基于诈骗与入侵容忍技术的动态取证系统研究-数学;运筹学与控制论专业论文.docxVIP

1111 1111 t l I T T I II T III III IIl YI 92201 6 时也滋生了不少计算机 秩序。数字取证作为一 子证据的收集、固定、 呈交等工作来开展，目的是使存储在计算机等电子设备中的信息能够作为有效的诉 讼证据提交法庭。由于电子证据具有与一般犯罪证据不同的特点，如无形性、高科 技性、复合性、易破坏性、海量存储及外在表现形式的多样性等，所以对其进行获 取、分析，并保证这些电子证据的法律效力，成为计算机犯罪案件侦破的难点。 本文首先对数字取证进行了综述，包括其发展趋势、现有模型及取证过程应遵循 的原则，指出了静态取证技术的不足。然后分别阐述了诱骗技术和入侵容忍技术，并 应用于动态取证系统中，前者的运用实现了证据的动态获取，提高了证据的可靠性； 后者则提高了系统的可存活性。最后，将基于诱骗与入侵容忍技术的动态取证系统分 五个模块进行了详述：诱骗系统模块主要运用Honeyd软件虚拟服务引诱入侵：入侵容 忍模块是当系统处于受攻击状态时，主动实现进程迁移：在数字证据收集阶段，从入 侵检测系统、蜜罐系统、入侵容忍系统、主机等多数据源收集相关数字证据并实现安 全规范存储，采用完整性算法验证数字证据传输和存贮过程中的完整性；在数字证据 分析阶段，利用基于正则表达式的关键词查找技术对本地数据收集系统的证据进行分 析，分析网络数据流时，在对入侵行为进行建模后采用入侵关联图的方法实现入侵场 景重构；证据显示模块采用XML标记语言记录并显示提取的证据。 关键词：动态取证，入侵诱骗，入侵容忍，入侵场景重构，入侵关联图 ▲譬程越疆零；壤Ⅷ写 ▲譬程越疆零；壤Ⅷ写 Abstract Abstract With the rapid development of information technology,not only the great convenience it brings，information technology also breed a number of computer intrusion which may even be harm to the country’S economic，political and cultural aspects of the normal order．As an interdisciplinary science，Digiml Forensic involves the Computer Science，the Law and the Crime Investigation，mainly revolve the collection， conservation and submission of electronic evidence．To carry out such work is aim tO make every electronic device which stored information including computers can be as effective as evidence for the handling of cases to the court．Because electronic evidence is evidence of a crime with its special characteristics such as intangibility,high-tech， composite nature，the diversity of external forms，easy to destructive，mass storage and other features，its acquisition，analysis，and to ensure the legal effect of electronic evidence have become difficult cases when detect computer crime． First of all，Digital Forensics is reviewed in this article，including the development trends，exiaing models and principles should follow during the forensics process．The shortcomings of static forensics technology are pointed out．Then，this paper present the deception technology