A task scheduling method and system for real-time analysis of forensic case structures

Abstract

A task scheduling method and system for instant analysis of forensic case structure are disclosed, including instant pushing of state change messages to an analysis service after a forensic service generates partial forensic data and writes into a database, the analysis service starting an analysis process after receiving the messages; grouping and scheduling tasks in the analysis process, granularity of grouping being set based on a combination dimension of "case-evidence-processing item"; the processing item including at least pre-processing and AI analysis; before starting a specific analysis engine, performing governance item screening and anti-duplicate processing according to a current service state of the AI engine; in response to passing of the screening, dynamically constructing a query statement based on a preset database structure coding scheme to extract data sources of a current batch from a forensic database, inputting the data sources into an initialized AI engine object to perform analysis, and storing analysis results into a separate analysis result database.

Description

Technical Field

[0001] This invention relates to the technical field of computer data processing and electronic forensics, and in particular to a task scheduling method and system for real-time analysis of the structure of forensic cases. Background Technology

[0002] With the continuous development of electronic data forensics technology, the analysis of forensic data has become increasingly complex. In practical applications, the analysis of forensic data often involves the interaction of multiple SQLite files, attachments, and AI interfaces, making it a typical I / O-intensive task. The number of these I / O interaction nodes is usually large, and there are complex dependencies, reusability relationships, or parallelization relationships between them.

[0003] In existing technologies, data analysis based on forensic results typically employs a sequential processing model. Specifically, current analysis schemes require that all forensic work be completed before subsequent analysis can begin. Furthermore, in terms of data storage architecture, existing analysis results are usually stored together with forensic results, resulting in a deep coupling between the two.

[0004] This traditional serial processing mode and deeply coupled architecture have the following main technical drawbacks: Long work cycle and poor user experience: Because the analysis cannot begin until all evidence collection is completed, the entire "evidence collection-analysis" work cycle is lengthened, and users have to endure a long waiting time to obtain the analysis results, which greatly affects the user experience.

[0005] Low system resource utilization: During the forensics process, the machine's CPU, memory, and other system resources often have some idle time. However, existing solutions cannot utilize these idle resources to perform parallel analysis during the forensics process, resulting in a waste of computing resources.

[0006] High data coupling: The mixed storage of analysis results and evidence collection results increases the complexity of data management and is not conducive to the independent transfer and reuse of analysis results.

[0007] Therefore, how to break the serial limitation of evidence collection and analysis, make full use of system resources for parallel processing, and achieve decoupling of result data are the technical problems that urgently need to be solved in the field of electronic forensics. Summary of the Invention

[0008] To address the aforementioned technical problems in the existing technology, this invention proposes a task scheduling method and system for real-time analysis of evidence case structures, thereby resolving these technical issues.

[0009] According to a first aspect of the present invention, a task scheduling method for real-time analysis of the structure of forensic cases is proposed, comprising: S1: After the evidence collection service generates some evidence collection data and writes it into the database, it immediately pushes a status change message to the analysis service. The analysis service starts the analysis process after receiving the message. S2: Tasks in the analysis process are grouped and scheduled, and the granularity of the group is set based on the combined dimension of "case-evidence-processing item". Among them, preprocessing tasks with the same granularity share the same thread pool and are executed in sequence. Preprocessing tasks with different granularity are assigned to thread pools of different groups and are processed in parallel. Processing items include at least preprocessing and AI analysis. S3: Before starting the specific analysis engine, perform governance item screening and anti-duplicate processing based on the current service status of the AI ​​engine; S4: In response to the successful screening, based on the preset database structure encoding scheme, a query statement is dynamically constructed to extract the data source of the current batch from the evidence database, input it into the initialized AI engine object to perform analysis, and the analysis results are stored in an independent analysis result library.

[0010] In some specific embodiments, each group of thread pools in S2 has a maximum concurrency configuration item, and the maximum concurrency is dynamically adjusted according to the hardware resources of the running machine.

