提出了一種網(wǎng)絡(luò)取證日志分布式安全管理方法，通過日志代理和管理網(wǎng)關(guān)將分散的異構(gòu)的日志收集并存儲到多個管理節(jié)點。該管理節(jié)點采用信息分配算法IDA將日志記錄分散為n份，計算所有分片單向散列值，并同該節(jié)點相應(yīng)存儲分片關(guān)聯(lián)存儲。取證分析時，管理節(jié)點根據(jù)網(wǎng)絡(luò)入侵事件多特征關(guān)聯(lián)性，利用任意m(m＜n)個節(jié)點提取相關(guān)日志記錄分片重建原有信息。由于每個分片攜帶所屬日志記錄所有分片的單向散列值，通過驗證可以保證重構(gòu)日志記錄的完整性。

A distributed security management method of network forensic log is proposed and designed in this paper. The log agents and management gateway collect and forward the log records to the multi-management nodes. The log records are respectively dispersed into n shares by information dispersal arithmetic in the node, and the node stores the corresponding share and the hash values of all shares. The management node can reconstruct the log records through corresponding information in m (m