An artificial immune based dynamic forensics model for distributed anonymous network

The success of blockchain technology makes more and more applications begin to use distributed anonymous network. However, the decentralized, anonymous, and distributed features of the distributed anonymous network also create conditions for many illegal activities, such as fraud, illegal transactions, money theft and money laundering. The traditional computer forensics models work under a static and passive way which not suitable for the distributed anonymous network. In this case, this paper introduces a new dynamic computer forensics model based on artificial immune (DCFMAI). In DCFMAI, the antigen, antibody and the formal of the evidence data are defined, and the evolutionary process of immune tolerance, antibody memory, antibody expansion and dynamic forensics are established. By generating immune antibodies, DCFMAI can dynamically collet evidence data during an attack or abnormal transaction. And then, by utilizing the immune response information between the peers, DCFMAI can reconstruct the evidence chain and trace the illegal users' real IP address.