[0011] In some specific embodiments, the filtering and anti-duplicate processing of S3 specifically includes: detecting the service status corresponding to the AI ​​engine; if the service is unavailable, the analysis engine that depends on the service will not be triggered; detecting the running status of the AI ​​engine; if it is in the running state or the result status is marked as completed, the current analysis request will be filtered out; if there is no analysis item to be triggered after filtering, or if the same preprocessing task that is already running is detected, the current analysis process will be terminated.

[0012] In some specific implementations, the initialization of AI engine objects is managed using a combination of the factory pattern and the state machine pattern; for multiple AI engines that have upstream and downstream pipeline relationships in business logic, a tree-like containment structure is used for definition and initialization.

[0013] In some specific embodiments, the data source extraction process includes: parsing the target database's library file name, data table name, and field name from the configuration file; constructing filtering conditions based on the current forensic data generation progress; and generating SQL statements to mine the data to be analyzed.

[0014] In some specific embodiments, the interaction process between the analysis service and the AI ​​analysis engine includes: filling parameters into the AI ​​client, the AI ​​client sending a request to the AI ​​server according to the interface protocol, storing the processing result returned by the AI ​​server into the analysis result database, and reporting the success status of the AI ​​result.

[0015] According to a second aspect of the invention, a computer-readable storage medium is provided on which one or more computer programs are stored, which, when executed by a computer processor, implement the method described above.

[0016] According to a third aspect of the present invention, a task scheduling system for real-time analysis of the structure of forensic cases is proposed, comprising: The asynchronous triggering module is configured to push status change messages to the analysis service immediately after the evidence collection service generates some evidence collection data and writes it to the database. The analysis service starts the analysis process after receiving the message. The resource scheduling module is configured to group and schedule tasks during the analysis process. The granularity of the group is set based on the combined dimension of "case-evidence-processing item". Preprocessing tasks with the same granularity share the same thread pool and are executed in sequence. Preprocessing tasks with different granularity are assigned to thread pools of different groups and are processed in parallel. Processing items include at least preprocessing and AI analysis. The preprocessing governance module is configured to perform governance item filtering and anti-duplicate processing based on the current service status of the AI ​​engine before starting the specific analysis engine; The data analysis module is configured to respond to the screening process by dynamically constructing query statements based on a preset database structure encoding scheme to extract the data source of the current batch from the evidence database, inputting it into the initialized AI engine object to perform analysis, and storing the analysis results in an independent analysis result library.

[0017] In some specific embodiments, each group of thread pools in the resource scheduling module has a maximum concurrency configuration item, and the maximum concurrency is dynamically adjusted according to the hardware resources of the running machine.

[0018] In some specific embodiments, the screening and anti-duplicate processing of the preprocessing governance module specifically includes: detecting the service status corresponding to the AI ​​engine; if the service is unavailable, the analysis engine that depends on the service will not be triggered; detecting the running status of the AI ​​engine; if it is in the running state or the result status is marked as completed, the current analysis request will be filtered out; if there is no analysis item to be triggered after screening, or if the same preprocessing task that is already running is detected, the current analysis process will be terminated.

[0019] In some specific implementations, the initialization of AI engine objects is managed using a combination of the factory pattern and the state machine pattern; for multiple AI engines that have upstream and downstream pipeline relationships in business logic, a tree-like containment structure is used for definition and initialization.

[0020] In some specific embodiments, the data source extraction process includes: parsing the target database's library file name, data table name, and field name from the configuration file; constructing filtering conditions based on the current forensic data generation progress; and generating SQL statements to mine the data to be analyzed.

[0021] In some specific embodiments, the interaction process between the analysis service and the AI ​​analysis engine includes: filling parameters into the AI ​​client, the AI ​​client sending a request to the AI ​​server according to the interface protocol, storing the processing result returned by the AI ​​server into the analysis result database, and reporting the success status of the AI ​​result.

