基于本体和上下文感知的主动式计算机犯罪取证模型设计研究

事后被动的取证已经无法满足计算机犯罪取证的要求,文章针对计算机取证模型实现的关键技术进行研究,融合了蜜罐、入侵检测、上下文感知信息、Ontology等技术,有效地进行事前主动获取取证数据。文章提出了基于Ontology和上下文感知的动态取证模型,应用实例表明模型提高了对攻击源定位的追踪的准确性和实时性。

Dynamic Forensics Model based on Ontology and Context Information

The existing Forensics model already could not satisfy the need of the computer forensics.Key technology which can implement Forensics Model was studied in this paper.Honeypot forensics,IDS,Ontology technologies were combined effectively in order to obtain forensics data beforehand.A complete dynamic forensics system which can replay computer crime was designed.Non-repeated varying probability packet marking scheme was proposed.The paper proposed dynamic forensics model based on ontology and context information.The efficiency and accuracy of spam filtering are improved.