在分析網(wǎng)絡(luò)入侵取證和多Agent 技術(shù)的基礎(chǔ)上，提出了一個基于多Agent 的網(wǎng)絡(luò)入侵取證系統(tǒng)的模型，并詳細(xì)描述了入侵檢測與取證的過程和方法。將入侵檢測和計算機(jī)取證技術(shù)結(jié)合在一起，在遭受入侵時能實時地收集可靠的證據(jù)，完成入侵事件的檢測和取證分析，彌補(bǔ)了入侵檢測系統(tǒng)的不足，有效地阻止了黑客攻擊。
關(guān)鍵詞：入侵取證；取證分析；Multi-Agent

Design of Network Intrusion Forensics Model Based on Multi-Agent Abstract: This paper analyses the technology of network intrusion forensics and multi-agent, presents a model of
network intrusion forensics system based on multi-agent, and introduces progress and methods of intrusion detection and forensic in detail. Synergizing with intrusion detection system, the system can collect real-time reliable evidences, detect and analyse intrusion events. Therefore the limitation of intrusion detect system is overcome, and hold back effectively the attack.
Keyword: Intrusion Forensics, Forensics Analysis, Multi-Agent