CN106534182A - Traceless network evidence acquisition method based on user state protocol stack - Google Patents

The invention provides a traceless network evidence acquisition method based on a user state protocol stack. An evidence acquisition device grabs an IP address of a public network to which a monitoring object terminal accesses, accesses a target server through the obtained IP address and the user state protocol stack, and sends the evidence acquisition data to the target server, that is, the evidence acquisition device can still transmit electronic evidence to a background server through the IP address of the public network on other devices on the circuit by using the user state protocol stack technology in an environment in which the public network cannot be accessed.

A kind of seamless network forensics method based on User space protocol stack

Technical field

The present invention relates to information network evidence obtaining field, and in particular to a kind of seamless network forensics based on User space protocol stack Method.

Background technology

Network forensics technology has been achieved with tremendous expansion in China at present, and network forensics are based primarily upon some means and network Core routing communication data evidence-obtaining system obtains the illegal network behavior in destination object part and network crime evidence, by target The network communication equipment porch carry of object computer access Internet faces detects evidence taking equipment, destination object is performed short Time, the analysis of in-plant network service behavior and monitoring, so obtain the first hand network unlawful activities of destination object and The electronic evidence of behavior.

But in actual evidence obtaining work, evidence taking equipment is because some reasons need to be deployed in connect public network Environment, causes evidence taking equipment timely and effectively cannot be passed back to the electronic evidence of the network unlawful activities and behavior of destination object Server.

The content of the invention

It is an object of the invention to provide a kind of seamless network forensics method based on User space protocol stack, by User space Agreement stack technology can utilize the public network IP address of other equipment on circuit that electronic evidence is passed back to background server.

For achieving the above object, the present invention proposes a kind of seamless network forensics method based on User space protocol stack, wraps Include following steps：

（a）First, monitored object terminal passes through router access public network；

（b）Secondly, evidence taking equipment obtains the public network IP address of monitored object terminal by capturing router network data traffic；

（c）Finally, evidence taking equipment accesses the destination service for accessing public network by User space protocol stack and the public network IP address of crawl Device, and forensic data is transferred to into the destination server.

Further, in the seamless network forensics method based on User space protocol stack, evidence taking equipment is by crawl Router network data traffic obtains the public network IP address of monitored object terminal, comprises the following steps：

（b1）Evidence taking equipment accesses the router；

（b2）Evidence taking equipment captures the network packet of the router by a packet capturing program, and the network packet is TCP Network data protocol package or UDP network data protocol packages；

（b3）Evidence taking equipment is by an analysis program to step（b2）The network packet of middle acquisition is parsed, and obtains monitoring right As the public network IP address of terminal.

Further, in the seamless network forensics method based on User space protocol stack, evidence taking equipment is by user State protocol stack, and the public network IP address for obtaining, access the destination server for accessing public network, and forensic data are transferred to described Destination server, specifically includes following steps：

（c1）User space protocol stack program is run on evidence taking equipment；

（c2）The public network IP address of the acquisition is configured to into the Internet of User space protocol stack；

（c3）A web application is created in User space protocol stack application layer, evidence taking equipment and destination server are by described Web application sets up communication；

（c4）After evidence taking equipment and destination server set up communication, evidence taking equipment is by web application using agreement of giving out a contract for a project Forensic data is sent to into destination server.

Further, it is in the seamless network forensics method based on User space protocol stack, described to give out a contract for a project agreement for TCP Network data transfer protocol or UDP network data transfer protocols.

Compared with prior art, the invention has the beneficial effects as follows：Evidence taking equipment is accessed by capturing monitored object terminal The IP address of public network, and the IP address by obtaining and the stack addressing of User space agreement forensic data is sent to into destination service Device, i.e. evidence taking equipment in the environment that cannot access public network, still can by User space agreement stack technology using on circuit its Electronic evidence is passed back to background server by the public network IP address of equipment by him.

Description of the drawings

Fig. 1 is the seamless network forensics method schematic diagram in one embodiment of the invention based on User space protocol stack.

Specific embodiment

Below in conjunction with seamless network forensics method based on User space protocol stack of the schematic diagram to the present invention, carry out more detailed Thin description, which show the preferred embodiments of the present invention, it should be appreciated that those skilled in the art can change and be described herein The present invention, and still realize the present invention advantageous effects.Therefore, description below is appreciated that for people in the art Member's is widely known, and is not intended as limitation of the present invention.

As shown in figure 1, the seamless network forensics method based on User space protocol stack proposed by the present invention, including following step Suddenly：

（a）First, monitored object terminal 1 accesses public network 4 by router 2；

（b）Secondly, evidence taking equipment 3 obtains the public network IP ground of monitored object terminal 1 by capturing 2 network traffic data of router Location, specifically includes step：

（b1）Evidence taking equipment 3 accesses the router 2；

（b2）Evidence taking equipment 3 captures the network packet of the router 2 by a packet capturing program, and the network packet is TCP network datas protocol package or UDP network data protocol packages；

（b3）Evidence taking equipment 3 is by an analysis program to step（b2）The network packet of middle acquisition is parsed and is obtained series connection The public network IP address of monitored object terminal 1 on circuit；

（c）Finally, evidence taking equipment 3 accesses the target clothes for accessing public network 4 by User space protocol stack and the public network IP address of crawl Business device 5, and forensic data is transferred to into the destination server 5, specifically include following steps：

（c1）User space protocol stack program is run on evidence taking equipment 3；

（c2）The public network IP address of the acquisition is configured to into the Internet of User space protocol stack；

（c3）A web application is created in User space protocol stack application layer, evidence taking equipment 3 and destination server 5 pass through institute State web application and set up communication；

（c4）After evidence taking equipment 3 and destination server 5 set up communication, evidence taking equipment 3 is utilized by web application gives out a contract for a project Forensic data is sent to destination server by agreement, wherein, it is described to give out a contract for a project agreement for TCP network data transfer protocols or UDP nets Network Data Transport Protocol.

To sum up, in the seamless network forensics method based on User space protocol stack provided in an embodiment of the present invention, evidence obtaining sets The standby IP address by capturing the accessed public network of monitored object terminal, and the IP address by obtaining and User space agreement stack addressing And forensic data is sent to into destination server, i.e. evidence taking equipment in the environment that cannot access public network, can still pass through to use Electronic evidence is passed back to background server using the public network IP address of other equipment on circuit by family state agreement stack technology.

The preferred embodiments of the present invention are above are only, any restriction effect is not played to the present invention.Belonging to any Those skilled in the art, in the range of without departing from technical scheme, to the invention discloses technical scheme and Technology contents make the variation such as any type of equivalent or modification, belong to the content without departing from technical scheme, still Belong within protection scope of the present invention.