[0022] This invention separates the analysis function from the originally serial forensics process, employing asynchronous communication to achieve parallel processing. The forensics service can execute the next batch of tasks without waiting for the analysis process to finish, and the analysis service starts analysis immediately upon receiving a status change message for the forensic data. Compared to the traditional serial "forensics first, analysis later" approach, this method effectively reduces user waiting time, greatly improving the overall efficiency of forensics work and user experience.

[0023] Given that forensic data analysis is an I / O-intensive task with a large number of nodes, this invention utilizes idle CPU and memory resources during the forensic process for real-time analysis, avoiding resource waste. By employing "task grouping" and "concurrent execution," it maximizes the use of available resources in a multi-tasking system.

[0024] This invention employs a thread pool grouping strategy based on the granularity of "case-evidence-processing item". Multiple preprocessing tasks for the same evidence use the same thread pool group (to avoid I / O conflicts), while tasks for different cases or evidence use different thread pool groups (to achieve parallelism). This location-specific grouping and scheduling effectively resolves the complex dependencies when interacting with a large number of SQLite files and attachments, ensuring performance optimization across different machine environments.

[0025] By introducing a "governance item filtering" logic in the preprocessing stage, the system can automatically filter out invalid or redundant analysis requests based on the service status of the AI ​​engine (unavailable, running, completed). This anti-duplicate processing mechanism ensures that unnecessary governance engines are not triggered, further avoiding unnecessary resource overhead and guaranteeing the efficient operation of the system. Unlike the existing technology that couples the analysis results with the forensic results for storage, the analysis results of this invention are output to an independent, portable database file. This decoupling design not only reduces the dependency between data modules but also makes the analysis results easier to manage, migrate, and display independently. Attached Figure Description

[0026] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments and, together with the description, serve to explain the principles of the invention. Other embodiments and many anticipated advantages of the embodiments will be readily recognized as they become better understood through reference to the following detailed description. Other features, objects, and advantages of this application will become more apparent from reading the following detailed description of non-limiting embodiments with reference to the accompanying drawings: Figure 1 This is a flowchart of a task scheduling method for real-time analysis of the structure of forensic cases, according to an embodiment of this application; Figure 2 This is a schematic diagram illustrating the forensic data analysis process of a specific embodiment of this application; Figure 3 This is a flowchart illustrating the forensic data analysis process of a specific embodiment of this application; Figure 4 This is a flowchart of the preprocessing process according to a specific embodiment of this application; Figure 5 This is a schematic diagram of the AI ​​analysis process in a specific embodiment of this application; Figure 6 This is a framework diagram of a task scheduling system for real-time analysis of forensic case structures, according to a specific embodiment of this application. Figure 7 This is a schematic diagram of the structure of a computer system used to implement the electronic device of the present application. Detailed Implementation

[0027] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and not intended to limit it. Furthermore, it should be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings.

[0028] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0029] Figure 1 A flowchart illustrating a task scheduling method for real-time analysis of forensic case structures according to an embodiment of this application is shown. Figure 1 As shown, the method includes the following steps: S1: After the evidence collection service generates some evidence collection data and writes it to the database, it immediately pushes a status change message to the analysis service. The analysis service starts the analysis process after receiving the message.

[0030] In a specific embodiment, the analysis service starts the analysis process after receiving the message, without waiting for the evidence collection service to complete all tasks.

[0031] S2: Tasks in the analysis process are grouped and scheduled, and the granularity of the group is set based on the combined dimension of "case-evidence-processing item". Among them, preprocessing tasks with the same granularity share the same thread pool and are executed in sequence. Preprocessing tasks with different granularity are assigned to thread pools of different groups and are processed in parallel. Processing items include at least preprocessing and AI analysis.

[0032] In a specific embodiment, each group of thread pools has a maximum concurrency configuration item, and the maximum concurrency is dynamically adjusted according to the hardware resources of the running machine.

