Network evidence taking content tracing method based on multiple fingerprint Hash bloom filters

Abstract

The invention relates to a network evidence taking content tracing method based on multiple fingerprint Hash bloom filters. The method comprises the steps that captured original network flow data packets are recombined, and conversations of application layers are constructed; within each time interval, conversation content is divided into blocks to be stored into the enhanced multiple fingerprint Hash bloom filters, a conversation index table is saved, and each block is stored into the basic bloom filter and connected with conversion indexes in series to be stored into the bloom filter with the conversion indexes; after an inquiry request is received, the same method is used for blocking inquired excerpts, then searching is carried out in all file storing units within the possible time intervals, at first, the obtained blocks are inquired in the basic bloom filter, and if the blocks can be inquired, the obtained blocks are connected with candidate conversation indexes in series and inquired in the bloom filter with the conversation indexes to obtain application information of the excerpts. The method can improve the ability and the accuracy of network evidence taking content tracing.

Description

technical field [0001] The invention relates to the field of network forensics, and is a network forensics method and system for tracing the source of session content based on an enhanced fingerprint multi-hash Bloom filter (EWMB) data structure. Background technique [0002] The popularity of computers and networks has brought great convenience to the present invention, but at the same time a large number of information security threats have also been produced. Among them, what attracts attention is that cybercrime is becoming more and more rampant nowadays, both in terms of scope and technical means used are changing with each passing day. There have been some excellent works on the prevention of cybercrime, but there are few results in helping law enforcement agencies or security experts to investigate and collect cybercrimes. A method that can trace the content transmitted on the network is needed. system. [0003] The most direct method is to capture and store the ori...

AI Technical Summary

Problems solved by technology

Although this method has a certain ability of traceability and evidence collection, its disadvantage is that it can only trace the source of the payload, and can only obtain the quadruples of the source and destination

In network security incidents, in order to judge victims or perpetrators for evidence collection, the traceability of the system is far from enough

Images