ESM기반의 전자적 증거관리 시스템 설계 및 구현

다국어 초록 (Multilingual Abstract)

More various and effective security technology is introduced to us such as from protection technique against usual computer emergency incident like the existing intrusion detection system, firewall, intrusion prevention system to the present integration management system, ESM. However we should change it by the customers' needs- they need computer forensics technology which analyzes the evidence of intruders, tracks and finally finds it - because this technology is very poor to get the evidence for the intruders and network efficiency. The computer forensics field which has been used for the investigation method before becomes more important by often computer emergency incident. Confidence and integrity of incident system in forensics was recognized importantly, since it has been performed as an evidence however at this time also it is made much account of the prompt judgement and correspondence against the incident.
ESM is a method to strengthen security and also gathers and manages log of each agent. For analyzing this, it provides a manger with log information. The gathered information could be legal evidence but it shows a boundary because of shortage of integrity and insufficiency of analysis technology. Integrated security management system has no problem in load management side because it transmits just the existing fixed log but, but the system, which supports computer forensic, needs to load management function because it must transmit high capacity files such as disk image.
We classify the digital evidence management by module such as evidence charge module, evidence analysis module, agent management module, infringement accident confrontation module. We also design and implement the system to overcome the limit of integrated security management system above in this paper. We implement the system focusing on database, which guarantees the integrity of evidence and stores it, and load balancing of digital evidence management system. As a result of performance evaluation for verification, this system was far superior to general integrated security management system in the side of resource utilization. We know it mostly supports the functions of computer forensic.

목차 (Table of Contents)

• 제 1 장 서 론 = 1
• 1.1 연구 배경 = 1
• 1.2 연구 목적 = 3
• 1.3 연구 내용 및 논문 구성 = 6
• 제 2 장 관련 연구 = 7
• 2.1 ESM = 7
• 2.1.1 ESM 개요 = 7
• 2.1.2 ESM 구성요소 = 9
• 2.1.3 ESM 동향 = 11
• 2.2 컴퓨터 포렌식스 = 16
• 2.2.1 컴퓨터 포렌식스 개요 = 16
• 2.2.2 컴퓨터 포렌식스 국내외 동향 = 22
• 2.2.3 컴퓨터 포렌식스 도구 문제점 = 26
• 2.3 증거관리 요구사항 분석 = 28
• 제 3 장 전자적 증거관리 시스템 설계 및 구현 = 32
• 3.1 전자적 증거관리 시스템 개요 = 32
• 3.2 전자적 증거관리 시스템 구성도 = 39
• 3.2.1 시스템 세부 구성요소 = 39
• 3.2.2 연계 시스템 = 41
• 3.3 전자적 증거관리 시스템의 동작 시나리오 = 44
• 3.4 설계 및 구현 = 47
• 3.4.1 증거 보관 모듈 = 48
• 3.4.2 증거 분석 모듈 = 53
• 3.4.3 에이전트 관리 모듈 = 57
• 3.4.4 침해사고 대응 모듈 = 66
• 제 4 장 실험 결과 및 분석 = 67
• 4.1 실험 환경 = 67
• 4.1.1 침입 탐지 시스템 실행 = 68
• 4.1.2 실험을 위한 공격 = 69
• 4.1.3 증거수집 시스템 = 70
• 4.2 전자적 증거관리 시스템 실행 = 71
• 4.2.1 증거 보관 모듈 = 71
• 4.2.2 증거 분석 모듈 = 72
• 4.2.3 에이전트 관리 모듈 = 74
• 4.2.4 침해사고 대응 모듈 = 75
• 4.3 결과 분석 = 76
• 4.3.1 에이전트 관리 모듈 성능 평가 = 76
• 4.3.2 전자적 증거관리 시스템 성능 평가 = 79
• 제 5 장 결론 = 80
• 참고문헌 = 81
• Abstract = 83