基于蜜罐技术的计算机动态取证系统研究

Research of Dynamic Computer Forensics System Based on Honeypot

提出了一种基于蜜罐的计算机动态取证方法.该方法通过蜜罐技术将入侵转移到一个虚拟的环境,不仅可以保护网络或主机不受攻击,而且还可以为证据的提取争取到更长的时间,从而获得更为真实的电子证据.实验结果表明:基于蜜罐的动态取证系统具有检测率高、误报率低、取证能力强的特性.

A dynamic computer forensics method based on honeypot is presented in this paper. This method can transfer the intrusion to a virtual entironments with honeypot. It can not only protect the network or host, but also gain the more time for gathering evidence, so that the more authentic evidence can be achieved. Experimental result shows that the system remains higher detection rate and lower false alarm rate and better forensics ability.