A method for improving the reliability of blockchain web forensics

Abstract

The present invention relates to the field of blockchain technology, and specifically discloses a method for improving the reliability of blockchain webpage forensics. Step S01: Obtain a webpage forensics request initiated by a user; Step S02: Determine whether it is intercepted on the website login page, if not intercepted, enter the next pixel loading; if intercepted, log in to the website in a simulated login mode, and then enter the pixel loading; Step S03: Use Puppeteer to control the browser scrolling pixels, and determine whether the page scrolling is completed or exceeds the preset maximum height, meet the requirements, and enter the page image resource loading detection; if it does not meet the requirements, repeatedly use Puppeteer to control the browser scrolling pixels; Step S04: Complete the page image resource loading detection, obtain the page height, and determine whether the page height exceeds the image screenshot critical value, if not exceeded, the screenshot is packaged; if exceeded, enter the page video element processing. The purpose of the present invention is to solve the problem of incomplete evidence collection in the traditional blockchain webpage forensics process.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology, and specifically discloses a method for improving the reliability of blockchain web page forensics. Background Art

[0002] Blockchain is a term in the field of information technology. In essence, it is a shared database, and the data or information stored in it has the characteristics of "unforgeable", "full traceability", "traceability", "openness and transparency", and "collective maintenance". Based on these characteristics, blockchain technology provides a solid "trust" foundation for the present invention, creates a reliable "cooperation" mechanism, and has broad application prospects.

[0003] Web page forensics is to load resource pages through a browser and collect information about the content displayed on a specific web page at a certain moment. Currently, for websites that require login to access, forensics will be blocked at the login page; for websites with infinite scrolling pages and many image resources, it is impossible to accurately judge the time when resource loading is completed, resulting in missing pictures and videos in forensics, and incomplete evidence collection. Therefore, in view of this, the inventor provides a method for improving the reliability of blockchain web page forensics to solve the above problems. Summary of the invention

[0004] The purpose of the present invention is to solve the problem of incomplete evidence collection that is prone to occur in the traditional blockchain webpage evidence collection process.

[0005] In order to achieve the above objectives, the basic scheme of the present invention provides a method for improving the reliability of blockchain webpage forensics:

[0006] Step S01: obtaining a webpage evidence collection request initiated by a user, and opening the webpage that the user needs to collect evidence through a preset program;

[0007] Step S02: Determine whether the user is blocked on the website login page. If not, proceed to pixel loading. If blocked, perform a simulated login to the website and then proceed to pixel loading.

[0008] Step S03: Use Puppeteer to control the browser scrolling pixels, and determine whether the page has been scrolled or exceeds the preset maximum height. If it meets the requirements, enter the page image resource loading detection; if it does not meet the requirements, repeatedly use Puppeteer to control the browser scrolling pixels;

[0009] Step S04: Complete the page image resource loading detection, obtain the page height, and determine whether the page height exceeds the image screenshot critical value. If not, take screenshots and package them; if exceeded, enter the page video element processing, save as PDF and package;

[0010] Step S05: Pack and upload all evidence collection files and feed them back to the evidence collection user.

[0011] Further, in step S01, when the preset program opens the webpage that the user needs to obtain evidence, the following steps are included:

[0012] Step X01: The user creates a forensic through the Sass front-end page and enters the Sass back-end;

[0013] Step X02: The Sass backend sends a forensics request, the Node server receives the request, and the main program starts;

[0014] Step X03: Get the network proxy, initialize Puppeteer configuration parameters, and start headless Chrome;

[0015] Step X04: Open the forensic website. If it fails, repeat step X03.

[0016] Further, in step X04, if the forensic website fails to be opened three times in a row, the forensics ends, and the Sass backend is notified to update the forensics as failed, and the user is informed of the failure through the Sass frontend.

[0017] Further, in step S02, if the login is blocked:

[0018] a. When the slider verification component appears during login, login is completed by finding the slider DOM;

[0019] b. When encountering a text message verification code, the mobile phone automatically forwards the text message to the backend server for login verification and completes the login;

[0020] c. When encountering a graphic verification code, you can use OCR technology to identify the verification code, perform login verification, and complete login.

[0021] Furthermore, when the website is logged in normally, use the Puppeteer API to download the website data resources to the local computer.

[0022] Further, in step S03, when scrolling the pixels, the following steps are included:

[0023] Step Z01: When the page is loaded normally and the page scrolling is completed, the image resource loading detection is performed;

[0024] Step Z02: Get valid link resources by getting all tag elements of the page;

[0025] Step Z03: Use the new Image() instance to load image resources, record the number of successes and failures, and wait for all resources to be loaded.

