Mail content search method and device, terminal and storage medium

Abstract

The invention provides a mail content search method and device, a terminal and a storage medium. The search method includes extracting and storing email content from network data; extracting a featurevector in the mail content, inputting the feature vector into a pre-constructed event type classifier, and classifying the mail content by using a predefined event type in the event type classifier;according to the classification, deriving an event type for performing a related mail search. The search method provided by the invention flexibly searches the email contents of different types of cases by setting the event types related to the investigation cases, which ensures the search breadth and prevents the search direction from deviating from the designated investigation direction, and cangrasp the email content information more efficiently and quickly.

Description

technical field [0001] The invention relates to the field of mail search, in particular to a method, device, terminal and storage medium for searching mail content. Background technique [0002] The mutual integration and intertwined development of mobile communication technology, network technology and information technology have made email replace traditional letters as the main written communication carrier in work and life. According to statistics, an average employee of an enterprise spends a quarter of his time dealing with mail-related business every day, and sends an average of 43 letters every day. And in cases involving e-mail forensics investigations, investigators search for e-mail content to find clues related to the investigation event, such as participants, events, and time of occurrence, and need to understand e-mail content in detail. At present, most investigations are completed through keyword search combined with manual processing. Because keyword search...

AI Technical Summary

Problems solved by technology

[0003] 1) Relevant forensic tools are not efficient for text content search

Current tools mainly rely on relatively simple hash and search algorithms, which limits the efficiency of inspections

The processing time of a limited number of keyword searches (10-20 keywords) often takes several days, and important evidence is often submerged in a large number of hits that are not highly relevant to the case

[0004] 2) Investigators' limited cognitive processing capabilities hamper the outcome of forensic investigations

However, One-hot Representation will cause the word vector dimension to be too large, which is prone to dimension disasters, especially when it is used in some algorithms of Deep Learning; while Distributed Representation cannot distinguish antonyms with the same context, and cannot describe words and words well. similarity between words ("lexical gap")

[0012] Therefore, the above event recognition methods all have the following two problems: the same event may be represented by different trigger words and one representation represents different events in different contexts

Images