Mail evidence collection method and device, equipment and storage medium

Abstract

The invention belongs to the technical field of artificial intelligence, and discloses a mail evidence collection method, device and equipment and a storage medium, and the method comprises the steps: obtaining at least one original mail file, and carrying out the analysis of the original mail file through a mail analysis assembly, and obtaining the header information, text information and attachment information of the original mail file; rendering the head information and the body information through an information rendering template to obtain head rendering information and body rendering information, and combining the head rendering information with the body rendering information to obtain target mail information; acquiring corresponding picture binary information according to the content ID identifier of the attachment information, and encoding the picture binary information to obtain picture encoding information; and generating a PDF file according to the target mail information and the picture coding information, and converting the PDF file into a picture form to obtain a content screenshot of the original mail file. The mail evidence collection method and device can be applied to implementation scenes of the medical and financial fields, and the efficiency and accuracy of mail evidence collection are improved.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and in particular to a method, apparatus, device, and storage medium for collecting email evidence. Background Art

[0002] During various certification reviews, such as those for the Data Management Capability Maturity Model (DCMM) and the Information Security Management System (ISO 27001), companies are often required to provide extensive and detailed business process records as evidence. Email communication, a crucial method of information exchange in daily business operations, is required as a key component of compliance documentation. For example, in the healthcare and financial sectors, communication between hospitals and businesses, or between businesses, is often conducted via email, and this email is used as a key component of compliance documentation.

[0003] Currently, the mainstream method of collecting email evidence relies on manually taking screenshots of the email client interface screen by screen and manually splicing multiple screenshots using image editing software to form a complete view of the email content. This process is not only inefficient, but also increases labor costs sharply, especially when processing large-scale emails (for example, the total number of emails containing transaction data between life insurance companies and customers in the past three years needs to be processed in a single go: 50,000). In addition, due to the limitations of manual operation, it is very easy to cause problems such as missed screenshots, misaligned splicing, or distorted content, which in turn affects the accuracy and reliability of email screenshot evidence collection.

[0004] In summary, the existing email evidence collection method has technical problems of low efficiency and accuracy. Summary of the Invention

[0005] The purpose of the embodiments of the present application is to provide a method, device, equipment and storage medium for collecting email evidence, the main purpose of which is to improve the efficiency and accuracy of email evidence collection.

[0006] First, in order to solve the above technical problems, the present application provides a method for collecting email evidence, which adopts the following technical solutions:

[0007] Acquire at least one original email file, and parse the original email file using an email parsing component to obtain email parsing data, wherein the email parsing data includes header information, body information, and attachment information;

[0008] Rendering the header information and the body information using a preset information rendering template to obtain header rendering information and body rendering information, and combining the header rendering information and the body rendering information to obtain the target email information;

[0009] Obtaining corresponding image binary information according to the content ID of the attachment information, and encoding the image binary information to obtain image encoding information;

[0010] A PDF file is generated according to the target email information and the image encoding information, and the PDF file is converted into an image format to obtain a screenshot of the content of the original email file.

[0011] Secondly, in order to solve the above technical problems, the embodiments of the present application further provide an email evidence collection device, which adopts the following technical solution:

[0012] a parsing module, configured to obtain at least one original email file, and parse the original email file using an email parsing component to obtain email parsing data, wherein the email parsing data includes header information, body information, and attachment information;

[0013] a rendering module, configured to render the header information and the body information using a preset information rendering template to obtain header rendering information and body rendering information, and to obtain target email information by combining the header rendering information and the body rendering information;

[0014] An encoding module, configured to obtain corresponding image binary information according to the content ID of the attachment information, and encode the image binary information to obtain image encoding information;

[0015] The conversion module is used to generate a PDF file according to the target email information and the image encoding information, and convert the PDF file into an image format to obtain a content screenshot of the original email file.

[0016] On the third aspect, in order to solve the above-mentioned technical problems, an embodiment of the present application also provides a computer device, comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the email evidence collection method as described above.

[0017] Fourthly, in order to solve the above technical problems, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which implements the above-mentioned email evidence collection method when executed by a processor.

[0018] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0019] The email parsing component can fully parse the original email file to ensure that key data such as header information, body information, and attachment information are not missed, ensuring the completeness of the email data and thus improving the accuracy of email evidence collection. The email parsing component also automatically extracts structured information from emails, which can improve the efficiency of email evidence collection.

[0020] By independently generating the header information and body information through different templates, the template complexity is reduced, thereby improving the efficiency of email evidence collection. By combining the header rendering information with the initial body rendering information to generate the target email information, the integrity of the target email information can be guaranteed, thereby improving the accuracy of email evidence collection.

