基于多Agent的分布式计算机动态取证模型研究

传统的计算机取证大多采用静态取证技术,通过事后分析的方法提取证据,证据的收集和提取比较困难,证据的法律效力低.将计算机取证技术与入侵检测技术结合,提出一种基于多Agent的分布式计算机动态取证模型,采用多Agent的分布式数据采集策略,扩展了取证范围;通过入侵检测系统实时监测,动态获取入侵证据,提高了证据的证明能力;同时,采用证据融合的数据分析技术,通过多源联合信息降低了误警率,增加了证据的可信度,提高了证据的有效性.

A DISTRIBUTED COMPUTER DYNAMIC FORENSICS MODEL BASED ON MULTI-AGENT

Traditionally, the static computer forensic technique is assigned to collect crime Commitment information analyzed post-facto, which makes evidences collecting really difficult. More seriously, the severity of the evidences in law cannot be guaranteed. Combining with computer forensic technique and intrusion detection technique,a distributed dynamic computer forensics model based on multi-Agent is presented. The distributed data collection policy is adopted, so that the range of data collection is extended. The dynamic intrusion detection system provides real-time evidences of high legal stringency. The evidence-combined data analysis technique is adopted to decrease the rate of false alarm and enhance the validity of the evidences.