Study on electronic evidence acquisition and analysis method over Windows logs
In order to collect logs in real time,two methods to acquire Windows logs in real time were proposed respectively according to the two types of log file formats.Based on acquiring logs,an approach for correlating log files with atomic attack functions was proposed.After the correlation,atomic attack...
Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | zho |
| Published: |
Editorial Department of Journal on Communications
2012-11-01
|
| Series: | Tongxin xuebao |
| Subjects: | |
| Online Access: | http://www.joconline.com.cn/zh/article/doi/10.3969/j.issn.1000-436x.2012.z2.016/ |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| Summary: | In order to collect logs in real time,two methods to acquire Windows logs in real time were proposed respectively according to the two types of log file formats.Based on acquiring logs,an approach for correlating log files with atomic attack functions was proposed.After the correlation,atomic attack functions can be analyzed instead of log files,which can greatly decrease the time of analysis.A time based log correlation and event reconstruction method was proposed to reconstruct the computer criminal scenarios.Experimental results show that log evidences can be acquired and the crime process can be reconstructed effectively. |
|---|---|
| ISSN: | 1000-436X |