CN1246995C - Network monitoring and dynamic evidence obtaining system and method - Google Patents

Abstract

The invention provides a method for network monitoring and dynamic evidence collection, which belongs to the field of information security. It is characterized by real-time monitoring of large-scale network activities, timely extraction of attack scene evidence, and proper and safe processing and storage of evidence to ensure the reliability, security, and integrity of evidence. The invention can cope with the change of hacker attack technology, meet the needs of judicial organs for evidence collection, and can meet the needs of some companies, enterprises, individuals, etc. for evidence collection, and has broad application prospects.

Description

A method of network monitoring and dynamic evidence collection

technical field

The invention relates to the technical field of information security. It specifically involves network monitoring, intrusion detection, computer evidence collection technology, digital signature technology, virtual private network (VPN) technology and security log technology in information security technology.

Background technique

The traditional method of computer forensics is a static method, which extracts, analyzes and extracts effective evidence after the incident. This method is time-consuming and has high requirements for forensic personnel, and cannot deal with sophisticated hacker attacks. After the attack is completed, the evidence will be completely and completely destroyed or tampered with. Even the best data analysis tools will be powerless afterwards. Therefore, there is a lack of timely processing and effective protection of evidence.

In addition, the application of Chinese Patent Publication No. CN1310526, the principle of the invention is: use the existing network security products to collect information related to network security, and generate information in a standard format, transmit the collected information to the network monitoring center through a dedicated channel, and the monitoring center sends Download the anti-control command to the client. The disadvantage is that this method cannot implement effective real-time monitoring of large-scale network activities, and relies heavily on the capabilities of existing security products, firewalls, and IDS systems on the market, and the collected information lacks strict security requirements such as non-repudiation. Measures, therefore, they are not authoritative and cannot be used as evidence in court.

Contents of the invention

The present invention provides a method for network monitoring and dynamic evidence collection, which can monitor each host in the entire internal network in real time, collect information generated during monitoring, record external illegal intrusions, and extract attack evidence in real time, and at the same time collect evidence for Handle safely and store properly.

The invention utilizes the basic principle of biological immunology, and by simulating the identification and classification of human immune cells on pathogens, the function of identifying external network intrusions and performing online real-time evidence collection is achieved.

The network monitoring and dynamic evidence collection system of the present invention is composed of immune cells, dynamic evidence collection cells, evidence servers and the like. The module that performs real-time monitoring functions in the system is the immune cell, and the module that performs evidence extraction is the dynamic forensic cell. These two types of cells are distributed on every host in the internal network, forming a distributed network monitoring and dynamic evidence collection system. Antigens are defined in the system as network requests, self as normal network requests, and non-self as abnormal network activities (network attacks). Self and non-self constitute the antigen set, and the same network activities cannot exist in self and non-self. Also defined in the system are antibodies, which are present in immune cells to detect and match antigens. The system first performs antigen presentation (feature extraction) on network activity information to obtain epitopes (features). When implementing the immune execution process (matching antibodies to antigens), once the matching is successful, network intrusion is discovered, and hormones are immediately secreted to stimulate dynamic forensic cells. These hormones include the current host environment, attack type, attack host address and port number, etc. The dynamic forensic cell executes the function of evidence extraction, and the obtained evidence includes the intercepted antigen information and the surrounding environment information during the attack. Afterwards, the obtained evidence is digitally signed, and a time stamp is added during the signing process; the signed evidence is transmitted to the evidence server through a secure VPN, and the log is digitally watermarked (another patent I applied for: digital watermark log structure method, and the application number is 03117842.1) and stored in the evidence server. Immune cells and dynamic forensic cells complete the monitoring of network intrusion and the process of forensics, and complete the intrusion detection function while collecting evidence.

Before going into details, some nouns, symbols and some formulas used in the system are first defined:

其中D＝{0，1}^l，l为常自然数，|a|表示字符串a的长度。1) Define the collection of strings as $\mathrm{\Ω}=\underset{i=1}{\overset{\∞}{\∪}}{\left\{\mathrm{0,1}\right\}}^l,$ The set of IP packets is Ψ, and ΨΩ; define the set

Wherein D={0,1} ^l , l is a constant natural number, and |a| represents the length of the string a.

