计算机静态取证存在证据的真实性、有效性和及时性问题。本文提出将取证技术结合到防火墙、入侵检测系统中,对所有可能的计算机犯罪行为进行实时的动态取证,重点研究了基于智能代理的动态取证系统模型、智能代理技术在动态取证中的应用以及动态取证中的数据获取,解决动态取证的实时性、智能性、可适应性和扩展性问题。 There is evidence of the authenticity, validity and timeliness of the evidence in computer static forensics. This paper proposes to integrate forensic technology into the firewall and intrusion detection system to conduct real-time dynamic forensics of all possible computer crimes. Emphasis is placed on the dynamic forensics system model based on intelligent agent, the application of intelligent agent technology in dynamic forensics and its dynamic Acquisition of data in evidence to solve the real-time dynamic evidence, intelligence, adaptability and scalability issues.