Design and Implementation of Distributed Network Behavior-Auditing System

The network behavior-monitoring technology is a key way to monitor network behavior and to collect evidence.The current network behavior-monitoring systems cannot monitor many hosts in a large scale.Moreover,they cannot intercept enough elaborate information.Considering these shortcomings,a distributed network behavior-auditing system is designed and implemented in this paper.This system can get the detailed information of users' network behaviors in a large scale,and has a pretty strong auditing ability,not only being able to discover abnormal behaviors,but also being helpful to identify the hosts being evilly controlled.The strong auditing ability provides an effective method for network forensics.