[0033] S3: Before starting the specific analysis engine, perform governance item screening and anti-duplicate processing based on the current service status of the AI ​​engine.

[0034] In a specific embodiment, the filtering and anti-duplicate processing includes: detecting the service status corresponding to the AI ​​engine; if the service is unavailable, the analysis engine that depends on the service will not be triggered; detecting the running status of the AI ​​engine; if it is running or the result status is marked as completed, the current analysis request will be filtered out; if there is no analysis item to be triggered after filtering, or if the same preprocessing task is detected to be running, the current analysis process will be terminated.

[0035] S4: In response to the successful screening, based on the preset database structure encoding scheme, a query statement is dynamically constructed to extract the data source of the current batch from the evidence database, input it into the initialized AI engine object to perform analysis, and the analysis results are stored in an independent analysis result library.

[0036] In a specific embodiment, the initialization of AI engine objects is managed using a combination of the factory pattern and the state machine pattern. For multiple AI engines with upstream and downstream pipeline relationships in business logic, a tree-like containment structure is used for definition and initialization. The data source extraction process includes: parsing the target database's database file name, table name, and field name from the configuration file; constructing filtering conditions based on the current forensic data generation progress; and generating SQL statements to mine the data to be analyzed. The interaction process between the analysis service and the AI ​​analysis engine includes: filling parameters into the AI ​​client; the AI ​​client sending requests to the AI ​​server according to the interface protocol; storing the processing results returned by the AI ​​server in the analysis result database; and providing feedback on the success status of the AI ​​results.

[0037] Figure 2 This illustration shows a schematic diagram of the forensic data analysis process according to a specific embodiment of this application. Figure 2 This illustration shows the macroscopic interaction architecture and data flow between the forensic service and the analysis service in this embodiment. The core of this architecture lies in separating the analysis function from the traditional forensic process, forming an independent analysis service, and achieving parallel processing through an asynchronous communication mechanism. The specific process is described below: Batch generation and notification of evidence data: During the operation of the "Evidence Collection Service", all data is not generated at once, but evidence data is generated in batches (as shown in "Evidence Collection Data A" and "Evidence Collection Data B" in the figure).

[0038] Once a batch of forensic data (such as one or more database files) has been generated and written, the forensic service will immediately send a status change notification message to the analysis service.

[0039] After issuing a notification, the forensics service can continue to execute the next batch of forensics tasks without waiting for the analysis service to complete its processing (for example, after generating data A and issuing a notification, it can immediately start generating data B), thus enabling parallel operation of forensics and analysis.

[0040] Asynchronous startup analysis process: As a consumer, the "Analysis Service" initiates an independent analysis process for the batch of data after receiving a notification from the Evidence Collection Service (as shown in the diagram, "Analysis Process A" corresponds to "Evidence Collection Data A," and "Analysis Process B" corresponds to "Evidence Collection Data B"). These analysis processes are executed in parallel or asynchronously within the Analysis Service and do not block each other.

[0041] Result storage and decoupling: After each analysis process (A and B) is completed, the processing results are "generated" and written to a separate "analysis results library". This design decouples the analysis results from the original forensic data, facilitating subsequent data transfer and management.

[0042] Real-time Interface Display: Once the analysis results are written to the results database, the system will push a notification message to the application layer. Upon receiving the notification, the application layer (as shown in the "Real-time Interface Display" diagram) will directly retrieve the latest data from the analysis results database and dynamically display it on the interface, allowing users to see some of the analysis results even before the evidence collection process is fully completed.

[0043] Figure 3 This illustration shows a flowchart of forensic data analysis according to a specific embodiment of this application, such as... Figure 3 As shown, it further demonstrates Figure 2 The specific execution logic within any "analysis process" (such as analysis process A). Each analysis process follows an asynchronous model flow of "preprocessing + AI analysis". The specific flow description is as follows: Start Analysis and Preprocessing: When the analysis service receives a task request, the "Start Analysis" node initiates the "Preprocessing" module asynchronously. Preprocessing is the entry point for the entire analysis chain, primarily responsible for data discovery and classification / governance.