[0021] By traversing the attachment list and comparing the CID identifiers item by item, efficient matching can be achieved, thereby improving the efficiency of email evidence collection. Encoding the image binary data (such as encoding it into a Base64 string) solves the problem of missing email images and improves the accuracy of email evidence collection.

[0022] By generating a PDF file based on the target email information and the image encoding information and converting the PDF file into an image format, a content screenshot of the original email file is obtained, thereby improving the integrity and accuracy of email evidence collection. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the solutions in this application, a brief introduction will be given below to the drawings required for use in the description of the embodiments of this application. Obviously, the drawings described below are some embodiments of this application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0024] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0025] Figure 2 A flowchart of an embodiment of a method for collecting email evidence according to the present application;

[0026] Figure 3 This is a structural diagram of an embodiment of a mail evidence collection device according to the present application;

[0027] Figure 4 It is a structural diagram of an embodiment of a device according to the present application. DETAILED DESCRIPTION

[0028] Unless otherwise defined, all technical and scientific terms used herein have the same meanings as commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of the application are for the purpose of describing specific embodiments only and are not intended to limit this application. The terms "including" and "having" and any variations thereof in the specification and claims of this application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of this application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0029] References herein to "embodiments" mean that a particular feature, structure, or characteristic described in connection with the embodiments may be included in at least one embodiment of the present application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0030] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0031] like Figure 1 As shown, system architecture 100 may include a terminal device 101, a network 102, and a server 103. Terminal device 101 may be a laptop computer 1011, a tablet computer 1012, or a mobile phone 1013. Network 102 is a medium for providing a communication link between terminal device 101 and server 103. Network 102 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0032] The user can use the terminal device 101 to interact with the server 103 via the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0033] The terminal device 101 can be various electronic devices with a display screen and supporting web browsing. In addition to the laptop computer 1011, tablet computer 1012 or mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV) player, a laptop computer and a desktop computer, etc.

[0034] The server 103 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal device 101 .

[0035] It should be noted that the email evidence collection method provided in the embodiment of the present application is generally executed by a server / terminal device, and accordingly, the email evidence collection device is generally set in the server / terminal device.

[0036] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is merely illustrative. Any number of terminal devices, networks and servers may be provided as required.

[0037] Continue to refer Figure 2 , showing a flowchart of an embodiment of the email evidence collection method according to the present application. According to different needs, the order of the steps in the flowchart can be changed, and some steps can be omitted. The email evidence collection method provided in the embodiment of the present application can be applied to any scenario where email evidence collection is required, such as transaction data emails between hospitals and enterprises in the medical field, or transaction data emails between enterprises in the financial field. Both of them need to collect the transaction data emails, and the email evidence collection method can be applied to products in these scenarios. The email evidence collection method includes the following steps:

[0038] Step S201: Acquire at least one original email file, and parse the original email file using an email parsing component to obtain email parsing data, wherein the email parsing data includes header information, body information, and attachment information.

[0039] In this embodiment, the electronic device on which the email evidence collection method is executed (eg Figure 1The server / terminal device shown in the figure) can obtain at least one original email file through a wired connection or a wireless connection. It should be noted that the above-mentioned wireless connection method may include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (Ultra Wide Band) connection, and other wireless connection methods currently known or to be developed in the future.

[0040] In this embodiment, the above-mentioned original email file includes email headers, email body and attachments, which refers to files saved in a specific format during the transmission or storage process of the email; the above-mentioned email parsing component refers to a component (such as JavaScript / Node.js parsing component, etc.) that reads and parses the original email file based on the format of the original email file; the above-mentioned email parsing data refers to data parsed from the original email file, including header information (sender From, recipient To, subject Subject, sending time Data, email ID Massage-ID and other custom header fields, etc.), body information (plain text and HTML format text) and attachment information (attachments such as images).

[0041] In this embodiment, at least one original email file is obtained. The above-mentioned acquisition source can be a local file: obtaining the original email file from a user-specified path; a network request: downloading the original email file from an email server or API interface; a database: obtaining stored email data from a storage system; after obtaining at least one original email file, the format of each original email file is identified, and an email parsing component corresponding to the format is called to parse the original email file to obtain email parsed data corresponding to the original email file.

[0042] In one embodiment, the email parsing component is used to parse the original email file to obtain email parsing data, wherein the email parsing data includes header information, body information, and attachment information, including:

[0043] Parsing the original email file using the email parsing component to obtain the email structure;

[0044] Extracting the fields corresponding to each of the email structures according to the email structure to obtain the header information, the body information, and the attachment information;

[0045] The header information, the body information and the attachment information are collected to obtain the email parsing data.