2) Antigen set Ag: is a collection of binary strings. For any antigen x∈Ag, xb is the original IP packet, xa is the feature (antigenic determinant) obtained after the original IP packet is passed through similar antigen presenting cells (APCs), and xa= APCs (xb), xa are mainly composed of binary strings of network transaction characteristics such as source and destination IP addresses, port numbers, protocol types, and protocol states.

3) Self and non-self sets: SelfAg and NonselfAg. And there is Self∪Nonself=Ag, Self∩Nonself=φ. Self is a normal network service, and Nonself is an attack from the network.

4) Define sAgAg, and |sAg|=η*|Ag|, (0<η<1).

5) Define the belonging operation ∈ _APCs of the self as follows:

Where x∈Ag, x.a is an epitope.

6) Define immune cell set B, and B={<d, age, count>|d∈D, age, count∈N}, where d is an antibody, which has the same expression form as an epitope, and age is an antibody Age, count is the number of matches, and N is a set of natural numbers. Immune cells include mature immune cells T _b and memory immune cells M _b , that is, B=M _b ∪ _{T b} , and M _b ∩T _b =φ, these two types of immune cells participate in the immune execution process.

7) Affinity (affinity) calculation function f _{r_con} (x, y): r-contiguous bits matching function can be used, and the calculation formula is shown in formula (2):

${\mathrm{<span\; class="notranslate">\; f</span>}}_{\mathrm{<span\; class="notranslate">\; r</span>}<span\; class="notranslate">\; \_</span>\mathrm{<span\; class="notranslate">\; con</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; the\; y</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}& <span\; class="notranslate">\; \&Exists;</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; \&Greater\; Equal;</span>\mathrm{<span\; class="notranslate">\; r</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; 0</span>}<span\; class="notranslate">\; <</span>\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; <</span>\mathrm{<span\; class="notranslate">\; j</span>}<span\; class="notranslate">\; \&le;</span>\mathrm{<span\; class="notranslate">\; l</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; .</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; the\; y</span>}<span\; class="notranslate">\; .</span>{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; .</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; the\; y</span>}<span\; class="notranslate">\; .</span>{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; i</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; 1</span>}}<span\; class="notranslate">\; ,</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; .</span><span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; .</span>{\mathrm{<span\; class="notranslate">\; d</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}<span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; the\; y</span>}<span\; class="notranslate">\; .</span>{\mathrm{<span\; class="notranslate">\; a</span>}}_{\mathrm{<span\; class="notranslate">\; j</span>}}\\ \mathrm{<span\; class="notranslate">\; 0</span>}& \mathrm{<span\; class="notranslate">\; otherwise</span>}\end{array}\right.<span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 2</span>}<span\; class="notranslate">\; )</span>$

In addition, the affinity calculation function may also use other functions, such as Hamming distance, Euler distance and other calculation functions.

8) Matching of antigen and antibody: when the binary string of the epitope and the antibody starts from a certain position, and there are consecutive r positions that are the same, it is said that the antigen and the antibody match, and the obtained value is 1; otherwise, if they do not match, the obtained The value is 0.

9) Define immature immune cell I _b : I _b = {<d, age>|d∈D, age∈N}, where the meanings of d and age are the same as those of d and age in immune cells.

10) Define evidence set Γ{<t, x, y, s>|t∈N, x∈Ag, y∈Ω, s∈Ω}. Among them, t is the moment of evidence extraction (the moment of network intrusion); x is the captured IP packet intruding into the network, x.b is the original evidence (original IP packet), and x.a is equivalent to the preliminary analysis and extraction of the original evidence (antigen presentation ); y is the status quo of the network environment at time t, which is similar to the state of cells around the captured antigen in the immune system, which can be the utilization rate of the CPU, system process status, network bandwidth usage, memory status, etc.; Digital signature of <t, x, y>. In order to further illustrate the principles and features of the present invention, the following will be described in detail in conjunction with the accompanying drawings.

Description of drawings

Figure 1 is a system architecture diagram of the system.

Figure 2 is a flow chart of the system.

Fig. 3 is a flowchart of antigen detection by memory immune cells.

Fig. 4 is a flowchart of antigen detection by mature immune cells.

Fig. 5 is a flowchart of self-tolerance of immature immune cells.

Figure 6 is an evidence package diagram.

Figure 7 is a structure diagram of evidence organization form.

Detailed ways

Figure 1 is a system architecture diagram.

