A criminal investigation application system and method based on WIFI big data

Abstract

The invention discloses a criminal investigation application system and method based on WIFI big data, which is used to solve the problems of single detection method, large workload of manually extracting features and human subjective factors in criminal investigation application, and comprises an acquisition layer, a storage layer, an analysis layer and an application layer; the acquisition layer is used to collect and record original user data and send the original user data to the storage layer; the storage layer is used to collect original user data in real time and access the analysis layer through a unified data bus; the analysis layer is used to obtain the original user data and perform real-time data analysis on the original user data. The invention uses a probe device to collect MAC addresses of mobile terminals within the radiation range, and conducts modeling analysis by combining the collected data with specific application requirements of public security criminal investigation, so as to integrate the investigative thinking, habits, methods and requirements of commanders, researchers and investigators in actual investigative activities into the system, and conduct a new investigative method of finding and tracking criminal suspects by using signals.

Description

Technical Field

[0001] The present invention relates to the technical field of criminal investigation application of big data, and in particular to a criminal investigation application system and method based on WIFI big data. Background Art

[0002] With the development of urban informatization and the maturity of intelligent terminal equipment technology, WIFI can be used for signal collection and has been identified by the public security department as a new means of investigation. Based on big data technology, police applications such as data collision, fence warning, and trajectory tracking are constructed, and the investigative thinking, habits, methods, and needs of commanders, analysts, and investigators in actual investigative activities are integrated into the system. Actively explore the development direction of new investigative means to serve the police, change the situation of relying on a single method of detection, promote the transformation of the police model from "business-driven" to "data perception, analysis, and prediction", and actively explore the development direction of future police reform. Summary of the invention

[0003] The purpose of the present invention is to solve the problems of single detection method, large workload of manual feature extraction and human subjective factors in criminal investigation application, and propose a criminal investigation application system and method based on WIFI big data; the present invention uses probe equipment to collect MAC addresses of mobile terminals within the radiation range, and conducts modeling analysis by combining the collected data with the specific application needs of public security criminal investigation, and integrates the investigative thinking, habits, methods and needs of commanders, researchers and investigators in actual investigative activities into the system, so as to use signals to find and track suspects.

[0004] The purpose of the present invention can be achieved by the following technical solutions: A criminal investigation application system based on WIFI big data, including a collection layer, a storage layer, an analysis layer and an application layer;

[0005] The collection layer is used to collect and record original user data and send it to the storage layer; the storage layer is used to collect original user data in real time and access the analysis layer through a unified data bus; the analysis layer is used to obtain original user data and perform real-time data analysis on it. The specific process is: build a big data computing platform through Hadoop, use Hive for standard SQL distributed data computing and mining, and Spark for real-time data stream analysis and calculation and send the analysis results to the application layer for display; the application layer uses big data technology to apply data to criminal investigation business needs.

[0006] The storage layer establishes a distributed massive data retrieval service through Elasticsearch and performs unified data storage through the HDFS distributed database and the HBase database.

[0007] Preferably, the data application of the application layer is specifically: through the integration and deep mining of massive data through big data technology, the project is dominated by criminal investigation practice, and the algorithm research on high-dimensional complex big data clustering analysis and data collision is carried out, and the classified data is compared and sorted, and the remaining overall relationships and correlation relationships are analyzed. A data analysis and judgment model is established, including fence warning, data collision, trajectory tracking, and finding companions. Multifunctional real-time data application.

[0008] Preferably, the collection layer also pre-installs monitoring equipment in each monitoring area and captures the MAC addresses of mobile terminals passing through the radiation range through the monitoring equipment; the monitoring equipment includes a probe device with a MAC collection function, a front-end device with a WIFI probe function, and a collection module for collecting and recording original user data.

[0009] Preferably, the collection layer also registers the device model, fixed location, and longitude and latitude data of the monitoring device.

[0010] Preferably, the original user data includes a MAC address, a timestamp and a geographic location information; wherein the MAC address corresponds to different monitoring devices, i.e., different monitoring devices correspond to unique MAC addresses; the timestamp is the time point when the acquisition module acquires the original user data; the geographic location information is the geographic location information of the WIFI probe, i.e., the geographic location information of the monitoring area.