[0046] In this embodiment, according to the file format of the original email file, the corresponding email parsing component is called for parsing, and a structured object (such as a tree structure) of the original email file is parsed to obtain the email structure, which includes various parts, namely the header information part, the body information part and the attachment information part; based on each part in the email structure, the fields of each part are traversed respectively, such as the header field of the header part in the email structure is traversed to extract the corresponding header information; check whether there are multiple parts in the body information part. If it is a multi-part email, traverse each part and extract the plain text or HTML content. If it is a single-part email, directly extract the body content to obtain the corresponding body information; traverse the attachment information part, extract the attachment file name, etc., to obtain the corresponding attachment information; the header information, body information and attachment information are collected to obtain email parsing data.

[0047] In this embodiment, by traversing the corresponding fields in the email structure, the header information, body information and attachment information are obtained, and the key information in the email can be accurately extracted, thereby improving the comprehensiveness of email information extraction and thus improving the accuracy of email evidence collection; and the extracted header information, body information and attachment information are aggregated to form complete email parsing data, which can obtain all the key information of the email at one time, without the need to obtain information from different parts of the email multiple times, thereby improving the efficiency of email evidence collection.

[0048] In one embodiment, after parsing the original email file using the email parsing component to obtain email parsing data, the method further includes:

[0049] Traversing the header information in the email parsing data, judging whether the header information has any anomaly according to a preset field judgment rule, and assigning a first-level anomaly label to the email parsing data when the header information has any anomaly;

[0050] Traversing the body information and the attachment information in the email parsed data, and assigning a secondary abnormality label to the email parsed data when both the body information and the attachment information are missing;

[0051] When either the main text information or the attachment information is missing, a corresponding three-level abnormality label is assigned according to the missing data.

[0052] In this embodiment, the above-mentioned preset field judgment rule refers to checking whether the preset fields exist and are in the correct format, such as checking whether the "From" field exists and is in the correct format, and checking whether the "Date" field is in a valid date format; first traverse the header information in the email parsing data, the header information usually contains key metadata of the email, such as sender, recipient, subject, date, etc.; judge the header information according to the preset field rules to obtain a judgment result, and when there is an exception in the judgment result (such as the field is correct or the format is wrong), give the email parsing data a first-level exception label; traverse the email parsing data Analyze the body information and attachment information in the data, and check whether the body information is empty and whether the attachment information is missing; when the body information and attachment information are both missing, it indicates that there is a body information and / or attachment information parsing anomaly in the email parsing data, and the email parsing data is given a second-level anomaly label; when only one of the body information and attachment information is missing, a corresponding third-level anomaly label is given according to the missing data, wherein the third-level anomaly label includes a third-level body missing label and a third-level attachment missing label. When the body information is missing, the third-level body missing label is given, and when the attachment information is missing, the third-level attachment missing label is given. According to the labels of the email parsing data, they are stored in different databases to distinguish the priority of processing abnormal email parsing data. The first-level abnormal label corresponds to the priority processing channel, because the lack of header information will affect the basic processing flow of the email; the second-level abnormal label refers to the second-priority processing channel, which requires manual completion based on the original email file or through secondary email parsing to complete the missing data; the third-level abnormal label is the channel with the lowest priority, which requires manual review of the email parsing data to check whether the original email file contains the missing data. If the data in the original email corresponds to the email parsing data, the abnormal label of the email parsing data is removed. If the original data contains the missing data, the missing data is completed, and the abnormal label of the email parsing data after the missing data is completed is removed, and then the subsequent process is carried out.

[0053] In this embodiment, by traversing the email parsing data and further performing anomaly monitoring and labeling on the email parsing data, problems in the email parsing data can be identified, thereby improving the reliability and accuracy of email evidence collection; and through automated inspection and labeling, manual intervention can be reduced, thereby improving the efficiency of email evidence collection.

[0054] In an implementable example A, for example, in the life insurance business, that is, in the financial field, a customer submits an insurance application via email. The email content includes the insured personal information, details of the insured product and health notices, ID card images, etc. The insurance company needs to parse these emails and automatically extract the email information as evidence; when receiving the email sent by the user, the customer email is parsed into structured data through the email parsing component, and the header information (such as sender, subject, time, etc.), body information (insured product details, health notices, etc.), and attachment information (front and back images of ID cards, etc.) are distinguished based on the parsed structured data, and the contents of the header information, body information, and attachment information are extracted respectively to obtain the email parsed data.

[0055] The above-mentioned feasible example A can also be applied in the medical field, through email exchanges between doctors and patients, or transaction data emails between hospitals and enterprises (such as suppliers, etc.).

