计算机犯罪取证学(computerforensics)是指把计算机看作犯罪现场,搜寻确认罪犯及其犯罪证据,并据此提起诉讼。入侵追踪是计算机犯罪取证学必不可少的重要手段。但入侵者通常在进入目标主机前会通过一系列中间主机来隐藏真实身份,这就使得追踪起来非常困难。笔者介绍了常规的方法,在此基础上,提出了另一新思路用于入侵追踪。此方法利用了java和cookie技术。 Computer forensics refers to the computer as a crime scene, to search for evidence of convicted criminals and their evidence, and accordingly filed a lawsuit. Intrusion tracking is an indispensable means of computer forensics crime. However, the intruder usually hides the real identity through a series of intermediate hosts before entering the target host, which makes tracking very difficult. The author introduces the conventional method, on this basis, put forward another new idea for intrusion tracking. This method takes advantage of java and cookie technologies.