An automatic detection and analysis method based on mobile phone evidence data analysis

Abstract

This invention relates to an automated detection and analysis method based on mobile phone forensic data parsing, belonging to the field of electronic data forensics and intelligent analysis technology. The method includes: S1 standardizing and cleaning the multi-source heterogeneous raw data extracted from the mobile phone, constructing a global data view and establishing a dual-dimensional global index of time and entities; S2 extracting multi-dimensional features of entities, calculating similarity, performing unified identification and identity mapping of related entities, and aggregating records from all sources of the same subject to generate an entity association table; S3 constructing a multi-dimensional abnormal behavior detection model, identifying various abnormal behaviors and connecting them to form a complete abnormal behavior chain, and completing risk quantification scoring; S4 automatically extracting related evidence nodes based on the abnormal behavior chain, generating a logically closed-loop case evidence chain, and completing legality and completeness verification. This achieves fully automated processing of mobile phone forensic data from preprocessing, entity association, anomaly detection, and evidence generation.

Description

Technical Field

[0001] This invention belongs to the field of electronic data forensics and intelligent analysis technology, specifically involving an automated detection and analysis method based on mobile phone forensic data parsing. Background Technology

[0002] With the popularization of smart terminals and network applications, the data involved in various cases are characterized by multi-source heterogeneity, massive volume and complexity. Electronic evidence collection and behavioral analysis have become the core means of case analysis.

[0003] Currently, conventional forensic techniques can only perform simple parsing and storage of data from a single source, lacking unified data organization and governance capabilities. Data from multiple sources has inconsistent fields, and redundant and invalid data are mixed together, making it impossible to form a complete and traceable set of forensic data across the entire domain, resulting in low data utilization. At the same time, traditional index structures are simple in design, only supporting basic data retrieval, unable to achieve multi-granularity time-layered retrieval and entity association retrieval, and do not support dynamic updates of incremental data, making it difficult to guarantee the retrieval efficiency of massive amounts of forensic data.

[0004] In terms of entity association analysis, existing methods mostly rely on single account, nickname and other identifiers for matching and association, without combining multi-dimensional behavioral characteristics for similarity calculation. This makes it impossible to complete the unified mapping of entity identities across platforms, which can easily lead to the problem of fragmented identity of the same entity and confusion of multiple entity identities, making it difficult to accurately sort out the real interaction and association relationships between entities.

[0005] In terms of abnormal behavior detection, traditional detection methods are one-dimensional, relying solely on fixed rules to determine single-point anomalies. They lack a structured detection logic that integrates multiple dimensions, and cannot cover various behavioral scenarios such as communication, funds, trajectory, and equipment. As a result, the false alarm rate of detection results is high. At the same time, they cannot connect and integrate scattered single-point abnormal behaviors, making it difficult to form a complete abnormal behavior chain. They also lack standardized multi-dimensional risk quantification methods and cannot accurately define the level of abnormal risk.

[0006] In the evidence chain construction stage, existing technologies mainly rely on manual screening and organization of evidence, resulting in insufficient coverage of evidence mining and problems such as evidence omission and redundancy. The manually constructed evidence chain is logically loose, lacking a unified timeline and logical connection, and the mutual support between evidence is weak. At the same time, there is a lack of automated evidence verification mechanisms, which cannot automatically identify logical conflicts in evidence, verify the completeness of evidence, or supplement missing evidence links. The overall level of automation in evidence collection and analysis is low, and the stability and accuracy of analysis results are poor, making it difficult to adapt to the judgment needs of complex case scenarios. Summary of the Invention

[0007] To address the aforementioned problems in the existing technology, this invention provides an automated detection and analysis method based on mobile phone forensic data parsing. The objective of this invention can be achieved through the following technical solutions: include: S1: Standardize and analyze various raw evidence data extracted from mobile phones, extract the core attributes of each data item; organize and store the data according to a unified structure, build a global data view, and establish a global index for time and entity dimensions; S2: Extract identifiable entity information from the global data view, extract multi-dimensional features for each entity, calculate the feature similarity between entities, match entities with matching similarity scores, perform unified identification and identity mapping for associated entities, aggregate all source records of the same entity, and generate an entity association table; S3: Based on the global data view and entity association table, construct a multi-dimensional abnormal behavior detection model; identify various abnormal behaviors through the abnormal behavior detection model, perform multi-dimensional association analysis on the identified abnormal behaviors to form a complete abnormal behavior chain, and perform risk quantification scoring on the abnormal behavior chain; S4: Based on the abnormal behavior chain and entity relationship, automatically extract all evidence nodes related to the abnormal behavior from the global data view; organize them in an orderly manner according to time sequence and logical association to generate a case evidence chain; verify the legality and completeness of the case evidence chain to generate a case analysis report and evidence list.

[0008] Specifically, the construction process of the global data view is as follows: Iterate through all the raw data blocks output by the application parsing module, compare the hash values ​​of the data content to remove duplicate data entries, and filter out invalid data with incorrect format or missing fields; Establish a core field mapping table to map heterogeneous fields from different applications to a unified field system, convert various time formats into standard timestamps, calculate the hash check value of each data entry and associate it with the corresponding extraction process operation logs, and then concatenate all processed data entries.

