基于木马的计算机监控和取证系统研究  

Computer monitor and forensics system based on Trojan

作　　者：史伟奇[1] 张波云[2] 刘运[2] 

机构地区：[1]湖南大学软件学院 [2]国防科技大学计算机学院,湖南长沙410073

出　　处：《计算机工程与设计》2007年第10期2300-2302,2305,共4页Computer Engineering and Design

基　　金：湖南省科技攻关计划和公安部应用创新基金项目(2005YYCXHNST095)

摘　　要：阐述了常用动态取证工具和取证系统的特点,分析了取证模式及木马技术,设计了一种基于木马的计算机取证系统。通过木马的隐藏和抗查杀等关键技术的应用,取证系统能提供3种不同取证方法实现对监控目标的秘密、实时、动态取证。First, the characters of common used dynamic computer forensics tools and forensics system are described, after the forensics model and Trojan technology are analyzed, a computer forensics system based on Trojan is designed then. By utilizing the key technologies such as the conceal of Trojan and anti-scanning, three different kinds of forensics methods are proposed to realized the secret, real-time and dynamic forensics of the monitored objects.

关 键 词：木马 监控与取证 取证系统 取证代理 主动获取 电子证据 隐蔽通道 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]