基于HTTP协议报文分析的计算机网络取证研究

Research on computer network forensics based on HTTP protocol message analysis

针对目前我国网络用户不断增长,并且网络中出现的攻击现象不断增多,导致网络中用户的信息出现一系列的安全问题。为了能够有效保证网络用户的操作能够得到有效的监管,本文通过创建基于HTTP协议报文分析的计算机网络取证系统,对网络用户的电子邮件、日志文件、即时通信软件进行提取和分析,从而手机电子数据证据,重新构建犯罪现场,为诉讼案件提供真实可靠的信息及证据。最后对基于HTTP协议报文分析的计算机网络取证系统进行了模型实验分析,通过实验表示,系统能够将可疑入侵的日志进行提取,达到预期目的。

In view of the current growing number of network users in China,and the increasing number of attacks in the network,resulting in a series of security problems in the network users＇ information. In order to ensure the operation of Internet users can get effective supervision,this paper through the creation of computer network forensics analysis system based on HTTP protocol message,the network user log files,e-mail,instant messaging software to extract and analysis,thus hand machine electronic data evidence,re build the crime scene,providing information and reliable evidence for the case. Finally,the model experiment analysis of the computer network forensics system based on HTTP protocol message analysis is carried out. Through experiments,the system can extract the logs of suspicious intrusion,and achieve the desired goal.