一种支持犯罪重现的按需取证技术  

On-demand forensics to support crime scene reconstruction

作　　者：田志宏[1] 姜伟[2] 张宏莉[1] 

机构地区：[1]哈尔滨工业大学计算机科学与技术学院,哈尔滨150001 [2]北京工业大学计算机学院,北京100124

出　　处：《清华大学学报（自然科学版）》2014年第1期20-28,共9页Journal of Tsinghua University(Science and Technology)

基　　金：国家“八六三”高技术资助项目(2012AA012506,2012AA012502,2012AA012901)

摘　　要：基于实时取证的思想,提出了一种支持犯罪重现的按需取证技术—DFR2(on-demand forensic technology support for rollback recovery)。基于按需取证概念,DFR2缩小了处理范围、缩短了取证时间,基于对象依赖技术的多源证据推理融合算法,提取出完整的攻击流程,提高了证据关联性。此外,还将犯罪重现引入计算机取证领域,有效地解决了电子证据证明力不足的问题。实验分析结果表明:与当前主流的取证方法 Snare相比,DFR2不仅支持按需取证、犯罪重现等功能,且在进行系统调用劫持过程中的平均性能开销降低约5%左右。A system, DFR2 （owdemand forensic technology support for rollback recovery）, is developed to obtain on demand real-time evidence from crimes to support rollback recovery. The Linux based system for obtaining evidence uses different methods and objects which are logically based on their different environments to narrow down the range of treatments, to shorten the investigations and evidence acquisition, and to improve the effectiveness of the evidence. The system also supports rollback recovery of the file system data to minimize intrusion losses. Compared with existing method Snare, the results have improved function and performance with reducing 5 % cost during robbing process.

关 键 词：入侵取证 犯罪重现 电子证据 按需取证 

分 类 号：TP393.32[自动化与计算机技术—计算机应用技术]