计算机动态取证系统模型研究

Research on the model of Computer Dynamic Forensics

在犯罪事件发生后对犯罪行为进行事后的取证,存在着证据的真实性、有效性和及时性问题。本文提出将取证技术结合到防火墙、入侵检测系统中,对所有可能的计算机犯罪行为进行实时的动态取证,重点研究了基于数据挖掘的多智能代理动态取证系统模型以及基于该模型下的数据获取模块和数据分析模块。

If the computer forensics is adopted after the crime had occured, it will have the problems of the true and the efficacy on the evidence. This paper presents the combine forensics with firewall and intrusion detection system to get the electronic evidence timely. It focuses on the model of the dynamic forensics,the data collection and data mining based on the model.