Dynamic Network Forensic Based Plug-In Architecture

Considering on judicial forensic requirements and the character of network crime diversity, a architecture basedon XML and plug-in techniques is proposed in this paper. The framework adopts encrypt and authentication technologywhich ensures collected evidence can be accepted by court, so the original evidence in framework is stability. Because of the network application’s diversity, the judgment whether the network packet need collect is implemented by plug-in. Finally, based on the framework, the forensic on specifically information and hacker attack are implemented, in which the analyzing of hacker attack forensic adapts intrusion detection system such as snort, consequently, feasibility of architecture is proved by experiment.