[0026] Further, in step S04, if the image exceeds the screenshot threshold, all video tags on the page are obtained, a thumbnail is generated and the poster attribute is set, and the src attribute of the video tag is set to empty.

[0027] Furthermore, the website data resources are packaged and uploaded to the forensic user.

[0028] The principles and effects of this basic solution are:

[0029] 1. Compared with the prior art, during the process of web page evidence collection, when encountering a web page that requires login, the present invention can simulate the current mainstream login method to complete the website login and enter the target page for evidence collection. There is no need to regularly update the login information to complete the web page evidence collection. Moreover, according to user needs, the login interface can be retained and the evidence collection work can be completed based on the updated web page.

[0030] 2. Compared with the prior art, the present invention can accurately detect and judge the resource loading status. If the webpage is loaded, the subsequent steps of evidence collection can be entered; if the webpage is not loaded, it can be judged and reloaded by itself until the webpage is loaded, and then the subsequent steps of evidence collection can be entered, thereby accurately performing page evidence collection and ensuring the integrity of evidence collection.

[0031] 3. Compared with the prior art, when collecting evidence on a web page whose page height exceeds the range of the image screenshot, the present invention uses PDF screenshots instead of JPG format image screenshots to adapt to a wider range of web pages, thereby improving the adaptability and scope of evidence collection. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application, and those skilled in the art can obtain other drawings based on these drawings without creative work.

[0033] Figure 1 A flowchart of a method for improving the reliability of blockchain webpage forensics proposed in an embodiment of the present application is shown;

[0034] Figure 2 A partial flow chart of step S01 in improving the reliability of blockchain webpage forensics proposed in an embodiment of the present application is shown;

[0035] Figure 3 A partial flow chart of the forensics process for improving the reliability of blockchain web page forensics proposed in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0036] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the specific implementation mode, structure, characteristics and effects of the present invention are described in detail below in combination with the accompanying drawings and preferred embodiments.

[0037] Implementation example Figure 1 , Figure 2 as well as Figure 3 As shown:

[0038] This embodiment pre-sets a web evidence collection platform and an evidence collection terminal. The evidence collection platform can be set up by the relevant rights unit or by other units or organizations authorized by the relevant rights unit. The evidence collection terminal can provide users with platform interfaces such as applications (APP), web pages, social platform public accounts, etc. After the user registers on any platform interface through a terminal device such as a mobile phone, tablet, or computer, he can use the web evidence collection service provided by the evidence collection system. When the user has a web evidence collection need, he can register and log in to the web evidence collection platform on the evidence collection terminal.

[0039] During the registration process, you need to verify your permissions. You can choose the following methods to verify your permissions:

[0040] 1) The evidence collection platform actively initiates: The evidence collection platform actively sends a registration link to the evidence collection staff terminal, and the evidence collection staff clicks the link to complete the registration;

[0041] 2) The evidence collection platform inputs the name, ID number, mobile phone number, and face of the evidence collection staff. When the evidence collection staff needs to log in to the evidence collection platform to collect evidence, they can complete the login with their personal name, ID number, mobile phone number, and face;

[0042] 3) The evidence collection staff will actively enter their name, ID number, mobile phone number, face and other information, and the registration will be completed after the evidence collection platform has established verification authority by the court or other authorized organization.

[0043] Once various evidence collection staff have completed registration, they can start subsequent evidence collection work through the preset evidence collection platform.

[0044] When a user finds content that can be used as evidence in a web page, the web page can be used as the target web page, and a web page evidence request can be sent to the evidence collection server through the user's terminal device. Specifically, the user can first submit evidence to the Sass backend service through the Sass front-end page provided by the evidence collection platform, and use the Sass backend service to send the evidence collection request to the Node server to receive the request. When the Node server receives the instruction of the Sass backend service to send the evidence collection request, the node in the Node server can be used to obtain the network proxy right. In this process, the Node server finds the page for submitting the web page evidence collection request in the platform interface, and fills in the Uniform Resource Locator (URL) of the target web page in the designated area of ​​the page. Among them, the URL is a concise representation of the location and access method of resources that can be obtained from the Internet, and is the address of the standard resource on the Internet. Generally, when a user browses a web page through a browser, the URL of the current web page will be displayed in the address bar of the browser, and the user can directly copy the URL from the address bar; when the user completes filling in the relevant information, click the submit button to send a web page forensics request to the forensics server, and then use Puppeteer configuration parameters to initialize, open headless Chrome, and try to open the forensics target website. If the forensics target website is not successfully opened during this process, return to the step "obtain network proxy permissions". Repeat the above steps. If the forensics target website fails to be opened three times in a row, directly notify the Sass backend of the forensics failure and end the forensics.