[0009] Specifically, the process for establishing the global index of time and entity dimensions is as follows: Extract the timestamp field of all data and sort them chronologically. Divide the data into blocks according to different time granularities and create an index entry for each data block at each time granularity, pointing to all data within the corresponding time range. Parse the subject identifier field of each data entry, associate and bind the data entry with the corresponding subject entity, and build an inverted index for the entity dimension using the entity identifier as the key and the storage location of the associated data entry as the value. The original source information of the data is recorded synchronously in the index entries. When new evidence data is added, the new data is automatically inserted into the index block with the corresponding time granularity and the entity inverted index is updated.

[0010] Specifically, the calculation process for the feature similarity between entities is as follows: Extract entity identity features, behavioral habit features, and content preference features; The matching degree of each dimension of features is calculated separately. The identity identification feature is calculated using exact matching, the behavioral habit feature is calculated using cosine similarity, and the content preference feature is calculated using Jaccard similarity. Different weights are assigned to each dimension based on their importance, and the overall similarity between entities is obtained by weighted summation.

[0011] Specifically, the execution process of the unified identifier and identity mapping of the associated entities is as follows: Assign a unique identifier to each unique real entity confirmed by similarity judgment, and establish a one-to-one correspondence between the original entity identifier and the unified identifier in each application; Record the matching basis, data source and confidence level of each mapping relationship. The confidence level is calculated based on the number and weight of matching features. When new entity feature information is obtained, the mapping relationship is automatically updated and the corresponding confidence level is adjusted to handle the situation of multiple entity similarity conflicts.

[0012] Specifically, the generation process of the entity association table is as follows: Organize all entities with unified identifiers, all associated original identity information, first appearance time and last activity time, record the call, SMS, chat, transfer and peer interaction relationships between entities, mark the number of occurrences, most recent occurrence time and relationship strength of each relationship, the relationship strength is calculated based on the number of interactions and time decay factor, and sort all entity relationships from high to low relationship strength.

[0013] Specifically, the multi-dimensional abnormal behavior detection model includes an input layer, a feature extraction layer, a multi-dimensional detection layer, and an output layer, and the specific construction process is as follows: The total input is a global data view and an entity association table, and the total output is a list of anomalous behaviors with anomaly type and confidence score; The input layer cleans the input data, transforms the data format, and outputs standardized data to be detected. The feature extraction layer extracts statistical features, calculates temporal features, and mines correlation features. The multi-dimensional detection layer detects anomalies that deviate from normal behavior patterns from four dimensions: communication behavior, financial transactions, location trajectory, and device usage, using statistical analysis and pattern recognition algorithms. The output layer cross-validates the detection results of each dimension, integrates multi-dimensional information, classifies the confirmed abnormal behaviors, labels their confidence levels, and generates a list of abnormal behaviors.

[0014] Specifically, the formation process of the complete abnormal behavior chain is as follows: Starting with each identified abnormal behavior, search forward and backward for other abnormal behaviors that are time-adjacent and involve the same entity. Analyze the causal relationships and logical connections between adjacent abnormal behaviors, supplement and connect the transitional normal behaviors of different abnormal behaviors, merge overlapping and intersecting behavior segments, prune and remove irrelevant isolated behavior nodes, and finally form a complete chain of abnormal behaviors that is continuous in time and coherent in logic.

[0015] Specifically, the risk quantification scoring process for the abnormal behavior chain is as follows: The scores are divided into four dimensions: severity of abnormal behavior, number of entities involved, duration, and scope of impact. Match anomaly types to obtain severity scores, and count the number of independent entities involved, calculate the duration of the behavior chain, and count the types of related applications and the total amount of data. Each score level is matched separately, the weight corresponding to the current case type is loaded, the scores of each dimension are multiplied by the corresponding weights and summed to obtain the total risk value, the total risk value is matched with the preset risk level range, and the risk level of the abnormal behavior chain is determined.

[0016] Specifically, the extraction process of the evidence node is as follows: Using the abnormal behavior chain as the core clue, extract the original data records of the abnormal behavior, all relevant activity records of the entities involved, the system logs and equipment operation records of the same time period, and indirect auxiliary evidence to corroborate the abnormal behavior; Filter out duplicate and irrelevant evidence nodes, and record the original hash value and extraction source of each evidence node.

[0017] Specifically, the process of generating the evidence chain in the case is as follows: Using the timeline and logic of the abnormal behavior chain as the main thread, all extracted evidence nodes are mapped one by one to the corresponding links in the behavior chain. Each evidence node is labeled with the corresponding case fact elements, the relationship between evidence nodes is established, the types of direct and indirect corroboration are marked, and the complete logical thread from the motive, preparation process, implementation process to the final result is sorted out. Evidence nodes are uniformly numbered, and direct and indirect evidence are distinguished to construct a logically closed and mutually supportive complete chain of evidence for the case.

