基于Multi-Agent 的网络入侵取证模型的设计

在分析网络入侵取证和多Agent 技术的基础上，提出了一个基于多Agent 的网络入侵取证系统的模型，并详细描述了入侵检测与取证的过程和方法。将入侵检测和计算机取证技术结合在一起，在遭受入侵时能实时地收集可靠的证据，完成入侵事件的检测和取证分析，弥补了入侵检测系统的不足，有效地阻止了黑客攻击。
关键词：入侵取证；取证分析；Multi-Agent

Design of Network Intrusion Forensics Model Based on Multi-Agent Abstract: This paper analyses the technology of network intrusion forensics and multi-agent, presents a model of
network intrusion forensics system based on multi-agent, and introduces progress and methods of intrusion detection and forensic in detail. Synergizing with intrusion detection system, the system can collect real-time reliable evidences, detect and analyse intrusion events. Therefore the limitation of intrusion detect system is overcome, and hold back effectively the attack.
Keyword: Intrusion Forensics, Forensics Analysis, Multi-Agent