網(wǎng)絡(luò)電子取證技術(shù)研究
發(fā)布時(shí)間：2018-08-05 20:35
【摘要】：隨著計(jì)算機(jī)和網(wǎng)絡(luò)技術(shù)的不斷發(fā)展,網(wǎng)絡(luò)安全問題越來越受到人們的關(guān)注。為了解決網(wǎng)絡(luò)攻擊的簡單化和網(wǎng)絡(luò)防御的復(fù)雜化之間的矛盾,網(wǎng)絡(luò)安全研究開始由單純的被動(dòng)防御向主動(dòng)防御轉(zhuǎn)變,將網(wǎng)絡(luò)犯罪行為訴諸法律就是主動(dòng)防御的一種。對網(wǎng)絡(luò)犯罪行為取證問題的研究是網(wǎng)絡(luò)犯罪訴訟的核心,只有取證問題得到解決,網(wǎng)絡(luò)法規(guī)才能得以健全和執(zhí)行,才能打擊和震懾網(wǎng)絡(luò)犯罪分子,從根本上保障網(wǎng)絡(luò)的安全。 本文對網(wǎng)絡(luò)電子取證技術(shù)進(jìn)行了深入的研究和探討。試圖從技術(shù)的角度解決網(wǎng)絡(luò)電子取證中存在的問題,為網(wǎng)絡(luò)安全在法律上實(shí)現(xiàn)提供技術(shù)上的幫助。主要工作與成果有: 1.分析了當(dāng)前計(jì)算機(jī)網(wǎng)絡(luò)安全的概況、存在的問題,指出只有借助法律手段才能解決日益猖獗的計(jì)算機(jī)網(wǎng)絡(luò)犯罪。 2.對電子取證技術(shù)的研究作了回顧,介紹了電子取證發(fā)展的歷程,國內(nèi)外的研究現(xiàn)狀,從取證模型和取證技術(shù)兩個(gè)方面分析了當(dāng)前一些電子取證技術(shù)的不足。從這兩個(gè)問題出發(fā),提出了代理第三方簽名的網(wǎng)絡(luò)電子取證過程模型,該模型提供了一個(gè)較為清晰的網(wǎng)絡(luò)電子取證過程框架,給出網(wǎng)絡(luò)電子取證過程中應(yīng)遵循的基本原則和基本步驟。具有如下特點(diǎn):擴(kuò)展了攻擊預(yù)防的范圍,有效地保證了證據(jù)的完整性,提出了第三方簽名的概念及其實(shí)施機(jī)制,保證取證監(jiān)督鏈的完整性,使所取得的電子證據(jù)真實(shí)可信;以時(shí)間為線索,結(jié)構(gòu)清晰,各階段任務(wù)明確,可操作性強(qiáng)。 3.在取證過程模型的指導(dǎo)下,設(shè)計(jì)實(shí)現(xiàn)的網(wǎng)絡(luò)電子取證系統(tǒng),該系統(tǒng)分為取證服務(wù)器、取證代理、電子證據(jù)分析重放系統(tǒng)三個(gè)部分,通過加密、認(rèn)證、簽名等手段有效的保證了電子證據(jù)的真實(shí)性、完整性、抗抵賴性,解決了電子取證中存在的電子證據(jù)易于消失,完整性和真實(shí)性難以得到保證的問題。并舉例說明了該取證系統(tǒng)的部署和應(yīng)用。 最后,對網(wǎng)絡(luò)電子取證技術(shù)作了總結(jié)和展望。
[Abstract]:With the development of computer and network technology, people pay more and more attention to network security. In order to solve the contradiction between the simplification of network attack and the complication of network defense, the research of network security began to change from pure passive defense to active defense. The research on the problem of obtaining evidence of network crime is the core of network crime litigation. Only when the problem of obtaining evidence is solved, can the network laws and regulations be perfected and enforced, the network criminals can be attacked and intimidated, and the security of the network can be guaranteed fundamentally. In this paper, the network electronic forensics technology is deeply studied and discussed. This paper attempts to solve the problems existing in network electronic forensics from the technical point of view and provide technical help for the legal realization of network security. The main work and results are as follows: 1. This paper analyzes the general situation and existing problems of computer network security at present, and points out that only by means of legal means can the increasingly rampant computer network crime be solved. This paper reviews the research of electronic forensics, introduces the development of electronic forensics, the current research situation at home and abroad, and analyzes the shortcomings of some current electronic forensics technologies from two aspects: forensics model and forensics technology. Based on these two problems, a network electronic forensics process model of proxy third party signature is proposed, which provides a clear framework of network electronic forensics process. The basic principles and steps to be followed in the process of network electronic forensics are given. It has the following characteristics: expanding the scope of attack prevention, effectively ensuring the integrity of evidence, putting forward the concept of third-party signature and its implementation mechanism, ensuring the integrity of the chain of forensic supervision, making the obtained electronic evidence truthful and credible; Take the time as the clue, the structure is clear, each stage task is clear, the maneuverability is strong. 3. Under the guidance of the forensics process model, the network electronic forensics system is designed and implemented. The system is divided into three parts: the forensics server, the forensics agent, the electronic evidence analysis and replay system, which are encrypted and authenticated. Signature can effectively guarantee the authenticity, integrity and non-repudiation of electronic evidence, and solve the problem that the electronic evidence in electronic forensics is easy to disappear, integrity and authenticity is difficult to be guaranteed. An example is given to illustrate the deployment and application of the system. Finally, the network electronic forensics technology is summarized and prospected.