[0018] Specifically, the execution process for verifying the legality and completeness of the evidence chain in the case is as follows: Verify the completeness and compliance of the records of the extraction time, personnel, equipment, and process for each piece of evidence; Compare the contradictions and conflicts between different pieces of evidence in terms of time, content and logic, and verify the coverage of all key aspects of the case by the evidence; The system annotates contradictory evidence, provides specific directions for supplementary evidence collection for missing key evidence links, and automatically generates a verification report containing all inspection items and results.

[0019] The beneficial effects of this invention are as follows: (1) By setting up a global data view construction module and a time and entity dual-dimensional global index mechanism, it can automatically clean, deduplicatize and standardize multi-source heterogeneous mobile phone evidence data, unify heterogeneous fields and time formats, and achieve efficient retrieval and incremental updates of massive evidence data by relying on hierarchical time index and entity inverted index. With the help of multi-feature similarity calculation, unified entity identifier mapping and entity association table generation strategy, it can accurately aggregate cross-platform scattered data of the same subject, effectively solve the problems of messy traditional evidence data, fragmented entity identity and ambiguous association relationship, and provide a regular, complete and accurate data foundation for anomaly identification and evidence mining. (2) By setting up a multi-dimensional abnormal behavior detection model, an abnormal behavior chain sorting mechanism and an automated evidence chain construction verification system, it can accurately identify abnormal behavior from multiple dimensions such as communication, funds, trajectory and equipment, integrate multi-dimensional detection results to suppress single-dimensional detection errors, connect scattered abnormal nodes to form a complete behavior chain and complete standardized risk quantification and classification, and automatically capture all-dimensional related evidence nodes based on behavioral clues, automatically organize closed-loop case evidence chains according to time and logical relationships, autonomously complete evidence compliance verification, conflict verification and missing judgment, get rid of the traditional manual evidence sorting and subjective risk judgment mode, and significantly improve the automation level of electronic evidence collection and analysis and the accuracy of case judgment. Attached Figure Description

[0020] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings.

[0021] Figure 1 This is a flowchart illustrating an automated detection and analysis method based on mobile phone forensic data parsing according to the present invention. Figure 2 This is a data flow diagram of an automated detection and analysis method based on mobile phone forensic data parsing according to the present invention. Detailed Implementation

[0022] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided.

[0023] Please see Figures 1-2 An automated detection and analysis method based on mobile phone forensic data parsing; include: S1: Standardize and analyze various raw evidence data extracted from mobile phones, extract the core attributes of each data item; organize and store the data according to a unified structure, build a global data view, and establish a global index for time and entity dimensions; S2: Extract identifiable entity information from the global data view, extract multi-dimensional features for each entity, calculate the feature similarity between entities, match entities with matching similarity scores, perform unified identification and identity mapping for associated entities, aggregate all source records of the same entity, and generate an entity association table; S3: Based on the global data view and entity association table, construct a multi-dimensional abnormal behavior detection model; identify various abnormal behaviors through the abnormal behavior detection model, perform multi-dimensional association analysis on the identified abnormal behaviors to form a complete abnormal behavior chain, and perform risk quantification scoring on the abnormal behavior chain; S4: Based on the abnormal behavior chain and entity relationship, automatically extract all evidence nodes related to the abnormal behavior from the global data view; organize them in an orderly manner according to time sequence and logical association to generate a case evidence chain; verify the legality and completeness of the case evidence chain to generate a case analysis report and evidence list.

[0024] In this embodiment, the various types of raw evidence data refer to the unprocessed electronic data extracted from smart terminal devices in this invention, specifically including: call logs, SMS logs, instant messaging chat logs, fund transaction records, location trajectory data, device operation logs, system operation logs, application installation and uninstallation records, file access records, browser history, contact list, album metadata, Bluetooth connection records, and WiFi connection records; The entity information refers to the identifiable information that can uniquely identify an independent entity in this invention. It is the basic object of entity association analysis and specifically includes: various application accounts, mobile phone numbers, unique device identifiers, user nicknames, avatar hash values, email addresses, fragments of ID card numbers, the last four digits of bank card numbers, payment accounts, and social platform IDs. Multi-dimensional features refer to the three sets of features used in this invention to calculate the similarity between entities. They are the core basis for cross-platform entity identity matching and specifically include: entity identity features, behavioral habit features, and content preference features. The term "full-source record" refers to the complete set of data records belonging to the same real subject after being uniformly identified and mapped, originating from all applications, all systems, and all devices. Specifically, it includes all interactive behaviors, operation records, content data, and trace information of the subject on different platforms.

