| 本文已被：浏览 6256次 下载 14020次 |
码上扫一扫！ |
|
|
| 面向网络取证的网络攻击追踪溯源技术分析 |
|
刘雪花1,2, 丁丽萍1,3,4, 郑涛5, 吴敬征6, 李彦峰1,2
|
|
1.中国科学院 软件研究所 并行软件与计算科学实验室, 北京 100190;2.中国科学院大学 计算机科学与技术学院, 北京 100049;3.广州中国科学院软件应用技术研究所 电子数据取证实验室, 广东 广州 511458;4.广东中科实数科技有限公司, 广东 广州 511458;5.联通华盛通信有限公司, 北京 100005;6.中国科学院 软件研究所 智能软件研究中心, 北京 100190
|
|
| 摘要: |
| 首先定位网络攻击事件的源头，然后进行有效的电子数据证据的收集，是网络取证的任务之一.定位网络攻击事件源头需要使用网络攻击追踪溯源技术.然而，现有的网络攻击追踪溯源技术研究工作主要从防御的角度来展开，以通过定位攻击源及时阻断攻击为主要目标，较少会考虑到网络取证的要求，从而导致会在网络攻击追踪溯源过程中产生的大量有价值的数据无法成为有效电子数据证据在诉讼中被采用，因而无法充分发挥其在网络取证方面的作用.为此，提出了一套取证能力评估指标，用于评估网络攻击追踪溯源技术的取证能力.总结分析了最新的网络攻击追踪溯源技术，包括基于软件定义网络的追踪溯源技术，基于取证能力评估指标分析了其取证能力，并针对不足之处提出了改进建议.最后，提出了针对网络攻击追踪溯源场景的网络取证过程模型.该工作为面向网络取证的网络攻击追踪溯源技术的研究提供了参考. |
| 关键词: 网络攻击追踪溯源 网络取证 电子数据证据可采性 电子数据证据证明力 取证过程模型 IP追踪 |
| DOI：10.13328/j.cnki.jos.006105 |
| 分类号: |
| 基金项目:2019年度南沙区人工智能应用示范项目（2019SF01）；广州市科技计划（201802020015）；国家自然科学基金（61772507）；羊城创新创业领军人才支持计划（领军人才2016008） |
|
| Analysis of Cyber Attack Traceback Techniques from the Perspective of Network Forensics |
|
LIU Xue-Hua1,2, DING Li-Ping1,3,4, ZHENG Tao5, WU Jing-Zheng6, LI Yan-Feng1,2
|
|
1.Laboratory of Parallel Software and Computational Science, Institute of Software, Chinese Academy of Sciences, Beijing 100190, China;2.School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing 100049, China;3.Digital Forensics Laboratory, Institute of Software Application Technology, Guangzhou & Chinese Academy of Sciences (GZIS), Guangzhou 511458, China;4.Guangdong Chinese Academy of Sciences & Realdata Science and Technology Co. Ltd., Guangzhou 511458, China;5.China Unicom VSENS Communications Co. Ltd., Beijing 100005, China;6.Intelligent Software Research Center, Institute of Software, Chinese Academy of Sciences, Beijing 100190, China
|
| Abstract: |
| Locating the source of cyber attack and then collecting digital evidence is one of the tasks of network forensics. Cyber attack traceback techniques are used to locate the source of cyber attack. However, current research on cyber attack traceback is mainly conducted from a defensive perspective, targeting at blocking cyber attack as soon as possible via locating the cyber attack source, and rarely considers digital evidence acquirement. As a result, the large amount of valuable digital evidence generated during the process of cyber attack traceback cannot be used in prosecutions, and their value in network forensics cannot be fully exploited. Therefore, a set of forensics capability metrics is proposed to assess the forensics capability of cyber attack traceback techniques. The latest cyber attack traceback techniques, including cyber attack traceback based on software defined network, are summarized and analyzed. Their forensics capability is analyzed and some suggestions are provided for improvement. At last, a specific forensics process model for cyber attack traceback is proposed. The work of this paper provides reference for research on cyber attack traceback technology targeting at network forensics. |
| Key words: cyber attack traceback network forensics the admissibility of digital evidence the probative force of digital evidence forensics process model IP traceback |
