A real-time network intrusion forensics method based on evidence reasoning network

Based on the analysis of problems about the existing network intrusion forensics systems, this paper proposed a real-time network intrusion forensics method according to the evidence reasoning network (NetForensic). This method connected the concept of vulnerability correlation with the field of network intrusion forensics. It built the evidence reasoning network on the basis of the network system vulnerabilities and environmental information. At the same time, NetForensic realized the attack scenario reconstruction and with high efficiency in use of the reasoning ability of multi-staged attacks provided by the evidence reasoning network. Experimental data shows that NetForensic has supplied a complete and credible chain of evidence and it also has the capacity for real-time reasoning. All of these provide a strong guarantee for the rapid and effective evidence investigation.