[0056] In this embodiment, the email parsing component can fully parse the original email file to ensure that key data such as header information, body information and attachment information are not missed, thereby ensuring the complete information of the email data and thereby improving the accuracy of email evidence collection; and the email parsing component can automatically extract the structured information of the email, thereby improving the efficiency of email evidence collection.

[0057] Step S202: Render the header information and the body information using a preset information rendering template to obtain header rendering information and body rendering information, and combine the header rendering information and the body rendering information to obtain the target email information;

[0058] In this embodiment, the preset information rendering template includes a header information rendering template and a body information rendering template. The header information is rendered using the preset header information rendering template to obtain header rendering information, and the body information is rendered using the body information rendering template to obtain body rendering information. The rendered header rendering information and body rendering information are combined to obtain the target email information.

[0059] In one embodiment, the rendering of the header information and the body information using a preset information rendering template to obtain header rendering information and initial body rendering information, and combining the header rendering information and the initial body rendering information to obtain the target email information includes:

[0060] Pre-build header information rendering template and body information rendering template;

[0061] Rendering the header information using the header information rendering template to obtain header rendering information;

[0062] Rendering the text information using the text information rendering template to obtain initial text rendering information;

[0063] The target email information is obtained by combining the header rendering information and the initial body rendering information.

[0064] In this embodiment, a header information rendering template and a body information rendering template are pre-constructed, wherein the construction step of the header information rendering template includes constructing a title area and a metadata area, and each area has a corresponding placeholder; the title area is used to display the subject information of the header information, including a preset background color and a bold font setting, and limiting the number of words in a single line of the subject information; the metadata area is used to display the metadata in the header information (such as sender, recipient, time, etc.), and the position and field format of each placeholder in the metadata area are arranged according to the layout requirements, for example, "sender-recipient" double-column alignment, forced left alignment of the date, etc., as well as the field format of the sender, the field format of the date, the time zone mark, etc.; after the above settings are completed, the header information rendering template is obtained; the construction step of the body information rendering template It includes constructing a content container and embedding a header information placeholder, wherein the content container has a body information placeholder for embedding the body information into the content container; the content container includes a preset background color, embedded font spacing, embedded line spacing, automatic centering format, etc., and the header information embedding placeholder is used to subsequently combine the header rendering information with the body rendering information; after the above settings are completed, a body information embedding template is generated; the header information is rendered through the constructed header information rendering template to obtain the header rendering information; the initial body rendering information is obtained by embedding the body information into the placeholder of the content container in the body information rendering template. At this time, the body rendering information is not output in the form of a file first, but the body rendering information is combined with the header rendering information in the body information rendering template to obtain the target email information.

[0065] In this embodiment, by constructing a preset rendering template to render the body information and header information, and combining them to generate the target email information, the efficiency of email evidence collection can be improved; and by solidifying the field format and standardizing the layout, the standardization and consistency of email evidence can be improved.

[0066] In another embodiment, rendering the header information using the header information rendering template to obtain header rendering information includes:

[0067] Extracting the header information and identifying each header information field of the header information;

[0068] Matching each of the header information fields with a template field in the header information rendering template;

[0069] In the header information rendering template, the successfully matched header information field is embedded into the placeholder of the corresponding template field, and the format of the header information field is modified according to the format requirement of the placeholder;

[0070] When all the header information fields have corresponding placeholders embedded in the header information rendering template, the header rendering information is obtained.

[0071] In this embodiment, the header information is extracted, and each header information field in the header information is identified, such as sender: Zhang San, sending date: xxxx-xx-xx, recipient: Li Si, subject: xxx, etc., each template field in the header information rendering template, such as template subject, template recipient, etc., and the placeholder corresponding to each template field are obtained, each header information field is matched with the template field in the header information rendering template to obtain a matching result, and according to the matching result, the header information field is embedded in the placeholder of the corresponding template field in the header information rendering template, and the format of the header information field is modified according to the format requirements of the placeholder. When all the header information fields are embedded, the header rendering information is generated.

[0072] In this embodiment, the header rendering information is generated by embedding each field of the header information into the placeholder of the header information rendering template, thereby improving the efficiency and accuracy of email evidence collection.

[0073] In another embodiment, combining the header rendering information and the initial body rendering information to obtain the target email information includes:

[0074] Obtaining the header rendering information, and inserting the header rendering information into the header information embedding placeholder in the body information rendering template;

[0075] The target email information is obtained by combining the initial text rendering information.