【學(xué)位授予單位】：西北工業(yè)大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2005
【分類號(hào)】：D918.2
[Abstract]:With the development of computer and network technology, people pay more and more attention to network security. In order to solve the contradiction between the simplification of network attack and the complication of network defense, the research of network security began to change from pure passive defense to active defense. The research on the problem of obtaining evidence of network crime is the core of network crime litigation. Only when the problem of obtaining evidence is solved, can the network laws and regulations be perfected and enforced, the network criminals can be attacked and intimidated, and the security of the network can be guaranteed fundamentally. In this paper, the network electronic forensics technology is deeply studied and discussed. This paper attempts to solve the problems existing in network electronic forensics from the technical point of view and provide technical help for the legal realization of network security. The main work and results are as follows: 1. This paper analyzes the general situation and existing problems of computer network security at present, and points out that only by means of legal means can the increasingly rampant computer network crime be solved. This paper reviews the research of electronic forensics, introduces the development of electronic forensics, the current research situation at home and abroad, and analyzes the shortcomings of some current electronic forensics technologies from two aspects: forensics model and forensics technology. Based on these two problems, a network electronic forensics process model of proxy third party signature is proposed, which provides a clear framework of network electronic forensics process. The basic principles and steps to be followed in the process of network electronic forensics are given. It has the following characteristics: expanding the scope of attack prevention, effectively ensuring the integrity of evidence, putting forward the concept of third-party signature and its implementation mechanism, ensuring the integrity of the chain of forensic supervision, making the obtained electronic evidence truthful and credible; Take the time as the clue, the structure is clear, each stage task is clear, the maneuverability is strong. 3. Under the guidance of the forensics process model, the network electronic forensics system is designed and implemented. The system is divided into three parts: the forensics server, the forensics agent, the electronic evidence analysis and replay system, which are encrypted and authenticated. Signature can effectively guarantee the authenticity, integrity and non-repudiation of electronic evidence, and solve the problem that the electronic evidence in electronic forensics is easy to disappear, integrity and authenticity is difficult to be guaranteed. An example is given to illustrate the deployment and application of the system. Finally, the network electronic forensics technology is summarized and prospected.
【學(xué)位授予單位】：西北工業(yè)大學(xué)
【學(xué)位級(jí)別】：碩士
【學(xué)位授予年份】：2005
【分類號(hào)】：D918.2
【引證文獻(xiàn)】
相關(guān)期刊論文 前2條
1 陳華;蔣文保;陳德禮;許能;;高速網(wǎng)絡(luò)取證的數(shù)據(jù)分析模型[J];赤峰學(xué)院學(xué)報(bào)(自然科學(xué)版);2009年10期
2 張楚;張樊;;網(wǎng)絡(luò)取證中的若干問題研究[J];證據(jù)科學(xué);2007年Z1期
相關(guān)會(huì)議論文 前1條
1 丁可;;網(wǎng)絡(luò)取證模型研究綜述[A];第三屆全國軟件測試會(huì)議與移動(dòng)計(jì)算、柵格、智能化高級(jí)論壇論文集[C];2009年
相關(guān)碩士學(xué)位論文 前4條
1 張?jiān)苹?動(dòng)態(tài)電子證據(jù)采集系統(tǒng)研究與實(shí)現(xiàn)[D];昆明理工大學(xué);2006年
2 劉海旺;可信網(wǎng)絡(luò)平臺(tái)之準(zhǔn)入控制研究[D];上海交通大學(xué);2009年
3 王e，
本文編號(hào)：2166946
本文鏈接：http://www.sikaile.net/shekelunwen/gongan/2166946.html
教材專著
