分布式网络实时取证系统研究与设计

Research and Design of a Distributed Network Real Forensics System

在分析目前网络体系中存在的不利于网络取证的问题的基础上,提出和设计了一种分布式网络实时取证系统。该系统通过不断监视和分析网络内部的运行情况,在保护网络安全的基础上,确定网络入侵者的行为是否已构成犯罪,然后提取和分析入侵者犯罪证据信息,并实现证据信息的完整性保护和验证。最后,通过时间线性化实时融合,生成入侵者犯罪证据。

Based on the discussion of the weakness of the network forensics in current Internet system, a distributed real network forensics system is proposed and designed. This system monitors and analyzes the state of the local network. When the Internet intruder is found, on the base of the security of the local network, the system confirms whether crime has happened, and then captures and analyzes the intruding evidence information, protects the integrity of them, finally, produces the intruding crime evidence.