0前言基于Web的网络实时取证技术是伴随计算机犯罪事件的出现而发展起来的一种技术,主要是指在防火墙、入侵检测、网络陷阱等技术的支持下,对一切存在或者潜在的网络犯罪行为进行数据信息的获取及分析,并在网络系统安全的情况下实现对数据的获取、鉴定及提交。基于Web网络实时取证和一般的计算机取证不同,其主要是对网络大数据信息、审计痕迹、主机系统日记等方面的及时性监控和分析,继而及时发现网络系统中存在或者潜在的危害性因素。 0 Preface Web-based real-time network forensics technology is accompanied by the emergence of computer crime incident and the development of a technology, mainly refers to the firewall, intrusion detection, network traps and other technology support for all existing or potential cybercrime Data acquisition and analysis of data, and in the case of network security to achieve data access, identification and submission. Web-based real-time network forensics and general computer forensics is different, it is mainly on the network big data information, audit trails, host system diaries and other aspects of timely monitoring and analysis, and then timely detection of network systems exist or potentially harmful factors.