[0025] Various abnormal behaviors refer to suspicious behaviors that deviate from the normal behavior pattern of the subject in this invention, covering four major detection dimensions, specifically including: communication abnormalities, financial abnormalities, location abnormalities, and equipment abnormalities; The raw data block refers to the smallest data unit output by each application parsing module in this invention. Each raw data block corresponds to a complete independent record, containing all the original fields, original content and metadata information of the record. It is the basic processing unit for building the global data view, specifically including: a chat message, a transfer record, a call record and other independent data records. Entity identity identifier features refer to static features in this invention that can directly or indirectly point to the identity of a specific subject. Similarity is calculated using an exact matching method, and specifically includes: mobile phone number, various application accounts, user nickname, avatar hash value, email address, device IMEI number, MAC address, and payment account; Behavioral habit characteristics refer to the dynamic statistical characteristics that reflect the long-term behavioral patterns of the subject in this invention. They are calculated using cosine similarity and specifically include: 24-hour call frequency distribution, weekly call frequency, transfer time distribution, daily transaction frequency, activity time patterns, average daily usage time of a single application, chat frequency distribution, message reply speed, consumption amount range, login location distribution, device switching frequency, and file sending type distribution. Content preference features refer to the semantic features that reflect the subject's interests and content preferences in this invention. They are calculated using Jaccard similarity and specifically include: commonly used chat keywords, types of content viewed, categories of accounts followed, topics of collected content, types of files sent, topics of participation in group chats, search keywords, types of articles read, types of content shared, and preferences for comment content. Original identity information refers to the native identity identifiers stored in various application systems of this invention that have not undergone unified mapping. Each piece of original identity information uniquely corresponds to a globally unified identifier, specifically including: WeChat ID, QQ number, Alipay account, Douyin account, mobile phone number, and email address. The elements of case facts refer to the five core elements that constitute the complete facts of a case in this invention. All evidence nodes must be marked with the corresponding elements, specifically including: time, place, people, event, and result.

[0026] Specifically, the construction process of the global data view is as follows: Iterate through all the raw data blocks output by the application parsing module, compare the hash values ​​of the data content to remove duplicate data entries, and filter out invalid data with incorrect format or missing fields; Establish a core field mapping table to map heterogeneous fields from different applications to a unified field system, convert various time formats into standard timestamps, calculate the hash check value of each data entry and associate it with the corresponding extraction process operation logs, and then concatenate all processed data entries.

[0027] Specifically, the process for establishing the global index of time and entity dimensions is as follows: Extract the timestamp field of all data and sort them chronologically. Divide the data into blocks according to different time granularities and create an index entry for each data block at each time granularity, pointing to all data within the corresponding time range. Parse the subject identifier field of each data entry, associate and bind the data entry with the corresponding subject entity, and build an inverted index for the entity dimension using the entity identifier as the key and the storage location of the associated data entry as the value. The original source information of the data is recorded synchronously in the index entries. When new evidence data is added, the new data is automatically inserted into the index block with the corresponding time granularity and the entity inverted index is updated.

[0028] Specifically, the calculation process for the feature similarity between entities is as follows: Extract entity identity features, behavioral habit features, and content preference features; The matching degree of each dimension of features is calculated separately. The identity identification feature is calculated using exact matching, the behavioral habit feature is calculated using cosine similarity, and the content preference feature is calculated using Jaccard similarity. Different weights are assigned to each dimension based on their importance, and the overall similarity between entities is obtained by weighted summation.

[0029] Specifically, the execution process of the unified identifier and identity mapping of the associated entities is as follows: Assign a unique identifier to each unique real entity confirmed by similarity judgment, and establish a one-to-one correspondence between the original entity identifier and the unified identifier in each application; Record the matching basis, data source and confidence level of each mapping relationship. The confidence level is calculated based on the number and weight of matching features. When new entity feature information is obtained, the mapping relationship is automatically updated and the corresponding confidence level is adjusted to handle the situation of multiple entity similarity conflicts.

[0030] Specifically, the generation process of the entity association table is as follows: Organize all entities with unified identifiers, all associated original identity information, first appearance time and last activity time, record the call, SMS, chat, transfer and peer interaction relationships between entities, mark the number of occurrences, most recent occurrence time and relationship strength of each relationship, the relationship strength is calculated based on the number of interactions and time decay factor, and sort all entity relationships from high to low relationship strength.

[0031] Specifically, the multi-dimensional abnormal behavior detection model includes an input layer, a feature extraction layer, a multi-dimensional detection layer, and an output layer, and the specific construction process is as follows: The total input is a global data view and an entity association table, and the total output is a list of anomalous behaviors with anomaly type and confidence score; The input layer cleans the input data, transforms the data format, and outputs standardized data to be detected. The feature extraction layer extracts statistical features, calculates temporal features, and mines correlation features. The multi-dimensional detection layer detects anomalies that deviate from normal behavior patterns from four dimensions: communication behavior, financial transactions, location trajectory, and device usage, using statistical analysis and pattern recognition algorithms. The output layer cross-validates the detection results of each dimension, integrates multi-dimensional information, classifies the confirmed abnormal behaviors, labels their confidence levels, and generates a list of abnormal behaviors.

[0032] Specifically, the formation process of the complete abnormal behavior chain is as follows: Starting with each identified abnormal behavior, search forward and backward for other abnormal behaviors that are time-adjacent and involve the same entity. Analyze the causal relationships and logical connections between adjacent abnormal behaviors, supplement and connect the transitional normal behaviors of different abnormal behaviors, merge overlapping and intersecting behavior segments, prune and remove irrelevant isolated behavior nodes, and finally form a complete chain of abnormal behaviors that is continuous in time and coherent in logic.

