An Extended Immune-Based Model for Computer Forensics

An extended immune based model of network surveillance and dynamic computer forensics is presented. Two kinds of cells including lymphocyte and forensic cell are defined. The proper time for forensic cell to catch evidence is given out. And the digital watermark method of encapsulation and preservation for digital evidences is introduced. The experiments show that the model has the features of self-adaption, self-learning, distribution, and real time.