在分析网络入侵取证和多Agent技术的基础上,提出了一个基于多Agent的网络入侵取证系统的模型,并详细描述了入侵检测与取证的过程和方法。将入侵检测和计算机取证技术结合在一起,在遭受入侵时能实时地收集可靠的证据,完成入侵事件的检测和取证分析,弥补了入侵检测系统的不足,有效地阻止了黑客攻击。 Based on the analysis of network intrusion forensics and multi-agent technology, a model of network intrusion forensics system based on multi-agent is proposed, and the process and method of intrusion detection and forensics are described in detail. The combination of intrusion detection and computer forensics can collect reliable evidence in real time when intrusion, and complete the detection and forensic analysis of intrusion events to make up for the shortcoming of intrusion detection system and effectively prevent hacker attacks.