[0076] In this embodiment, the initial body rendering information refers to the information obtained by inserting the body information into the content container in the body information rendering template. In this case, the initial body rendering information is not output in the form of a file. Instead, the header rendering information is inserted as a whole into the header information embedding placeholder in the body information rendering template. After the embedding is completed, the target email message is obtained by combining the initial body rendering information.

[0077] In this embodiment, the header rendering information is inserted as a whole through the placeholder in the body rendering template, avoiding formatting errors caused by directly relying on character strings, thereby improving the accuracy of email evidence collection.

[0078] Continuing with the above-mentioned feasible example A, after parsing the email sent by the customer, the email parsing data is obtained, the header information in the email parsing data is extracted, the various header information fields of the header information are identified, and the various header information fields are embedded into the header information rendering template to obtain the header rendering information; the body information in the email parsing data is extracted, and the body information and the header rendering information are embedded into the placeholder corresponding to the body information rendering template to obtain the target email information.

[0079] In this embodiment, the placeholders of the above-mentioned text information rendering template and header information rendering template both adopt a "one-time rendering" strategy. After the text information and header information rendering are completed, the text rendering information and header rendering information obtained are in a locked state, that is, once the placeholder is rendered, it cannot be edited again.

[0080] In this embodiment, by independently generating the header information and the body information through different templates, the complexity of the template is reduced, thereby improving the efficiency of email evidence collection; by combining the header rendering information with the initial body rendering information to generate the target email information, the integrity of the target email information can be ensured, thereby improving the accuracy of email evidence collection.

[0081] Step S203: Obtain corresponding image binary information according to the content ID of the attachment information, and encode the image binary information to obtain image encoding information;

[0082] In this embodiment, the attachment information (attachments) is a general collection of attachments, including all attachments in the email (such as non-image files such as PDF, ZIP, and image files); the content ID identifier refers to the CID identifier, and the CID (Content-ID) is a mechanism for uniquely identifying inline attachments in emails. The image information in the attachment information can be accurately located based on the content ID identifier; if all attachments in the attachment information are directly traversed and encoded, processing resources for non-image files (such as PDF, ZIP, etc.) will be wasted, and non-image attachments may be mistakenly encoded, resulting in exceptions when generating PDF files subsequently.

[0083] In this embodiment, according to the content ID identifier of the attachment information, attachments of the picture type are filtered out from the attachment information, and the picture binary information of at least one picture is obtained, and the picture binary information is encoded (such as converted to Base64) to obtain picture encoding information.

[0084] In one embodiment, the acquiring corresponding image binary information according to the content ID identifier of the attachment information, and encoding the image binary information to obtain image encoding information includes:

[0085] Extracting the content ID of the attachment information from the original email file;

[0086] Matching the attachment information according to the content ID identifier to obtain at least one picture in the attachment information;

[0087] Obtain the picture binary information corresponding to at least one of the pictures, and encode the picture binary information to obtain the picture encoding information.

[0088] In this embodiment, the attachment information CID and parameters are parsed from the body information in the original email file, and the prefix and parameter part of the CID are removed to obtain the content ID identifier of the attachment information; the entire attachment information is traversed according to the content ID identifier, and at least one picture corresponding to the content ID identifier is matched from the entire attachment information, and the picture binary information of each picture is obtained, and each picture binary information is encoded (such as a Base64 string at the encoding layer) to obtain the picture encoding information.

[0089] In this embodiment, by traversing the attachment list and comparing the CID identifiers item by item, efficient matching can be achieved, thereby improving the efficiency of email evidence collection; encoding the image binary data (such as encoding it into a Base64 string) solves the problem of missing email images and improves the accuracy of email evidence collection.

[0090] Continuing with the above-mentioned feasible example A, the body information of the email sent by the customer is identified, and the content ID (i.e., CID) is obtained from the body information. Based on the content ID, the attachment information of the email is traversed to match the image, and the binary information of the image is obtained. The image binary information is Base64-encoded to obtain the image encoding information.

[0091] Step S204: Generate a PDF file according to the target email information and the image encoding information, and convert the PDF file into an image format to obtain a screenshot of the content of the original email file.

[0092] In this embodiment, a PDF generation component (such as an HTML-PDF component) is used to generate a PDF file based on the target email information and image encoding information. The PDF format is a widely used document format with good compatibility and stability, and can be accurately displayed and replaced on different operating systems and devices; the output type of the image format is defined as PNG, that is, a PNG format image is generated, and the PDF file is converted into an image format according to the defined output type to obtain a screenshot of the content of the original email file.

[0093] In this embodiment, a PDF file is generated according to the target email information and the image encoding information, and the PDF file is converted into an image format to obtain a content screenshot of the original email file, thereby improving the integrity and accuracy of email evidence collection.