Figure 1 shows the distribution of the entire system in the network: the internal network is connected to Internet through a gateway, and immune cells and dynamic forensic cells are distributed in each host in the internal network, thus forming a distributed network intrusion monitoring and forensics system; evidence The server is connected to the intranet through VPN to ensure its security and independence.

Figure 2 is a flow chart of the system.

The immune cell is a module defined by the system to perform real-time monitoring functions, the dynamic forensics cell is a module for performing dynamic forensics functions, and the evidence server is a hardware device part of the system for storing obtained evidence. The task of the system is to divide an input antigen set (IP packet) Ag into δ generations (δ is a constant), select a certain number of antigens in each generation to form the sAg antigen set, and classify it into autologous and non-aggressive antigens through the detection of B set. self. The whole process is divided into three stages: the first stage is from time 0 to the end of a tolerance period α, and it is necessary to define the initial self set Self(0) and immature cell set I _b (0), the latter undergoes the tolerance of the former. become mature cells. The second stage is from α+1 time to the time when memory cells are produced, which is the self-learning stage. Mature cells produce memory cells that can recognize a large number of different non-self antigens through clonal selection, and the antigens that are classified as self through detection are finally sent to the end. Mature cells are tolerant. In the second stage, the generation of memory cells is terminated, and all parts of the immune system are produced, and the detection in the actual environment is carried out: first, memory cells detect, then mature cells detect the remaining antigens, and finally immature cells use the remaining antigens as White body for endurance training. In the second and third stages, when the immune cells recognize non-self antigens, that is, when a network intrusion is discovered, the evidence τ is immediately extracted, and at the same time, τ is sent to the evidence server using a secure transmission method (VPN), and the evidence is completed. archiving work.

Among them, the generation process of self in the system is:

The initial self set is defined by the system administrator, and can also be obtained by offline learning of hacking patterns. Later comes from antigens that have survived the immune execution process. The dynamic evolution of the self is described by the equation:

$\mathrm{Self}\left(t\right)=\left\{\begin{array}{cc}\{x_1,x_2,...,x_{\mathrm{no}}\}& t=0\\ \mathrm{Self}(t-1)-{\mathrm{Self}}_{\mathrm{variation}}\left(t\right)\&cup;\mathrm{Sel}{f}_{\mathrm{new}}\left(t\right)& t\&Greater\; Equal;1\end{array}\right.$ (3)

(4)

(4)

Self _new (t)={y|y is the newly added self string at time t}(5)

(6)

(6)

(7)

(7)

B(t)=M _b (t)∪T _b (t), t≥0(8)

为初始自体集合，Self_new为t时刻系统新增的自体串。Self_variation为t时刻发生变异的自体，即删除自体集合中不再是自体的元素。f_check(y，x)(y∈B，x∈Ag)模拟免疫细胞对抗原的分类作用：若免疫细胞匹配了抗原，且抗原属于Self(t-1)，即检测到一个曾经是自体的抗原则返回2；若匹配但不属于Self(t-1)，即检测到一个非自体抗原则返回1；若未匹配，则该抗原为已知的自体抗原，返回0。f_{costimulation}模拟免疫系统的协同刺激，指示当前抗原是否为自体抗原，外部信号可以是系统管理员的应答等。Equation (3) simulates the dynamic evolution of the body, where

is the initial self set, and Self _new is the new self string added by the system at time t. Self _variation is the self that mutates at time t, that is, delete the elements in the self collection that are no longer self. f _check (y, x)(y∈B, x∈Ag) simulates the classification of immune cells on antigens: if the immune cells match the antigen, and the antigen belongs to Self(t-1), it detects a once-self The antigen principle returns 2; if it matches but does not belong to Self(t-1), that is, a non-self antibody is detected, the principle returns 1; if it does not match, the antigen is a known self antigen, and returns 0. f _{costimulation} simulates the co-stimulation of the immune system, indicating whether the current antigen is a self-antigen, the external signal can be the response of the system administrator, etc.

