在犯罪事件發(fā)生后對犯罪行為進行事后的取證，存在著證據(jù)的真實性、有效性和及時
性問題。本文提出將取證技術(shù)結(jié)合到防火墻、入侵檢測系統(tǒng)中，對所有可能的計算機犯罪行為進行實時的動態(tài)取證，重點研究了基于數(shù)據(jù)挖掘的多智能代理動態(tài)取證系統(tǒng)模型以及基于該模型下的數(shù)據(jù)獲取模塊和數(shù)據(jù)分析模塊。
關(guān)鍵詞 動態(tài)取證 系統(tǒng)模型 數(shù)據(jù)獲取 數(shù)據(jù)分析

Research on the model of Computer Dynamic Forensics Zhong xiu-yu1 (Department of computer, Jiaying Univercity, Meizhou,Guangdong,514015) Abstract: If the computer forensics is adopted after the crime had occured, it will have the problems of the true and the efficacy on the evidence. This paper presents the combine forensics with firewall
and intrusion detection system to get the electronic evidence timely. It focuses on the model of the dynamic forensics, the data collection and data mining based on the model.
Keyword: dynamic forensics, model, data collection, data analysis.