基于Multi-agent的计算机动态取证  

Dynamic Computer Forensics Based on Multi-agent

作　　者：仰石[1] 李涛[1] 丁菊玲[1] 

机构地区：[1]四川大学计算机系,成都610065

出　　处：《计算机工程》2005年第1期153-154,F003,共3页Computer Engineering

基　　金：国家自然科学基金资助项目;教育部博士点基金资助项目

摘　　要：提出了一种基于multi-agent的计算机动态取证模型。该模型在监控agent(SA)、协同agent(CA)及反击agent(BA) 的协作下能实时、准确全面地收集入侵证据,将这些信息有机整合、排序,可再现入侵过程。从而克服了静态取证的缺乏及时性、不连续性和不充分性等缺陷。This paper presents a model of dynamic computer forensics based on multi-agent. This model can collect intrusion evidence real-timely, accurately and entirely, which collaborates with surveillance agents (SA), cooperating agents (CA) and beating back agents (BA). Then these intrusion processes can be played back according to the real-time intrusion evidence. Therefore the limitation of static computer forensic is overcome, such as non-real-time, non-continuity and non-sufficiency.

关 键 词：MULTI-AGENT 主动型网络安全 计算机动态取证 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]