[0011] A criminal investigation application method based on WIFI big data, characterized by comprising the following steps:

[0012] S1: Data collection: Collect and record original user data through monitoring equipment pre-installed in each monitoring area; the monitoring equipment includes a probe device with a MAC collection function, a front-end device with a WIFI probe function, and a collection module for collecting and recording original user data, and the original user data includes a MAC address, a timestamp, and a geographic location information; the MAC address corresponds to different monitoring devices, that is, different monitoring devices correspond to unique MAC addresses; the timestamp is the time point when the collection module collects the original user data; the geographic location information is the geographic location information of the WIFI probe;

[0013] S2: Data storage: For the original user data in S1, a distributed massive data retrieval service is established through Elasticsearch, and the data is uniformly stored through the HDFS distributed database and HBase database;

[0014] S3: Data analysis: Analyze the original user data stored in S2, build a big data computing platform through Hadoop, use Hive for standard SQL distributed data computing and mining, and use Spark for real-time data stream analysis and computing, and send the analysis results to the application layer for display;

[0015] S4: Application demonstration: Through the integration and deep mining of massive data with big data technology, the project is dominated by criminal investigation practice, and studies the algorithms for clustering analysis and data collision of high-dimensional complex big data, compares and sorts the classified data, analyzes the remaining overall relationships and correlations, and establishes a data analysis and judgment model.

[0016] Compared with the prior art, the present invention has the following beneficial effects:

[0017] 1. The present invention realizes preprocessing of original user data, is compatible with multi-manufacturer equipment information, saves storage space, and improves computing speed;

[0018] 2. The present invention conducts modeling and analysis in combination with the specific application needs of public security criminal investigation, integrates the investigative thinking, habits, methods and needs of commanders, analysts and investigators in actual investigative activities into the system, and conducts a new investigative method of using signals to find and track criminal suspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to facilitate understanding by those skilled in the art, the present invention is further described below with reference to the accompanying drawings.

[0020] Figure 1 It is a principle block diagram of the present invention;

[0021] Figure 2 It is the overall flow chart of the present invention. DETAILED DESCRIPTION

[0022] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] See also Figure 1-2 As shown, a criminal investigation application system and method based on WIFI big data includes a collection layer, a storage layer, an analysis layer and an application layer;

[0024] At the collection layer, before the terminal device accesses the AP, the two need to send some plaintext data packets to identify their existence. These data packets contain the MAC address information of the terminal; they also include the latitude and longitude of the AP device, the detection time, the terminal type and brand and other basic data; for the case of accessing wireless AP devices from multiple different manufacturers, it is necessary to adopt the UDP packet receiving and parsing technology based on AP probe modules from different manufacturers to implement the parsing of data sent by probe modules of AP devices from different manufacturers; in addition, due to the large number of wireless AP devices and the huge amount of probe data received, this system adopts a distributed cluster based on UDP to achieve dynamic expansion and meet the reception and parsing of massive AP probe data;

[0025] Storage layer, using HDFS, HBase, ElasticSearch three systems for unified data storage; HDFS is the basis of data storage management in Hadoop system; this paper makes full use of HDFS distribution advantage, using HDFS as the basic file storage platform, for the ever-increasing big data, HDFS can be well expanded and cleaned, and simplifies the consistency model of files, through streaming data access, to provide high throughput application data access function; in the face of massive data query, the system data structure design and performance optimization will be very high requirements, traditional databases can hardly complete multi-condition query; in order to achieve massive data query in seconds, this system uses HBase database for data that needs random access, real-time reading and writing, and establishes distributed massive data retrieval service based on Elasticsearch as the query entry of HBase data warehouse, to achieve the return of results within a few seconds; HBase is a high reliability, high performance, column-oriented, scalable, real-time read and write distributed database; it uses Hadoop HDFS as its basic file storage system, uses Hadoop MapReduce to process massive data in HBase, and uses Zookeeper as its distributed collaborative service; in addition, HBase technology is widely used on cheap PC A large-scale structured storage cluster can be built on the server, which has both PB-level data storage capacity and can save system capital investment; in this system, considering the huge amount of data, the performance and storage space requirements of distributed server nodes are relatively large. By using LZO compression technology, the original data is compressed to about 12%, reducing 78% of storage resources;

[0026] The analysis layer builds a big data computing platform based on Hadoop, uses Hive for standard SQL distributed data computing and mining, and uses Spark for real-time data stream analysis and computing to support complex data mining algorithms and graph computing algorithms. This system includes the computing and analysis of close friends and peers.

