摘要
设计一种针对涉密网的基于Agent的动态远程控制取证模型,采取Agent的分布式数据采集策略,引入syslog协议实时高效传输相关日志,将计算机取证与入侵检测技术相结合,动态获取入侵证据,提高证据的可信性、有效性及证明能力.
Combining with computer forensic technique and intrusion detection technique,a distributed dynamic computer forensics model based on multi-Agent is presented. The distributed data collection policy is adopted,and introduced the protocol of syslog to translate the related log real-time and efficiently,so that the range of data collection is extended. The dynamic intrusion detection system provides real-time evidences of high legal stringency. The evidence-combined data analysis technique is adopted to decrease the rate of false alarm and enhance the validity of the evidences.
出处
《微电子学与计算机》
CSCD
北大核心
2010年第5期202-205,共4页
Microelectronics & Computer
关键词
网络安全
计算机取证
涉密网
network security
computer forensics
security-network