[0044] Preprocessing and Result Repository Status Interaction: The diagram shows a status interaction between "Preprocessing" and "Analysis Result Repository." The preprocessing module checks the status of the analysis result repository or system to determine whether to trigger subsequent AI analysis. Specific interaction logic includes: Service Availability Check: If the service corresponding to the AI ​​engine is unavailable, subsequent processes are not triggered. Running Status Check: Querying for the existence of a running engine of the same type; if it is running, it is not triggered again. Completion Status Check: Querying the result repository; if the result status of a certain AI analysis is already marked as "Completed," the analysis is skipped to avoid duplicate calculations. In addition, the preprocessing stage also performs "engine object initialization," including searching for evidence data based on the BCP encoding scheme and populating the database with progress information (sending a message indicating task start and progress is 0) so that the interface can display the progress.

[0045] Asynchronous distribution of AI analysis tasks: After preprocessing and screening, for tasks confirmed to require execution, the preprocessing module will asynchronously initiate specific AI analysis tasks. As shown in the figure, depending on the data type, multiple sub-tasks such as "AI Analysis - Type 1" and "AI Analysis - Type 2" may be launched in parallel. This distribution adopts a "thread pool grouping" method, grouping tasks at the granularity of "case-evidence-processing item" to ensure that different tasks are processed in parallel when resources allow.

[0046] Results Recording and Feedback: After executing specific analysis algorithms (through interaction between the AI ​​client and the server), each AI analysis module (Type 1 and Type 2) will store the final processing results, "Record Results," in the "Analysis Results Library." Upon completion of this step, a status update is typically sent back to the governance module, signifying the end of that branch of the task.

[0047] Figure 4 A flowchart illustrating the preprocessing of a specific embodiment of this application is shown, such as... Figure 4 As shown, the preprocessing module primarily handles data discovery and classification governance, serving as the entry point for the entire analysis process. This process specifically includes three core steps: "screening available governance items," "searching forensic data based on BCP," and "engine object initialization." Filter available governance items. The main purpose of this step is to remove unnecessary governance engines based on several criteria, thereby eliminating redundant factors in the upstream stage and avoiding unnecessary resource overhead. The specific filtering logic follows these rules: Check the service status corresponding to the AI ​​engine. If the service is unavailable, do not trigger the analysis engine that depends on this service. Check if the AI ​​engine is currently running; if so, do not trigger the analysis engine again. Check if the AI ​​engine's result status is marked as "completed". If so, skip this analysis engine. After completing the above filtering, the system will also perform anti-duplicate processing: if the filtering results show that there are no AI analysis items that need to be triggered, or if a preprocessing task is already running, the system will ignore this request and end the current analysis process.

[0048] Forensic data is retrieved based on BCP, a database structure encoding scheme. In this step, the preprocessing module uses this scheme to acquire specific forensic data. Specifically, the system reads configuration data from a predefined configuration library, combines "library file name," "data table name," "field name," and "filter conditions," and dynamically constructs a series of SQL statements. By executing these SQL statements, the system can extract the data sources needed for subsequent analysis from the forensic database. The search results are stored as structured variables in memory or a separate database cache table, serving as input data for subsequent AI analysis steps.

[0049] Engine object initialization. This step uses a combination of the "factory pattern" and the "state machine pattern" to create and manage engine objects. For the upstream and downstream pipeline relationships between some AI engines in terms of business logic, the system adopts a "parent-child" tree-like containment structure and completes the relevant settings during the initialization phase. This pattern has good extensibility; newly integrated AI engines can add corresponding class definitions according to this pattern. In addition, the initialization work also includes populating progress information; the system sends a "task started and progress is 0" message to ensure that the interface can promptly display dynamic analysis results.