There are two key points in the dynamic evolution of the self: ① self-immune surveillance, which eliminates self _variation at any time, thereby eliminating false negatives: the non-self is regarded as the self. An increase in the false negative rate will lead to an increase in the false negative rate, and autoimmune surveillance can well address the problem of self variation over time. ②Dynamic growth of itself, for example: as time goes by, the network will provide new services, open new ports, etc., that is, network access that was not allowed before is now open. By timely adding self elements (Self _new ) and expanding the scope of self description, the rate of false positives can be effectively reduced: the self is regarded as non-self, resulting in false positives. Its own dynamic regeneration mechanism can better solve the serious problem of high false alarm rate of current IDS.

The collection process of antigens in the system is as follows: express network activities as antigen expressions—binary strings. The information contained in the network request includes: source address, destination address, port number, service type, protocol type, etc. The dynamic evolution process of antigen is described by the equation:

$\mathrm{Ag}\left(t\right)=\left\{\begin{array}{cc}\mathrm{Self}\left(0\right)& t=0\\ \mathrm{Ag}(t-1)-{\mathrm{Ag}}_{\mathrm{nonself}}\left(t\right)& t>0,t\mathrm{mod}\mathrm{\&delta;}\&NotEqual;0\\ {\mathrm{Ag}}_{\mathrm{new}}\left(t\right)& t>0,t\mathrm{mod}\mathrm{\&delta;}=0\end{array}\right.$ (9)

sAg(t)Ag(t), |sAg(t)|=η*|Ag(t)|, t≥0

(11)

(11)

∨ f _check (y, x) = 1)}

Among them, sAg is the antigen processed by the system each time, and its elements are randomly extracted from Ag (composed of self and non-self elements) according to the ratio η (0<η<1), and η is the detection coefficient. Ag _nonself is the non-self antigen detected at time t. The antigen set at the initial moment is the initial self set (B is empty at this time). δ is the antigen renewal cycle, which means that Ag is replaced with a new antigen set (Ag _new ) every δ generation. The change of the antigen set in the renewal cycle is only to delete the detected non-self antigens, so as to complete the work of sending the remaining self-antigens to the immature immune cells _Ib for tolerance.

Fig. 3 is a flowchart of antigen detection by memory immune cells.

Memory immune cells match against antigens. The antibody of the memory immune cell is matched with the determinant of the antigen to be processed, and the r consecutive position matching rule is used for matching.

(1) If the matching is successful, if the detected antigen is judged to be self at the previous moment, the immune cell will be deleted; if the detected antigen is judged to be non-self, the detected antigen will be deleted and hormones will be secreted.

(2) The matching is unsuccessful, and the antigen to be processed is sent to mature immune cells for detection.

Using the equation to describe the memory process of memory immune cells is:

$m_b\left(t\right)=\left\{\begin{array}{cc}\mathrm{\&phi;}& t=0\\ m_b(t-1)-m_{\mathrm{dead}}\left(t\right)\&cup;T_{\mathrm{memory}}\left(t\right)& t\&Greater\; Equal;1\end{array}\right.$ (12)

(13)

(13)

Fig. 4 is a flowchart of antigen detection by mature immune cells.

Antigens detected by memory immune cells are handed over to mature immune cells for detection. The process is as follows:

(1) Determine whether the matching number of mature immune cells is greater than the threshold;

(2) If it is greater than the threshold, it will be upgraded to a memory immune cell;

(3) less than the threshold, judging whether its age is greater than the age threshold;

(4) If the age is greater than the age threshold, the mature immune cells are deleted;

(5) If the age is less than or greater than the age threshold, it starts to match the antigen;

(6) If the matching is successful, if the detected antigen is self at the previous moment, the immune cell will be deleted; if the detected antigen is non-self, the antigen will be deleted and hormones will be secreted;

(7) The matching is unsuccessful, and these remaining antigens are sent to the bone marrow model to participate in the tolerance process.

The life cycle of mature immune cells is described by the equation:

$T_b\left(t\right)=\left\{\begin{array}{cc}\mathrm{\&phi;}& t=0\\ T_b^{\&prime;}\left(t\right)\&cup;T_{\mathrm{new}}\left(t\right)-T_{\mathrm{memory}}\left(t\right)-T_{\mathrm{dead}}\left(t\right)& t\&Greater\; Equal;1\end{array}\right.$ (14)

T′ _b (t)=T″ _b (t)-P(t)∪T _clone (t) (15)

T″ _b (t)={y|yd=xd, y.age=x.age+1, y.count=x.count, x∈T _b (t-1)} (16)