[0033] Specifically, the risk quantification scoring process for the abnormal behavior chain is as follows: The scores are divided into four dimensions: severity of abnormal behavior, number of entities involved, duration, and scope of impact. Match anomaly types to obtain severity scores, and count the number of independent entities involved, calculate the duration of the behavior chain, and count the types of related applications and the total amount of data. Each score level is matched separately, the weight corresponding to the current case type is loaded, the scores of each dimension are multiplied by the corresponding weights and summed to obtain the total risk value, the total risk value is matched with the preset risk level range, and the risk level of the abnormal behavior chain is determined.

[0034] Specifically, the extraction process of the evidence node is as follows: Using the abnormal behavior chain as the core clue, extract the original data records of the abnormal behavior, all relevant activity records of the entities involved, the system logs and equipment operation records of the same time period, and indirect auxiliary evidence to corroborate the abnormal behavior; Filter out duplicate and irrelevant evidence nodes, and record the original hash value and extraction source of each evidence node.

[0035] Specifically, the process of generating the evidence chain in the case is as follows: Using the timeline and logic of the abnormal behavior chain as the main thread, all extracted evidence nodes are mapped one by one to the corresponding links in the behavior chain. Each evidence node is labeled with the corresponding case fact elements, the relationship between evidence nodes is established, the types of direct and indirect corroboration are marked, and the complete logical thread from the motive, preparation process, implementation process to the final result is sorted out. Evidence nodes are uniformly numbered, and direct and indirect evidence are distinguished to construct a logically closed and mutually supportive complete chain of evidence for the case.

[0036] Specifically, the execution process for verifying the legality and completeness of the evidence chain in the case is as follows: Verify the completeness and compliance of the records of the extraction time, personnel, equipment, and process for each piece of evidence; Compare the contradictions and conflicts between different pieces of evidence in terms of time, content and logic, and verify the coverage of all key aspects of the case by the evidence; The system annotates contradictory evidence, provides specific directions for supplementary evidence collection for missing key evidence links, and automatically generates a verification report containing all inspection items and results.

[0037] In this embodiment, the specific construction process of the global data view is as follows: traverse all raw data blocks output by the application parsing module, calculate the content hash value of each data item using the SHA-256 algorithm, and eliminate completely duplicate data items by comparing the hash values; filter invalid data with a field missing rate exceeding 30% or whose format does not conform to preset rules; establish a unified mapping table containing 28 core fields to map heterogeneous fields from different applications to a unified field system; convert various time formats into millisecond-level standard timestamps, recalculate the SHA-256 hash check value of each data item and associate it with the corresponding extraction process operation log (including extraction time, extraction device number, and operator number), and concatenate all processed data items to form a complete and traceable global data set.

[0038] In this embodiment, the specific process of establishing the global index for time and entity dimensions is as follows: extract the millisecond-level timestamp field of all data and sort them according to time sequence; divide the data into blocks according to four time granularities: seconds, minutes, hours, and days; create a B+ tree index entry for each time granularity data block, pointing to all data within the corresponding time range; parse the subject identifier field of each data entry, associate and bind the data entry with the corresponding subject entity, and construct a hash-structured entity-dimensional inverted index with the entity identifier as the key and the storage location of the associated data entry as the value; synchronously record the original source information of the data in the index entry; automatically trigger incremental updates when 1000 new evidence data entries are added, insert the new data into the index block of the corresponding time granularity and update the entity inverted index, with the update delay controlled within 50 milliseconds.

[0039] In this embodiment, the specific calculation process for the feature similarity between entities is as follows: entity identity features, behavioral habit features, and content preference features are extracted. Identity features include 8 categories: account, phone number, and nickname. Behavioral habit features include 12 dimensions: 24-hour call frequency distribution, transfer time distribution, and activity patterns. Content preference features include 20 dimensions: commonly used chat keywords and browsed content types. The matching degree of each dimension is calculated separately. Identity features are calculated using exact matching, with 1 point for a successful match and 0 points for a failed match. Behavioral habit features are calculated using cosine similarity, with a feature vector dimension of 12. Content preference features are calculated using Jaccard similarity, with a keyword set size of 20. The overall similarity between entities is obtained by weighting the features according to a weight distribution of 0.5 for identity, 0.3 for behavioral habit, and 0.2 for content preference.

[0040] In this embodiment, the specific execution process of the unified identifier and identity mapping of associated entities is as follows: a preset similarity threshold is set, and a globally unique unified identifier of a specified number of bits is assigned to each unique real entity whose similarity exceeds the threshold and is confirmed by judgment; a one-to-one correspondence between the original entity identifier and the unified identifier in each application is established, and the matching basis, data source and confidence level of each mapping relationship are recorded. The confidence level is calculated as follows: confidence level = number of matching features × corresponding feature weight; when new entity feature information is obtained, the similarity is automatically recalculated and the mapping relationship is updated, and the corresponding confidence level is adjusted synchronously; when multiple entity similarity conflicts occur, the mapping relationship with the highest confidence level is selected as the final result, and the remaining conflicting relationships are marked as pending manual review.

