基于蜜罐的数字取证系统的研究与实现  

Research and Implementation of Digital Forensic System based on Honeypot

作　　者：马国富[1] 朱建林[2] 傅玥[3] 

机构地区：[1]中央司法警官学院,河北保定071000 [2]保定金融高等专科学校计算机科学与技术系,河北保定071001 [3]石家庄经济学院信息工程学院,河北石家庄050031

出　　处：《微计算机信息》2007年第36期59-61,共3页Control & Automation

基　　金：河北省自然科学基金项目资助(F2004000133)

摘　　要：数字取证已成为信息安全和司法领域的研究热点,文中在深入分析各种Web攻击行为的基础上,利用蜜罐搭建了当前流行的Web服务器系统,综合利用基于主机和网络的入侵检测技术,开发出一套高效实用可控的Web数字取证系统。该系统通过多个分布式取证代理不断监视和分析网络中对Web服务器的访问情况,在构建高度可控的Web服务器基础上,确定网络入侵者的行为是否已构成犯罪,然后提取和分析入侵犯罪信息,实现证据信息的完整性保护,同时通过对证据进行融合,生成入侵犯罪证据。Digital Forensic has become hot spot of information and the judicial domain by analyzing the current information security. System has built currently popular Web Server in Honeypot on based of analyzing the Web attacks. A digital forensics system for Web is highly effective developed, by Comprehensive utilization intrusion detecting technology based on host and network. This system unceasingly monitors and analyzes visiting situation for Web Server of the network by forensic agent. When the Web Server＇s intruder is found, on the base of protecting security of Web Server, the system confirms whether crime has happened, and then captures and analyzes the intruding evidence information, protects the integrity of them, finally, produces the intruding crime evidence by evidence fusion.

关 键 词：蜜罐 取证代理 协议分析 完整性检查 证据融合 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]