[0094] Through the above steps, this solution achieves the automated conversion from the original email file to the image of the original email file. First, the original email file is read and parsed using the email parsing component to obtain the email parsed content. The email content is then rendered using different rendering templates. The attached image is then encoded. Finally, the rendered target email information and image encoding are converted into PNG images. Through the batch processing mechanism, a large number of email files can be efficiently processed, solving the low efficiency and error-prone problem of manual screenshots in the existing technology. At the same time, it avoids the defect of missing images after conversion in existing open source solutions, improving the efficiency and accuracy of email evidence collection.

[0095] It should be emphasized that in order to further ensure the privacy and security of the above-mentioned rental information, the above-mentioned rental information can also be stored in a node of a blockchain.

[0096] The blockchain referred to in this application is a new application model for computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Blockchain is essentially a decentralized database, a series of data blocks generated using cryptographic methods. Each data block contains information about a batch of network transactions, which is used to verify the validity of this information (to prevent counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, the platform product service layer, and the application service layer.

[0097] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) is the theory, method, technology, and application system that uses digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use knowledge to achieve optimal results.

[0098] Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interaction systems, and mechatronics. AI software technologies primarily encompass computer vision, robotics, biometrics, speech processing, natural language processing, and machine learning / deep learning.

[0099] Those skilled in the art will appreciate that all or part of the processes in the above-described method embodiments can be implemented by instructing related hardware via computer-readable instructions. The computer-readable instructions can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes in the above-described method embodiments. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0100] It should be understood that although the steps in the flowcharts of the accompanying drawings are shown in sequence as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some of the steps in the flowcharts of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0101] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a mail evidence collection device. Figure 2 Corresponding to the method embodiment shown, the apparatus can be specifically applied to various computer devices.

[0102] like Figure 3 As shown, the email evidence collection device 300 of this embodiment includes: a parsing module 301, a rendering module 302, an encoding module 303, and a conversion module 304. Among them:

[0103] The parsing module 301 is configured to obtain at least one original email file and parse the original email file using an email parsing component to obtain email parsing data, wherein the email parsing data includes header information, body information, and attachment information;

[0104] In one embodiment, the parsing module includes:

[0105] A parsing submodule, configured to parse the original email file using the email parsing component to obtain an email structure;

[0106] An extraction submodule, configured to extract fields corresponding to each email structure according to the email structure, and obtain the header information, the body information, and the attachment information;

[0107] The collection submodule is used to collect the header information, the body information and the attachment information to obtain the email parsing data.

[0108] In one embodiment, the apparatus further comprises:

[0109] A first label assignment module is configured to traverse the header information in the email parsing data, determine whether the header information is abnormal according to a preset field judgment rule, and assign a first-level abnormality label to the email parsing data when the header information is abnormal;

[0110] a second label assigning module, configured to traverse the body information and the attachment information in the email parsing data, and assign a secondary abnormality label to the email parsing data when both the body information and the attachment information are missing;

[0111] The third label assigning module is used to assign a corresponding third-level abnormal label according to the missing data when either the main text information or the attachment information is missing.

[0112] A rendering module 302 is configured to render the header information and the body information using a preset information rendering template to obtain header rendering information and body rendering information, and to obtain a target email message by combining the header rendering information and the body rendering information;

[0113] In one embodiment, the rendering module includes:

[0114] Build submodules to pre-build header information rendering templates and body information rendering templates;

[0115] A first rendering submodule, configured to render the header information using the header information rendering template to obtain header rendering information;

[0116] A second rendering submodule is configured to render the text information using the text information rendering template to obtain initial text rendering information;

[0117] The combining submodule is used to combine the header rendering information and the initial body rendering information to obtain the target email information.

[0118] In another embodiment, the first rendering submodule includes:

[0119] an identification subunit, configured to extract the header information and identify each header information field of the header information;

[0120] a matching subunit, configured to match each of the header information fields with a template field in the header information rendering template;

[0121] an embedding subunit, configured to embed the successfully matched header information field into the placeholder of the corresponding template field in the header information rendering template, and modify the format of the header information field according to the format requirement of the placeholder;

[0122] The verification subunit is configured to obtain the header rendering information when all the header information fields have corresponding placeholders embedded in the header information rendering template.

[0123] In another embodiment, the combining submodule comprises:

[0124] An inserting subunit, configured to obtain the header rendering information and insert the header rendering information into a header information embedding placeholder in a body information rendering template;

[0125] The combining subunit is used to combine the initial text rendering information to obtain the target email information.

