信息网络安全

信息网络安全 ›› 2017, Vol. 17 ›› Issue (3): 33-38.doi: 10.3969/j.issn.1671-1122.2017.03.006

• • 上一篇    下一篇

基于logs2intrusions与Web Log Explorer的综合取证分析研究

杨晶(), 赵鑫, 芦天亮   

  1. 中国人民公安大学信息技术与网络安全学院,北京102600
  • 收稿日期:2016-11-01 出版日期:2017-03-20 发布日期:2020-05-12
  • 作者简介:

    作者简介：杨晶（1990—）,女,山东,硕士研究生,主要研究方向为计算机犯罪侦查;赵鑫（1990—）,男,甘肃,本科,主要研究方向为电子数据取证;芦天亮（1985—）,男,河北,讲师,博士,主要研究方向为网络攻防、恶意代码分析与检测。

  • 基金资助:
    国家自然科学基金[61602489]

Research on Comprehensive Forensic Analysis Based on Logs2intrusions and Web Log Explorer

Jing YANG(), Xin ZHAO, Tianliang LU   

  1. School of Information Technology and Network Security, People’s Public Security University of China, Beijing 102600, China
  • Received:2016-11-01 Online:2017-03-20 Published:2020-05-12

RichHTML

4

PDF (PC)

263

摘要：

随着互联网应用的迅猛增长,其受到的安全威胁也越来越严重,尤其是网络入侵攻击事件造成了极大的危害。目前,对入侵行为检测的一种必要手段是对日志数据进行分析,网站日志文件是记录Web服务器接收处理请求以及运行时错误等各种原始信息的文件,但目前来看网络日志文件的作用还有待进一步提升。文章分析了logs2intrusions、Web Log Explorer、光年SEO日志分析系统、逆火网站分析器这四种日志分析工具的特性,提出了基于logs2intrusions和Web Log Explorer两个工具优势的综合取证分析技术,实现了对大批量入侵攻击日志数据的快速分析处理,提高了对网络入侵攻击行为识别的准确率。

关键词: 网络入侵检测, logs2intrusions, Web Log Explorer, 系统日志

Abstract:

With the rapid development of Internet applications, the security threat is becoming more and more serious, especially network intrusion attacks. At present, it is necessary for intrusion detection to analyze the log data. The website log file is a file that records various original information, such as web server receiving processing requests and run-time errors, but the effect of analyzing log data remains to be further improvement. This paper analyzed the characteristics of four log analysis tools,Logs2intrusions, Web Log Explorer, Light Year SEO Log Analysis System, Backfire Website Analyzer, and proposed the comprehensive forensic analysis technique based on the advantage of these tools. The technique, which have a certain value in combating cybercrime and maintaining network space security, achieve the rapid analysis of the log data from the large quantities of intrusion attacks, and improve the recognition accuracy of network intrusion attack.

Key words: network intrusion detection, logs2intrusions, Web Log Explorer, system log

中图分类号: