提出了一種網(wǎng)絡(luò)取證日志分布式安全管理方法，通過(guò)日志代理和管理網(wǎng)關(guān)將分散的異構(gòu)的日志收集并存儲(chǔ)到多個(gè)管理節(jié)點(diǎn)。該管理節(jié)點(diǎn)采用信息分配算法IDA將日志記錄分散為n份，計(jì)算所有分片單向散列值，并同該節(jié)點(diǎn)相應(yīng)存儲(chǔ)分片關(guān)聯(lián)存儲(chǔ)。取證分析時(shí)，管理節(jié)點(diǎn)根據(jù)網(wǎng)絡(luò)入侵事件多特征關(guān)聯(lián)性，利用任意m(m＜n)個(gè)節(jié)點(diǎn)提取相關(guān)日志記錄分片重建原有信息。由于每個(gè)分片攜帶所屬日志記錄所有分片的單向散列值，通過(guò)驗(yàn)證可以保證重構(gòu)日志記錄的完整性。

A distributed security management method of network forensic log is proposed and designed in this paper. The log agents and management gateway collect and forward the log records to the multi-management nodes. The log records are respectively dispersed into n shares by information dispersal arithmetic in the node, and the node stores the corresponding share and the hash values of all shares. The management node can reconstruct the log records through corresponding information in m (m