一种支持计算机取证的日志系统的设计

Log System Support for Computer Forensics

在很多系统中,日志包含敏感信息。该文描述了一种简便的计算方法,对日志记录进行逐条加密,通过与可信机器的少量连接,限制攻击者破坏日志的能力,为计算机取证提供帮助。

In many systems ,log files contain sensitive information.This paper describes a method for encrypting each log record by a little computation.With a minima amount of communication with a trusted machine,this method can confine attacker's capability of destroying log file,and support computer forensics and intrusion detection.