一种基于Linux的动态取证策略

计算机动态取证是信息安全领域的研究热点,在简单介绍取证策略的基础上,提出一种基于Linux的计算机动态取证策略。该策略将Linux系统下的待取证数据分为两类,并采用不同的方法来取证：对于易失性的数据,通过分析内核的数据结构来获取证据;对于非易失性的数据,利用取证工具和系统命令来获取证据。在Linux9.0上进行了实验。实验表明,采用该策略能够对Linux系统下的常见入侵进行动态取证。

A Dynamic Forensics Strategy Based on Linux

Computer dynamic forensics is the research focus in the information security fields. In this paper, the forensics strategy is introduced simply, and then a dynamic forensics strategy based on Linux is proposed. This strategy classifies datas of Linux into two varieties and handles them differently: For volatile data, by analyzing the kernel data structure to obtain the evidence; for non-volatile data, by using the evidence collection tools and system calls to obtain the evidence. The experiments On Linux 9....