[0050] Figure 5 This application illustrates a specific embodiment of the AI ​​analysis process, as shown in the diagram. Figure 5 As shown, this process details the communication and data processing logic between the governance module, AI client, and AI server. The governance module, part of the AI ​​analysis engine, is primarily responsible for concurrency management and task scheduling. The AI ​​client, also part of the AI ​​analysis engine, is defined as a module specifically responsible for interacting and communicating with the server. The AI ​​server is an independently deployed component, which can be deployed on a local machine or other remote machines, and is responsible for executing specific AI algorithm calculations. For each data item to be processed, the AI ​​analysis process is executed according to the following steps: Step 1: Parameter Population. The governance module first initiates a call to the AI ​​client to perform parameter population. This step involves passing the data to be analyzed, selected in the preprocessing stage, to the communication module.

[0051] Step 2: Constructing the request. After receiving the parameters, the AI ​​client encapsulates them according to the established interface protocol, performs the operation of "constructing request parameters according to the interface protocol", and sends the request to the independently deployed AI server.

[0052] Step 3: Return processing results. After receiving the request and completing the calculation, the AI ​​server sends the analysis results back to the AI ​​client, which is the "return processing results" operation.

[0053] Step 4: Result Storage. After receiving the data from the server, the AI ​​client is responsible for storing the results directly into the analysis results database. This step demonstrates the decoupled storage of result data, ensuring that the analysis results are persisted to an independent database file.

[0054] Step 5: Status Feedback. Finally, the AI ​​client sends a notification to the governance module, requesting feedback on the success of the AI ​​result. The governance module then updates the task status accordingly, completing the closed-loop management of this AI analysis task.

[0055] Figure 6This application illustrates a framework diagram of a task scheduling system for real-time analysis of forensic case structures, based on a specific embodiment of this application. Figure 6 As shown, the system includes an asynchronous triggering module 601, a resource scheduling module 602, a preprocessing and management module 603, and a data analysis module 604. The asynchronous triggering module 601 is configured to immediately push status change messages to the analysis service after the evidence collection service generates some evidence collection data and writes it to the database. The analysis service starts the analysis process after receiving the message. The resource scheduling module 602 is configured to group and schedule tasks in the analysis process. The granularity of the group is set based on the combined dimension of "case-evidence-processing item". Preprocessing tasks with the same granularity share the same thread pool and are executed in sequence. Preprocessing tasks with different granularity are assigned to thread pools of different groups for parallel processing. The processing items include at least preprocessing and AI analysis. The preprocessing governance module 603 is configured to perform governance item screening and anti-duplicate processing according to the current service status of the AI ​​engine before starting the specific analysis engine. The data analysis module 604 is configured to dynamically construct query statements to extract the data source of the current batch from the evidence collection database based on the preset database structure encoding scheme in response to the screening, input it into the initialized AI engine object for analysis, and store the analysis results in an independent analysis result library.

[0056] This application proposes a task scheduling method and system for real-time analysis of evidence collection case structures, breaking the traditional serial barrier of "evidence collection first, analysis later". Through an asynchronous communication mechanism and an innovative three-level granular thread pool grouping strategy of "case-evidence-processing item", it effectively solves the resource competition and efficiency bottleneck of I / O intensive tasks. At the same time, combined with the intelligent governance item screening mechanism based on state machine in the preprocessing stage, it realizes on-demand allocation of system computing power and anti-duplication and anti-duplication. Finally, while ensuring the independent decoupling of analysis results, it significantly shortens the evidence collection and analysis cycle and maximizes the utilization of computing resources and user experience.

[0057] The following is for reference. Figure 7 It shows a schematic diagram of the structure of a computer system suitable for implementing the electronic device of the present application. Figure 7 The electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.