$\mathrm{<span\; class="notranslate">\; P</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span><span\; class="notranslate">\; \{</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; |</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; \&Element;</span>{\mathrm{<span\; class="notranslate">\; T</span>}}_{\mathrm{<span\; class="notranslate">\; b</span>}}^{<span\; class="notranslate">\; \&prime;</span><span\; class="notranslate">\; \&prime;</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; ,</span><span\; class="notranslate">\; \&Exists;</span>\mathrm{<span\; class="notranslate">\; the\; y</span>}<span\; class="notranslate">\; \&Element;</span>\mathrm{<span\; class="notranslate">\; sAg</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; -</span>\mathrm{<span\; class="notranslate">\; 1</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; (</span>{\mathrm{<span\; class="notranslate">\; f</span>}}_{\mathrm{<span\; class="notranslate">\; check</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; ,</span>\mathrm{<span\; class="notranslate">\; the\; y</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; 1</span>}$

(f _check (x, y)=2f _{costimulation} (y)=0)} (17)

T _clone (t)={y|yd=xd, y.age=x.age, y.count=x.count+1, x∈P(t)} (18)

T _new (t)={y|yd=xd, y.age=0, y.count=0, x∈I _maturation (t)} (19)

T _memory (t)＝{x|x∈T′ _b (t)(x.count≥β)} (20)

(21)

(twenty one)

Fig. 5 is a flowchart of self-tolerance of immature immune cells (bone marrow model).

After the detected antigens are detected by memory immune cells and mature immune cells, the remaining ones are considered as white body antigens, and immature immune cells conduct tolerance training with these self-antigens.

(1) A new autologous antigen is added to the bone marrow model, and a certain number of immature immune cells are randomly generated at the same time:

(2) The immature immune cells match the autologous antigens in the bone marrow model;

(3) If the matching is successful, delete the immature immune cells, that is, tolerance failure:

(4) If the matching is unsuccessful, return to (1) for the next tolerance, and the whole process is repeated α times (α is the tolerance period).

(5) At the end of the cycle, the surviving immature immune cells (that is, immature immune cells older than α) are upgraded to mature immune cells and participate in the immune execution process.

The process is described by the equation:

$I_b\left(t\right)=\left\{\begin{array}{cc}\{x_1,x_2,...,x_{\mathrm{\&xi;}}\}& t=0\\ I_{\mathrm{tolerance}}\left(t\right)-I_{\mathrm{maturity}}\left(t\right)\&cup;I_{\mathrm{new}}\left(t\right)& t\&Greater\; Equal;1\end{array}\right.$ (twenty two)

I _tolerance (t)={y|yd=xd, y.age=x.age+1,

$x\&Element;(I_b(t-1)-\{x|x\&Element;I_b^{\&prime;}(t-1),\&Exists;\mathrm{the\; y}\&Element;\mathrm{sAg}(t-1)(f_{r\_\mathrm{con}}(x,\mathrm{the\; y})=1)\})$ (twenty three)

I _{maturatiio n} (t)＝{x|x∈I _tolerance (t), x.age＞α} (24)

I _new (t)={y ₁ , y ₂ ,...y _k } (25)

Figure 6 is an evidence package diagram.

●Extraction of evidence includes:

(1) Intercepting the matching antigen, which contains the original IP packet and the determinant (characteristic value) presented by the antigen, the epitope can be regarded as a preliminary analysis of the original IP packet.

(2) Snapshot attack site. The evidence obtained includes: system log files, internal and external memory status, swap status, process type, process status, attacker source address, destination address, port, protocol used, number of network connections, connection time, connection type, and average number of packets sent, etc. .

The process is described by the equation:

$\mathrm{\&Gamma;}\left(t\right)=\left\{\begin{array}{cc}\mathrm{\&phi;}& t=0\\ \mathrm{\&Gamma;}(t-1\&cup;{\mathrm{\&Gamma;}}_{\mathrm{new}}\left(t\right)& t>0\end{array}\right.$ (26)

Г _new (t)={τ|τ∈Г, τ.t=t, τ.x=x, τ.y=y′, τ.s=s′,

s′=E _kpv (H(τ.t+τ.x+τ.y)), x∈Ag _nonself (t)} (27)

Among them, Г _new (t) is the evidence collected in real time in the face of network intrusion at time t; x is the intercepted attack data, which includes two parts: ① x.b is the original IP packet as the original evidence. ②x.a is equivalent to the basic characteristics of the original evidence obtained after the antigen presentation of the original evidence, and presented as direct evidence; y′ is a snapshot of the network environment when collecting evidence, such as CPU usage, system log files, internal and external storage status, swap status, file system changes, process status, number of network connections, connection time, connection type, and average number of packets sent, etc., as indirect evidence; To ensure the authority of the evidence.

