在分析目前網(wǎng)絡(luò)體系中存在的不利于網(wǎng)絡(luò)取證的問題的基礎(chǔ)上，提出和設(shè)計(jì)了一種分布式網(wǎng)絡(luò)實(shí)時(shí)取證系統(tǒng)。該系統(tǒng)通過不斷監(jiān)視和分析網(wǎng)絡(luò)內(nèi)部的運(yùn)行情況，在保護(hù)網(wǎng)絡(luò)安全的基礎(chǔ)上，確定網(wǎng)絡(luò)入侵者的行為是否已構(gòu)成犯罪，然后提取和分析入侵者犯罪證據(jù)信息，并實(shí)現(xiàn)證據(jù)信息的完整性保護(hù)和驗(yàn)證。最后，通過時(shí)間線性化實(shí)時(shí)融合，生成入侵者犯罪證據(jù)。Based on the discussion of the weakness of the network forensics in current Internet system, a distributed real network forensics system is proposed and designed. This system monitors and analyzes the state of the local network. When the Internet intruder is found, on the base of the security of the local network, the system confirms whether crime has happened, and then captures and analyzes the intruding evidence information, protects the integrity of them, finally, produces the intruding crime evidence.