Proactive Forensics Method Based on Intrusion Detection System
基于入侵检测系统的主动取证方法

So it is costly to be evidence as a whole.A proactive forensics method was proposed to reduce the huge amount of data and reserve valuable evidence according to IDS alerts.The method was viable and reach a good trade-off performance,between possible evidence and cost.