[0027] At the application layer, advanced big data technology is used to achieve the integration and deep mining of massive data. The project is dominated by criminal investigation practice, and studies the algorithm of cluster analysis and data collision of high-dimensional complex big data. It compares and sorts the classified data, analyzes the remaining overall relationships and correlations, and establishes a data analysis and judgment model. It supports fence warning, data collision, trajectory tracking, and finding multifunctional data real-time applications, providing auxiliary decision-making information for investigation and judgment, and case analysis;

[0028] Embodiment 1: a designated area is pre-defined, and a pre-set mobile terminal target is scanned in real time in the designated area. If it is, the signal of the MAC is obtained, the location information in the signal is obtained, and the target MAC information is sent to the platform to generate an alarm;

[0029] Process the collision area selected by the map frame to generate a regional data set, use the relationship between the set, such as AND, OR, NOT or combination relationship to perform data collision, and analyze the effective data results through data collision. Collision analysis provides support for each time you select an area on the map. After the selection is successful, a set is generated on the panel, which supports the function selection of AND, OR, NOT and custom sets. Through MAC address collision, massive data screening is carried out to improve case handling efficiency;

[0030] Conduct trajectory analysis on the MAC address of any mobile phone that enters the WIFI coverage area. For a specified MAC address, after entering a certain WIFI coverage area, you can obtain the MAC information set of the WIFI collection devices that the mobile phone has accessed in chronological order, and use this set to display the behavior trajectory of the mobile phone on the map;

[0031] MAC address search based on AP location and time dimensions calculates and analyzes whether different MACs have the same behavior track at the same time, so as to find people traveling together.

[0032] A criminal investigation application method based on WIFI big data

[0033] S1 Data Collection: Install a front-end device with WIFI probe function in each monitoring area in advance. Use the front-end device to capture the MAC address of the mobile terminal passing through the radiation range;

[0034] Users can place devices in the monitoring area according to actual needs. The original user data includes MAC address, timestamp, and geographic location information. MAC addresses correspond to different devices, that is, different devices correspond to unique MAC addresses. The timestamp is the time point when the acquisition module collects this original user data. The geographic location information is the geographic location information of the WIFI probe, that is, the geographic location information of the monitoring area where the device corresponding to this original user data is located.

[0035] S2 data storage: stores the user data sent by S1; S2 connects to the analysis module S3, stores the user data and sends it to the data classification.

[0036] S3 data analysis: Perform data modeling such as correlation analysis on user data; data analysis is connected to S4, and the analysis results will be sent to the business for display.

[0037] The specific association analysis is as follows: through the co-occurrence correlation and cosine correlation data of the crowd, it can be analyzed whether there are conditions of traveling together and close people, and the personnel information and traveling records can be analyzed;

[0038] Abnormal analysis: Through three-dimensional abnormal analysis of location, time and population, abnormal records of high-risk populations and locations can be obtained;

[0039] Frequency analysis: By dividing the frequency and time of a crowd’s appearance, we can analyze the places where the crowd often goes and where they usually live, and indirectly judge their occupation information;

[0040] Situation analysis: Based on AP data, AP tags, and third-party tags, analyze people’s food, clothing, housing, transportation, interests, and entertainment.

[0041] S4 application demonstration: using advanced big data technology to achieve the integration and deep mining of massive data, the project is dominated by criminal investigation practice, and studies the algorithms for clustering analysis and data collision of high-dimensional complex big data, compares and sorts the classified data, analyzes the remaining overall relationships and correlations, and establishes a data analysis and judgment model. It supports fence warning, data collision, trajectory tracking, and finding companions in real-time, multifunctional data applications, providing auxiliary decision-making information for investigation and judgment, and case analysis.

[0042] When the present invention is in use, the collection layer collects and records original user data and sends the original user data to the storage layer; the storage layer collects original user data in real time and accesses the analysis layer through a unified data bus; the analysis layer obtains the original user data and performs real-time data analysis on it, builds a big data computing platform through Hadoop, uses Hive to perform standard SQL distributed data computing and mining, and Spark to perform real-time data stream analysis and calculation and send the analysis results to the application layer for display; the application layer performs data application on criminal investigation business needs through big data technology; realizes preprocessing of original user data, is compatible with multi-manufacturer equipment information, saves storage space, and improves computing speed; conducts modeling analysis in combination with specific application needs of public security criminal investigation, integrates the investigative thinking, habits, methods and needs of commanders, analysts and investigators in actual investigative activities into the system, and uses signals to find and track new investigative means of suspects.

