摘要
日志是指系统所指定对象的某些操作和其操作结果按时间有序的集合,每个日志文件由日志记录组成,每条日志记录描述了一次单独的系统事件,如何充分利用日志发掘有效的计算机证据,是计算机取证研究领域中一个重要的问题。本文分析了日志文件及日志分析在计算机取证中的重要作用,综述了日志分析的基本方法和关联分析方法,指出日志分析技术的发展方向。
The log refers to some operations of certain objects and their operating results, according to the time order. Each log file consists of log records which describe every single systematic event. It is valuable to find out how to search for effective computer evidence by making full use of logs in the computer forensics field. This paper analyzes the important role of log files and log analysis in computer forensics, and reviews the basic and correlating analytic methods for log analysis, and points out the directions for log analysis development.
出处
《电子设计工程》
2013年第6期62-64,共3页
Electronic Design Engineering
基金
湖北医药学院研究生启动基金资助计划项目资助(2008QDJ25)
关键词
计算机取证
日志分析
基本方法
分析方法
关联分析
computer forensics
log analysis
the basic methods
analytic methods
correlating analysis