[0041] In this embodiment, the specific process of generating the entity association table is as follows: Organize the 16-bit unified identifiers of all entities, all associated original identity information, first appearance time, and last activity time; record the five types of interactive associations between entities: call, SMS, chat, transfer, and peer; assign weights to each type of interactive relationship: transfer 0.4, chat 0.3, call 0.2, peer 0.1; label the occurrence frequency, most recent occurrence time, and association strength of each association relationship; the association strength calculation formula is: association strength = number of interactions × corresponding interaction weight × (1 - 0.01 × number of days since current date); sort all entity relationships from high to low according to association strength, and arrange those with the same association strength in descending order of most recent occurrence time.

[0042] In this embodiment, the specific construction process of the multi-dimensional abnormal behavior detection model is as follows: the model is built with a four-layer structure: input layer, feature extraction layer, multi-dimensional detection layer, and output layer. The global data view and entity association table are used as the total input, and the list of abnormal behaviors with abnormality type and confidence score is used as the total output. The input layer uses the min-max normalization method to clean and convert the input data and outputs standardized data to be detected. The feature extraction layer extracts 12-dimensional statistical features, 24-dimensional temporal features, and 8-dimensional association features, for a total of 44-dimensional feature vectors. The multi-dimensional detection layer employs adaptive algorithms for anomaly detection across four dimensions: communication behavior, financial transactions, location tracking, and device usage. For communication behavior, the isolated forest algorithm is used, inputting a 12-dimensional communication feature vector (including call duration distribution, call frequency, proportion of unknown contacts, SMS volume, group chat participation, etc.) to construct an isolated forest model containing 100 binary trees. Abnormal samples are isolated by randomly partitioning the feature space, and an anomaly score is calculated for each sample. Samples with an anomaly score higher than 0.7 are identified as exhibiting abnormal communication behavior. For financial transactions, the DBSCAN clustering algorithm is used, inputting an 8-dimensional transaction feature vector (including single transaction amount, daily transaction frequency, counterparty dispersion, transfer time deviation, proportion of large transactions, etc.). With a neighborhood radius of 0.5 and a minimum sample size of 5, outliers that cannot be assigned to any cluster are identified as exhibiting abnormal financial transaction behavior. For location tracking, a hidden Markov model is used, inputting a 30-day location time series sequence of the user, dividing the user's frequently visited locations into 5-8... The system employs a hidden state to train a state transition probability matrix and an observation emission probability matrix. It then calculates the generation probability of new trajectory sequences, identifying trajectories with a generation probability below 0.01 as abnormal location behavior. For device usage, a statistical threshold method is used. Baseline device usage data (including power-on time, power-off time, average daily usage time per application, device login IP range, etc.) for 15 consecutive days is collected. The mean and standard deviation of each indicator are calculated, and a threshold of 3 times the standard deviation is set. Device operations exceeding this threshold are identified as abnormal device usage behavior. The output layer uses a weighted voting method to cross-validate the detection results of each dimension, fusing multi-dimensional information to classify confirmed abnormal behaviors and label them with confidence levels between 0 and 1, generating a list of abnormal behaviors.

[0043] In this embodiment, the specific process of forming a complete abnormal behavior chain is as follows: taking each identified abnormal behavior as the starting node, extending the time window forward and backward by 24 hours, searching for other abnormal behaviors that are adjacent in time and involve the same entity; analyzing the causal relationship and logical association of adjacent abnormal behaviors, supplementing and connecting the transitional normal behaviors of different abnormal behaviors; merging behavior segments that overlap and cross, pruning and removing irrelevant isolated behavior nodes with a correlation degree of less than 0.1, and finally forming a complete abnormal behavior chain that is continuous in time and logically coherent.

[0044] In this embodiment, the specific execution process of risk quantification scoring for abnormal behavior chains is as follows: Scoring is performed on four dimensions: severity of abnormal behavior, number of entities involved, duration, and scope of impact. Each dimension has a score range of 1-5 points. Severity scores are obtained by matching the abnormality type; the number of independent entities involved, the duration of the behavior chain, and the types of related applications and the total amount of data are counted and matched to corresponding score levels. Weights are allocated according to severity (0.4), entities involved (0.2), duration (0.2), and scope of impact (0.2). The scores for each dimension are multiplied by their corresponding weights and summed to obtain the total risk value. The total risk value is matched to a preset risk level range: 0-3 points for low risk, 3-6 points for medium risk, 6-9 points for high risk, and 9 points or above for extremely high risk, thus determining the risk level corresponding to the abnormal behavior chain.