[0045] After completing the forensic instruction, the forensic user will check whether the website link and other content are correct. After the verification is completed, he can try to open the forensic target website again according to the above steps. This cycle will be repeated until the forensic target website is successfully opened, and then he can start to enter the target website.

[0046] Enter the target website, use Puppeteer to take a preliminary screenshot of the forensic website, try to control the browser to scroll, and identify whether there is a login interface on the website page. If the login page is not identified and it can still scroll at a high height, it means that the forensic website login is successful, and you can proceed to the next stage;

[0047] If a login section is detected, the login process starts:

[0048] 1) When the slider verification component appears during login, the slider DOM is searched. At this time, the specific class name (className: https: / / developer.mozilla.org / zh-CN / docs / Web / API / Element / className) or id name of the label element of the slider component of different website login is used to find the specific slider component, and the verification is completed by controlling the movement of the slider element;

[0049] 2) When encountering a text message verification code, the mobile phone automatically forwards the text message to the background server for login verification. At this time, it is necessary to develop a dedicated mobile phone operation terminal APP that can obtain the corresponding text message verification code. This APP connects to the forensic platform through the Internet, and then identifies the text message verification message, reads the website login verification code, and uploads the text message verification code to the forensic platform. The forensic platform analyzes the delay through RTT, and finally fills the verification code into the login page to complete the login.

[0050] 3) When encountering a graphic verification code, you can use OCR technology to identify the verification code. For a simple graphic verification code, capture the page verification code to generate an image, upload the image through a third-party OCR service to complete the recognition, return the verification code text, and complete the verification code filling authentication. Similarly, after repeated verification failures, login fails and evidence collection fails.

[0051] After the login is completed, use Puppeteer Api to download the website data resources to the local computer to ensure that the login status is retained in the subsequent forensics. At the same time, the website login can also be retained for forensics to expand the forensics content.

[0052] Puppeteer API downloads website data resources mainly in the following two ways:

[0053] 1) Through Puppeteer Api page.content()

[0054] (https: / / pptr.dev / #?product=Puppeteer&version=v13.0.0&show=api-pagecontent) Get the website HTML and write it to a local file;

[0055] 2)Use Puppeteer Api page.on('response')

[0056] (https: / / pptr.dev / #?product=Puppeteer&version=v13.0.0&show=api-event-response) method listens to resource loading, obtains resources, and writes resources to a local folder.

[0057] If you successfully log in to the website directly or use simulated login, you can use Puppeteer to control the browser to scroll 500px every 2s to load the web pages one by one.

[0058] Each time you scroll, check whether the page has been loaded. When the webpage is loaded or the height of the webpage exceeds the maximum height preset by the forensic platform, stop scrolling and proceed to the next step of the image loading program for detection;

[0059] The image loading detection program starts. When the page is loaded normally and the page scrolling is completed, the image resource loading detection is performed; by obtaining all the tag elements of the page (including those in the iframe), extract The tag src attribute and all element background image attribute values ​​are used to obtain valid link resources; the image resource is loaded by using the new Image() instance, where the Image() function will create a new HTMLImageElement instance, add a resource link to the instance, and the instance has two events, onload and onerror, which are callbacks for successful and failed image loading, and record the number of successes and failures. After waiting for all resources to be loaded (success and failure are both considered loaded), enter the next process to obtain the page height, and use the Puppeteer Api to determine whether the page height meets the requirements of the jpg screenshot. If it meets the requirements, the screenshot operation will be performed. If it does not meet the requirements, it needs to be optimized before the forensic work can be carried out.

[0060] The steps to obtain valid link resources are as follows:

[0061] a) Get all tag elements through document.querySelectorAll('*') and loop all the obtained tag elements.

[0062] b) Get the element's style set (CSSStyleDeclaration) through Window.getComputedStyle(), and then get the background image "background-image" property value through CSSStyleDeclaration.getPropertyValue(), and use regular matching to find valid link resources and store them in the resource pool.

[0063] c) Match by tag element tagName Tags, get The value of the tag attribute src is the resource link, which is stored in the resource pool.

[0064] d) Match by tag element tagName <iframe>Tag, obtained through (iframe.contentDocument)<iframe> In the document element, repeat a

[0065] In steps b, c, and d, all image resources are stored in a resource pool.

