在分析目前網(wǎng)絡(luò)體系中存在的不利于網(wǎng)絡(luò)取證的問題的基礎(chǔ)上，提出和設(shè)計了一種分布式網(wǎng)絡(luò)實時取證系統(tǒng)。該系統(tǒng)通過不斷監(jiān)視和分析網(wǎng)絡(luò)內(nèi)部的運行情況，在保護網(wǎng)絡(luò)安全的基礎(chǔ)上，確定網(wǎng)絡(luò)入侵者的行為是否已構(gòu)成犯罪，然后提取和分析入侵者犯罪證據(jù)信息，并實現(xiàn)證據(jù)信息的完整性保護和驗證。最后，通過時間線性化實時融合，生成入侵者犯罪證據(jù)。Based on the discussion of the weakness of the network forensics in current Internet system, a distributed real network forensics system is proposed and designed. This system monitors and analyzes the state of the local network. When the Internet intruder is found, on the base of the security of the local network, the system confirms whether crime has happened, and then captures and analyzes the intruding evidence information, protects the integrity of them, finally, produces the intruding crime evidence.