入侵检测动态取证模型

A Dynamic Forensics Model Based on Intrusion Detection System

文章分析了计算机取证的发展情况,指出进行动态取证是其必然的发展趋势。在论证了入侵检测系统用于动态取证的可行性之后,给出了动态取证系统模型,并进行了详尽的阐述。该模型将入侵检测系统与司法分析技术有机结合,它的提出对计算机犯罪的动态取证有一定指导意义。

In this article,we analyze the condition of computer forensics and point out dynamic forensics is its trend. After reasoning the feasibility of adopting IDS into dynamic forensics,a dynamic forensics system model is presented and expounded in detail.Since it is the combo of IDS and justice parsing technique,it will be instructive for the dynamic forensics of computer crime.