[0126] An encoding module 303 is configured to obtain corresponding image binary information according to the content ID of the attachment information, and encode the image binary information to obtain image encoding information;

[0127] In one embodiment, the encoding module includes:

[0128] An identification extraction submodule, configured to extract the content ID of the attachment information from the original email file;

[0129] an identification matching submodule, configured to match the attachment information according to the content ID identification to obtain at least one picture in the attachment information;

[0130] The encoding submodule is used to obtain the picture binary information corresponding to at least one of the pictures, and encode the picture binary information to obtain the picture encoding information.

[0131] The conversion module 304 is configured to generate a PDF file according to the target email information and the image encoding information, and convert the PDF file into an image format to obtain a screenshot of the content of the original email file.

[0132] In this embodiment, the email parsing component can fully parse the original email file to ensure that key data such as header information, body information, and attachment information are not missed, thereby ensuring the completeness of the email data and improving the accuracy of email evidence collection. The email parsing component also automatically extracts structured information from emails, which can improve the efficiency of email evidence collection.

[0133] By independently generating the header information and body information through different templates, the template complexity is reduced, thereby improving the efficiency of email evidence collection. By combining the header rendering information with the initial body rendering information to generate the target email information, the integrity of the target email information can be guaranteed, thereby improving the accuracy of email evidence collection.

[0134] By traversing the attachment list and comparing the CID identifiers item by item, efficient matching can be achieved, thereby improving the efficiency of email evidence collection. Encoding the image binary data (such as encoding it into a Base64 string) solves the problem of missing email images and improves the accuracy of email evidence collection.

[0135] By generating a PDF file based on the target email information and the image encoding information and converting the PDF file into an image format, a content screenshot of the original email file is obtained, thereby improving the integrity and accuracy of email evidence collection.

[0136] In order to solve the above technical problems, the embodiment of the present application also provides a device (computer device). Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0137] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with a memory 41, a processor 42, and a network interface 43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to a microprocessor, an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital signal processor (DSP), an embedded device, etc.

[0138] The computer device may be a desktop computer, notebook computer, PDA, cloud server, etc. The computer device may interact with the user via a keyboard, mouse, remote control, touchpad, or voice control device.

[0139] The memory 41 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as the hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk equipped on the computer device 4, a smart memory card (SMC), a secure digital (SD) card, a flash memory card, etc. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions of the email evidence collection method. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0140] In some embodiments, the processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to execute computer-readable instructions stored in the memory 41 or process data, such as computer-readable instructions for executing the email evidence collection method.

[0141] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0142] During implementation, the electronic device of this application can fully parse the original email file through the email parsing component to ensure that key data such as header information, body information, and attachment information are not missed, thereby ensuring the completeness of the email data and thereby improving the accuracy of email evidence collection. The email parsing component also automatically extracts structured information from emails, thereby improving the efficiency of email evidence collection.

[0143] By independently generating the header information and body information through different templates, the template complexity is reduced, thereby improving the efficiency of email evidence collection. By combining the header rendering information with the initial body rendering information to generate the target email information, the integrity of the target email information can be guaranteed, thereby improving the accuracy of email evidence collection.

[0144] By traversing the attachment list and comparing the CID identifiers item by item, efficient matching can be achieved, thereby improving the efficiency of email evidence collection. Encoding the image binary data (such as encoding it into a Base64 string) solves the problem of missing email images and improves the accuracy of email evidence collection.

[0145] By generating a PDF file based on the target email information and the image encoding information and converting the PDF file into an image format, a content screenshot of the original email file is obtained, thereby improving the integrity and accuracy of email evidence collection.

[0146] The present application also provides another embodiment, namely, providing a storage medium (computer-readable storage medium), wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the above-mentioned email evidence collection method.

[0147] During implementation, the computer-readable storage medium of the present application can fully parse the original email file through the email parsing component to ensure that key data such as header information, body information, and attachment information are not omitted, thereby ensuring the completeness of the email data and thereby improving the accuracy of email evidence collection. Furthermore, the email parsing component can automatically extract structured information from emails, thereby improving the efficiency of email evidence collection.

[0148] By independently generating the header information and body information through different templates, the template complexity is reduced, thereby improving the efficiency of email evidence collection. By combining the header rendering information with the initial body rendering information to generate the target email information, the integrity of the target email information can be guaranteed, thereby improving the accuracy of email evidence collection.

[0149] By traversing the attachment list and comparing the CID identifiers item by item, efficient matching can be achieved, thereby improving the efficiency of email evidence collection. Encoding the image binary data (such as encoding it into a Base64 string) solves the problem of missing email images and improves the accuracy of email evidence collection.

[0150] By generating a PDF file based on the target email information and the image encoding information and converting the PDF file into an image format, a content screenshot of the original email file is obtained, thereby improving the integrity and accuracy of email evidence collection.