[0066] When PDF screenshots are used for web pages whose page height exceeds the image screenshot range, the PDF screenshot has a problem in that the video element is displayed as completely black after being captured, and an optimization program needs to be entered.

[0067] Optimization program: By obtaining all the page<video> Tags (including those in iframes), use canvas to dynamically draw video elements and get a thumbnail.<video> The tag poster attribute is empty, set it to thumbnail. Also set<video> The tag src attribute is empty. In this case, the video displays a thumbnail effect, which ensures that the PDF screenshot video tag has an image display. In the process of obtaining thumbnails , the following steps are mainly performed:

[0069] e) Get all tag elements through document.querySelectorAll('*') and loop all acquired tag elements; f) Match by tag element tag name tagName<video> Tags, stored in the element pool; g) Match by tag element tag name tagName<iframe> Tag, through iframe.contentDocument; Acquisition<iframe> In the document element, repeat steps e, f, and g to store all video elements into the element pool; h ) looping through the video element pool to determine whether the video element has a thumbnail attribute poster, if so, clearing the resource src attribute and skipping step i; if not, proceeding to step i;

[0074] i) Using canvas's drawing capability, use canvas.getContext('2d').drawImage() to draw a certain frame of the video element into a picture resource as a thumbnail, set the poster attribute, and leave the src attribute blank.Finally, all Puppeteer APIs are used to download website data resources, .jpg format screenshots and PDF format screenshots are all packaged and processed, packaged, and the entire website data resources, .jpg format screenshots and PDF format screenshots are made into evidence packages and fed back to the Sass back end, for evidence collection personnel to download, complete evidence collection work. In the download process of evidence collection personnel, the downloaded evidence package can be actively encrypted and numbered, to improve the security of evidence package, so as to prevent the evidence package from spreading and failing, when it is needed to use, the evidence collection staff transmits the evidence package to the authorized personnel for use, and the authorized personnel obtain passwords according to the numbered access evidence collection platform.

[0076] During the application of this method, when encountering a web page that requires login, the current mainstream login method can be simulated to complete the website login and enter the target page for evidence collection. The web page evidence collection can be completed without regularly updating the login information, and the login interface can be retained according to user needs and the evidence collection work can be completed according to the updated web page; the evidence collection platform enters the name, ID number, mobile phone number, and face of the evidence collection staff. When the evidence collection staff needs to log in to the evidence collection platform to perform evidence collection work, they can complete the login with their personal name, ID number, mobile phone number, and face; when collecting evidence for a web page whose page height exceeds the range of the picture screenshot, PDF screenshots are used instead of JPG format picture screenshots to adapt to a larger range of web pages, thereby improving the adaptability and scope of evidence collection.

[0077] Although the above methods are illustrated and described as a series of actions to simplify the explanation, it should be understood and appreciated that these methods are not limited by the order of the actions. According to one or more embodiments, some actions may occur in different orders and / or concurrently with other actions from the diagrams and descriptions herein or not illustrated and described herein but understandable to those skilled in the art. (To enable) those skilled in the art will further appreciate that the various illustrative logic blocks, modules, circuits, and algorithm steps described in conjunction with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or a combination of the two. To clearly explain this interchangeability of hardware and software, various illustrative components, frames, modules, circuits, and steps are described generally in the form of their functionality above. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system. The technical staff may implement the described functionality in different ways for each specific application, but such implementation decisions should not be interpreted as resulting in a departure from the scope of the present invention.The various illustrative logic blocks, modules, and circuits described in conjunction with the embodiments disclosed herein may be implemented or executed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in an alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors cooperating with a DSP core, or any other such configuration. The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. The software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read and write information from / to the storage medium. In an alternative, the storage medium may be integrated into the processor, and the processor and the storage medium may reside in an ASIC, which may reside in a user terminal. In an alternative, the processor and the storage medium may reside in a user terminal as discrete components. In one or more exemplary embodiments, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented as a computer program product in software, each function may be stored on or transmitted by a computer-readable medium as one or more instructions or codes. Computer-readable media include both computer storage media and communication media, including any media that facilitates the transfer of a computer program from one place to another, and storage media may be any available media that can be accessed by a computer. As an example and not a limitation, such a computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage device, or any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer. Any connection is also properly referred to as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium.Disk and disc as used herein include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, wherein disk often reproduces data magnetically, while disc reproduces data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.< / iframe>

