism of decentralized storage (IPFS) and local storage and a block chain technology, the integrity and non-tampering property of data are ensured; and finally, analyzing the relevance between the behavior chains by using an
attack traceability module, and constructing a complete attack traceability graph. According to the method, the accuracy of attack behavior tracing and the security of data storage are effectively improved, the risk of
data loss and tampering in a traditional tracing method is reduced, and powerful support is provided for subsequent
network security event investigation and legal evidence obtaining.