IT取证管理的敏捷方法
Agile Approach for IT Forensics Management
摘要：
网络攻击和IT事件的取证调查变得越来越困难，因为复杂性和网络化程度越来越高。特别是对于高级攻击（AT），如不断增加的高级持续性威胁，敏捷方法是必不可少的。攻击涉及多个系统（多主机攻击）。目前的法医模型和程序在分析这类攻击的过程中显示出相当大的缺陷。为此，本文提出了新的花模型，它使用敏捷方法，形成了一种新的取证管理方法。通过这种方式，满足了AT日益增长的挑战。在对此类攻击的取证调查中，由于需要分析的数据量很大，因此必须解决大数据问题。拟议的模式满足了这一要求，它精确地界定了需要在早期回答的问题，并只收集回答这些问题所需的法庭诉讼中可用的证据。此外，新的花模型AT提出，满足不同阶段的调查过程。
英文摘要：
The forensic investigation of cyber attacks and IT incidents is becoming increasingly difficult due to increasing complexity and intensify networking. Especially with Advanced Attacks (AT) like the increasing Advanced Persistent Threats an agile approach is indispensable. Several systems are involved in an attack (multi-host attacks). Current forensic models and procedures show considerable deficits in the process of analyzing such attacks. For this purpose, this paper presents the novel flower model, which uses agile methods and forms a new forensic management approach. In this way, the growing challenges of ATs are met. In the forensic investigation of such attacks, big data problems have to be solved due to the amount of data that needs to be analyzed. The proposed model meets this requirement by precisely defining the questions that need to be answered in an early state and collecting only the evidence usable in court proceedings that is needed to answer these questions. Additionally, the novel flower model for AT is presented that meets the different phases of an investigation process.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
