摘要
事件日志记录着操作系统或应用程序中重要的事件。通过对日志进行分析,发现所需事件信息和规律是安全审计的根本目的。文章讨论了对Windows系统日志文件进行集中式统一管理,采用API钩子技术实现Windows下的审计数据的获取,并通过对Windows日志的分析给出了一种基于主机日志分析的安全审计通用模型。
An event log records some important events of an operating system or an application procedure. It is the primary purpose of a security audit to discover the required information and rules of an event by the analysis of a log. This paper discusses the central and global mnagment of windows system log files, employs such a techanology as API hook to acquire the audit data of windows system, and presents a host log analysis based security audit universal model by the analysis of a windows log.
出处
《山东科学》
CAS
2009年第1期40-45,共6页
Shandong Science
基金
山东省自然科学基金(Y2006G20)
