摘要： 介绍了一些对恶意网络活动进行司法调查的方法,主要分为基于网络和基于协议两大类。在基于协议的网络连接链追踪方面,重点介绍了会话令牌协议(STOP),它以ident协议为基础,在保护网络用户个人隐私的前提下,为网络犯罪司法调查提供支持。

关键词: 网络安全, 网络追踪, Ident, STOP

Abstract: Network attacker , in order to hide his identity, always logs on to a series of compromised hosts before he attacks the target. This paper introduces a series of methods designed to assist in the forensic investigation of malicious network activity .The mainly introduced methods can be divided into two areas: network-based solutions and protocol-based solutions. In the protocol-based connection chain traceback area , this paper specially introduces the session token protocol (STOP) , which is based on the ident protocol, and helps forensic investigation of attacker’s activities while protecting the privacy of users.

中图分类号: 

• TP393.08