[0058] like Figure 7As shown, the computer system includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 702 or programs loaded from storage section 708 into random access memory (RAM) 703. The RAM 703 also stores various programs and data required for the operation of the system 700. The CPU 701, ROM 702, and RAM 703 are interconnected via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0059] The following components are connected to I / O interface 705: an input section 706 including a keyboard, mouse, etc.; an output section 707 including a liquid crystal display (LCD) and speakers, etc.; a storage section 708 including a hard disk, etc.; and a communication section 709 including a network interface card such as a LAN card and a modem, etc. The communication section 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to I / O interface 705 as needed. A removable medium 711, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 710 as needed so that computer programs read from it can be installed into storage section 708 as needed.

[0060] Specifically, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable storage medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 709, and / or installed from removable medium 711. When the computer program is executed by central processing unit (CPU) 701, it performs the functions defined in the methods of this application. It should be noted that the computer-readable storage medium of this application can be a computer-readable signal medium or a computer-readable storage medium or any combination thereof. The computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium may also be any computer-readable storage medium other than a computer-readable storage medium that can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. Program code contained on a computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0061] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof. Programming languages ​​include object-oriented programming languages—such as Java, Smalltalk, and C++—as well as conventional procedural programming languages—such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0062] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0063] The modules described in the embodiments of this application can be implemented in software or in hardware.

[0064] In another aspect, this application also provides a computer-readable storage medium, which may be included in the electronic device described in the above embodiments; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable storage medium carries one or more programs. When the electronic device executes these programs, the electronic device: after the evidence collection service generates partial evidence collection data and writes it into the database, it immediately pushes a status change message to the analysis service, which then initiates the analysis process upon receiving the message; it groups and schedules tasks in the analysis process, with the granularity identifier of the groups set based on a combination dimension of "case-evidence-processing item"; preprocessing tasks with the same granularity identifier share the same thread pool and are executed sequentially; preprocessing tasks with different granularity identifiers are assigned to thread pools of different groups for parallel processing; the processing items include at least preprocessing and AI analysis; before starting a specific analysis engine, it performs governance item screening and anti-duplicate processing based on the current service status of the AI ​​engine; in response to successful screening, it dynamically constructs a query statement based on a preset database structure encoding scheme to extract the data source of the current batch from the evidence collection database, inputs it into the initialized AI engine object for analysis, and stores the analysis results in an independent analysis result library.

[0065] The above description is merely a preferred embodiment of this application and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in this application is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this application.

Claims

1. A task scheduling method for real-time analysis of the structure of evidence collection cases, characterized in that, include: S1: After the evidence collection service generates some evidence collection data and writes it into the database, it immediately pushes a status change message to the analysis service. The analysis service starts the analysis process after receiving the message. S2: The tasks in the analysis process are grouped and scheduled, and the granularity of the group is set based on the combined dimension of "case-evidence-processing item"; among them, preprocessing tasks with the same granularity are shared in the same thread pool and executed in sequence; preprocessing tasks with different granularity are assigned to thread pools of different groups and executed in parallel; the processing item includes at least preprocessing and AI analysis. S3: Before starting the specific analysis engine, perform governance item screening and anti-duplicate processing based on the current service status of the AI ​​engine; S4: In response to the successful screening, based on the preset database structure encoding scheme, a query statement is dynamically constructed to extract the data source of the current batch from the evidence database, input it into the initialized AI engine object to perform analysis, and the analysis results are stored in an independent analysis result library.

2. The task scheduling method for real-time analysis of evidence collection case structure according to claim 1, characterized in that, Each group of thread pools in S2 has a maximum concurrency configuration item, which is dynamically adjusted according to the hardware resources of the running machine.

3. The task scheduling method for real-time analysis of evidence collection case structure according to claim 1, characterized in that, The filtering and anti-duplicate processing of S3 specifically includes: detecting the service status corresponding to the AI ​​engine; if the service is unavailable, the analysis engine that depends on the service will not be triggered; detecting the running status of the AI ​​engine; if it is in the running state or the result status is marked as completed, the current analysis request will be filtered out; if there is no analysis item to be triggered after filtering, or if the same preprocessing task that is already running is detected, the current analysis process will be terminated.

