网络协同取证系统的设计与实现  

Design and Implementation of Network Coordinative Forensics System

作　　者：张电 高平 潘峰 

机构地区：[1]解放军72671部队

出　　处：《信息安全与通信保密》2011年第11期89-91,共3页Information Security and Communications Privacy

摘　　要：随着网络传输速度的不断提高和网络应用的飞速发展,如何实时获取网络信息,准确快速地进行网络取证,已经成为计算机科学领域专家关注的热点问题。文中在分析网络取证技术和取证过程特点的基础上,给出了对主机、网络数据包和安全设备的协同取证系统,针对从不同取证要素获取的数据,系统并行地采用多种处理技术,最后采用模糊决策方法进行证据的分析和判定。该系统在计算机网络取证方面实现了协同并行处理、实时快速响应及综合智能分析。With the growing network transmission speed and the rapid development of network application,how to obtain real-time network information,quick and accurate network forensics becomes the hot issue for computer science experts. Based on analysis of network forensics and evidence collection process,a coordinative forensics system for host,network data packet and security devices is proposed and designed. For the principal elements evidence collected from different data systems,this system,with parallel processing technology and finally the fuzzy decision-making methods,analyzes the collected evidence and makes the determination. The system,in the field of computer network forensics,could achieve coordinative parallel processing,real-time rapid response,and comprehensive intelligent analysis.

关 键 词：协同取证 取证系统 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]