基于网络攻击的云取证方法和工具的实现

发布时间：2018-12-13 17:42

【摘要】：云计算是当前快速发展的一种计算服务模型。它具有服务快速获取、释放和易于扩展等优点。越来越多的商业公司和学术机构开始使用云计算提供的服务,并且深入研究该领域。然而,云计算并非绝对安全。它正在逐渐成为犯罪活动的乐土。同时,旨在调查云上犯罪活动的云取证工作也面临着诸多问题,如快照分析、持续存储、分布式环境、证据甄别、缺少必要取证工具等。针对利用OpenStack IaaS云上虚拟机产生大流量数据包的网络攻击为例,本文提出了一种取证上述攻击的主动式云取证方法。该方法由三步组成:第一步网络监控,监控OpenStack网络流量以便发现攻击;第二步OpenStack取证,获取存放在OpenStack云上的攻击证据;第三步计算机设备取证,取证存放在虚拟机上的攻击证据。同时,本文实现了一个基于该方法的取证工具。它包含四个主要的功能模块,分别是网络流量分析报警模块、Client-Server通讯模块、证据收集模块、磁盘文件搜索模块。通过在OpenStack IaaS云上实现SSH暴力破解攻击和DoS洪流攻击,以及攻击发生时对该主动式工具的模块测试,本文证实了所提出的取证方法能够解决取证面临的问题,并且有效的获取和攻击相关的证据。
[Abstract]:Cloud computing is a rapidly developing computing service model. It has the advantages of fast service acquisition, release and easy extension. More and more business companies and academic institutions begin to use cloud-based services and study the field in depth. Cloud computing, however, is not absolutely secure. It is gradually becoming a paradise for criminal activities. At the same time, cloud forensics, which aims to investigate criminal activities on the cloud, also faces many problems, such as snapshot analysis, persistent storage, distributed environment, evidence screening, lack of necessary forensic tools, and so on. In this paper, an active cloud forensics method is proposed to obtain evidence from a network attack in which large traffic packets are generated by a virtual machine on the OpenStack IaaS cloud. The method is composed of three steps: the first step is network monitoring, the second step is to monitor OpenStack network traffic to detect attacks, the second step is to obtain evidence of attack stored on OpenStack cloud, and the second step is to obtain evidence of attacks stored on OpenStack cloud. The third step of computer equipment evidence, evidence stored in the virtual machine attack evidence. At the same time, this paper implements a forensic tool based on this method. It consists of four main function modules, namely, network traffic analysis and alarm module, Client-Server communication module, evidence collection module, disk file search module. Through the implementation of SSH brute force attack and DoS flood attack on OpenStack IaaS cloud, and the module test of the active tool at the time of attack, this paper proves that the proposed method can solve the problem of forensics. And effectively obtain evidence related to the attack.
【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08

【相似文献】