[0151] The non-Company software tools or components appearing in the embodiments of this application are merely examples and do not represent actual use.

[0152] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0153] Obviously, the embodiments described above are only some of the embodiments of the present application, rather than all of the embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions described in the aforementioned specific embodiments, or to make equivalent replacements for some of the technical features therein. Any equivalent structure made using the contents of the present application specification and the accompanying drawings, directly or indirectly used in other related technical fields, is also within the scope of patent protection of the present application.

Claims

1. A method for collecting email evidence, characterized in that: The method comprises: Acquire at least one original email file, and parse the original email file using an email parsing component to obtain email parsing data, wherein the email parsing data includes header information, body information, and attachment information; Rendering the header information and the body information using a preset information rendering template to obtain header rendering information and body rendering information, and combining the header rendering information and the body rendering information to obtain the target email information; Obtaining corresponding image binary information according to the content ID of the attachment information, and encoding the image binary information to obtain image encoding information; A PDF file is generated according to the target email information and the image encoding information, and the PDF file is converted into an image format to obtain a screenshot of the content of the original email file.

2. The email evidence collection method according to claim 1, wherein: The email parsing component is used to parse the original email file to obtain email parsing data, wherein the email parsing data includes header information, body information and attachment information, including: Parsing the original email file using the email parsing component to obtain the email structure; Extracting the fields corresponding to each of the email structures according to the email structure to obtain the header information, the body information, and the attachment information; The header information, the body information and the attachment information are collected to obtain the email parsing data.

3. The email evidence collection method according to claim 1, wherein: After parsing the original email file using the email parsing component to obtain email parsing data, the method further includes: Traversing the header information in the email parsing data, judging whether the header information has any anomaly according to a preset field judgment rule, and assigning a first-level anomaly label to the email parsing data when the header information has any anomaly; Traversing the body information and the attachment information in the email parsed data, and assigning a secondary abnormality label to the email parsed data when both the body information and the attachment information are missing; When either the main text information or the attachment information is missing, a corresponding three-level abnormality label is assigned according to the missing data.

4. The email evidence collection method according to claim 1, wherein: The step of rendering the header information and the body information using a preset information rendering template to obtain header rendering information and initial body rendering information, and combining the header rendering information and the initial body rendering information to obtain target email information includes: Pre-build header information rendering template and body information rendering template; Rendering the header information using the header information rendering template to obtain header rendering information; Rendering the text information using the text information rendering template to obtain initial text rendering information; The target email information is obtained by combining the header rendering information and the initial body rendering information.

5. The email evidence collection method according to claim 4, wherein: The step of rendering the header information using the header information rendering template to obtain header rendering information includes: Extracting the header information and identifying each header information field of the header information; Matching each of the header information fields with a template field in the header information rendering template; In the header information rendering template, the successfully matched header information field is embedded into the placeholder of the corresponding template field, and the format of the header information field is modified according to the format requirement of the placeholder; When all the header information fields have corresponding placeholders embedded in the header information rendering template, the header rendering information is obtained.

6. The email evidence collection method according to claim 4, wherein: The combining of the header rendering information and the initial body rendering information to obtain the target email information includes: Obtaining the header rendering information, and inserting the header rendering information into the header information embedding placeholder in the body information rendering template; The target email information is obtained by combining the initial text rendering information.

7. The email evidence collection method according to claim 1, wherein: The step of obtaining corresponding image binary information according to the content ID of the attachment information and encoding the image binary information to obtain image encoding information includes: Extracting the content ID of the attachment information from the original email file; Matching the attachment information according to the content ID identifier to obtain at least one picture in the attachment information; Obtain the picture binary information corresponding to at least one of the pictures, and encode the picture binary information to obtain the picture encoding information.

8. A mail evidence collection device, characterized in that: The device comprises: a parsing module, configured to obtain at least one original email file, and parse the original email file using an email parsing component to obtain email parsing data, wherein the email parsing data includes header information, body information, and attachment information; a rendering module, configured to render the header information and the body information using a preset information rendering template to obtain header rendering information and body rendering information, and to obtain target email information by combining the header rendering information and the body rendering information; An encoding module, configured to obtain corresponding image binary information according to the content ID of the attachment information, and encode the image binary information to obtain image encoding information; The conversion module is used to generate a PDF file according to the target email information and the image encoding information, and convert the PDF file into an image format to obtain a content screenshot of the original email file.

9. A computer device, characterized in that: The computer device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the email evidence collection method according to any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the email evidence collection method according to any one of claims 1 to 7 is implemented.

Images