网络入侵取证系统

【作者】 胡季敏；

【导师】 许榕生；

【作者基本信息】 福州大学 ， 计算机应用， 2002， 硕士

【摘要】 随着网络技术的不断发展，网络安全变得越来越重要。在已有的网络安全研究中，多着眼于防犯入侵，而对于入侵后的取证问题研究甚少，目前还没有可以利用的工具。由于取证问题是网络诉讼的核心，所以，只有取证问题得到解决，网络法才能得以健全和执行，网络才会有真正的安全。 本文对计算机取证技术进行深入的研究和探讨，从网络入侵的角度解决取证的问题。对于网络上的计算机而言，入侵者最有可能在系统日志和网络通信数据中留下痕迹。因此在研究的过程中，我们从这两个方向入手，收集了大量的取证理论和安全技术，最终将这些理论和技术应用到我们所开发的网络入侵取证系统中。这个系统的开发属于国家863计划《保障国家信息网络空间安全战略规划》首批启动项目，是国内开发的第一批取证工具之一。更多还原

【Abstract】 With the development of network technology, the security of network is more and more important. But the focus of the current security study is for guarding against intrusion, there is little study for the forensic of network criminal, as a result no forensic tools are available now But forensic is the key of network lawsuit, unless this problem is worked out, the network law can be efficient, and then the network will be real secure. The thesis is committed to the study of computer forensic. For a computer in the iNTERNET, no material is as important as the system log and the communicating data which can mark the trends of the hacker. In the process I learn much forensic theory and secure technologies, and in the end I propose the solution to computer forensic. During the development of this network intrusion forensic system, I design and develop the secure log model and the network data model. This system belongs to the first started plans which are national 863 plan.更多还原