Preposed audit method

Abstract

The invention discloses a preposed audit method in the field of network information security audit. An audit analysis behavior is finished through an audit system, specifically, network data packets are intercepted through a netfilter, related policy matching is carried out on the intercepted data packets, through modification of the final data packet in a data packet stream, corresponding js is inserted before the final data packet, the js obtains necessary information from a client browser, and an audit process is realized. According to the method, the audit efficiency is improved, an auditmode is changed, and through utilization of the system, a user can obtain the necessary information relatively comprehensively and rapidly, and the existing behavior audit mode is expanded.

Description

technical field [0001] The invention relates to the field of network information security auditing, in particular to a pre-auditing method aimed at enriching virtual person identity information related to the business of public security departments and collecting data. Background technique [0002] With the increasing popularity of the Internet and the development and maturity of related technologies, people have entered an era of extremely rich information. The Internet has brought many conveniences, but it has also brought many problems. increasing day by day. Facing the virtuality and uncertainty of the network, network behavior auditing has become a necessary means and guarantee for information security. [0003] The existing Internet security behavior auditing technology audits network behaviors in a flow-through manner through two deployment modes. One is to deploy the device on the egress link as a gateway / transparent bridge to analyze and audit the bidirectional tr...

AI Technical Summary

Problems solved by technology

In this method, if the protocol changes, the method to deal with it is relatively complicated, and the audit method is not flexible enough; the second disadvantage is that in order to support the restoration of content, a complex restoration algorithm is required as support, and this restoration cannot support multi-threaded concurrent packet analysis , causing a system bottleneck

[0005] The obvious disadvantage of the audit flow-through audit method is that all data traffic must reach the audit device before the analysis of related protocols can be performed. This method is not efficient

Especially when auditing emails, webpage access, etc., data packet restoration is required to obtain information such as text, title, recipient, etc., a cumbersome restoration algorithm will be born, and it will not be able to achieve concurrency under large data, becoming the entire system the bottleneck

Images