●Digital signature: digitally sign the acquired evidence. Described by the equation as:

s＝E _kprivate (H(t+x+y)) (28)

Among them, E is the signature algorithm, which can use RSA, DSS signature algorithm, etc.; k _private is the private key when the system signs the evidence, H is the one-way hash function such as SHA-1, etc., and + is the concatenation operation of strings. First, combine the strings <t, x, y> into one string, calculate the hash value h of the string, and use the system's private key k _private to encrypt h with the public key algorithm E to obtain a digital signature. According to cryptography theory, if k _private is long enough, s is safe and can resist any attack.

For any evidence τ∈Γ, by verifying the digital signature of τ, the integrity and originality (authority, non-repudiation) of the evidence can be provided. The verification method is shown in formula (29):

${\mathrm{<span\; class="notranslate">\; f</span>}}_{\mathrm{<span\; class="notranslate">\; verify</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&tau;</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\left\{\begin{array}{cc}\mathrm{<span\; class="notranslate">\; 1</span>}& {\mathrm{<span\; class="notranslate">\; D.</span>}}_{\mathrm{<span\; class="notranslate">\; public</span>}}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&tau;</span>}<span\; class="notranslate">\; .</span>\mathrm{<span\; class="notranslate">\; the\; s</span>}<span\; class="notranslate">\; )</span><span\; class="notranslate">\; =</span>\mathrm{<span\; class="notranslate">\; h</span>}<span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; \&tau;</span>}<span\; class="notranslate">\; .</span>\mathrm{<span\; class="notranslate">\; t</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; \&tau;</span>}<span\; class="notranslate">\; .</span>\mathrm{<span\; class="notranslate">\; x</span>}<span\; class="notranslate">\; +</span>\mathrm{<span\; class="notranslate">\; \&tau;</span>}<span\; class="notranslate">\; .</span>\mathrm{<span\; class="notranslate">\; the\; y</span>}<span\; class="notranslate">\; )</span>\\ \mathrm{<span\; class="notranslate">\; 0</span>}& \mathrm{<span\; class="notranslate">\; otherwise</span>}\end{array}\right.<span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; -</span><span\; class="notranslate">\; (</span>\mathrm{<span\; class="notranslate">\; 29</span>}<span\; class="notranslate">\; )</span>$

Among them, D _kpublic (τ.s) is to use the public key k _public of the system to adopt the corresponding public key algorithm to decrypt τ.s to obtain the original encrypted hash value, H(τ.t+τ.x+τ .y) is to use the corresponding algorithm to recalculate its hash value. If the two are equal, the verification is successful and the evidence τ is complete and valid; otherwise, the evidence τ has been destroyed and cannot be trusted.

● Encapsulation evidence.

The time of intercepting the antigen, the antigen, the surrounding environment, and the digital signature on the combination of the three are packaged together into an evidence record form.

Figure 7 is a structure diagram of evidence organization form.

In the evidence server, the organizational form of the evidence is the generated digital watermark evidence file.

According to the digital watermark log construction method, the evidence is stored in the evidence server in the form of a digital watermark log, that is, a watermark is added to the evidence. The watermark is in the form of a binary string, which can be a piece of text, logo, serial number, and image.

When creating a digital watermark evidence file, first fill in the relevant information of the file header, such as: file identifier, digest algorithm identifier, asymmetric encryption algorithm identifier, watermark, etc. Among them, the file identifier identifies the digital watermark evidence file; the digest algorithm identifier indicates the digest algorithm used by the digital watermark evidence file, which can use the digest algorithm commonly used at home and abroad, such as: MD2, MD5 and SHA-1, etc.; asymmetric encryption algorithm The identifier indicates the asymmetric encryption algorithm used by the digital watermark evidence file, which can be asymmetric encryption algorithm commonly used at home and abroad, such as: RSA, DSA, ECC and DH, etc.; the file signature data field mainly includes watermark, summary information of all evidence records, etc. , the information is stored after being encrypted by the algorithm specified by the asymmetric encryption algorithm identifier. Initially, the file signature data field is empty, and every time an evidence record is added in the future, this field will change accordingly; the file signature data is essentially the digital signature of the abstract information of all the evidence in the evidence file, and any slight change in the evidence record will be ignored. would result in a huge discrepancy in the digest information, so verifying the signature information for this field verifies the integrity of the entire evidence file.

