基于HTTP协议报文分析的计算机网络取证方法  

Computer Network Forensics Method Based on HTrP Protocol Packet Analysis

作　　者：覃志波 陆幼骊[1] 姜林 周轩[3] QIN Zhi-bo LU You-li JIANG Lin ZHOU Xuan(Naval Command College, Nanjing 211800, China Luoyang Electronic Equipment Test Center of China, Luoyang 471000, China Hefei Electronic Engineering Institute, Hefei 230037, China)

机构地区：[1]海军指挥学院,南京211800 [2]中国洛阳电子装备实验中心,洛阳471000 [3]合肥电子工程学院,合肥230037

出　　处：《计算机科学》2016年第B12期26-29,共4页Computer Science

摘　　要：计算机系统之间的网络通信遵循HTTP网络协议，网络中HTTP协议报文承栽着犯罪分子利用计算机系统及计算机网络进行犯罪的大量“作案痕迹”，因此报文分析可以为打击计算机网络犯罪提供非常重要的线索和证据来源。利用Burp Suite报文分析将网络犯罪分子作案过程中的各种行为和操作过程作为有效的电子证据真实完整地出示给法庭，结合取证实例详细探讨报文分析在电子数据取证中的运用。Network communications between computer systems follow the HTTP network protocol. HTTP protocol packets carry the criminals crime by computer systems and computer networks with a large number of traces of the crime, so packets analysis is very important to fight against cyber crime by providing clues and evidence sources. Using Burp Suite packets analysis to present the Cyber criminal＇s criminal act as an effective electronic evidence to the Court, combining with practical evidence packet analysis, the application of packet analysis in electronic data forensics was discussed in detail.

关 键 词：计算机网络取证 报文分析 入侵追踪 Burp SUITE 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]