[0043] The preferred embodiments of the present invention disclosed above are only used to help explain the present invention. The preferred embodiments do not describe all the details in detail, nor do they limit the invention to only specific implementation methods. Obviously, many modifications and changes can be made according to the content of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the present invention, so that those skilled in the art can understand and use the present invention well. The present invention is limited only by the claims and their full scope and equivalents.

Claims

1. A criminal investigation application system based on WIFI big data, characterized in that: Includes collection layer, storage layer, analysis layer and application layer; The collection layer is used to collect and record original user data and send it to the storage layer; the storage layer is used to collect original user data in real time and access the analysis layer through a unified data bus; the analysis layer is used to obtain original user data and perform real-time data analysis on it. The specific process is: build a big data computing platform through Hadoop, use Hive for standard SQL distributed data computing and mining, and use Spark for real-time data stream analysis and computing and send the analysis results to the application layer for display; The application layer uses big data technology to apply data to criminal investigation business needs; The storage layer establishes a distributed massive data retrieval service through Elasticsearch and performs unified data storage through the HDFS distributed database and the HBase database; The data application of the application layer is specifically: through the integration and deep mining of massive data through big data technology, the project is dominated by criminal investigation practice, and the algorithm research on clustering analysis and data collision of high-dimensional complex big data is carried out, and the difference comparison and sorting of classified data are carried out, and the remaining overall relationship and correlation relationship are analyzed, and a data analysis and judgment model is established, including fence warning, data collision, trajectory tracking, and finding multifunctional real-time data applications for companions; The acquisition layer also installs monitoring equipment in each monitoring area in advance and uses the monitoring equipment to capture the MAC addresses of mobile terminals passing through the radiation range; the monitoring equipment includes a probe device with a MAC acquisition function, a front-end device with a WIFI probe function, and an acquisition module for collecting and recording original user data; The collection layer also registers the device model, fixed location, and longitude and latitude data of the monitoring device; The original user data includes MAC address, timestamp and geographic location information; The MAC addresses correspond to different monitoring devices, that is, different monitoring devices correspond to unique MAC addresses; The timestamp is the time point when the acquisition module acquires the original user data; the geographic location information is the geographic location information of the WIFI probe, that is, the geographic location information of the monitoring area; A designated area is pre-defined, and a pre-set mobile terminal target is scanned in real time in the designated area. If it is, the signal of the MAC is obtained, the location information in the signal is obtained, and the target MAC information is sent to the platform to generate an alarm; Process the collision area selected by the map frame to generate a regional data set, use the AND, OR, NOT relationship or combination relationship between the sets to perform data collision, and analyze the valid data results through data collision. The collision analysis supports each time you select an area on the map. After the selection is successful, a set is generated on the panel. It supports the AND, OR, NOT, and custom set function selection, and screens massive data through MAC address collision; Conduct trajectory analysis on the MAC address of any mobile phone that enters the WIFI coverage area. For a specified MAC address, after entering a certain WIFI coverage area, obtain the MAC information set of the WIFI collection devices that the mobile phone has accessed in chronological order. Through this set, the behavior trajectory of the mobile phone can be displayed on the map; Based on the MAC address search in two dimensions of AP location and time, calculate and analyze whether different MACs have the same behavior trajectory at the same time to find people traveling together.

2. A criminal investigation application method based on WIFI big data, characterized in that: A criminal investigation application system based on WIFI big data as described in claim 1, comprising the following steps: S1: Data collection: Collect and record original user data through monitoring equipment pre-installed in each monitoring area; the monitoring equipment includes a probe device with a MAC collection function, a front-end device with a WIFI probe function, and a collection module for collecting and recording original user data, and the original user data includes a MAC address, a timestamp, and a geographic location information; the MAC address corresponds to different monitoring devices, that is, different monitoring devices correspond to unique MAC addresses; the timestamp is the time point when the collection module collects the original user data; the geographic location information is the geographic location information of the WIFI probe; S2: Data storage: For the original user data in S1, a distributed massive data retrieval service is established through Elasticsearch, and the data is uniformly stored through the HDFS distributed database and HBase database; S3: Data analysis: Analyze the original user data stored in S2, build a big data computing platform through Hadoop, use Hive for standard SQL distributed data computing and mining, and use Spark for real-time data stream analysis and computing, and send the analysis results to the application layer for display; S4: Application demonstration: Through the integration and deep mining of massive data with big data technology, the project is dominated by criminal investigation practice, and studies the algorithms for clustering analysis and data collision of high-dimensional complex big data, compares and sorts the classified data, analyzes the remaining overall relationships and correlations, and establishes a data analysis and judgment model.

Images