Abstract: Network forensic analysis and fault diagnosis are becoming increasingly important in network management and network security domain．This requires network management system has the ability to query network metadata．For instance,network provenance can be used in tracking the path of dataflow through the network to obtain the source of data．This paper presented the design and implementation of a network provenance system (NPS) framework.The framework is used to support the full range of functionality required for enabling forensics in distributed systems．We adopted the declarative networking technique in the networking domain to maintain and query distributed network provenance．The framework adopts a reference-based approach to transfer provenance information and a cyclic graph to represent the provenance information,implementing efficient network provenance in distributed network.Simulation experiments were conducted in simulated network.The experiment results indicate that our network provenance system can support provenance process in a large-scale distributed network and significantly reduce bandwidth cost compared to traditional approach.

Key words: Network provenance,Declarative networking,Distributed query processing,Query optimization