在犯罪事件發(fā)生后對(duì)犯罪行為進(jìn)行事后的取證，存在著證據(jù)的真實(shí)性、有效性和及時(shí)
性問(wèn)題。本文提出將取證技術(shù)結(jié)合到防火墻、入侵檢測(cè)系統(tǒng)中，對(duì)所有可能的計(jì)算機(jī)犯罪行為進(jìn)行實(shí)時(shí)的動(dòng)態(tài)取證，重點(diǎn)研究了基于數(shù)據(jù)挖掘的多智能代理動(dòng)態(tài)取證系統(tǒng)模型以及基于該模型下的數(shù)據(jù)獲取模塊和數(shù)據(jù)分析模塊。
關(guān)鍵詞 動(dòng)態(tài)取證 系統(tǒng)模型 數(shù)據(jù)獲取 數(shù)據(jù)分析

Research on the model of Computer Dynamic Forensics Zhong xiu-yu1 (Department of computer, Jiaying Univercity, Meizhou,Guangdong,514015) Abstract: If the computer forensics is adopted after the crime had occured, it will have the problems of the true and the efficacy on the evidence. This paper presents the combine forensics with firewall
and intrusion detection system to get the electronic evidence timely. It focuses on the model of the dynamic forensics, the data collection and data mining based on the model.
Keyword: dynamic forensics, model, data collection, data analysis.