[0045] In this embodiment, taking the evidence collection and analysis of a smartphone involved in a fraud case as an example, the specific implementation process is as follows: C is the preset invalid data judgment threshold, F is the preset index incremental update trigger threshold, G is the preset maximum index update delay threshold, L is the preset entity matching similarity threshold, M is the preset global unified identifier length, Q is the preset communication anomaly judgment threshold, R is the preset DBSCAN clustering neighborhood radius, S is the preset minimum number of DBSCAN clustering samples, U is the preset trajectory anomaly judgment threshold, V is the preset statistical anomaly threshold multiple, W is the preset abnormal behavior chain extension time window duration, Y is the preset number of risk levels, Z is the preset evidence extraction extension time window duration, and α is the preset evidence time contradiction judgment threshold. The specific implementation process of S1 is as follows: Full data extraction is performed on the target smart terminal involved in the case to obtain the full original data blocks; all original data blocks are traversed, and the SHA-256 algorithm is used to calculate the content hash value to remove duplicate entries, and invalid data with a field missing rate exceeding C or whose format does not conform to the rules is filtered out; a core field mapping table is established to map heterogeneous fields from different applications to a unified system, uniformly converting them to millisecond-level standard timestamps, recalculating the hash verification value of each data entry and associating it with the extraction operation log, and concatenating the processed data to construct a global data view; the timestamps of all data are extracted and sorted, and data blocks are divided by seconds, minutes, hours, and days, and a B+ tree index is established; the main identifier field is parsed, and an entity dimension inverted index with a hash structure is constructed; incremental updates are automatically triggered every F new pieces of evidence data, with update latency controlled within G milliseconds; The specific implementation process of S2 is as follows: Extract identifiable entity information from the global data view, and extract three multi-dimensional features for each entity: identity identifier, behavioral habits, and content preferences; calculate the matching degree of each dimension using exact matching, cosine similarity, and Jaccard similarity respectively, and sum them according to preset weights to obtain the overall similarity between entities; set a similarity threshold of L, and match entities that meet the association criteria; perform unified identifier and identity mapping of associated entities, assign M global unified identifiers to each unique real entity, establish the mapping relationship between the original identifier and the unified identifier, and record the confidence level; aggregate all source records of the same entity, record five types of interaction relationships: calls, text messages, chats, transfers, and peers, mark the number of occurrences, the most recent time, and the association strength, and generate an entity association table by sorting by association strength; The specific implementation process of S3 is as follows: Based on the global data view and entity association table, a four-layer anomaly detection model is constructed: input layer, feature extraction layer, multi-dimensional detection layer, and output layer. The input layer uses min-max standardization to process the data, and the feature extraction layer generates 44-dimensional feature vectors. The multi-dimensional detection layer uses an adaptation algorithm: for the communication behavior dimension, an isolated forest model with 100 binary trees is used, and samples with anomaly scores higher than Q are judged as communication anomalies; for the fund transaction dimension, the DBSCAN algorithm is used, setting a neighborhood radius R and a minimum number of samples S, and outliers are judged as fund anomalies; for the location trajectory dimension, a hidden Markov model is used, dividing the user's frequently visited locations into 5-8 hidden states, and trajectories with a generation probability lower than U are judged as location anomalies; for the device usage dimension, a statistical threshold method is used, setting V times the standard deviation as the anomaly threshold to judge abnormal device behavior; the output layer uses a weighted voting method to generate a list of abnormal behaviors; with each abnormal behavior as a node, a W-hour time window is expanded forward and backward, adjacent abnormal behaviors are connected and transitional behaviors are supplemented, overlapping segments are merged, and correlations below 0.1 are pruned. Isolated nodes form a complete chain of abnormal behavior; scores are given from four dimensions: severity, entities involved, duration, and scope of impact; the total risk value is calculated by loading the corresponding weights of the cases; and the risk level is determined by matching Y risk level intervals. The specific implementation process of S4 is as follows: Taking the abnormal behavior chain as the core clue, extend the time window forward and backward by Z hours to extract the original records of abnormal behavior, entity-related activity records, system logs, and indirect auxiliary evidence; use the SHA-256 algorithm to filter duplicate evidence and eliminate irrelevant evidence; using the timeline and logic line of the abnormal behavior chain as the main line, map the evidence nodes to the corresponding links, mark the five types of case fact elements: time, place, person, event, and result, establish the relationship between evidence and mark the corroboration type; sort out the complete logic from the motive to the final result, uniformly number the evidence and distinguish between direct and indirect evidence, and construct a closed-loop case evidence chain; check the completeness of the evidence extraction records and the compliance of the process one by one, compare the contradictions and conflicts between evidence, and consider the time difference exceeding α minutes as a time contradiction; check the coverage of key links, mark contradictory evidence and give directions for supplementary evidence collection, and automatically generate a verification report and a case analysis report.

[0046] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. An automated detection and analysis method based on mobile phone forensic data parsing, characterized in that, include: S1: Standardize and analyze various raw evidence data extracted from mobile phones, extract the core attributes of each data item; organize and store the data according to a unified structure, build a global data view, and establish a global index for time and entity dimensions; S2: Extract identifiable entity information from the global data view, extract multi-dimensional features for each entity, calculate the feature similarity between entities, match entities with matching similarity scores, perform unified identification and identity mapping for associated entities, aggregate all source records of the same entity, and generate an entity association table; S3: Based on the global data view and entity association table, construct a multi-dimensional abnormal behavior detection model; identify various abnormal behaviors through the abnormal behavior detection model, perform multi-dimensional association analysis on the identified abnormal behaviors to form a complete abnormal behavior chain, and perform risk quantification scoring on the abnormal behavior chain; S4: Based on the abnormal behavior chain and entity relationship, automatically extract all evidence nodes related to the abnormal behavior from the global data view; organize them in an orderly manner according to time sequence and logical association to generate a case evidence chain; verify the legality and completeness of the case evidence chain to generate a case analysis report and evidence list.