Claims

1. A method for improving the reliability of blockchain webpage forensics, characterized by: The following steps are involved: Step S01: obtaining a webpage evidence collection request initiated by a user, and opening the webpage that the user needs to collect evidence through a preset program; Step S02: Determine whether the user is blocked on the website login page. If not, proceed to pixel loading. If blocked, perform a simulated login to the website and then proceed to pixel loading. Step S03: Use Puppeteer to control the browser scrolling pixels, and determine whether the page has been scrolled or exceeds the preset maximum height. If it meets the requirements, enter the page image resource loading detection; Does not meet the requirements, reuse Puppeteer to control browser scroll pixels; Step S04: Complete the page image resource loading detection, obtain the page height, and determine whether the page height exceeds the image screenshot critical value. If not, take screenshots and package them; if exceeded, enter the page video element processing, save as PDF and package; In step S04, if the image exceeds the screenshot threshold, all video tags on the page are obtained, thumbnails are generated and poster attributes are set, and the src attribute of the video tag is set to empty; When using PDF screenshots for web pages whose page height exceeds the image screenshot range, the PDF screenshot has a problem that the video element is displayed as completely black after being captured, so you need to enter the optimization program; Optimizer: Get all pages including iframes <video>Tag, use canvas to dynamically draw the video element, get a thumbnail, if <video>The poster attribute of the tag is empty. Set it to a thumbnail and set <video> The tag src attribute is empty. In this case, the video displays a thumbnail effect, which ensures that the PDF screenshot video tag has an image display.< / video> < / video> < / video> The process of obtaining thumbnails mainly involves the following steps: e) Get all tag elements through document.querySelectorAll('*') and loop all the obtained tag elements; f) Match by tag element tagName <video> Tags, stored in the element pool;< / video> g) Match by tag element tagName <iframe>Tag, through iframe.contentDocument; Get<iframe> In the document element, repeat steps e, f, and g to store all video elements into the element pool; h) Loop through the video element pool to determine whether the video element has the thumbnail attribute poster. If so, set the resource src attribute to empty and skip step i. If not, go to step i. i) Through the drawing capability of canvas, use canvas.getContext('2d').drawImage() to draw a frame of the video element into an image resource as a thumbnail, set the poster attribute, and leave the src attribute empty; Step S05: Pack and upload all forensic files and feed them back to the forensic user. Pack and process all website data resources, .jpg screenshots, and PDF screenshots downloaded using Puppeteer API. After packing, make the entire website data resources, .jpg screenshots, and PDF screenshots into an evidence package and feed it back to the Sass backend for download by the forensic personnel to complete the forensic work.

2. A method for improving the reliability of blockchain webpage forensics according to claim 1, characterized in that: In step S01, when the preset program opens the webpage that the user needs to obtain evidence, the following steps are included: Step X01: The user creates a forensic through the Sass front-end page and enters the Sass back-end; Step X02: The Sass backend sends a forensics request, the Node server receives the request, and the main program starts; Step X03: Get the network proxy, initialize Puppeteer configuration parameters, and start headless Chrome; Step X04: Open the forensic website. If it fails, repeat step X03.

3. A method for improving the reliability of blockchain webpage forensics according to claim 2, characterized in that: In step X04, if the forensic website fails to be opened three times in a row, the forensics ends, and the Sass backend is notified to update the forensics as failed, and the user is informed of the failure through the Sass frontend.

4. A method for improving the reliability of blockchain webpage forensics according to claim 1, characterized in that: In step S02, if the login is blocked: a. When the slider verification component appears during login, login is completed by finding the slider DOM; b. When encountering a text message verification code, the mobile phone automatically forwards the text message to the backend server for login verification and completes the login; c. When encountering a graphic verification code, you can use OCR technology to identify the verification code, perform login verification, and complete login.

5. A method for improving the reliability of blockchain webpage forensics according to claim 4, characterized in that: When the website is logged in normally, use the Puppeteer API to download the website data resources to the local computer.

6. A method for improving the reliability of blockchain webpage forensics according to claim 1, characterized in that: In step S03, when scrolling pixels, the following steps are included: Step Z01: When the page is loaded normally and the page scrolling is completed, the image resource loading detection is performed; Step Z02: Obtain valid link resources by obtaining all tag elements of the page; Step Z03: Use the new Image() instance to load image resources, record the number of successes and failures, and wait for all resources to be loaded.

7. A method for improving the reliability of blockchain webpage forensics according to claim 5, characterized in that: The website data resources are packaged and uploaded to the forensic user. .< / iframe>

Images