After the digital watermark evidence file is established, each evidence record is written at the end of the file, and each time a new evidence record is added, the evidence file is digitally signed again and written back to the evidence file.

When it is necessary to verify the integrity of the entire file, take out the file signature data in the file header and verify the correctness of the signature. If the signature verification is passed, it means that all evidence records have not been destroyed and the evidence is complete; otherwise, it means that the evidence file has been destroyed.

When it is necessary to verify the authority and non-repudiation of an evidence record, take out the digital signature of the record and verify its correctness. If it passes the signature verification, it means that the evidence record has not been damaged and is credible; otherwise, It means that the piece of evidence has been destroyed or forged and cannot be trusted.

Note: If the file signature verification is successful, it means that all the evidence records are credible; if the verification is unsuccessful, it means that some or all of the evidence records in the evidence file have been destroyed. At this time, the digital signature of the evidence record can be used to verify The legitimacy of each piece of evidence. If a piece of evidence record is verified, even if the whole evidence file fails to be verified, the piece of evidence is credible.

In addition, the evidence server is a very reliable machine, and very few people touch the evidence server. It is connected to the internal network through VPN to ensure its independence and security. The evidence server is used to store the evidence extracted by the forensic cell for future evidence analysis. When the evidence server receives the evidence, it also needs to perform a data signature on the evidence to complete the handover process of the evidence.

Claims (4)

1. A network monitoring and dynamic evidence collection method is characterized in that comprising the following steps: the step of network monitoring based on immunity; the step of real-time evidence extraction; the step of evidence storage; the step of evidence integrity verification; wherein: (1) The steps of network monitoring based on immunization include the following steps: Antigen presentation, i.e. feature extraction, for network activities; The steps of the dynamic evolution of self collection; The steps of the dynamic evolution of the antigen collection; Steps of memorizing immune cells to detect antigens; A step in which mature immune cells detect antigens; Steps in self-tolerance of immature immune cells; (2) The steps of real-time evidence extraction include the following steps: Steps to record the moment when evidence was taken; The step of extracting the original IP packet and its basic features; Steps to take a snapshot of the environment surrounding the attack site; Steps of digitally signing the moment of extracting the evidence, the original IP packet and its basic characteristics, and the snapshot information of the surrounding environment of the attack site; the step of encapsulating the evidence in the form of an evidence record; (3) The steps of evidence storage include the following steps: The step of constructing the evidence file in the evidence server; Steps of transmitting the evidence record to the evidence server through the VPN tunnel; The steps of storing the evidence in the evidence server; (4) The steps of evidence integrity verification include the following steps: Steps to verify the integrity of evidence records; Steps for integrity verification of evidence files. 2. A kind of network monitoring and dynamic forensics method according to claim 1, characterized in that in the step of real-time evidence extraction, the step of extracting snapshots of the surrounding environment of the attack site includes extracting CPU usage, system log files, internal and external Steps for storage status, swap status, file system changes, process status, number of network connections, connection time, connection type, and average number of packets sent. 3. A kind of network monitoring and dynamic evidence collection method according to claim 1, characterized in that in the step of evidence storage, the step of constructing the evidence file in the evidence server comprises the steps of constructing evidence file header and evidence record, wherein the file header consists of File identifier, digest algorithm identifier, asymmetric encryption algorithm identifier, watermark, file signature data, evidence record is composed of evidence content and digital signature, where evidence content includes the moment of extracting evidence, the original IP packet, the original IP packet Basic features, snapshots of the surrounding environment of the attack site, such as CPU usage, system log files, internal and external memory status, swap status, file system changes, process status, number of network connections, connection time, connection type, and average number of packets sent. 4. A kind of network monitoring and dynamic evidence collection method according to claim 1, characterized in that in the step of evidence storage, the step of evidence storage in the evidence server comprises the step of inserting the evidence record into the evidence file; Steps to digitally sign.

Images