2. The method according to claim 1, characterized in that, The specific construction process of the global data view is as follows: Iterate through all the raw data blocks output by the application parsing module, compare the hash values ​​of the data content to remove duplicate data entries, and filter out invalid data with incorrect format or missing fields; Establish a core field mapping table to map heterogeneous fields from different applications to a unified field system, convert various time formats into standard timestamps, calculate the hash check value of each data entry and associate it with the corresponding extraction process operation logs, and then concatenate all processed data entries.

3. The method according to claim 1, characterized in that, The specific process for establishing the global index of time and entity dimensions is as follows: Extract the timestamp field of all data and sort them chronologically. Divide the data into blocks according to different time granularities and create an index entry for each data block at each time granularity, pointing to all data within the corresponding time range. Parse the subject identifier field of each data entry, associate and bind the data entry with the corresponding subject entity, and build an inverted index for the entity dimension using the entity identifier as the key and the storage location of the associated data entry as the value. The original source information of the data is recorded synchronously in the index entries. When new evidence data is added, the new data is automatically inserted into the index block with the corresponding time granularity and the entity inverted index is updated.

4. The method according to claim 1, characterized in that, The specific calculation process for the feature similarity between entities is as follows: Extract entity identity features, behavioral habit features, and content preference features; The matching degree of each dimension of features is calculated separately. The identity identification feature is calculated using exact matching, the behavioral habit feature is calculated using cosine similarity, and the content preference feature is calculated using Jaccard similarity. Different weights are assigned to each dimension based on their importance, and the overall similarity between entities is obtained by weighted summation.

5. The method according to claim 1, characterized in that, The specific execution process of the unified identifier and identity mapping of the associated entities is as follows: Assign a unique identifier to each unique real entity confirmed by similarity judgment, and establish a one-to-one correspondence between the original entity identifier and the unified identifier in each application; Record the matching basis, data source and confidence level of each mapping relationship. The confidence level is calculated based on the number and weight of matching features. When new entity feature information is obtained, the mapping relationship is automatically updated and the corresponding confidence level is adjusted to handle the situation of multiple entity similarity conflicts.

6. The method according to claim 1, characterized in that, The specific process for generating the entity association table is as follows: Organize all entities with unified identifiers, all associated original identity information, first appearance time and last activity time, record the call, SMS, chat, transfer and peer interaction relationships between entities, mark the number of occurrences, most recent occurrence time and relationship strength of each relationship, the relationship strength is calculated based on the number of interactions and time decay factor, and sort all entity relationships from high to low relationship strength.

7. The method according to claim 1, characterized in that, The multi-dimensional abnormal behavior detection model includes an input layer, a feature extraction layer, a multi-dimensional detection layer, and an output layer. The specific construction process is as follows: The total input is a global data view and an entity association table, and the total output is a list of anomalous behaviors with anomaly type and confidence score. The input layer cleans the input data, transforms the data format, and outputs standardized data to be detected. The feature extraction layer extracts statistical features, calculates temporal features, and mines correlation features. The multi-dimensional detection layer detects anomalies that deviate from normal behavior patterns from four dimensions: communication behavior, financial transactions, location trajectory, and device usage, using statistical analysis and pattern recognition algorithms. The output layer cross-validates the detection results of each dimension, integrates multi-dimensional information, classifies the confirmed abnormal behaviors, labels their confidence levels, and generates a list of abnormal behaviors.

8. The method according to claim 1, characterized in that, The specific formation process of the complete abnormal behavior chain is as follows: Starting with each identified anomalous behavior, search forward and backward for other anomalous behaviors that are time-adjacent and involve the same entity. Analyze the causal relationships and logical connections between adjacent abnormal behaviors, supplement and connect the transitional normal behaviors of different abnormal behaviors, merge overlapping and intersecting behavior segments, prune and remove irrelevant isolated behavior nodes, and finally form a complete chain of abnormal behaviors that is continuous in time and coherent in logic.

9. The method according to claim 1, characterized in that, The specific execution process for the risk quantification scoring of the abnormal behavior chain is as follows: The scores are divided into four dimensions: severity of abnormal behavior, number of entities involved, duration, and scope of impact. Match anomaly types to obtain severity scores, and count the number of independent entities involved, calculate the duration of the behavior chain, and count the types of related applications and the total amount of data. Each score level is matched separately, the weight corresponding to the current case type is loaded, the scores of each dimension are multiplied by the corresponding weights and summed to obtain the total risk value, the total risk value is matched with the preset risk level range, and the risk level of the abnormal behavior chain is determined.

10. The method according to claim 1, characterized in that, The specific process for generating the chain of evidence in the case is as follows: Using the timeline and logic of the abnormal behavior chain as the main thread, all extracted evidence nodes are mapped one by one to the corresponding links in the behavior chain. Each evidence node is labeled with the corresponding case fact elements, the relationship between evidence nodes is established, the types of direct and indirect corroboration are marked, and the complete logical thread from the motive, preparation process, implementation process to the final result is sorted out. Evidence nodes are uniformly numbered, and direct and indirect evidence are distinguished to construct a logically closed and mutually supportive complete chain of evidence for the case.

Images