4. The task scheduling method for real-time analysis of evidence collection case structure according to claim 1, characterized in that, The initialization of the AI ​​engine object is managed using a combination of the factory pattern and the state machine pattern; for multiple AI engines that have upstream and downstream pipeline relationships in business logic, a tree-like containment structure is used for definition and initialization.

5. The task scheduling method for real-time analysis of evidence collection case structure according to claim 1, characterized in that, The data source extraction process includes: parsing the target database's library file name, data table name, and field name from the configuration file; constructing filtering conditions based on the current forensic data generation progress; and generating SQL statements to mine the data to be analyzed.

6. The task scheduling method for real-time analysis of evidence collection case structure according to claim 1, characterized in that, The interaction process between the analysis service and the AI ​​analysis engine includes: filling parameters into the AI ​​client, the AI ​​client sending a request to the AI ​​server according to the interface protocol, storing the processing result returned by the AI ​​server into the analysis result database, and reporting the success status of the AI ​​result.

7. A computer-readable storage medium having one or more computer programs stored thereon, characterized in that, When the one or more computer programs are executed by a computer processor, they perform the method according to any one of claims 1-6.

8. A task scheduling system for real-time analysis of the structure of evidence collection cases, characterized in that, include: An asynchronous triggering module is configured to immediately push a status change message to the analysis service after the evidence collection service generates some evidence collection data and writes it to the database. The analysis service starts the analysis process after receiving the message. The resource scheduling module is configured to group and schedule tasks in the analysis process. The granularity of the group is set based on the combined dimension of "case-evidence-processing item". Preprocessing tasks with the same granularity share the same thread pool and are executed in sequence. Preprocessing tasks with different granularity are assigned to thread pools of different groups and are processed in parallel. The processing items include at least preprocessing and AI analysis. The preprocessing governance module is configured to perform governance item filtering and anti-duplicate processing based on the current service status of the AI ​​engine before starting the specific analysis engine; The data analysis module is configured to respond to the screening process by dynamically constructing query statements based on a preset database structure encoding scheme to extract the data source of the current batch from the evidence database, inputting it into the initialized AI engine object to perform analysis, and storing the analysis results in an independent analysis result library.

9. A task scheduling system for real-time analysis of evidence collection case structures according to claim 8, characterized in that, Each group of thread pools in the resource scheduling module has a maximum concurrency configuration item, which is dynamically adjusted according to the hardware resources of the running machine.

10. A task scheduling system for real-time analysis of evidence collection case structures according to claim 8, characterized in that, The preprocessing governance module's screening and anti-duplicate processing specifically includes: detecting the service status corresponding to the AI ​​engine; if the service is unavailable, the analysis engine that depends on the service will not be triggered; detecting the running status of the AI ​​engine; if it is running or the result status is marked as completed, the current analysis request will be filtered out; if there are no analysis items to be triggered after screening, or if the same preprocessing task is already running, the current analysis process will be terminated.

11. A task scheduling system for real-time analysis of evidence collection case structures according to claim 8, characterized in that, The initialization of the AI ​​engine object is managed using a combination of the factory pattern and the state machine pattern; for multiple AI engines that have upstream and downstream pipeline relationships in business logic, a tree-like containment structure is used for definition and initialization.

12. A task scheduling system for real-time analysis of evidence collection case structures according to claim 8, characterized in that, The data source extraction process includes: parsing the target database's library file name, data table name, and field name from the configuration file; constructing filtering conditions based on the current forensic data generation progress; and generating SQL statements to mine the data to be analyzed.

13. A task scheduling system for real-time analysis of evidence collection case structures according to claim 8, characterized in that, The interaction process between the analysis service and the AI ​​analysis engine includes: filling parameters into the AI ​​client, the AI ​​client sending a request to the AI ​​server according to the interface protocol, storing the processing result returned by the AI ​​server into the analysis result database, and reporting the success status of the AI ​​result.

Images